Information processing device, information processing method, program, and storage medium

Abstract

To provide an information processing apparatus which allows information about an alert to be efficiently shared among a plurality of systems.SOLUTION: The information processing apparatus comprises an ID giving computer which gives a log ID to collected log data of a device, a first processing computer which stores therein the log data and the log ID and detects abnormality on the basis of the log data, and a second processing computer which stores therein the log data and the log ID and detects abnormality on the basis of the log data and transmits the log ID of the log data on the basis of which abnormality has been detected, and a detection result of the abnormality to the first processing computer. The first processing computer stores therein the log data stored in the first processing computer and the received detection result in association with each other on the basis of the log ID received from the second processing computer.SELECTED DRAWING: Figure 10

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, a program, and a storage medium, and relates to, for example, analysis and sharing of data in a server system. [Background technology]

[0002] As the IoT revolution progresses, with everything being connected to the Internet, ensuring the security of IoT devices has become one of the most important social issues. In particular, when IoT devices are automobiles, such as connected cars and self-driving cars, security attacks on automobiles can pose a threat to human safety, and there is a demand for technology that can minimize such damage to safety.

[0003] As a measure to minimize damage caused by cyber-attacks on automobiles, there are security operations centers for automobiles that monitor logs sent from the automobile on a server, detect cyber-attacks on the automobile, and respond to the attacks.

[0004] Traditionally, security operation centers have been introduced as a measure against cyber attacks on the IT systems of companies and other organizations. Unlike this conventional type of security operation center, a security operation center for vehicles is one that monitors connected cars, self-driving cars, and the systems that these cars connect to, consisting of server systems and mobile terminals. It is sometimes called a Vehicle Security Operation Center (VSOC).

[0005] Patent document 1 discloses a system that accurately evaluates alerts generated in a security operations center's monitoring system by adding classification information based on the results of the alert evaluation, thereby enabling the monitored system to be operated stably and safely.

[0006] In security operations centers, security information and event management (SIEM) systems are used as an example of a system that integrates and analyzes various security events and logs. There are many proven SIEM products for conventional security operations centers for IT systems, but there are few proven SIEM products for automotive security operations centers. For this reason, automotive security operations centers may combine a SIEM that has no proven track record but has detection rules created for automobiles with a SIEM that has a track record for IT systems. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] International Publication No. 2020 / 255512 Brochure Summary of the Invention [Problem to be solved by the invention]

[0008] However, conventional technologies have the drawback that it is difficult to efficiently share information about alerts between multiple SIEM systems.

[0009] When building a security operations center by combining multiple SIEM systems, a method is required for sharing alerts issued by one SIEM system with other SIEM systems. However, because each SIEM system has different monitoring target logs, analysis methods, and methods for storing analysis results, sharing only alert information between multiple SIEM systems makes it difficult for the system that received the alert to fully utilize that information.

[0010] For example, according to Patent Document 1, a system is constructed for accurately evaluating alerts by adding to the alerts an identifier associated with the alert and classification information based on the evaluation results. However, Patent Document 1 does not provide a mechanism for sharing alerts and the identifiers and classification information associated with the alerts in a form that can be utilized among multiple systems.

[0011] The present invention has been made to solve such problems, and has an object to provide a technique that enables information related to alerts to be efficiently shared among a plurality of systems. [Means for solving the problem]

[0012] An example of an information processing device according to the present invention is an ID assigning computer that assigns a log ID to the collected device log data; a first processing computer that stores the log data and the log ID and detects an abnormality based on the log data; a second processing computer that stores the log data and the log ID, detects an abnormality based on the log data, and transmits the log ID of the log data in which the abnormality is detected and a detection result of the abnormality to the first processing computer; Equipped with The first processing computer associates the log data stored in the first processing computer with the received detection result based on the log ID received from the second processing computer, and stores them.

[0013] An example of an information processing method according to the present invention includes: An ID assigning computer assigns a log ID to the collected device log data; a first processing computer storing the log data and the log ID; The first processing computer detects an abnormality based on the log data; a second processing computer storing the log data and the log ID; The second processing computer detects an abnormality based on the log data; a step of the second processing computer transmitting the log ID of the log data in which an abnormality is detected and a detection result of the abnormality to the first processing computer; a step of storing, by the first processing computer, the log data stored in the first processing computer and the received detection result in association with each other based on the log ID received from the second processing computer; Equipped with. Effect of the Invention

[0014] The technology according to the present invention allows information about alerts to be efficiently shared among multiple systems.

[0015] For example, it makes it possible for multiple data analysis systems, such as SIEMs, to share alerts issued by one data analysis system and their related log information in a form that can be utilized by other data analysis systems, with a small amount of communication data. [Brief description of the drawings]

[0016] [Figure 1] 1 shows a configuration of a client-server system according to a first embodiment of the present invention. [Diagram 2] The configuration of the data collection server in Figure 1 is shown. [Diagram 3] The configuration of the data analysis server in Figure 1 is shown. [Figure 4] The configuration of the IoT device in Figure 1 is shown. [Diagram 5] The configuration of the log storage DB is shown. [Figure 6] The configuration of the analyzed log storage DB is shown. [Figure 7] The configuration of the alert DB is shown below. [Figure 8] 2 shows an overview of a flow of a log process according to the first embodiment of the present invention. [Figure 9] 2 shows an overview of a process flow when a log is transferred by a log collection server according to the first embodiment of the present invention. [Figure 10] 4 shows an overview of a process flow when an alert is issued according to the first embodiment of the present invention. [Figure 11] 13 shows a configuration of a data collection server according to a second embodiment of the present invention. [Figure 12] 13 illustrates a configuration of a data analysis server according to a second embodiment of the present invention. [Figure 13] 13 shows an overview of a process flow when an alert is issued according to a second embodiment of the present invention. [Figure 14] 13 shows a configuration of a data collection server according to a third embodiment of the present invention. [Figure 15] 13 shows an overview of a process flow when an alert is issued according to the third embodiment of the present invention. [Figure 16] 1 shows a configuration of an automobile system as a specific example of a client-server system according to a first embodiment of the present invention. [Figure 17] 13 illustrates a configuration of a data analysis server according to a modified example of the first embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] In the following description, an "interface unit" may be one or more interfaces. The one or more interfaces may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0018] In the following description, a "storage unit" refers to one or more memory devices, typically a primary storage device. At least one memory in the storage unit may be a volatile memory or a non-volatile memory. The non-volatile memory is, for example, a hard disk drive (HDD) or a solid state drive (SSD). The storage unit may also include a non-transitory storage medium.

[0019] In the following description, a "computing unit" refers to one or more computing modules. The at least one computing module is typically a microprocessor such as a CPU (Central Processing Unit), but may be another type of computing module such as a GPU (Graphics Processing Unit). The processor as the at least one computing module may be a single-core or multi-core processor. The at least one computing module may be a computing module in a broader sense, such as a hardware circuit (e.g., an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit)) that performs part or all of the processing.

[0020] In addition, the storage unit and the computing module, or the computer including them, may be virtual. For example, by executing a program on one computer, one or more virtual computers including one or more virtual storage units and one or more virtual computing modules can be configured.

[0021] In the following description, a "DB" (database) may be data of any structure. Therefore, an "xxxDB" may be referred to as "xxx information." In the following description, the configuration of each DB is an example, and information contained in one DB may be divided into two or more DBs, and information distributed across two or more DBs may be consolidated into one DB.

[0022] In the following description, functions may be described using the expression "yyy unit" (excluding the interface unit, storage unit, and calculation unit), but the function may be realized by one or more computer programs being executed by the calculation unit, or may be realized by one or more hardware circuits (e.g., FPGA or ASIC). When a function is realized by a program being executed by the calculation unit, the function may be at least a part of the calculation unit, since the specified processing is performed using the storage unit and / or the interface unit, etc., as appropriate. Processing described with a function as the subject may be processing performed by the calculation unit or a device having the calculation unit. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium (e.g., a non-transitory recording medium). The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0023] In the following description, the unit of "time" may be year, month, day, hour, minute, and second, or it may be coarser or finer than that, or may be a different unit than those.

[0024] In the following description, when elements of the same type are not distinguished from each other, common reference symbols are used, and when elements of the same type are distinguished from each other, individual reference symbols are used. For example, when the IoT devices are not distinguished from each other, they are collectively referred to as "IoT device 105", and when the IoT devices are distinguished from each other, they are referred to as "IoT device 105A", "IoT device 105B", and so on.

[0025] Hereinafter, several embodiments of the present invention will be described with reference to the drawings.

[0026] [First embodiment] 1 shows a configuration of an information processing device according to a first embodiment of the present invention. In this embodiment, the information processing device is realized as a client-server system. The client-server system executes the information processing method described in this specification.

[0027] Each of the multiple data analysis servers 103 (e.g., 103A, 103B) exists as an example of a server that analyzes data, the data collection server 101 exists as an example of a server that collects data from devices, and each of the IoT devices 105 (e.g., IoT devices 105A to 105C) exists as an example of a client. Communication is performed between the multiple data analysis servers 103 and the data collection server 101 via a communication network 102. Communication is performed between the data collection server 101 and each of the multiple IoT devices 105 via a communication network 104 such as a wireless communication network.

[0028] Various devices may be employed as the IoT device 105. For example, as shown in Fig. 16, each IoT device may be a plurality of vehicles 1605 running on a road, or may be a connected car center 1606 that provides online services to the vehicles.

[0029] In addition, in FIG. 1, the notations “Node A”, “Node B”, and “Node C” are node IDs (an example of a client ID) assigned to the IoT devices 105.

[0030] FIG. 2 shows the configuration of the data collection server 101.

[0031] The data collection server 101 is typically a computer system (one or more computers), and includes an interface unit 201, a storage unit 202, and a calculation unit 203 connected to these.

[0032] Communication with the data analysis server 103 and the IoT device 105 is performed via the interface unit 201.

[0033] The storage unit 202 stores one or more computer programs executed by the calculation unit 203 and information referenced or updated by the calculation unit 203. The one or more computer programs cause a computer to execute the method described in this specification, thereby causing the computer to function as the data collection server 101. The one or more computer programs may be stored in a non-transitory storage medium. In addition, a program including this program and other programs described later causes a computer system to execute the method described in this specification, thereby causing the computer system to function as an information processing device.

[0034] By the calculation unit 203 executing one or more computer programs, functions such as a connection control unit 221, a log ID generation unit 222, and a transfer destination determination unit 223 are realized.

[0035] Another example of information stored in the storage unit 202 is a log storage DB 211. The log storage DB 211 will be described in detail later.

[0036] The connection control unit 221 controls the connection with the data analysis server 103 and the IoT device 105 .

[0037] The log ID generating unit 222 generates a log by collecting log data transmitted from the IoT device 105 and assigning a log ID for identifying each piece of log data to the collected log data. That is, the log includes log data and a log ID. The log ID is a unique identifier for identifying each piece of log data. In this way, the data collecting server 101 functions as an ID assigning computer. The log ID may be, but is not limited to, a number indicating the order in which the logs arrive at the data collecting server 101.

[0038] The transfer destination determination unit 223 determines to which data analysis server 103 the log data transmitted from the IoT device 105 should be transferred. The transfer destination is determined according to the source of the log data, the contents of the log data, and the like. This may involve a rule-based method of determining the transfer destination by applying rules to the source of the log data and the contents of the log data, but is not limited to this. The number of data analysis servers 103 to which each piece of log data is transferred may be any number equal to or greater than 0.

[0039] 5 shows an example of the log storage DB 211. One record is called, for example, a log, and the log includes, for example, a collection time column 501, a log ID column 502, and a log data column 503. One piece of log data transmitted from the IoT device 105 is stored in one field of one record.

[0040] The collection time column 501 stores the time when the data collection server 101 received the log data. The log ID column 502 stores the log ID that the log ID generation unit 222 assigns to the log data. The log data column 503 stores the log data (which may be called raw data) transmitted from the IoT device 105. Note that the information stored in the log storage DB 211 is not limited to the above.

[0041] 3 shows a configuration of the data analysis server 103. The data analysis server 103 functions as a processing computer. For example, the data analysis server 103A is a first processing computer, and the data analysis server 103B is a second processing computer.

[0042] The data analysis server 103 is typically a computer system (one or more computers), and includes an interface unit 301, a storage unit 302, and a calculation unit 303 connected to these.

[0043] Communication with other data analysis servers 103 and data collection servers 101 is performed via the interface unit 301 .

[0044] The storage unit 302 stores one or more computer programs executed by the calculation unit 303 and information referenced or updated by the calculation unit 303. The one or more computer programs cause a computer to execute the methods described in this specification, thereby causing the computer to function as the data analysis server 103.

[0045] Examples of other information stored in the storage unit 302 include an analyzed log storage DB 311 and an alert DB 312. The analyzed log storage DB 311 and the alert DB 312 will be described in detail later.

[0046] By the calculation unit 303 executing one or more computer programs, functions such as a connection control unit 321, an alert detection unit 322, an alert transfer unit 323, and an analyzed log linking unit 324 are realized.

[0047] The connection control unit 321 controls the connection with the data collection server 101 and other data analysis servers 103 .

[0048] The alert detection unit 322 detects anomalies in the data in the analyzed log storage DB 311 and issues an alert. The method of detecting anomalies may be, but is not limited to, a rule-based method in which data is determined to be abnormal when it matches a certain pattern, or an anomaly detection method in which data is determined to be abnormal when it deviates from a normal pattern.

[0049] The alert transfer unit 323 transfers the alert issued by the alert detection unit and the log ID related to the log data determined to be abnormal by the alert detection unit 322 to another data analysis server 103. One log ID may be transferred for one alert, or a list including multiple log IDs for one alert may be transferred.

[0050] The analyzed log linking unit 324 links an alert transferred by another data analysis server 103 to a log in the analyzed log storage DB 311, and stores the alert in the alert DB 312. The analyzed log linking unit 324 will be described in detail later.

[0051] 6 shows an example of the analyzed log storage DB 311. A collection time column 601 stores the time when the data collection server 101 received log data from the IoT device 105. A log ID column 602 stores the log ID that the data collection server assigned to the log data.

[0052] Other columns in the analyzed log storage DB 311 store information acquired as a result of the analysis. For example, in this embodiment, the VIN column 603 stores the identifier VIN of the vehicle that transmitted the log data. The ECU column 604 stores the type of ECU that generated the log data. The engine RPM column 605 stores the engine speed recorded in the log data. Note that the information stored in the analyzed log storage DB 311 is not limited to these. Also, the upper limit (maximum number of records) of the number of records stored in the analyzed log storage DB 311 can be set to 5, for example, as shown in the figure, but this upper limit can be changed as appropriate.

[0053] 7 shows an example of the alert DB 312. The detection time column 701 stores the time when the alert detection unit 322 detected an abnormality. The alert ID column 702 stores a unique identifier assigned to the detected alert. The alert content column 703 stores the content of the detected alert, i.e., the detection result of the abnormality. The related log column 704 stores the log ID of the log that caused the alert to be issued, or a list thereof. Note that the information stored in the alert DB 312 is not limited to these.

[0054] FIG. 4 shows the configuration of the IoT device 105.

[0055] The IoT device 105 includes an interface unit 401, a storage unit 402, and a calculation unit 403 connected thereto.

[0056] Communication with the data collection server 101 is performed via the interface unit 401 .

[0057] The storage unit 402 stores one or more computer programs executed by the calculation unit 403 and information referenced or updated by the calculation unit 403. The one or more computer programs cause a computer to execute the methods described in this specification, thereby causing the computer to function as the IoT device 105. The storage unit 402 also includes a log storage unit 411.

[0058] The calculation unit 403 executes one or more computer programs to realize functions such as a connection control unit 421 and a log transmission unit 422. The connection control unit 421 controls the connection with the data collection server 101. The log transmission unit 422 transmits the logs in the log storage unit 411 to the data collection server 101.

[0059] 8 shows an overview of a series of flows from when the IoT device 105 according to this embodiment transmits a log to when the log is analyzed by the data analysis server 103. The information processing method according to this embodiment includes the steps shown in FIG.

[0060] When data to be transmitted is generated, the IoT device 105 stores the data as log data in the log storage unit 411, and transmits the log data to the data collection server 101 by the log transmission unit 422 (S801).

[0061] The data collection server 101 transfers the received log to the data analysis server 103 (S802). The details of S802 will be described later.

[0062] The data analysis server 103 analyzes the received log (S803). Details of S803 will be described later.

[0063] FIG. 9 explains the details of S802 and shows an overview of the flow of data transfer by the data collection server 101.

[0064] The connection control unit 221 of the data collection server 101 receives data transmitted from the log transmission unit 422 of the IoT device 105 (S901). The log ID generation unit 222 of the data collection server 101 generates a log ID to be assigned to the received data (S902).

[0065] The transfer destination determination unit 223 of the data collection server 101 determines whether the log matches the transfer rule to the data analysis server 103A (S903). If it does not match, proceed to S905. If it does match, transfer the log (including the log data and log ID) to the data analysis server 103A (S904), and proceed to S905.

[0066] The transfer destination determination unit 223 of the data collection server 101 determines whether the log matches the transfer rules to the data analysis server 103B (S905). If it does not match, proceed to S907. If it matches, transfer the log (including the log data and log ID) to the data analysis server 103B (S906) and proceed to S907. The data collection server 101 stores the log ID and the log in the log storage DB 211 (S907).

[0067] FIG. 10 explains the details of S803, and shows an overview of the flow of data analysis in the data analysis server 103 and sharing of alerts between data analysis servers.

[0068] The data analysis servers 103A and 103B store the logs (including log data and log IDs) received from the data collection server 101 in the analyzed log storage DB 311 of the storage unit 302 (S1000). The specific format of the stored data can be designed as appropriate, but for example, as shown in Fig. 6, a record is constructed by extracting a field for each item included in the log data.

[0069] As described above, the log that the data collection server 101 transmits to the data analysis server 103A may not be the same as the log that the data collection server 101 transmits to the data analysis server 103B.

[0070] The alert detection unit 322 of the data analysis server 103B detects a log set (log set) related to log data indicating an abnormality from the analyzed log storage DB 311, and issues an alert (S1001). For example, the alert detection unit 322 detects an abnormality based on the log data.

[0071] The alert transfer unit 323 of the data analysis server 103B associates the log ID of the log data in which an abnormality was detected (for example, a list of log IDs included in a log collection) and an alert (anomaly detection result) and transmits them to the data analysis server 103A (S1002). The abnormality detection result includes, for example, the content or type of the abnormality. The abnormality detection result may also include the detection time.

[0072] The analyzed log linking unit 324 of the data analysis server 103A associates the log data stored in the data analysis server 103A with the received detection results based on the log ID (e.g., a list of log IDs) received from the data analysis server 103B, and stores the associated data in the alert DB 312 (S1003).

[0073] 7, an example of a method in which the analyzed log linking unit 324 associates the abnormality detection result with the log and stores it is to store a log ID list in a related log column of the alert DB 312 and link each log ID in the log ID list with a log ID in the log ID column of the analyzed log storage DB 311. However, the association method is not limited to this.

[0074] In this embodiment, both data analysis servers 103A and 103B use a common log ID assigned by data collection server 101, so that the log data stored in data analysis server 103A can be associated with the detection result received from data analysis server 103B via the log ID. In that case, the association can be realized by simply storing the log ID.

[0075] More specifically, if any of the records in the analyzed log storage DB311 shown in FIG. 6 and any of the records in the alert DB312 shown in FIG. 7 contain the same log ID, it can be said that the log data of the former is associated with the detection result of the latter.

[0076] The timing at which the alert transfer unit 323 transfers the abnormality detection result in S1002 may be immediately after the alert detection in S1001, or may be some time after the alert detection. In the latter case, for example, the result may be transferred during regular batch processing.

[0077] By storing the abnormality detection result in the alert DB 312 in association with the data in the analyzed log storage DB 311, the data analysis server 103A can analyze the abnormality detected by the data analysis server 103B in association with the log that generated the alert. This allows for more effective and efficient data analysis.

[0078] In this way, information about alerts can be shared between multiple systems efficiently, especially when multiple SIEM systems are designed differently.

[0079] In the above-described first embodiment, the functions of data analysis server 103A and data analysis server 103B may be interchanged. Furthermore, one or more of the multiple data analysis servers 103 may have the functions of both data analysis servers 103A and 103B.

[0080] After S1003, the data analysis server 103 may output a part or all of the contents of the alert DB 312. For example, the contents may be transmitted to an external computer (another data analysis server 103 or another computer) via the connection control unit 321, or may be output via an output device (such as a display device or a printer) not shown.

[0081] [Second embodiment] The second embodiment will be described below, focusing mainly on the differences from the first embodiment, and explanations of the points in common with the first embodiment will be omitted or simplified.

[0082] 11 shows an example of a data collection server. The data collection server 1101 includes a log request receiving unit 1124 in the calculation unit in addition to the data collection server 101 in FIG.

[0083] The log request receiving unit 1124 receives a log ID list from the data analysis server, extracts logs having log IDs in the log ID list from the log storage DB 211 , and transmits a set of the extracted logs to the data analysis server 1203 .

[0084] 12 shows an example of a data analysis server. The data analysis server 1203 includes a log request unit 1225 in addition to the components of the data analysis server 103 in FIG.

[0085] The log request unit 1225 executes a process (log request process) to request log data when no log data corresponding to any log ID is stored for a log ID (for example, in the form of a log ID list) received in association with an anomaly detection result from another data analysis server 1203. For example, the log request unit 1225 requests logs by transmitting to the data collection server 1101 a log ID list including log IDs that the analyzed log linking unit 324 was unable to link to logs in the analyzed log storage DB 311.

[0086] FIG. 13 explains the details of S803 in this embodiment, and shows an overview of the flow of data analysis in the data analysis server and sharing of alerts between data analysis servers.

[0087] S1300, S1301, and S1302 respectively perform the same processes as S1000, S1001, and S1002. The data analysis server 1203A checks whether all logs having the same log ID as the log ID in the log ID list received in S1302 are stored in the analyzed log storage DB 311 (S1303).

[0088] If it is determined in S1303 that all logs have been stored, the process proceeds to S1308.

[0089] If all logs have not been stored in S1303, the log request unit of the data analysis server 1203A creates a list of the log IDs of the logs that have not been stored (S1304) and transmits this log ID list to the data collection server 1101 (S1305). This corresponds to the log request process.

[0090] The log request reception unit 1124 of the data collection server 1101 extracts logs having the same log ID as the log ID in the received log ID list from the log storage DB 211, and transmits the set of extracted logs to the data analysis server 1203A (S1306). The data analysis server 1203A processes the received set of logs and stores them in the analyzed log storage DB 311 (S1307).

[0091] Finally, in S1308, the same process as in S1003 in FIG. 10 is performed.

[0092] The timing when the log request unit creates the log ID list in S1304 may be immediately after S1303 or after some time has elapsed. In the latter case, for example, the creation may be performed during regular batch processing.

[0093] According to the second embodiment, when a data analysis server 1203A receives an alert transferred from another data analysis server 1203B, even if the analyzed log storage DB 311 does not hold the log that caused the alert, it is possible to collect the missing logs from the data collection server 1101 and analyze the alert.

[0094] [Third embodiment] The third embodiment will be described below, focusing mainly on the differences from the second embodiment, and explanations of the points in common with the second embodiment will be omitted or simplified.

[0095] In the third embodiment, in the log request processing, the log request unit 1225 of the data analysis server 1203 transmits to the data collection server the log ID list received from other data analysis servers 1203, as well as the detection results of abnormalities detected based on each log.

[0096] An example of a data collection server is shown in Fig. 14. The data collection server 1401 includes a related log extraction unit 1425 in the calculation unit in addition to the data collection server 1101 in Fig. 11.

[0097] The related log extraction unit 1425 receives an anomaly detection result from the log request reception unit 1124, extracts logs that may be related to the detection result from the log storage DB 211, and returns a list of log IDs of the extracted logs (related log ID list) to the log request reception unit 1124. Methods for extracting logs that may be related to the detection result include, but are not limited to, a method of extracting one or more logs according to the detection result (for example, based on the log ID and in accordance with a rule predefined for each content of the alert).

[0098] A specific example will be described. For example, if the detection result indicates an abnormality in the CAN (Controller Area Network) of the vehicle, logs related to the CAN within a predetermined range before and after the detection time are extracted from the logs of the vehicle as logs that may be related to the detection result. Also, for example, if the detection result indicates an abnormality in logs from a connected car center, all vehicles related to the logs in which the abnormality was detected are identified, and logs related to any of the identified vehicles within a predetermined range before and after the detection time are set as a search range, and logs that may be related to the detection result are extracted from this search range.

[0099] The log request receiving unit 1124 receives the detection result and the log ID list from the data analysis server 1203, and passes them to the related log extraction unit 1425. Then, the log request receiving unit 1124 transmits to the data analysis server 1203 the related log ID list returned from the related log extraction unit 1425 together with a set of logs extracted from the log storage DB 211 that have log IDs included in this related log ID list.

[0100] In this way, in response to the log request processing from the data analysis server 1203, the related log extraction unit 1425 extracts the log data to be sent from the collected device log data based on the received log ID and detection result, and sends the extracted log data to the data analysis server 1203.

[0101] FIG. 15 explains the details of S803 in this embodiment, and shows an overview of the flow of data analysis in the data analysis server 1203 and sharing of alerts between data analysis servers.

[0102] S1500, S1501, S1502, S1503, and S1504 respectively perform the same processes as S1300, S1301, S1302, S1303, and S1304 in FIG.

[0103] In S1505, the log request unit 1225 of the data analysis server 1203A transmits the abnormality detection result and the log ID list to the data collection server 1101 (S1505).

[0104] The log request receiving unit 1124 of the data collection server 1401 receives the detection result and the log ID list from the data analysis server 1203, and passes them to the related log extraction unit 1425. Then, the related log ID list returned from the related log extraction unit 1425 is sent to the data analysis server 1203A together with a set of logs having log IDs included in the related log ID list and extracted from the log storage DB 211 (S1506).

[0105] S1507 and S1508 respectively perform the same processes as S1307 and S1308 in FIG.

[0106] According to the third embodiment, when a data analysis server 1203A receives an abnormality detection result transferred from another data analysis server 1203B, even if the analyzed log storage DB 311 does not hold the log that caused the detection (the log that generated the alert), it is possible to collect the missing logs and logs that may be related to the alert from the data collection server 1401 and analyze the alert.

[0107] [Fourth embodiment] The fourth embodiment will be described below, focusing mainly on the differences from the second and third embodiments, and explanations of the commonalities between the second and third embodiments will be omitted or simplified.

[0108] 17 shows an example of a data analysis server. A data analysis server 1703 includes a notification unit 1725 in addition to the components of the data analysis server 1203 in FIG.

[0109] The data analysis server 1703 notifies the outside of the detection result of the abnormality prior to the log request process. That is, after notifying the outside of the detection result, the log request process is executed.

[0110] The timing of the notification can be, for example, after S1301 and before S1303 in FIG.

[0111] The specific process of the notification can be designed as appropriate, but for example, an alert may be sent to an external computer via the connection control unit 321, or the alert may be output via an output device (not shown, such as a display device or a printer). When a display device is used, output can be executed via a GUI.

[0112] The contents of the alert sent or output can also be designed as appropriate, but may include, for example, information (message, etc.) indicating that an alert has been detected, the time the abnormality was detected, an alert ID, the alert content, and the log ID or a list of the log that caused the alert to be issued.

[0113] According to the fourth embodiment, the alert contents can be output early before data is transmitted and received between data analysis servers, so that an external alert processing system or a person in charge of alert processing can recognize the alert early. This effect is particularly noticeable when data transmission and reception between data analysis servers is performed by batch processing, and an alert can be recognized without waiting for the scheduled execution of batch processing. [Explanation of symbols]

[0114] 101...Data collection server 102…Communications network 103…Data analysis server 104…Communications Network 105…IoT equipment 201...Interface section 202...Storage section 203...Arithmetic section 211...Log storage DB 221...Connection control unit 222…Log ID generation unit 223...Forwarding destination determination unit 301...Interface section 302...Storage section 303...Arithmetic section 311: Analyzed log storage DB 312…Alert DB 321...Connection control unit 322…Alert detection unit 323…Alert forwarding unit 324…Analyzed log linking section 401...Interface section 402...Storage section 403...Arithmetic section 411...Log storage section 421...Connection control unit 422…Log transmission unit 501...Collection time column 502…Log ID column 503...Log data column 601...Collection time column 602...Log ID column 603…VIN column 604…ECU Column 605…Engine RPM column 701…Detection time column 702...Alert ID column 703…Alert Content Column 704...Related log column 1101...Data collection server 1124...Log request reception unit 1203…Data analysis server 1225...Log request section 1401...Data collection server 1425…Related log extraction unit 1605…Vehicle 1606…Connected Car Center 1703…Data analysis server 1725…Information Department

Claims

1. an ID assigning computer that assigns a log ID to the collected device log data; a first processing computer that stores the log data and the log ID and detects an abnormality based on the log data; a second processing computer that stores the log data and the log ID, detects an abnormality based on the log data, and transmits the log ID of the log data in which an abnormality has been detected and a detection result of the abnormality to the first processing computer; Equipped with The first processing computer stores the log data stored in the first processing computer and the received detection result in association with each other based on the log ID received from the second processing computer.

2. 2. The information processing device according to claim 1, When the first processing computer does not store log data corresponding to the log ID received from the second processing computer, the first processing computer executes a log request process to request the log data.

3. 3. The information processing device according to claim 2, The first processing computer transmits the log ID and the detection result received from the second processing computer in the log request process.

4. 4. The information processing device according to claim 3, The log request process is performed on the ID-assigning computer, The ID assigning computer extracts log data to be transmitted from the collected device log data based on the log ID and the detection result in response to the log request processing, and transmits the extracted log data to the first processing computer. Information processing device.

5. 3. The information processing device according to claim 2, The first processing computer executes the log request process after notifying the detection result to the outside.

6. 1. An information processing method, comprising: an ID assigning computer assigning a log ID to the collected device log data; a first processing computer storing the log data and the log ID; The first processing computer detects an abnormality based on the log data; a second processing computer storing the log data and the log ID; The second processing computer detects an abnormality based on the log data; a step of the second processing computer transmitting the log ID of the log data in which an abnormality is detected and a detection result of the abnormality to the first processing computer; a step of storing, by the first processing computer, the log data stored in the first processing computer and the received detection result in association with each other based on the log ID received from the second processing computer; An information processing method comprising:

7. A program for causing a computer system to execute the method according to claim 6.

8. A non-transitory storage medium storing the program according to claim 7.

Images