PRIORITY DETERMINATION SYSTEM AND PRIORITY DETERMINATION METHOD

Abstract

A priority determination system capable of determining the priority of responses to vehicle vulnerabilities is provided. [Solution] The priority determination system 100 includes an impact scope extraction unit 10 that acquires information indicating vulnerabilities related to ECUs and extracts ECUs affected by the vulnerabilities, a calculation unit 20 that calculates at least two risk values ​​from an ECU risk value that indicates the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value that indicates the risk to a vehicle model in which an ECU is installed that poses a threat due to the vulnerability, and a spread risk value that indicates the risk when a threat caused by a vulnerability spreads to a vehicle model, a priority determination unit 30 that determines the priority of responding to vulnerabilities based on the at least two risk values, and an output unit 40 that outputs the priorities determined for multiple vulnerabilities.

Description

[Technical field]

[0001] The present disclosure relates to a priority determination system and a priority determination method for determining the priority of responses to vulnerabilities. [Background technology]

[0002] Patent Document 1 discloses a technology that analyzes the state of a system to calculate a risk value, and then determines the priority of measures to reduce the risk value, choosing emergency measures that take a short time to start functioning effectively and normal measures that cause only a small reduction in system usability. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 5304243 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the technology disclosed in Patent Document 1, when there are multiple target systems, it is difficult to determine which system should be prioritized. For example, when responding to vulnerabilities in automobiles, various on-board systems installed in various vehicle models are targeted, so it is difficult to determine the priority of responses to the vulnerabilities in automobiles.

[0005] Therefore, the present disclosure provides a priority determination system and a priority determination method that can determine the priority of responses to vehicle vulnerabilities. [Means for solving the problem]

[0006] The priority determination system according to the present disclosure is an ECU (Electronic Control Unit). the vulnerability of the ECU; a calculation unit that calculates at least two of the following risk values: an ECU risk value that indicates the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value that indicates the risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability will be caused by the vulnerability, and a spread risk value that indicates the risk when the threat caused by the vulnerability spreads to the vehicle model; a determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; and an output unit that outputs the priority determined for a plurality of the vulnerabilities.

[0007] The priority determination system of the present disclosure includes an acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability, a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating the risk to the ECU affected by the vulnerability, a vehicle model risk value indicating the risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating the risk when a threat caused by the vulnerability spreads to the vehicle model, a determination unit that determines a priority of a response to the vulnerability based on the at least two risk values, and an output unit that outputs the priority determined for at least one of the vulnerabilities.

[0008] The priority determination method of the present disclosure is a priority determination method executed by a priority determination system, and includes the steps of acquiring information indicating vulnerabilities related to an ECU, extracting ECUs affected by the vulnerabilities, calculating at least two risk values ​​from an ECU risk value indicating the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating the risk to a vehicle model in which the ECU is installed that a threat caused by the vulnerability is caused by the vulnerability, and a spread risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle model, determining a priority of a response to the vulnerability based on the at least two risk values, and outputting the priorities determined for a plurality of the vulnerabilities.

[0009] The priority determination method of the present disclosure is a priority determination method executed by a priority determination system, and includes the steps of acquiring information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability, calculating at least two risk values ​​from an ECU risk value indicating the risk to the ECU affected by the vulnerability, a vehicle model risk value indicating the risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating the risk when a threat caused by the vulnerability spreads to the vehicle model, determining a priority of a response to the vulnerability based on the at least two risk values, and outputting the priority determined for at least one of the vulnerabilities.

[0010] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized as any combination of a system, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0011] According to a priority determination system according to one aspect of the present disclosure, it is possible to determine the priority of responses to vulnerabilities in automobiles. [Brief description of the drawings]

[0012] [Figure 1] FIG. 13 is a diagram for explaining the difficulty of determining the priority of responses to vulnerabilities in automobiles. [Diagram 2] 1 is a block diagram showing an example of a priority determination system according to a first embodiment. [Diagram 3] 4 is a flowchart showing an example of the operation of the priority determination system according to the first embodiment. [Figure 4] FIG. 11 is a diagram illustrating an example of priority levels to be output. [Diagram 5] FIG. 11 is a diagram illustrating an example of a priority score calculation rule. [Figure 6]13 is a flowchart illustrating an example of a priority determination method according to another embodiment. [Figure 7] 13 is a flowchart illustrating an example of a priority determination method according to another embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] (How one aspect of the present disclosure was achieved) First, we will use Figure 1 to explain the difficulty of determining the priority of responses to vehicle vulnerabilities.

[0014] FIG. 1 is a diagram for explaining the difficulty of determining the priority of responses to vehicle vulnerabilities.

[0015] For example, suppose vulnerabilities 1 to 4 are found in automobiles, specifically, as vulnerabilities in the software of ECUs installed in various automobiles. For example, the risks of these vulnerabilities are assessed based on methods in accordance with standards such as ISO21434. Specifically, vulnerabilities 1 to 4 are each assessed as having a risk of 1 to 5 based on the attack feasibility and impact.

[0016] For example, as shown in Figure 1, vulnerabilities 1 to 3 are judged to have a risk of 5, and vulnerability 4 is judged to have a risk of 4. In this case, the risk is judged on a scale of only 5, which causes a problem of coarse granularity. In particular, in the case of automobiles, where there are many events that need to be addressed, vulnerabilities that pose the same risk frequently occur, making it difficult to determine the priority.

[0017] For example, as shown in Figure 1, suppose that vulnerability 3 affects 10 vehicles and vulnerability 4 affects 10,000 vehicles. In this case, vulnerability 3, which only affects 10 vehicles, poses a higher risk than vulnerability 4, which affects 10,000 vehicles, and so vulnerability 3 is given a higher priority. While methods based on standards such as ISO21434 make it possible to perform risk assessments targeting individual ECUs or individual vehicle models, it is difficult to perform risk assessments targeting all vehicle models that have already been shipped, and there is a problem in that the scope of the impact of vulnerabilities is not fully considered.

[0018] As such, it is difficult to determine the priority of responding to vehicle vulnerabilities.

[0019] Therefore, a priority determination system and a priority determination method capable of determining the priority of responses to vehicle vulnerabilities will be described below.

[0020] Hereinafter, the embodiment will be specifically described with reference to the drawings.

[0021] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, the arrangement and connection of the components, steps, and the order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure.

[0022] (Embodiment 1) The priority determination system according to the first embodiment will be described below.

[0023] Fig. 2 is a block diagram showing an example of the priority determination system 100 according to the embodiment 1. In addition to the priority determination system 100, Fig. 2 also shows a vulnerability notification system that notifies users of discovered vulnerabilities and a person in charge of dealing with the vulnerabilities.

[0024] The priority determination system 100 is a system for determining the priority of a response to a vulnerability of an automobile. The priority determination system 100 includes an impact range extraction unit 10, a calculation unit 20, a priority determination unit 30, an output unit 40, a vehicle model configuration acquisition unit 51, a vehicle model information acquisition unit 52, a vehicle model information storage unit 61, and a priority score calculation rule 62. The priority determination system 100 is a computer including a processor (microprocessor) and a memory. The memory is a ROM (Read Only Memory) and a RAM (Random Access Memory), and can store a program executed by the processor. The impact range extraction unit 10, the calculation unit 20, the priority determination unit 30, the output unit 40, the vehicle model configuration acquisition unit 51, and the vehicle model information acquisition unit 52 are realized by a processor that executes a program stored in the memory. The memory in which the vehicle model information storage unit 61 and the priority score calculation rule 62 are stored may be the same memory as the memory in which the program is stored, or may be a different memory.

[0025] For example, the priority determination system 100 may be a computer (device) in one housing, or a system made up of multiple computers. Also, for example, the priority determination system 100 may be a server. Note that the components of the priority determination system 100 may be located in one server, or may be distributed and located across multiple servers.

[0026] The impact range extraction unit 10 acquires information indicating vulnerabilities related to ECUs mounted on an automobile from a vulnerability notification system, and extracts ECUs affected by the vulnerabilities. The impact range extraction unit 10 is an example of an acquisition unit and an extraction unit. For example, the impact range extraction unit 10 is notified of various vulnerabilities in the software of various ECUs from the vulnerability notification system, and extracts, for each vulnerability, an ECU affected by the vulnerability (e.g., an ECU in which software in which the vulnerability exists is installed). In addition, for example, the impact range extraction unit 10 may extract a vehicle model in which an ECU affected by a vulnerability is mounted. In this way, the impact range extraction unit 10 extracts the impact range of a vulnerability.

[0027] The calculation unit 20 acquires a threat caused by a vulnerability, and calculates at least two risk values ​​from among an ECU risk value indicating a risk of the threat to an ECU, a vehicle model risk value indicating a risk to a vehicle model in which an ECU in which a threat caused by a vulnerability is installed, and a spread risk value indicating a risk when a threat caused by a vulnerability spreads to a vehicle model. For example, the calculation unit 20 calculates at least two risk values ​​for one ECU affected by a vulnerability. Alternatively, for example, the calculation unit 20 calculates at least two risk values ​​for a combination of one ECU affected by a vulnerability and one vehicle model in which the ECU is installed.

[0028] For example, the calculation unit 20 may have an ECU risk calculation unit 21 that calculates an ECU risk value, a vehicle model risk calculation unit 22 that calculates a vehicle model risk value, and a spillover risk calculation unit 23 that calculates a spillover risk value, and may calculate all of the ECU risk value, the vehicle model risk value, and the spillover risk value.

[0029] The vehicle model information storage unit 61 stores information about the vehicle configuration, and the vehicle model configuration acquisition unit 51 acquires the information about the vehicle configuration from the vehicle model information storage unit 61. The information about the vehicle configuration includes, for example, the configuration of the ECUs of various vehicle models and the internal configuration of each ECU. In addition, the vehicle model information storage unit 61 stores information about vehicle model management, and the vehicle model information acquisition unit 52 acquires information about vehicle model management from the vehicle model information storage unit 61. The information about vehicle model management includes, for example, the number of shipped vehicles, the operation rate, and the difficulty of handling of various vehicle models. For example, the ECU risk calculation unit 21 calculates the ECU risk value using information about the internal configuration of each ECU, and the vehicle model risk calculation unit 22 calculates the vehicle model risk value using information about the configuration of the ECUs of various vehicle models. For example, the spillover risk calculation unit 23 calculates the spillover risk value using information such as the number of shipped vehicles, the operation rate, and the difficulty of handling of various vehicle models.

[0030] The priority determination unit 30 determines the priority of the response to the vulnerability based on at least two calculated risk values. The priority determination unit 30 is an example of a determination unit. For example, the priority determination unit 30 determines the priority of the response to the vulnerability based on three risk values, namely, the ECU risk value, the vehicle model risk value, and the repercussion risk value. Also, for example, the priority determination unit 30 determines the priority of the response to the vulnerability using a priority score calculation rule 62. Details of the priority score calculation rule 62 will be described later. For example, the priority determination unit 30 determines the priority of the response to one ECU affected by the vulnerability. Alternatively, for example, the priority determination unit 30 determines the priority of the response to a combination of the one ECU affected by the vulnerability and one vehicle model in which the ECU is installed.

[0031] For example, a priority is determined for each of a plurality of vulnerabilities notified from a vulnerability notification system, and the output unit 40 outputs the determined priorities for the plurality of vulnerabilities. For example, the output unit 40 outputs the determined priorities for the plurality of vulnerabilities to a terminal such as a PC (Personal Computer) operated by a vulnerability response officer. This enables the vulnerability response officer to determine which vulnerability should be given priority in response.

[0032] Next, an example of the operation of the priority determination system 100 will be described with reference to Fig. 3. Here, an example will be described in which the calculation unit 20 calculates three risk values, namely, an ECU risk value, a vehicle model risk value, and a repercussion risk value, and the priority determination unit 30 determines the priority of responses to vulnerabilities based on the three risk values, namely, the ECU risk value, the vehicle model risk value, and the repercussion risk value.

[0033] FIG. 3 is a flowchart showing an example of the operation of the priority determination system 100 according to the first embodiment.

[0034] FIG. 3 illustrates an example in which a priority is determined for one ECU affected by a vulnerability. That is, in FIG. 3, the calculation unit 20 calculates an ECU risk value, a vehicle model risk value, and a spread risk value for one ECU affected by a vulnerability, and the priority determination unit 30 determines a priority of a response for one ECU affected by a vulnerability. For example, the process shown in FIG. 3 is performed for one ECU affected by a vulnerability, and the process shown in FIG. 3 is also performed for other ECUs affected by the vulnerability. Furthermore, these processes are performed for each of a plurality of vulnerabilities. As a result, a priority is determined for each combination of a vulnerability and an ECU.

[0035] The ECU risk calculation unit 21 acquires threats to the ECU due to vulnerabilities (also called ECU threats) (step S101). For example, there are various ECU threats for one vulnerability, and the ECU risk calculation unit 21 acquires a plurality of ECU threats. The ECU risk calculation unit 21 executes the processes from step S102 to step S104 for each ECU threat.

[0036] The ECU risk calculation unit 21 determines the impact of a certain ECU threat (step S102), determines the ease of attack (step S103), and calculates an ISO-compliant risk value (also called the risk value of the ECU threat) (step S104). For example, the ECU risk calculation unit 21 calculates the risk value of the ECU threat based on a method in accordance with a standard specification such as ISO21434. The ECU risk calculation unit 21 calculates the risk values ​​of a plurality of ECU threats by executing the processes from step S102 to step S104 for each ECU threat. The risk value of the ECU threat calculated based on the method in accordance with ISO21434 is a five-level value from 1 to 5.

[0037] The ECU risk calculation unit 21 calculates an ECU risk value for one ECU affected by the vulnerability (step S105). For example, the ECU risk calculation unit 21 calculates the maximum value of the risk values ​​of the ECU threats to one ECU affected by the vulnerability, calculated in the processes from step S102 to step S104, as the ECU risk value for that ECU. The ECU risk value is a five-level value from 1 to 5, similar to the risk values ​​of the ECU threats.

[0038] Next, the vehicle model risk calculation unit 22 acquires a vehicle model equipped with one ECU (also called a vulnerable ECU) affected by the vulnerability (step S106). For example, there are various vehicle models equipped with a vulnerable ECU, and the vehicle model risk calculation unit 22 acquires multiple vehicle models. In addition, the vehicle model risk calculation unit 22 acquires a threat to the vehicle model due to the vulnerability (also called a vehicle model threat) (step S107). For example, there are various vehicle model threats for one vulnerability, and the vehicle model risk calculation unit 22 acquires multiple vehicle model threats. The vehicle model risk calculation unit 22 executes the processes from step S108 to step S110 for each vehicle model threat for each vehicle model.

[0039] The vehicle model risk calculation unit 22 determines the impact (step S108) and the ease of attack (step S109) for a certain vehicle model threat of a certain vehicle model, and calculates an ISO-compliant risk value (referred to as the risk value of the vehicle model threat) (step S110). For example, the vehicle model risk calculation unit 22 calculates the risk value of the vehicle model threat based on a method according to a standard specification such as ISO21434. The vehicle model risk calculation unit 22 calculates the risk values ​​of a plurality of vehicle model threats of a plurality of vehicle models by executing the processes from step S108 to step S110 for each vehicle model threat of each vehicle model. The risk value of the vehicle model threat calculated based on the method according to ISO21434 is a five-level value from 1 to 5.

[0040] The vehicle model risk calculation unit 22 calculates a vehicle model risk value for one ECU affected by the vulnerability (step S111). For example, the vehicle model risk calculation unit 22 calculates the maximum value of the risk values ​​of the vehicle model threats for one ECU affected by the vulnerability, calculated in the processes from step S108 to step S110, as the vehicle model risk value for that ECU. The vehicle model risk value is a five-level value from 1 to 5, similar to the risk value of the vehicle model threat.

[0041] Next, the repercussions risk calculation unit 23 executes the processes in steps S112 and S113 for each of the vehicle models equipped with the vulnerable ECU.

[0042] The ripple risk calculation unit 23 calculates the damage scale (estimated damage) at the time of the threat occurrence based on the number of vehicles shipped or the difficulty of response (step S112), and calculates the response time (response lead time (LT)) at the time of the threat occurrence (step S113). The ripple risk calculation unit 23 executes the processes of steps S112 and S113 for each vehicle model to calculate the damage scale and response LT for multiple vehicle models.

[0043] The repercussion risk calculation unit 23 calculates a repercussion risk value from the damage scale and corresponding LT of all vehicle types equipped with a vulnerable ECU (step S114). For example, the repercussion risk calculation unit 23 calculates a repercussion risk value for one ECU affected by a vulnerability by comparing a representative value (for example, an average value or a median value) of the damage scale and corresponding LT of all vehicle types with a reference value for the damage scale and corresponding LT. The repercussion risk value is normalized to a five-level value from 1 to 5 to match the five-level risk value of the ECU risk value and vehicle type risk value, for example.

[0044] Then, the priority determination unit 30 calculates a priority score based on the priority score calculation rule 62 from the three risk values, the ECU risk value, the vehicle model risk value, and the repercussion risk value (step S115). For example, the priority determination unit 30 arranges the ECUs affected by the vulnerability in descending order of priority score, and determines a higher priority for the ECU with the higher priority score. The output unit 40 outputs the determined priority. Here, an example of the output priority will be described with reference to FIG. 4.

[0045] Fig. 4 is a diagram showing an example of the priority levels to be output. For example, when the priority levels are output, a table such as that shown in Fig. 4 is displayed on a display of a vulnerability response officer.

[0046] For example, suppose that an IVI affected by the vulnerability "CVE-2023-XXXX" has an ECU risk value of 5, a vehicle model risk value of 5, and a spillover risk value of 5, resulting in a priority score of 15. Also, suppose that an ADAS affected by the vulnerability "CVE-2023-XXXX" has an ECU risk value of 5, a vehicle model risk value of 4, and a spillover risk value of 4, resulting in a priority score of 13. Also, suppose that an OBC (On Board Charger) affected by the vulnerability "CVE-2023-ZZZZ" has an ECU risk value of 5, a vehicle model risk value of 3, and a spillover risk value of 4, resulting in a priority score of 12. In this case, the priority determination unit 30 arranges the ECUs in descending order of priority score as shown in FIG. 4, and assigns the highest priority to the response to the IVI affected by "CVE-2023-XXXX", the next highest priority to the response to the ADAS affected by "CVE-2023-XXXX", and the next highest priority to the response to the OBC affected by "CVE-2023-ZZZZ".

[0047] For example, the priority determination unit 30 determines coefficients to be weighted to at least two risk values ​​(here, ECU risk value, vehicle type risk value, and spillover risk value) based on the priority score calculation rule 62. Then, the priority determination unit 30 determines the priority of responses to vulnerabilities based on the ECU risk value, vehicle type risk value, and spillover risk value weighted by the coefficients. For example, if the coefficient weighted to the ECU risk value is α, the coefficient weighted to the vehicle type risk value is β, and the coefficient weighted to the spillover risk value is γ, the priority score is calculated by α×ECU risk value+β×vehicle type risk value+γ×spillage risk value. Note that FIG. 4 shows the priority score when the coefficients α, β, and γ are each 1.

[0048] For example, the coefficient α weighted to the ECU risk value is determined from the average value of the risk values ​​of the ECU threats calculated in the processes from step S102 to step S104 in Fig. 3, and specifically, the coefficient α is determined so that the coefficient α is higher as the average value is higher. For example, the coefficient β weighted to the vehicle type risk value is determined from the number of vulnerable ECUs installed, and specifically, the coefficient β is determined so that the coefficient β is higher as the number of vulnerable ECUs increases. For example, the coefficient γ weighted to the spread risk value is determined from the number of vehicles shipped, and specifically, the coefficient γ is determined so that the coefficient γ is higher as the number of vehicles shipped increases. Here, an example of the priority score calculation rule 62 will be described with reference to Fig. 5.

[0049] FIG. 5 is a diagram showing an example of the priority score calculation rule 62. As shown in FIG.

[0050] As shown in FIG. 5, when the average value of the risk values ​​of each ECU threat (also called the risk average value) is less than 3, the coefficient α is determined to be 1, when the risk average value is 3 or more and less than 4, the coefficient α is determined to be 2, and when the risk average value is 4 or more, the coefficient α is determined to be 3. When the number of vulnerable ECUs installed is 1, the coefficient β is determined to be 1, when the number of vulnerable ECUs installed is 2 or 3, the coefficient β is determined to be 2, and when the number of vulnerable ECUs installed is 4 or more, the coefficient β is determined to be 3. When the number of shipped units is less than 1000, the coefficient γ is determined to be 1, when the number of shipped units is 1000 or more and less than 10000, the coefficient γ is determined to be 2, and when the number of shipped units is 10000 or more, the coefficient γ is determined to be 3. Note that the index and threshold value of the method of determining the coefficients are merely examples and are set appropriately.

[0051] As described above, the priority of responses to vulnerabilities related to an automobile's ECU is determined from the perspective of at least two risk values ​​among the ECU risk value, the vehicle model risk value, and the repercussion risk value. Determining the priority of responses to automobile vulnerabilities is difficult because various on-board systems installed in various vehicle models are targeted, but the priority determination system 100 can determine the priority from the perspective of at least two risk values, rather than from the perspective of one risk value, and therefore can determine the priority of responses to automobile vulnerabilities.

[0052] (Embodiment 2) As the second embodiment, only the points different from the first embodiment will be described.

[0053] The priority determination system 100 comprises an influence range extraction unit 10, a calculation unit 20, a priority determination unit 30, an output unit 40, a vehicle model configuration acquisition unit 51, a vehicle model information acquisition unit 52, a vehicle model information storage unit 61 and priority score calculation rules 62.

[0054] The impact range extraction unit 10 acquires information indicating a vulnerability related to an ECU mounted on an automobile and the impact range of the vulnerability from a vulnerability notification system. The impact range extraction unit 10 does not necessarily need to acquire the impact range of the vulnerability from the vulnerability notification system, and may acquire the impact range separately from the information indicating the vulnerability. If the impact range of the vulnerability is not included in the acquired information, the impact range extraction unit 10 may extract an ECU affected by the vulnerability. For example, the impact range extraction unit 10 is notified of various vulnerabilities in the software of various ECUs from the vulnerability notification system, and extracts, for each vulnerability, an ECU affected by the vulnerability (for example, an ECU in which software in which the vulnerability exists is installed). For example, the impact range extraction unit 10 may extract a vehicle model in which an ECU affected by a vulnerability is mounted. In this manner, the impact range extraction unit 10 extracts the impact range of a vulnerability.

[0055] The output unit 40 outputs the priorities determined for one or more vulnerabilities. For example, the output unit 40 outputs the priorities determined for one or more vulnerabilities to a terminal such as a PC operated by a vulnerability response officer. This enables the vulnerability response officer to determine whether a certain vulnerability should be dealt with as a priority, or which vulnerability should be dealt with as a priority.

[0056] In this embodiment, for example, when the priority determination system 100 acquires vulnerability information indicated by "CVE-2023-XXXX" and "IVI, ADAS" as its scope of influence, a table as shown in FIG. 4 is displayed in the first embodiment, but in FIG. 4, the output unit 40 outputs only the priority for the vulnerable ECU affected by "CVE-2023-XXXX", i.e., the IVI and ADAS. Also, for example, when the priority determination system 100 acquires "CVE-2023-XXXX" and "CVE-2023-ZZZZ" and the scope of influence of these vulnerabilities, only the priority for the IVI affected by the vulnerability "CVE-2023-XXXX" with the highest priority score may be displayed. Furthermore, the output priority is not limited to the priority associated with the vulnerability with the highest priority score, and may be selected based on criteria other than the priority score, such as the priority associated with a vulnerability associated with a specific ECU.

[0057] FIG. 3 illustrates an example in which a priority is determined for one ECU affected by a vulnerability. That is, in FIG. 3, the calculation unit 20 calculates an ECU risk value, a vehicle model risk value, and a repercussion risk value for one ECU affected by a vulnerability, and the priority determination unit 30 determines a priority of a response for one ECU affected by a vulnerability. For example, the process shown in FIG. 3 is performed for one ECU affected by a vulnerability, and the process shown in FIG. 3 is also performed for other ECUs affected by the vulnerability. Furthermore, these processes are performed for each of one or more vulnerabilities. As a result, a priority is determined for each combination of a vulnerability and an ECU.

[0058] As explained above, the priority can be determined by using the extent of impact of vulnerabilities determined by other systems. In addition, the priority can be determined for vulnerabilities of one vehicle from the viewpoint of at least two risk values ​​among the ECU risk value, the vehicle model risk value, and the repercussion risk value.

[0059] (Other embodiments) As described above, the embodiment has been described as an example of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and can be applied to an embodiment in which appropriate changes, substitutions, additions, omissions, etc. are made. For example, the following modified examples are also included in one embodiment of the present disclosure.

[0060] For example, the number of shipped vehicles used to calculate the spread risk value may be the number of shipped vehicles per country or region. The number of shipped vehicles of a vehicle type differs from country or region to country, and accordingly, the estimated damage or response time in the event of a threat differs from country or region to country. Therefore, by calculating the estimated damage or response time in the event of a threat based on the number of shipped vehicles per country or region, it is possible to determine the priority for each country or region.

[0061] For example, the number of shipped vehicles used to calculate the spread risk value may be the number of vehicles in operation among the number of shipped vehicles. Some shipped vehicles are not in operation. Therefore, by calculating the expected damage or response time in the event of a threat occurrence based on the number of shipped vehicles in operation, it is possible to determine the priority of responses to vulnerabilities of vehicles in operation.

[0062] For example, when two or more vulnerabilities having the same priority determined based on at least two risk values ​​weighted by coefficients are included in the multiple vulnerabilities, the priority determination unit 30 may increase the priority of the vulnerability having the largest risk value weighted by the largest coefficient among the two or more vulnerabilities. For example, it is assumed that the coefficient α weighted to the ECU risk value is 3, the coefficient β weighted to the vehicle model risk value is 2, and the coefficient γ weighted to the spread risk value is 1. In this case, it is assumed that there are two vulnerabilities having the same priority score, the ECU risk value of one vulnerability is 5, and the ECU risk value of the other vulnerability is 4. In this case, the priority of one vulnerability having the larger ECU risk value is set higher than the other vulnerability. As a result, when there are vulnerabilities having the same priority, it is possible to increase the priority of the vulnerability having the largest coefficient, that is, the vulnerability having the largest risk value with the highest impact.

[0063] For example, at least two risk values ​​may each have a predetermined importance, and when the multiple vulnerabilities include two or more vulnerabilities with the same priority determined based on at least two risk values, the priority determination unit 30 may increase the priority of the vulnerability with the highest importance risk value among the two or more vulnerabilities. For example, when the importance of the ECU risk value is the highest among the ECU risk value, the vehicle model risk value, and the spread risk value, two vulnerabilities with the same priority score exist, and the ECU risk value of one vulnerability is 5 and the ECU risk value of the other vulnerability is 4. In this case, the priority of one vulnerability with the larger ECU risk value is set higher than the other vulnerability. As a result, when vulnerabilities with the same priority exist, the priority of the vulnerability with the highest importance risk value can be increased.

[0064] For example, in FIG. 3, the calculation unit 20 calculates at least two risk values ​​for one ECU affected by the vulnerability, and the priority determination unit 30 determines the priority of the response to the one ECU affected by the vulnerability, but the present invention is not limited to this. For example, the calculation unit 20 may calculate at least two risk values ​​for a combination of one ECU affected by the vulnerability and one vehicle model in which the ECU is installed, and the priority determination unit 30 may determine the priority of the response to the combination affected by the vulnerability. In this case, in FIG. 3, for example, the process shown in FIG. 3 is performed for the combination of one ECU affected by the vulnerability and one vehicle model in which the ECU is installed, and the process shown in FIG. 3 is also performed for other combinations affected by the vulnerability. Furthermore, these processes are performed for each of a plurality of vulnerabilities. As a result, a priority is determined for each combination of a vulnerability, an ECU, and a vehicle model.

[0065] For example, although an example has been described in which the ECU risk value is a value that complies with a standard specification, the ECU risk value may be a value based on any algorithm for calculating a risk value.

[0066] For example, although an example has been described in which the vehicle risk value is a value that complies with a standard specification, the vehicle risk value may be a value based on any algorithm that calculates a risk value.

[0067] For example, although an example has been described in which the spread risk value is a normalized five-level value from 1 to 5, the spread risk value may be an absolute value based on the scale of damage or response time.

[0068] For example, an example has been described in which the priority determination system 100 includes a vehicle model configuration acquisition unit 51, a vehicle model information acquisition unit 52, a vehicle model information storage unit 61, and a priority score calculation rule 62, but the priority determination system 100 does not have to include these components.

[0069] For example, the present disclosure can be realized not only as the priority determination system 100 but also as a priority determination method including steps (processing) performed by the components that make up the priority determination system 100.

[0070] 6 and 7 are flowcharts showing an example of a priority determination method according to another embodiment.

[0071] The priority determination method is executed by priority determination system 100, and includes the steps of obtaining information indicating vulnerabilities related to an ECU (step S11), extracting ECUs affected by the vulnerabilities (step S12), calculating at least two risk values ​​from an ECU risk value indicating the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating the risk to a vehicle model in which an ECU is installed in which a threat caused by the vulnerability occurs, and a spread risk value indicating the risk when a threat caused by a vulnerability spreads to a vehicle model, determining a priority for responding to the vulnerability based on the at least two risk values ​​(step S14), and outputting the priorities determined for a plurality of vulnerabilities (step S15).

[0072] The priority determination method is executed by priority determination system 100, and includes the steps of: acquiring information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability (step S21), as shown in FIG. 7; calculating at least two risk values ​​from among an ECU risk value indicating the risk to the ECU affected by the vulnerability, a vehicle risk value indicating the risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating the risk when a threat caused by the vulnerability spreads to the vehicle model (step S22); determining a priority of response to the vulnerability based on the at least two risk values ​​(step S23); and outputting the priority determined for at least one vulnerability (step S24).

[0073] For example, the present disclosure can be realized as a program for causing a computer (processor) to execute steps included in the priority determination method. Furthermore, the present disclosure can be realized as a non-transitory computer-readable recording medium, such as a CD-ROM, on which the program is recorded.

[0074] For example, when the present disclosure is realized by a program (software), each step is executed by executing the program using hardware resources such as a computer's CPU, memory, input / output circuit, etc. In other words, each step is executed by the CPU acquiring data from the memory or input / output circuit, etc., performing calculations, and outputting the calculation results to the memory or input / output circuit, etc.

[0075] In the above embodiment, each component included in the priority determination system 100 may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0076] A part or all of the functions of the priority determination system 100 according to the above embodiment are typically realized as an LSI, which is an integrated circuit. These may be individually integrated into one chip, or may be integrated into one chip that includes some or all of the functions. The integrated circuit is not limited to an LSI, and may be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells inside the LSI may be used.

[0077] Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or a different derivative technology, the components included in the priority determination system 100 may naturally be integrated into integrated circuits using that technology.

[0078] In addition, the present disclosure also includes forms obtained by applying various modifications to the embodiments that a person skilled in the art may conceive, and forms realized by arbitrarily combining the components and functions of each embodiment within the scope that does not deviate from the spirit of the present disclosure.

[0079] (Additional Note) The above description of the embodiments discloses the following techniques.

[0080] (Technology 1) A priority determination system comprising: an acquisition unit that acquires information indicating vulnerabilities related to an ECU; an extraction unit that extracts ECUs affected by the vulnerabilities; a calculation unit that calculates at least two risk values ​​from an ECU risk value that indicates the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value that indicates the risk to a vehicle model in which the ECU is installed that a threat caused by the vulnerability will be caused by the vulnerability, and a spread risk value that indicates the risk when the threat caused by the vulnerability spreads to the vehicle model; a determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; and an output unit that outputs the priorities determined for a plurality of the vulnerabilities.

[0081] According to this, the priority of responses to vulnerabilities related to an automobile's ECU is determined from the perspective of at least two of the risk values ​​of the ECU risk value, the vehicle model risk value, and the repercussion risk value. Determining the priority of responses to automobile vulnerabilities is difficult because various on-board systems installed in various vehicle models are the target, but the priority determination system can determine the priority from the perspective of at least two risk values ​​rather than from the perspective of one risk value, making it possible to determine the priority of responses to automobile vulnerabilities.

[0082] (Technology 2) A priority determination system comprising: an acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; a determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; and an output unit that outputs the priority determined for at least one of the vulnerabilities.

[0083] According to this, the impact range of the vulnerability determined by the other system can be used to determine the priority of the response to the vulnerability of the vehicle. Also, since the priority can be determined from the viewpoint of at least two risk values ​​of the ECU risk value, the vehicle model risk value, and the repercussion risk value for the vulnerability of one vehicle, the priority can be determined.

[0084] (Technology 3) The priority determination system described in Technology 1 or 2, wherein the calculation unit calculates an estimated damage or a response time in the event of a threat based on information regarding vehicle model management, and calculates the spread risk value based on the estimated damage or the response time.

[0085] This allows priorities to be determined taking into consideration expected damage or response time when a threat occurs.

[0086] (Technology 4) The priority determination system according to Technology 3, wherein the information relating to vehicle model management includes the number of vehicles shipped or the degree of difficulty of handling the vehicle models.

[0087] For example, the number of vehicle models shipped or the degree of difficulty of responding can be used to calculate the expected damage or response time in the event of a threat occurring.

[0088] (Technology 5) The priority determination system according to Technology 4, wherein the number of shipments is the number of shipments per country or region.

[0089] The number of vehicle models shipped differs from country or region to country, and the expected damage or response time in the event of a threat also differs from country or region to country. Therefore, by calculating the expected damage or response time in the event of a threat based on the number of vehicles shipped in each country or region, it is possible to determine the priority for each country or region.

[0090] (Technology 6) The priority determination system according to Technology 4 or 5, wherein the number of shipped units is the number of units in operation out of the total number of shipped units.

[0091] Some of the vehicles shipped are not in operation. Therefore, by calculating the expected damage or response time in the event of a threat occurring based on the number of shipped vehicles that are in operation, it is possible to determine the priority of responses to vulnerabilities of vehicles that are in operation.

[0092] (Technology 7) The priority determination system according to any one of Technologies 1 to 6, wherein the calculation unit calculates the ECU risk value or the vehicle model risk value based on a method in accordance with a standard specification.

[0093] This makes it possible to easily calculate the ECU risk value or vehicle model risk value based on a method in accordance with standards such as ISO21434.

[0094] (Technology 8) A priority determination system according to any one of Technologies 1 to 7, wherein the determination unit determines a coefficient to be weighted to each of the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients.

[0095] According to this, by weighting at least two risk values ​​with coefficients, it is possible to determine the priority with high accuracy.

[0096] (Technology 9) The priority determination system described in Technology 2, wherein the determination unit determines a coefficient to be weighted to each of the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients.

[0097] (Technology 10) The priority determination system according to Technology 9, wherein the at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is a plurality of the vulnerabilities.

[0098] According to this, by weighting at least two risk values ​​with coefficients, it is possible to determine the priority with high accuracy.

[0099] (Technology 11) In the priority determination system described in Technology 8 or 10, when the multiple vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values ​​weighted by the coefficients, the determination unit increases the priority of the vulnerability among the two or more vulnerabilities that has the largest risk value with the largest weighted coefficient.

[0100] According to this, when there are vulnerabilities with the same priority, the priority of the vulnerability with the largest coefficient, that is, the vulnerability with the highest risk value having the highest impact, can be given a higher priority.

[0101] (Technology 12) A priority determination system according to any one of Techniques 1 to 11, wherein an importance level is predefined for each of the at least two risk values, and when the plurality of vulnerabilities include two or more vulnerabilities having the same priority level determined based on the at least two risk values, the determination unit increases the priority level of a vulnerability among the two or more vulnerabilities that has the highest risk value with the highest importance level.

[0102] According to this, when there are vulnerabilities with the same priority, the priority of the vulnerability with the highest importance and the largest risk value can be increased.

[0103] (Technology 13) A priority determination system described in any of Techniques 2 to 11, wherein the at least one vulnerability is a plurality of vulnerabilities when the number of vulnerabilities is a plurality of vulnerabilities, and the at least two risk values ​​each have a predetermined importance, and when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values, the determination unit increases the priority of the vulnerability among the two or more vulnerabilities that has the highest risk value with the highest importance.

[0104] According to this, when there are vulnerabilities with the same priority, the priority of the vulnerability with the highest importance and the largest risk value can be increased.

[0105] (Technology 14) A priority determination system described in any of Technologies 1 to 13, wherein the calculation unit calculates the at least two risk values ​​for one of the ECUs affected by the vulnerability, and the determination unit determines the priority of the response to the one of the ECUs affected by the vulnerability.

[0106] This makes it possible to determine the priority of response to a single ECU affected by a vulnerability.

[0107] (Technology 15) A priority determination system described in any one of Technologies 1 to 13, wherein the calculation unit calculates the at least two risk values ​​for a combination of one of the ECUs affected by the vulnerability and one of the vehicle models in which the ECU is installed, and the determination unit determines the priority of the response to the combination affected by the vulnerability.

[0108] This makes it possible to determine the priority of a response to a combination of an ECU affected by a vulnerability and a vehicle model in which that ECU is installed.

[0109] (Technology 16) A priority determination method executed by a priority determination system, comprising the steps of: acquiring information indicating vulnerabilities related to an ECU; extracting an ECU affected by the vulnerability; calculating at least two risk values ​​from an ECU risk value indicating the risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating the risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability is caused by the vulnerability, and a spread risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle model; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the priorities determined for a plurality of the vulnerabilities.

[0110] This provides a priority determination method that can determine the priority of responses to vehicle vulnerabilities.

[0111] (Technology 17) A priority determination method executed by a priority determination system, comprising: a step of acquiring information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a step of calculating at least two risk values ​​from among an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; a step of determining a priority of a response to the vulnerability based on the at least two risk values; and a step of outputting the priority determined for at least one of the vulnerabilities.

[0112] This provides a priority determination method that can determine the priority of responses to vehicle vulnerabilities. [Industrial Applicability]

[0113] The present disclosure can be applied to systems for responding to vulnerabilities. [Explanation of symbols]

[0114] 10. Impact Scope Extraction Section 20 Calculation section 21 ECU Risk Calculation Section 22 Vehicle Risk Calculation Department 23. Contagion Risk Calculation Department 30 Priority determination section 40 Output section 51 Vehicle Configuration Acquisition Department 52 Vehicle information acquisition unit 61 Vehicle information storage unit 62 Priority score calculation rules 100 Priority Judgment System

Claims

1. An acquisition unit that acquires information indicating a vulnerability related to an ECU (Electronic Control Unit); An extraction unit that extracts an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the priorities determined for the plurality of vulnerabilities; The at least two risk values ​​include the spillover risk value. Priority determination system.

2. an acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the determined priority for at least one of the vulnerabilities; The at least two risk values ​​include the spillover risk value. Priority determination system.

3. the calculation unit calculates an estimated damage or a response time in the event of a threat based on information related to vehicle model management, and calculates the spread risk value based on the estimated damage or the response time; 3. The priority determination system according to claim 1.

4. The information regarding vehicle management includes the number of vehicles shipped or the degree of difficulty of handling the vehicle. The priority determination system according to claim 3 .

5. The number of shipments is the number of shipments per country or region. The priority determination system according to claim 4.

6. The number of shipped units is the number of units in operation out of the number of shipped units. The priority determination system according to claim 4.

7. The calculation unit calculates the ECU risk value or the vehicle model risk value based on a method in accordance with a standard specification.

3. The priority determination system according to claim 1.

8. An acquisition unit for acquiring information indicating a vulnerability related to an ECU; An extraction unit that extracts an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the priorities determined for the plurality of vulnerabilities; the determination unit determines coefficients to be weighted to the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients; when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values ​​weighted by the coefficients, the determination unit increases the priority of a vulnerability having the largest risk value with the largest weighted coefficient among the two or more vulnerabilities. Priority determination system.

9. An acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the determined priority for at least one of the vulnerabilities; the determination unit determines coefficients to be weighted to the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients; the at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is a plurality of the vulnerabilities; when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values ​​weighted by the coefficients, the determination unit increases the priority of a vulnerability having the largest risk value with the largest weighted coefficient among the two or more vulnerabilities. Priority determination system.

10. An acquisition unit that acquires information indicating a vulnerability related to an ECU; An extraction unit that extracts an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the priorities determined for the plurality of vulnerabilities; The at least two risk values ​​each have a predetermined importance, when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values, the determination unit increases the priority of a vulnerability having the highest risk value with the highest importance among the two or more vulnerabilities. Priority determination system.

11. An acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; an output unit that outputs the determined priority for at least one of the vulnerabilities; the at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is a plurality of the vulnerabilities; The at least two risk values ​​each have a predetermined importance, when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values, the determination unit increases the priority of a vulnerability having the highest risk value with the highest importance among the two or more vulnerabilities. Priority determination system.

12. The calculation unit calculates the at least two risk values ​​for one of the ECUs affected by the vulnerability, The determination unit determines the priority of a response to one of the ECUs affected by the vulnerability.

3. The priority determination system according to claim 1.

13. the calculation unit calculates the at least two risk values ​​for a combination of one of the ECUs affected by the vulnerability and one of the vehicle models in which the ECU is installed, The determination unit determines the priority of a response to the combination affected by the vulnerability.

3. The priority determination system according to claim 1.

14. A priority determination method executed by a priority determination system, comprising: obtaining information indicative of a vulnerability relating to the ECU; extracting an ECU affected by the vulnerability; calculating at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the determined priorities for a plurality of the vulnerabilities; The at least two risk values ​​include the spillover risk value. Priority determination method.

15. A priority determination method executed by a priority determination system, comprising: obtaining information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; calculating at least two risk values ​​from among an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the determined priority for at least one of the vulnerabilities; The at least two risk values ​​include the spillover risk value. Priority determination method.

Images