VEHICLE ATTACK EVENT CONTINUITY DETERMINATION METHOD, VEHICLE ATTACK EVENT CONTINUITY DETERMINATION DEVICE, AND PROGRAM

Abstract

This vehicle attack event continuity determination method includes: an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that has occurred on a vehicle-mounted network (20), second vehicle attack event information relating to a second vehicle attack event that occurred on the vehicle-mounted network (20) prior to the first vehicle attack event, and vehicle-mounted network information indicating the configuration of the vehicle-mounted network (20); a determining step of determining continuity between the first vehicle attack event and the second vehicle attack event on the basis of the first vehicle attack event information, the second vehicle attack event information, and the vehicle-mounted network information; and an output step of outputting the result of the determination.

Description

[Technical field]

[0001] This relates to a method for analyzing cyber attacks against a network. [Background technology]

[0002] Conventionally, there is known a technique for analyzing a cyber attack (hereinafter, also simply referred to as an "attack") against an in-vehicle network mounted on a vehicle (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-026252 A Summary of the Invention [Problem to be solved by the invention]

[0004] Among attacks against an in-vehicle network, there are attacks in which the time interval between the intrusion into the in-vehicle network and the attack on the attack target is relatively large (hereinafter, such attacks are referred to as "latent attacks").

[0005] Conventionally, in response to a single latent attack, it may be determined that two different vehicle attack events have occurred: a first vehicle attack event that occurs in a time period close to the time of the attack on the attack target, and a second vehicle attack event that occurs earlier than the first attack event, in a time period close to the time of intrusion into the in-vehicle network.

[0006] This may result in failure to correctly analyze a latent attack.

[0007] Even in such a case, if it is possible to determine the continuity between the attack path of the first vehicle attack event and the attack path of the second vehicle attack event, the first vehicle attack event and the second vehicle attack event determined for one latent attack can be regarded as a single vehicle attack event, and the attack of that vehicle attack event can be analyzed.

[0008] Therefore, the present disclosure aims to provide a vehicle attack event continuity determination method, etc., that can determine the continuity between a first vehicle attack event that occurs in an in-vehicle network and a second vehicle attack event that occurred earlier than the first vehicle attack event. [Means for solving the problem]

[0009] A vehicle attack event continuity determination method according to one embodiment of the present disclosure includes an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output step of outputting the determination result.

[0010] A vehicle attack event continuity determination device according to one embodiment of the present disclosure includes an acquisition unit that acquires first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination unit that determines the continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output unit that outputs the determination result.

[0011] A program according to one embodiment of the present disclosure is a program for causing a computer to execute a vehicle attack event continuity determination process, the vehicle attack event continuity determination process including an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output step of outputting the determination result. Effect of the Invention

[0012] According to a vehicle attack event continuity determination method relating to one embodiment of the present disclosure, it is possible to determine the continuity between a first vehicle attack event that occurs in an in-vehicle network and a second vehicle attack event that occurred earlier than the first vehicle attack event. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an attack monitoring system according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of a configuration of an in-vehicle network according to the first embodiment. [Diagram 3] FIG. 3 is a schematic diagram illustrating an example of how the anomaly detection unit according to the first embodiment detects an anomaly. [Figure 4] FIG. 4 is a schematic diagram illustrating an example of vehicle attack event information according to the first embodiment. [Diagram 5] FIG. 5 is a schematic diagram showing an example of vehicle function event information according to the first embodiment. [Figure 6] FIG. 6 is a block diagram showing an example of the configuration of a vehicle attack event continuity determination device according to the first embodiment. [Figure 7] FIG. 7 is a schematic diagram illustrating an example of a vehicle attack event history according to the first embodiment. [Figure 8] FIG. 8 is a schematic diagram showing an example of a vehicle function event history according to the first embodiment. [Figure 9] FIG. 9 is a schematic diagram illustrating an example of in-vehicle network information according to the first embodiment. [Figure 10] FIG. 10 is a flowchart of the first vehicle attack event continuity determination process according to the first embodiment. [Figure 11] FIG. 11 is a flowchart of the event search range calculation process according to the first embodiment. [Figure 12] FIG. 12 is a flowchart of the engine start event search range calculation process according to the first embodiment. [Figure 13] FIG. 13 is a flowchart of the automatic driving start event search range calculation process according to the first embodiment. [Figure 14] FIG. 14 is a flowchart of the high speed driving event search range calculation process according to the first embodiment. [Figure 15] FIG. 15 is a flowchart of the software update event search range calculation process according to the first embodiment. [Figure 16A] FIG. 16A is a schematic diagram showing a state in which a first event according to the first embodiment occurs. [Figure 16B] FIG. 16B is a schematic diagram showing a state in which a second event according to the first embodiment occurs. [Figure 16C] FIG. 16C is a schematic diagram showing a state in which a third event according to the first embodiment occurs. [Figure 16D] FIG. 16D is a schematic diagram showing a state in which a fourth event according to the first embodiment occurs. [Figure 17] FIG. 17 is a schematic diagram showing a usage state of a vehicle function event. [Figure 18] FIG. 18 is a block diagram showing an example of the configuration of a vehicle attack event continuity determination device according to the second embodiment. [Figure 19] FIG. 19 is a schematic diagram showing an example of an image displayed by the image display device according to the second embodiment. [Figure 20] FIG. 20 is a flowchart of the second vehicle attack event continuity determination process according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] (How one aspect of the present disclosure was achieved) As described above, conventionally, there are cases where a latent attack cannot be analyzed correctly.

[0015] For this reason, the inventors have conducted extensive research and experiments to find a method for correctly analyzing a latent attack.

[0016] As a result, the inventors have discovered that if it is possible to determine the continuity between a first vehicle attack event that occurs in an in-vehicle network and a second vehicle attack event that occurred before the first vehicle attack event, it will be possible to treat the first vehicle attack event and the second vehicle attack event determined to be a single latent attack as a single vehicle attack event, and analyze the attack of that vehicle attack event.

[0017] Based on this knowledge, the inventors conducted further research and experiments and came up with the vehicle attack event continuity determination method, vehicle attack event continuity determination device, and program according to the present disclosure below.

[0018] A vehicle attack event continuity determination method according to one embodiment of the present disclosure includes an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output step of outputting the determination result.

[0019] According to the above vehicle attack event continuity determination method, it is possible to determine the continuity between a first vehicle attack event that occurred in an in-vehicle network and a second vehicle attack event that occurred before the first vehicle attack event.

[0020] In addition, the acquisition step may further include acquiring third vehicle attack event information relating to a third vehicle attack event that occurred in the in-vehicle network before the second vehicle attack event, and if the continuity is not determined to be present in the determination step, the continuity between the first vehicle attack event and the third vehicle attack event may be determined based on the first vehicle attack event information, the third vehicle attack event information, and the in-vehicle network information.

[0021] Moreover, the in-vehicle network may include a plurality of anomaly detection units, the first vehicle attack event information includes information indicating one or more first anomaly detection units among the plurality of anomaly detection units that detected an anomaly in the first vehicle attack event, and the second vehicle attack event information includes information indicating one or more second anomaly detection units among the plurality of anomaly detection units that detected an anomaly in the second vehicle attack event, and in the determination step, an attack path in the first vehicle attack event is calculated, and an undetected anomaly detection unit that did not detect an anomaly in the first attack event and is located upstream of the one or more first anomaly detection units on the attack path is calculated, and the continuity may be determined to be present when the undetected anomaly detection unit coincides with an end point anomaly detection unit among the one or more second anomaly detection units that detected an anomaly at the latest time.

[0022] In addition, in the determining step, the continuity may be determined for the second vehicle attack event that has occurred within a first predetermined period from an occurrence time of the first vehicle attack event.

[0023] In addition, the acquisition step may further include acquiring vehicle function event information relating to a vehicle function event that has occurred in a vehicle equipped with the in-vehicle network, and the determination step may further determine the continuity based on the vehicle function event information.

[0024] In addition, the vehicle function event information includes a vehicle function utilization rate related to the number of times or period during which a first vehicle function event that is the same as a vehicle function event that occurred within a second predetermined period from the earliest first time among the times at which the one or more first anomaly detection units detected an anomaly occurred within a third predetermined period from the first time to the past that is longer than the second predetermined period, and further, the vehicle attack event continuity determination method may include a period update step of updating the first predetermined period based on the vehicle function utilization rate, and in the determination step, the continuity may be determined using the first predetermined period updated by the period update step.

[0025] In addition, in the period update step, the first specified period may be updated as follows: (1) if the first vehicle function event has not occurred within the third specified period from the first time to the past, the first specified period is not changed; (2) if the first vehicle function event has occurred within the third specified period from the first time to the past and has occurred a number of times or for a period equal to or greater than a specified threshold, the first specified period is shortened; or (3) if the first vehicle function event has occurred within the third specified period from the first time to the past and has occurred a number of times or for a period less than a specified threshold, the first specified period is lengthened.

[0026] The first vehicle function event may be an engine start event that starts an engine of the vehicle.

[0027] The first vehicle function event may be an automatic driving start event that starts automatic driving of the vehicle.

[0028] The first vehicle function event may be a high speed driving event in which the vehicle is driving at a high speed.

[0029] The first vehicle function event may be a software update event for updating software of the vehicle.

[0030] The method may further include a combining step of combining the first vehicle attack event and the second vehicle attack event when the determining step determines that there is continuity.

[0031] Furthermore, when the first vehicle attack event and the second vehicle attack event are combined in the combining step, the method may further include a reliability calculation step of calculating a reliability of a combined vehicle attack event obtained by combining the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information and the second vehicle attack event information, and the output step may further include outputting the reliability.

[0032] A vehicle attack event continuity determination device according to one embodiment of the present disclosure includes an acquisition unit that acquires first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination unit that determines the continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output unit that outputs the determination result.

[0033] According to the vehicle attack event continuity determination device having the above configuration, it is possible to determine the continuity between a first vehicle attack event that occurs in an in-vehicle network and a second vehicle attack event that occurred before the first vehicle attack event.

[0034] A program according to one embodiment of the present disclosure is a program for causing a computer to execute a vehicle attack event continuity determination process, the vehicle attack event continuity determination process including an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network, a determination step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information, and an output step of outputting the determination result.

[0035] According to the above program, it is possible to determine continuity between a first vehicle attack event that occurred in an in-vehicle network and a second vehicle attack event that occurred before the first vehicle attack event.

[0036] Hereinafter, a specific example of a vehicle attack event continuity determination method according to one aspect of the present disclosure will be described with reference to the drawings. Each embodiment shown here shows one specific example of the present disclosure. Therefore, the numerical values, shapes, components, arrangement and connection of the components, steps (processes) and the order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. In addition, each figure is a schematic diagram and is not necessarily a precise illustration. In each figure, the same reference numerals are given to substantially the same configurations, and duplicated explanations are omitted or simplified.

[0037] (Embodiment 1) Hereinafter, a description will be given of a vehicle attack event continuity determination device according to embodiment 1. This vehicle attack event continuity determination device is a device that determines continuity between a first vehicle attack event that occurred in an in-vehicle network mounted on a vehicle and a second vehicle attack event that occurred earlier than the first vehicle attack event.

[0038] <Configuration> FIG. 1 is a block diagram showing an example of the configuration of an attack monitoring system 1 that monitors attacks against an in-vehicle network 20 mounted on a vehicle 30, using a vehicle attack event continuity determination device 10 according to an embodiment.

[0039] As shown in FIG. 1, the attack monitoring system 1 includes a server device 40, a vehicle 30, an in-vehicle network 20, and an external network 50.

[0040] The server device 40 is a so-called computer device, and includes a processor (not shown), a memory (not shown), a communication interface (not shown), a storage device (not shown), and a display (not shown).

[0041] The server device 40 realizes the vehicle attack event continuity determination device 10 and the display device 41 by the processor executing the program stored in the memory.

[0042] The vehicle 30 has a communication function and is equipped with the in-vehicle network 20. The vehicle 30 is, for example, an automobile.

[0043] The external network 50 is a wide area network such as the Internet, and includes the vehicle attack event continuity determination device 10 and the in-vehicle network 20 as its connection destinations.

[0044] FIG. 2 is a block diagram showing an example of the configuration of the in-vehicle network 20. As shown in FIG.

[0045] As shown in FIG. 2, the in-vehicle network 20 includes a plurality of ECUs (Electronic Control Units) and a vehicle attack event management unit 60.

[0046] 2, the multiple ECUs correspond to ECU_A 70A, ECU_B 70B, ECU_C 70C, ECU_D 70D, and ECU_E 70E. In the following, each of the multiple ECUs may be referred to as ECU 70.

[0047] The multiple ECUs 70 include, for example, an ECU that controls the engine of the vehicle 30, an ECU that controls the automatic driving of the vehicle 30, an ECU that controls an air conditioner installed in the vehicle 30, and the like.

[0048] Each of the ECUs 70 includes an abnormality detection unit that detects an abnormality in the ECU 70. Here, the ECU_A70A includes an abnormality detection unit_A71A, the ECU_B70B includes an abnormality detection unit_B71B, the ECU_C70C includes an abnormality detection unit_C71C, the ECU_D70D includes an abnormality detection unit_D71D, and the ECU_E70E includes an abnormality detection unit_E71E. Hereinafter, the abnormality detection units included in each of the ECUs 70 may be referred to as abnormality detection units 71.

[0049] Here, the types of abnormality detected by the abnormality detection unit 71 in the ECU 70 include detection of an abnormal operation in the ECU 70 (hereinafter also referred to as “IDS”) and a defense error against an attack on the ECU 70. And The following description will be given assuming that:

[0050] When the anomaly detection unit 71 detects an anomaly in the ECU 70, it transmits anomaly detection information to the vehicle attack event management unit 60. Here, the anomaly detection information is information including an anomaly detection type indicating the type of anomaly, a detection time indicating the time when the anomaly was detected, and an ECU name indicating the ECU 70 in which the anomaly was detected.

[0051] FIG. 3 is a schematic diagram showing an example of how a plurality of anomaly detection units 71 detect an anomaly in the corresponding ECU 70 when an attack is made on the in-vehicle network 20. As shown in FIG.

[0052] The arrows in Fig. 3 indicate the connections between the ECUs 70 in the in-vehicle network 20. The "depth" in Fig. 3 indicates the degree of adverse effect on the vehicle 30 that may result from the detected abnormality. Here, the deeper the layer (the larger the layer number), the greater the degree of adverse effect.

[0053] In the example shown in FIG. 3, an attack is made on ECU_A70A, followed by an attack on ECU_C70C, which is connected to ECU_A70A, and then an attack is made on ECU_D70D, which is connected to ECU_C70C. In this case, (1) the abnormality detection unit _A71A detects whether or not the ECU_A70A is in the state where the ECU_C70C is in the state where the ECU_D70D is in the state where ...A70A is in the state where the ECU_C70C is in the state where the Defense Error (2) anomaly detection unit_A71A detects an IDS for an attack on ECU_A70A at time YY2 (year): MM2 (month) / DD2 (day): HH2 (hour): MM2 (minute): SS2 (second), and then (3) anomaly detection unit_C71C detects an IDS for an attack on ECU_C70C at time YY3 (year): MM3 (month) / DD3 (day): HH3 (hour): MM3 (minute): SS3 (second), and then (4) anomaly detection unit_D71D detects an IDS for an attack on ECU_D70D ... Defense Error This is an example of when the above was detected at the time YY4 (year):MM4 (month) / DD4 (day):HH4 (hour):MM4 (minute):SS4 (second).

[0054] Returning to FIG. 2, the description of the in-vehicle network 20 will continue.

[0055] The vehicle attack event management unit 60 receives the abnormality detection information transmitted from the abnormality detection unit 71.

[0056] When the vehicle attack event management unit 60 receives a plurality of pieces of abnormality detection information whose detection time difference is within a predetermined period TA (e.g., 5 minutes), it determines that a vehicle attack event consisting of detection of an abnormality in the ECU 70 indicated by the plurality of pieces of abnormality detection information has occurred in the in-vehicle network 20. Then, the vehicle attack event management unit 60 generates vehicle attack event information based on the plurality of pieces of abnormality detection information.

[0057] FIG. 4 is a schematic diagram showing an example of vehicle attack event information generated by the vehicle attack event management unit 60. As shown in FIG.

[0058] As shown in FIG. 4, the vehicle attack event information is information that corresponds to each of the detections of an abnormality in ECU 70 included in a vehicle attack event, the abnormality detection type, the detection time, the ECU name, and a detection number that identifies the detection of the abnormality.

[0059] From the vehicle attack event information illustrated in FIG. 4, the vehicle attack event indicated by the vehicle attack event information is the detection of an anomaly detected in ECU_C70C at 12:00:36 on April 1, 2020, with the anomaly detection type being IDS, and the detection of an anomaly detected in ECU_D70D at 12:00:37 on April 1, 2020, with the anomaly detection type being IDS. Defense Error It can be seen that this is an event consisting of the detection of an abnormality such as

[0060] Returning to FIG. 2, the description of the in-vehicle network 20 will continue.

[0061] When the vehicle attack event management unit 60 generates the vehicle attack event information, it checks vehicle function events that have occurred in the vehicle 30 within a predetermined period TB (for example, 10 minutes) from the earliest first time among the detection times included in the generated vehicle attack event information. Here, the vehicle function event refers to an event in which any of the functions possessed by the vehicle 30 is executed. For example, the vehicle function events include an engine start event indicating a state in which the engine of the vehicle 30 is running, an engine start event that starts the engine of the vehicle 30, an automatic driving start event that indicates a state in which the automatic driving of the vehicle 30 is running, an automatic driving start event that starts the automatic driving of the vehicle 30, a high-speed running event indicating a state in which the vehicle 30 is running at high speed, a high-speed running start event that starts the high-speed running of the vehicle 30, a software update event in which software installed in the vehicle 30 is updated, and the like.

[0062] Then, when a corresponding vehicle function event is found, the vehicle attack event management unit 60 calculates a vehicle function utilization rate related to the number of times or the period during which the same vehicle function event as that vehicle function event occurred within a predetermined period TC (e.g., one week) from the first time to the past.

[0063] The vehicle function utilization rate may be, for example, if the vehicle function event is an engine start event, an engine start utilization rate indicating the proportion of the period during which the engine is started relative to a predetermined period TB, or may be the continuous startup time of the engine; for example, if the vehicle function event is an engine start event, it may be an engine start frequency indicating the number of times the engine is started within the predetermined period TB; for example, if the vehicle function event is an automatic driving start event, it may be an automatic driving startup utilization rate indicating the proportion of the period during which automatic driving is started relative to a predetermined period TB, or may be the continuous startup time of automatic driving; for example, if the vehicle function event is an automatic driving start event, it may be an automatic driving start frequency indicating the number of times automatic driving is started within the predetermined period TB; for example, if the vehicle function event is a high-speed driving event, it may be a high-speed driving utilization rate indicating the proportion of the period during which high-speed driving is performed relative to the predetermined period TB, or may be the continuous high-speed driving time; for example, if the vehicle function event is a high-speed driving start event, it may be a high-speed driving start frequency indicating the number of times high-speed driving is started within the predetermined period TB; or for example, if the vehicle function event is a software update event, it may be a software update frequency indicating the number of times software is updated within the predetermined period TB.

[0064] When the vehicle attack event management unit 60 calculates the vehicle function utilization rate, it generates vehicle function event information based on the corresponding vehicle function event and the generated vehicle function utilization rate.

[0065] FIG. 5 is a schematic diagram showing an example of vehicle function event information generated by the vehicle attack event management unit 60. As shown in FIG.

[0066] As shown in FIG. 5, the vehicle function event information is information configured by associating a corresponding vehicle function event with a vehicle function utilization rate of the vehicle function event.

[0067] From the vehicle function event information exemplified in FIG. 5, it can be seen that the relevant vehicle function event is an engine start event, and the ratio of the period during which the engine is running to the predetermined period TB is 60%.

[0068] Returning to FIG. 2, the description of the in-vehicle network 20 will continue.

[0069] When the vehicle attack event management unit 60 generates the vehicle attack event information and the vehicle function event information, it transmits the generated vehicle attack event information and the generated vehicle function event information to the vehicle attack event continuity determination device 10.

[0070] The vehicle attack event management unit 60 is realized, for example, by a processor (not shown) constituting the in-vehicle network 20 executing a program stored in a memory (not shown) constituting the in-vehicle network 20.

[0071] FIG. 6 is a block diagram showing an example of the configuration of the vehicle attack event continuity determination device 10. As shown in FIG.

[0072] As shown in Figure 6, the vehicle attack event continuity determination device 10 includes an acquisition unit 11, a determination unit 12, a combination unit 13, an output unit 14, a period update unit 15, an attack path calculation unit 16, an undetected anomaly detection unit calculation unit 17, and a memory unit 18.

[0073] The acquisition unit 11 acquires vehicle attack event information and vehicle function event information transmitted from the vehicle attack event management unit 60.

[0074] When the acquisition unit 11 acquires new vehicle attack event information, the acquisition unit 11 updates the vehicle attack event history stored in the storage unit 18.

[0075] FIG. 7 is a schematic diagram showing an example of the vehicle attack event history stored in the storage unit 18. As shown in FIG.

[0076] As shown in Figure 7, the vehicle attack event history is information that is composed of, for each piece of vehicle attack event information previously acquired by the acquisition unit 11, the vehicle attack event information, a vehicle attack event information reception time indicating the time when the vehicle attack event information was received, a vehicle number that identifies the vehicle 30 including the vehicle attack event management unit 60 that sent the vehicle attack event information, and a vehicle attack event number that identifies the vehicle attack event information, in correspondence with each other.

[0077] Here, each component constituting the vehicle attack event continuity determination device 10 performs various processing using the vehicle attack event reception time at which the acquisition unit 11 receives the vehicle attack event information as the occurrence time of the vehicle attack event indicated by the vehicle attack event information.

[0078] Returning to FIG. 6, the vehicle attack event continuity determination device 10 will be described further.

[0079] When the acquisition unit 11 acquires new vehicle function event information, the acquisition unit 11 updates the vehicle function event history stored in the storage unit 18.

[0080] FIG. 8 is a schematic diagram showing an example of the vehicle function event history stored in the storage unit 18. As shown in FIG.

[0081] As shown in Figure 8, the vehicle function event history is information that is composed of, for each piece of vehicle function event information previously acquired by the acquisition unit 11, the vehicle function event information, a vehicle function event information reception time indicating the time at which the vehicle function event information was received, a vehicle number that identifies the vehicle 30 having the vehicle attack event management unit 60 that sent the vehicle function event information, and a vehicle attack event number that identifies the vehicle attack event corresponding to the vehicle function event information.

[0082] Returning to FIG. 6, the vehicle attack event continuity determination device 10 will be described further.

[0083] The storage unit 18 stores the vehicle attack event history and the vehicle function event history, as well as in-vehicle network information indicating the configuration of the in-vehicle network 20.

[0084] FIG. 9 is a schematic diagram showing an example of the in-vehicle network information stored in the storage unit 18. As shown in FIG.

[0085] 9, the entry point flag of the connection source ECU is a flag that is "True (e.g., logical value 1)" when the connection source ECU is an entry point ECU, and is "Fase (e.g., logical value 0)" when the connection source ECU is not an entry point ECU. Here, the entry point refers to the point of entry into the in-vehicle network 20 of an attack against the in-vehicle network 20.

[0086] The memory unit 18 may, for example, store in-vehicle network information in advance, or the memory unit 18 may, for example, have the acquisition unit 11 acquire in-vehicle network information transmitted from the vehicle attack event management unit 60, and store the in-vehicle network information acquired by the acquisition unit 11.

[0087] Returning to FIG. 6, the vehicle attack event continuity determination device 10 will be described further.

[0088] The attack path calculation unit 16 calculates an attack path including an entry point of an attack of a vehicle attack event and an attack target of the attack, for the vehicle attack event included in the vehicle attack event history stored in the storage unit 18. Here, the attack target refers to the target of an attack on the in-vehicle network 20.

[0089] More specifically, the attack path calculation unit 16 refers to the in-vehicle network information stored in the memory unit 18, and calculates connectable paths in the in-vehicle network 20 from a group of entry points that may become entry points to a group of attack targets that may become attack targets, and calculates the path among the calculated paths that has the smallest number of anomaly detection units 71 that did not detect anomalies in the target vehicle attack event as the attack path.

[0090] The undetected anomaly detection unit calculation unit 17 targets the attack path calculated by the attack path calculation unit 16 and calculates the undetected anomaly detection units that did not detect the anomaly and are located upstream of the anomaly detection unit 71 that detected the anomaly on that attack path.

[0091] The determination unit 12 determines the continuity between a first vehicle attack event indicated by first vehicle attack event information included in the vehicle attack event history stored in the memory unit 18, and a second vehicle attack event indicated by second vehicle attack event information that occurred earlier than the first vehicle attack event.

[0092] More specifically, when the undetected anomaly detection unit in the first vehicle attack event matches the anomaly detection unit 71 that detected an anomaly in the second vehicle attack event and that detected the anomaly latest among the anomaly detection units 71, the judgment unit 12 judges that there is continuity between the first vehicle attack event and the second vehicle attack event, and when there is no match, the judgment unit 12 judges that there is no continuity.

[0093] At this time, the determination unit 12 may determine the continuity for a second vehicle attack event that occurs within a predetermined period T1 from the occurrence time of the first vehicle attack event.

[0094] In addition, if the judgment unit 12 determines that there is no continuity between the first vehicle attack event and the second vehicle attack event, it may further judge the continuity between the first vehicle attack event indicated by the first vehicle attack event information included in the vehicle attack event history stored in the memory unit 18, and a third vehicle attack event that occurred earlier than the second vehicle attack event and is indicated by the third vehicle attack event information.

[0095] The period update unit 15 updates the predetermined period T1 based on the vehicle function utilization rate included in the vehicle function event information corresponding to the first vehicle attack event among the vehicle function events included in the vehicle function event history stored in the storage unit 18.

[0096] More specifically, the period update unit 15 updates the specified period T1 in the vehicle function event information corresponding to the first vehicle attack event information so as to (1) not change the specified period T1 if a vehicle function event that is the same as a vehicle function event that occurred within a specified period TB from the first time to the past has not occurred within a specified period TC from the first time to the past, (2) shorten the specified period T1 if a vehicle function event that is the same as a vehicle function event that occurred within a specified period TB from the first time to the past has occurred within a specified period TC from the first time to the past and has occurred a number of times or for a period equal to or greater than a specified threshold, or (3) lengthen the specified period T1 if a vehicle function event that is the same as a vehicle function event that occurred within the specified period TB from the first time to the past has occurred within a specified period TC from the first time to the past and has occurred a number of times or for a period less than the specified threshold.

[0097] When the determination unit 12 determines that there is continuity between the first vehicle attack event and the second vehicle attack event, the combination unit 13 combines the first vehicle attack event and the second vehicle attack event.

[0098] The output unit 14 outputs the determination result by the determination unit 12. More specifically, the output unit 14 outputs to the display device 41 a first display control signal including the determination result and causing the display device 41 to display the determination result.

[0099] <Operation> Hereinafter, the operation of the vehicle attack event continuity determination device 10 configured as described above will be described with reference to the drawings.

[0100] 10 is a flowchart of a first vehicle attack event continuity determination process performed by the vehicle attack event continuity determination device 10. This first vehicle attack event continuity determination process is a process for determining the continuity between a first vehicle attack event and a second vehicle attack event that occurred before the first vehicle attack event.

[0101] The first vehicle attack event continuity determination process is initiated, for example, when a user using the vehicle attack event continuity determination device 10 specifies the first vehicle attack event to be subjected to continuity determination, and performs an operation to execute the first vehicle attack event continuity determination process.

[0102] As shown in FIG. 10, when the first vehicle attack event continuity determination process is started, the attack path calculation unit 16 acquires first vehicle attack event information indicating the first vehicle attack event from the vehicle attack event history stored in the memory unit 18 (step S10).

[0103] When the attack path calculation unit 16 acquires the first vehicle attack event information, it calculates an attack path including an entry point of the attack of the first vehicle attack event and an attack target of the attack (step S15).

[0104] When the attack path is calculated, the undetected anomaly detection unit calculation unit 17 calculates undetected anomaly detection units that are located upstream of the anomaly detection unit 71 that detected the anomaly on the attack path and did not detect the anomaly (step S20). Then, the undetected anomaly detection unit calculation unit 17 checks whether or not there was an undetected anomaly detection unit in the calculation of the undetected anomaly detection units (step S25).

[0105] In the processing of step S25, if there is an undetected abnormality detection unit (step S25: Yes), the judgment unit 12 checks whether or not there is vehicle attack event information (hereinafter also referred to as "unacquired vehicle attack event information") indicating a vehicle attack event that occurred before the first vehicle attack event that has not been acquired in the vehicle attack event history stored in the memory unit 18 (step S30).

[0106] Here, unacquired vehicle attack event information refers to vehicle attack event information indicating a vehicle attack event that occurred earlier than the first vehicle attack event and that has not yet been acquired by the processing of step S30 in the loop processing formed by proceeding to Yes in the processing of step S30 and proceeding to No in the processing of step S45 described below, and in the loop processing formed by proceeding to Yes in the processing of step S30, proceeding to Yes in the processing of step S45 described below, and again proceeding to No in the processing of step S60 described below.

[0107] In the processing of step S30, if unacquired vehicle attack event information exists (step S30: Yes), the judgment unit 12 acquires unacquired vehicle attack event information (hereinafter also referred to as "acquired vehicle attack event information") including a reception time closest to the reception time included in the first vehicle attack event information from the vehicle attack event history stored in the memory unit 18 (step S35).

[0108] When the judgment unit 12 acquires the acquired vehicle attack event information, it calculates the end point abnormality detection unit, which is the abnormality detection unit 71 that detected an abnormality the latest among the abnormality detection units 71 that detected an abnormality in the vehicle attack event indicated by the acquired vehicle attack event information (hereinafter also referred to as the "acquired vehicle attack event") (step S40).

[0109] After calculating the end point abnormality detection portion, the determination portion 12 checks whether the undetected abnormality detection portion and the end point abnormality detection portion match (step S45).

[0110] In the processing of step S45, if the undetected abnormality detection unit and the end point abnormality detection unit match (step S45: Yes), the judgment unit 12 calculates the inter-event elapsed time, which is the elapsed time from the occurrence time of the acquired vehicle attack event (here, the reception time of the acquired vehicle attack event information) to the occurrence time of the first vehicle attack event (here, the reception time of the first vehicle attack event information) (step S50).

[0111] When the inter-event elapsed time is calculated, the period update unit 15 executes an event search range calculation process for updating the predetermined period T1 (hereinafter also referred to as the "event search range") (step S55).

[0112] FIG. 11 is a flowchart of the event search range calculation process executed by the period update unit 15.

[0113] As shown in FIG. 11, when the event search range calculation process is started, the period update unit 15 acquires vehicle function event information corresponding to the first vehicle attack event from among the vehicle function events included in the vehicle function event history stored in the memory unit 18 (step S100).

[0114] Then, the period update unit 15 checks whether or not a vehicle function event exists in the acquired vehicle function event information (step S110).

[0115] In the process of step S110, if a vehicle function event is present (step S110: Yes), the period update unit 15 checks whether or not the vehicle function utilization rate included in the acquired vehicle function event information is equal to or greater than a threshold value (step S130).

[0116] In the processing of step S130, if the vehicle function utilization rate is greater than or equal to the threshold value (step S130: Yes), the period update unit 15 updates the event search range so as to increase the event search range (step S140), that is, updates the predetermined period T1 so as to lengthen the predetermined period T1.

[0117] In the processing of step S130, if the vehicle function utilization rate is not greater than or equal to the threshold value (step S130: No), the period update unit 15 updates the event search range so as to reduce the event search range (step S140), that is, updates the specified period T1 so as to shorten the specified period T1.

[0118] In the processing of step S110, if a vehicle function event does not exist (step S110: No), the period update unit 15 updates the event search range so as not to change the event search range (step S120), that is, updates the predetermined period T1 so as not to update the predetermined period T1.

[0119] When the process of step S120 is completed, when the process of step S140 is completed, or when the process of step S150 is completed, the period updating section 15 ends the event search range calculation process.

[0120] Returning to FIG. 10, the description of the first vehicle attack event continuity determination process will be continued.

[0121] When the event search range calculation process ends, the determination unit 12 checks whether the inter-event elapsed time is within the event search range (step S60), that is, whether the inter-event elapsed time is equal to or shorter than the predetermined period T1.

[0122] In the processing of step S60, if the elapsed time between events is within the event search range (step S60: Yes), that is, if the elapsed time between events is less than or equal to the predetermined period T1, the judgment unit 12 judges that there is continuity between the first vehicle attack event and the acquired vehicle attack event (step S65).

[0123] When it is determined that there is continuity between the first vehicle attack event and the acquired vehicle attack event, the combining unit 13 combines the first vehicle attack event with the acquired vehicle attack event (step S70).

[0124] In the process of step S45, if the undetected anomaly detection unit and the end point anomaly detection unit do not match (step S45: No), or in the process of step S60, if the inter-event elapsed time is not within the event search range (step S60: Yes), the determination unit 12 determines that there is no continuity between the first vehicle attack event and the acquired vehicle attack event (step S75).Then, the first vehicle attack event continuity determination process proceeds to the process of step S30.

[0125] If there is no undetected anomaly detection unit in the processing of step S25 (step S25: No), if there is no unacquired vehicle attack event information in the processing of step S30 (step S30: No), or if the processing of step S70 has ended, the vehicle attack event continuity determination device 10 ends its first vehicle attack event continuity determination processing.

[0126] In addition, the first vehicle attack event continuity determination process may execute an engine start event search range calculation process, an autonomous driving start event search range calculation process, a high-speed driving event search range calculation process, or a software update event search range calculation process, described below, instead of the event search range calculation process in step S55.

[0127] FIG. 12 is a flowchart of the engine startup event search range calculation process executed by the period update unit 15.

[0128] As shown in Fig. 12, the engine startup event search range calculation process is a process in which the process of step S110 is changed to the process of step S210 and the process of step S130 is changed to the process of step S230 in the event search range calculation process shown in Fig. 11. Therefore, the process of step S210 and the process of step S230 will be mainly described here.

[0129] When the process of step S100 ends, the period update unit 15 checks whether or not an engine start event is present in the acquired vehicle function event information (step S210).

[0130] In the processing of step S210, if an engine start event is present (step S210: Yes), the period update unit 15 checks whether the vehicle function utilization rate included in the acquired vehicle function event information, i.e., the engine start utilization rate, is equal to or greater than a threshold value (step S230).

[0131] In the process of step S230, if the engine startup utilization rate is equal to or greater than the threshold value (step S230: Yes), the process proceeds to step S140.

[0132] In the process of step S230, if the engine startup utilization rate is not equal to or greater than the threshold value (step S230: No), the process proceeds to step S150.

[0133] In the process of step S210, if there is no engine start event (step S210: No), the process proceeds to step S120.

[0134] When the process of step S120 is completed, when the process of step S140 is completed, or when the process of step S150 is completed, the period updating unit 15 ends the engine start event search range calculation process.

[0135] FIG. 13 is a flowchart of the autonomous driving start event search range calculation process executed by the period update unit 15.

[0136] As shown in Fig. 13, the autonomous driving start event search range calculation process is a process in which the process of step S110 is changed to the process of step S310, and the process of step S130 is changed to the process of step S330 in the event search range calculation process shown in Fig. 11. For this reason, the process of step S310 and the process of step S330 will be mainly described here.

[0137] When the processing of step S100 is completed, the period update unit 15 checks whether or not an automatic driving start event is present in the acquired vehicle function event information (step S310).

[0138] In the processing of step S310, if an autonomous driving start-up event exists (step S310: Yes), the period update unit 15 checks whether the vehicle function utilization rate included in the acquired vehicle function event information, i.e., the autonomous driving start-up utilization rate, is greater than or equal to a threshold value (step S330).

[0139] In the process of step S330, if the automatic driving activation utilization rate is equal to or greater than the threshold value (step S330: Yes), the process proceeds to step S140.

[0140] In the process of step S330, if the automatic driving activation utilization rate is not equal to or greater than the threshold value (step S330: No), the process proceeds to step S150.

[0141] In the process of step S310, if an automatic driving start event does not exist (step S310: No), the process proceeds to step S120.

[0142] When the processing of step S120 is completed, when the processing of step S140 is completed, or when the processing of step S150 is completed, the period update unit 15 ends the autonomous driving start event search range calculation processing.

[0143] FIG. 14 is a flowchart of the high speed driving event search range calculation process executed by the period update unit 15.

[0144] As shown in Fig. 14, the high speed driving event search range calculation process is a process in which the process of step S110 is changed to the process of step S410 and the process of step S130 is changed to the process of step S430 in the event search range calculation process shown in Fig. 11. Therefore, the process of step S410 and the process of step S430 will be mainly described here.

[0145] When the process of step S100 ends, the period update unit 15 checks whether or not a high speed driving event is present in the acquired vehicle function event information (step S410).

[0146] In the processing of step S410, if a high speed driving event is present (step S410: Yes), the period update unit 15 checks whether the vehicle function utilization rate included in the acquired vehicle function event information, i.e., the high speed driving utilization rate, is equal to or greater than a threshold value (step S430).

[0147] In the process of step S430, if the highway driving utilization rate is equal to or greater than the threshold value (step S430: Yes), the process proceeds to step S140.

[0148] In the process of step S430, if the highway driving utilization rate is not equal to or greater than the threshold value (step S430: No), the process proceeds to step S150.

[0149] In the process of step S410, if a high speed driving event does not exist (step S410: No), the process proceeds to step S120.

[0150] When the process of step S120, the process of step S140, or the process of step S150 is completed, the period update unit 15 ends the high speed driving event search range calculation process.

[0151] FIG. 15 is a flowchart of the software update event search range calculation process executed by the period update unit 15.

[0152] As shown in Fig. 15, the software update event search range calculation process is a process in which the process of step S110 is changed to the process of step S510 and the process of step S130 is changed to the process of step S530 in the event search range calculation process shown in Fig. 11. Therefore, the process of step S510 and the process of step S530 will be mainly described here.

[0153] When the process of step S100 ends, the period update unit 15 checks whether or not a software update event is present in the acquired vehicle function event information (step S510).

[0154] In the processing of step S510, if a software update event exists (step S510: Yes), the period update unit 15 checks whether the vehicle function utilization rate, i.e., the software update frequency, included in the acquired vehicle function event information is equal to or greater than a threshold value (step S530).

[0155] In the process of step S530, if the software update frequency is equal to or greater than the threshold value (step S530: Yes), the process proceeds to step S140.

[0156] In the process of step S530, if the software update frequency is not equal to or greater than the threshold value (step S530: No), the process proceeds to step S150.

[0157] In the process of step S510, if there is no software update event (step S510: No), the process proceeds to step S120.

[0158] When the process of step S120 is completed, when the process of step S140 is completed, or when the process of step S150 is completed, the period update section 15 ends the software update event search range calculation process.

[0159] <Consideration> FIG. 16A shows an example of an IDS detection by an abnormality detection unit _C71C of ECU_C70C in an in-vehicle network 20 having a connection relationship from ECU_A70A to ECU_C70C, and a subsequent detection by an abnormality detection unit _D71D of ECU_D70D. Defense Error This is a schematic diagram showing the occurrence of a first event in which a first vehicle attack event consisting of an IDS detection by the abnormality detection unit _A71A of ECU_A70A and a second vehicle attack event consisting of an IDS detection by the abnormality detection unit _A71A of ECU_A70A have occurred.

[0160] At this time, the vehicle attack event continuity determination device 10 determines that there is continuity between the first vehicle attack event and the second vehicle attack event when (1) the anomaly detection unit A_71A is an undetected anomaly detection unit for the first vehicle attack event and an end point anomaly detection unit for the second vehicle attack event, and further, (2) the inter-event elapsed time between the first vehicle attack event and the second vehicle attack event is within the event search range.

[0161] When a determination is made that there is continuity in this manner, a user using the vehicle attack event continuity determination device 10 will be able to analyze the vehicle attack event by treating the latent attack consisting of the first vehicle attack event and the second vehicle attack event as a single vehicle attack event for the first event.

[0162] FIG. 16B shows an example of an IDS detection by an abnormality detection unit _C71C of an ECU_C70C in an in-vehicle network 20 that has no connection from an ECU_E70E to an ECU_C70C, and a subsequent detection by an abnormality detection unit _D71D of an ECU_D70D. Defense Error This is a schematic diagram showing a second event occurring in which a first vehicle attack event consisting of detection of an IDS by the abnormality detection unit _E71E of ECU_E70E and a second vehicle attack event consisting of detection of an IDS by the abnormality detection unit _E71E of ECU_E70E have occurred.

[0163] At this time, the vehicle attack event continuity determination device 10 does not calculate the abnormality detection unit E_71E as an undetected abnormality detection unit for the first vehicle attack event, and therefore determines that there is no continuity between the first vehicle attack event and the second vehicle attack event.

[0164] This determination of no continuity enables a user using the vehicle attack event continuity determination device 10 to analyze the first vehicle attack event and the second vehicle attack event in relation to the second event without treating them as a single latent attack.

[0165] FIG. 16C shows an example of an in-vehicle network 20 in which there is a connection relationship from ECU_A70A to ECU_C70C but no connection relationship from ECU_B70B to ECU_C70C, in which an abnormality detection unit _C71C of ECU_C70C detects an IDS and then an abnormality detection unit _D71D of ECU_D70D detects an IDS. Defense Error This is a schematic diagram showing a third event occurring in which a first vehicle attack event consisting of an IDS detection by an abnormality detection unit _A71A of ECU_A70A and a second vehicle attack event consisting of an IDS detection by an abnormality detection unit _B71B of ECU_B70B has occurred.

[0166] At this time, the vehicle attack event continuity determination device 10 does not calculate ECU_B70B, which is the end point anomaly detection unit of the second vehicle attack event, as an undetected anomaly detection unit of the first vehicle attack event, and therefore determines that there is no continuity between the first vehicle attack event and the second vehicle attack event.

[0167] This determination of no continuity enables a user using the vehicle attack event continuity determination device 10 to analyze the first vehicle attack event and the second vehicle attack event for the third event without treating them as a single latent attack.

[0168] FIG. 16D shows an example of an in-vehicle network 20 having a connection relationship from ECU_A70A to ECU_C70C, in which an abnormality detection unit _C71C of ECU_C70C detects an IDS and an abnormality detection unit _D71D of ECU_D70D subsequently detects an IDS. Defense Error This is a schematic diagram showing a fourth event in which a first vehicle attack event consisting of an IDS detection by the abnormality detection unit _A71A of ECU_A70A and a second vehicle attack event consisting of an IDS detection by the abnormality detection unit _A71A of ECU_A70A, where the inter-event elapsed time between the first vehicle attack event and the second vehicle attack event is outside the event search range.

[0169] At this time, the vehicle attack event continuity determination device 10 determines that there is no continuity between the first vehicle attack event and the second vehicle attack event because the inter-event elapsed time between the first vehicle attack event and the second vehicle attack event is outside the event search range.

[0170] This determination of no continuity enables a user of the vehicle attack event continuity determination device 10 to analyze the first vehicle attack event and the second vehicle attack event for the fourth event without treating them as a single latent attack.

[0171] FIG. 17 is a schematic diagram showing the usage status of a vehicle function event that is the same as a vehicle function event that occurred within a predetermined period TB from the first time, which is the earliest detection time of the first vehicle attack event, back to the past (hereinafter also referred to as the “most recently started vehicle function event”).

[0172] In general, in a latency attack, it is known that the initiation of some vehicle function event is used as a trigger to end the latency period and resume attack activities.

[0173] Therefore, as shown in (a) of Figure 17, when the utilization rate of a vehicle function event that is the same as the most recently started vehicle function event is relatively high, it is considered that the period between the pre-latency attack and the post-latency attack in a single latency attack is likely to be relatively short.

[0174] Therefore, the period update unit 15 updates the specified period T1 to shorten the specified period T1 when a vehicle function event that is the same as a vehicle function event that occurred within a specified period TB from the first time to the past occurs within a specified period TC from the first time to the past and occurs a number of times or for a period equal to or greater than a specified threshold value.

[0175] This allows the vehicle attack event continuity determination device 10 to determine the continuity between the first vehicle attack event and the second vehicle attack event relatively efficiently and effectively.

[0176] Conversely, as shown in (b) of Figure 17, when the utilization rate of the same vehicle function event as the most recently started vehicle function event is relatively low, it is considered that the period between the attack before the latency attack and the attack after the latency attack in a single latency attack is likely to be relatively long.

[0177] Therefore, the period update unit 15 updates the specified period T1 to lengthen it if a vehicle function event that is the same as a vehicle function event that occurred within a specified period TB from the first time to the past occurs within a specified period TC from the first time to the past and occurs a number of times or for a period less than a specified threshold.

[0178] This allows the vehicle attack event continuity determination device 10 to determine the continuity between the first vehicle attack event and the second vehicle attack event relatively efficiently and effectively.

[0179] (Embodiment 2) Hereinafter, a vehicle attack event continuity determination device according to embodiment 2 will be described, which is configured by modifying some of the functions of the vehicle attack event continuity determination device 10 according to embodiment 1. Here, for the vehicle attack event continuity determination device according to embodiment 2, components similar to those of the vehicle attack event continuity determination device 10 have already been described, so the same reference numerals are used and detailed descriptions are omitted, and the description will focus on the differences from the vehicle attack event continuity determination device 10.

[0180] <Configuration> FIG. 18 is a block diagram showing an example of the configuration of a vehicle attack event continuity determination device 10A according to the second embodiment.

[0181] As shown in FIG. 18, the vehicle attack event continuity determination device 10A is configured by adding a reliability calculation unit 19 to the vehicle attack event continuity determination device 10 of embodiment 1 and changing the output unit 14 to an output unit 14A.

[0182] When the combination unit 13 combines a first vehicle attack event and a second vehicle attack event, the reliability calculation unit 19 calculates the reliability of the combined vehicle attack event obtained by combining the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information indicating the first vehicle attack event and the second vehicle attack event information indicating the second vehicle attack event.

[0183] For example, the reliability calculation unit 19 may calculate the reliability as the matching rate of the anomaly detection units 71 that detected anomalies in the first vehicle attack event and the second vehicle attack event, relative to the anomaly detection units 71 present on the attack path calculated by the attack path calculation unit 16 for the first vehicle attack event.

[0184] For example, if the anomaly detection units 71 present on the attack path are anomaly detection unit _A71A, anomaly detection unit _B71B, anomaly detection unit _C71C, and anomaly detection unit _D71D, and the anomaly detection units 71 that detected anomalies in the first vehicle attack event and the second vehicle attack event are anomaly detection unit _A71A, anomaly detection unit _B71B, and anomaly detection unit _C71C, the reliability calculation unit 19 may calculate the reliability as 3 / 4 = 0.75.

[0185] In addition, the reliability calculation unit 19 may calculate, for example, the reliability as the coincidence rate between the anomaly detection type detected by the anomaly detection unit 71 present on the attack path calculated by the attack path calculation unit 16 for the first vehicle attack event and the anomaly detection type detected by the anomaly detection unit 71 that detected anomalies in the first vehicle attack event and the second vehicle attack event.

[0186] For example, if the anomaly detection types detected by the anomaly detection unit 71 present on the attack path are Anomaly Detection Unit_A_Abnormality1, Anomaly Detection Unit_B_Abnormality2, Anomaly Detection Unit_C_Abnormality3, Anomaly Detection Unit_D_Abnormality4, and Anomaly Detection Unit_D_Abnormality5, and the anomaly detection types detected by the anomaly detection unit 71 that detected anomalies in the first vehicle attack event and the second vehicle attack event are Anomaly Detection Unit_A_Abnormality1, Anomaly Detection Unit_B_Abnormality2, and Anomaly Detection Unit_C_Abnormality3, the reliability calculation unit 19 may calculate the reliability as 3 / 5 = 0.60.

[0187] The output unit 14A outputs the determination result by the determination unit 12 and the reliability calculated by the reliability calculation unit 19. More specifically, the output unit 14A outputs to the display device 41 a second display control signal including the determination result and the reliability, and causes the display device 41 to display the determination result and the reliability.

[0188] FIG. 19 is a schematic diagram showing an example of an image that is displayed by display device 41 that has received a second display control signal output from output unit 14A, based on the received second display control signal.

[0189] As illustrated in FIG. 19, the display device 41 receives the second display control signal output from the output unit 14A and displays the judgment result by the judgment unit 12 and the reliability calculated by the reliability calculation unit 19.

[0190] <Operation> Hereinafter, the operation of the vehicle attack event continuity determination device 10A configured as described above will be described with reference to the drawings.

[0191] The vehicle attack event continuity determination device 10A performs a second vehicle attack event continuity determination process in which a part of the process is changed from the first vehicle attack event continuity determination process performed by the vehicle attack event continuity determination device 10.

[0192] FIG. 20 is a flowchart of the second vehicle attack event continuity determination process performed by the vehicle attack event continuity determination device 10A.

[0193] As shown in FIG. 20, the second vehicle attack event continuity determination process is a process that has been modified from the first vehicle attack event continuity determination process by adding step S680, and terminating the second vehicle attack event continuity determination process when there is no undetected abnormality detection unit in step S25 (step S25: No) and when there is no unacquired vehicle attack event information in step S30 (step S30: No).

[0194] Therefore, the process of step S680 will be mainly described here.

[0195] When the processing of step S70 is completed, the reliability calculation unit 19 calculates the reliability of the combined vehicle attack event obtained by combining the first attack event and the acquired vehicle attack event based on the first vehicle attack event information indicating the first vehicle attack event and the vehicle attack event information indicating the acquired vehicle attack event (step S680).

[0196] When the process of step S680 is completed, the second vehicle attack event continuity determination process proceeds to the process of step S30.

[0197] <Consideration> According to the vehicle attack event continuity determination device 10A having the above-mentioned configuration, the determination result of the continuity between the first vehicle attack event and the second vehicle attack event, and the reliability of the combined vehicle attack event obtained by combining the first vehicle attack event and the second combined event are displayed on the display device 41.

[0198] This enables a user of the vehicle attack event continuity determination device 10A to determine whether or not the first vehicle attack event and the second vehicle attack event should be considered as a single latent attack based on the display content displayed on the display device 41.

[0199] (supplement) As described above, the technology disclosed in this application has been described based on the first and second embodiments. However, the present disclosure is not limited to these embodiments. As long as it does not deviate from the spirit of the present disclosure, various modifications conceived by a person skilled in the art to the present embodiments and forms constructed by combining components in different embodiments may also be included within the scope of one or more aspects of the present disclosure.

[0200] (1) In the first embodiment, the vehicle attack event continuity determination device 10 has been described as being realized by a server device 40 that exists outside the in-vehicle network 20. However, the vehicle attack event continuity determination device 10 does not necessarily need to be limited to an example in which it is realized by a server device 40, and further does not need to be limited to an example in which it is realized in a device outside the in-vehicle network 20. As an example, the vehicle attack event continuity determination device 10 may be realized within the in-vehicle network 20.

[0201] In this case, the in-vehicle network 20 may include, for example, a processor and a memory, and the vehicle attack event continuity determination device 10 may be realized by the processor executing a program stored in the memory.

[0202] (2) Some or all of the components included in the vehicle attack event continuity determination device 10 may be realized as dedicated or general-purpose circuits.

[0203] Some or all of the components included in the vehicle attack event continuity determination device 10 may be configured, for example, from one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, is a computer system including a microprocessor, a ROM (Read Only Memory), a RAM (Random Access Memory), etc. A computer program is stored in the ROM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0204] Here, we refer to it as a system LSI, but it may also be called an IC, LSI, super LSI, or ultra LSI depending on the level of integration. Also, the method of integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connections and settings of the circuit cells inside the LSI.

[0205] Furthermore, if a new integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a derivative technology, it is possible to integrate the functional blocks using that technology. The application of biotechnology is also a possibility.

[0206] (3) One aspect of the present disclosure may be not only the vehicle attack event continuity determination device 10, but also a vehicle attack event continuity determination method having steps corresponding to characteristic components included in the vehicle attack event continuity determination device 10. Another aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the vehicle attack event continuity determination method. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a computer program is recorded. [Industrial Applicability]

[0207] The present disclosure is widely applicable to attack monitoring systems that monitor cyber attacks against networks, etc. [Explanation of symbols]

[0208] 1. Attack Monitoring System 10, 10A Vehicle attack event continuity determination device 11 Acquisition Department 12 Judgment section 13 Joint 14, 14A output section 15 Term Update Department 16 Attack Path Calculation Unit 17 Undetected anomaly detection calculation unit 18 Memory section 19 Reliability calculation section 20 In-vehicle network 30 Vehicles 40 Server device 41 Display device 50 External Network 60 Vehicle Attack Event Management Department 70 ECU 70A ECU_A 70B ECU_B 70C ECU_C 70D ECU_D 70E ECU_E 71 Abnormality detection unit 71A Abnormality detection section_A 71B Abnormality detection section_B 71C Abnormality detection section_C 71D Abnormality detection section_D 71E Abnormality detection section_E

Claims

1. an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that has occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that has occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network; a determining step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information; and an output step of outputting the result of the determination. A method for determining the continuity of vehicle attack events.

2. The acquiring step further includes acquiring, in the in-vehicle network, third vehicle attack event information relating to a third vehicle attack event that occurred before the second vehicle attack event; In the determining step, when the continuity is not determined to be present, the continuity between the first vehicle attack event and the third vehicle attack event is determined based on the first vehicle attack event information, the third vehicle attack event information, and the in-vehicle network information. The vehicle attack event continuity determination method according to claim 1 .

3. The in-vehicle network includes a plurality of abnormality detection units, The first vehicle attack event information includes information indicating one or more first anomaly detection units among the plurality of anomaly detection units that detected an anomaly in the first vehicle attack event, The second vehicle attack event information includes information indicating one or more second anomaly detection units that detected an anomaly in the second vehicle attack event among the plurality of anomaly detection units, In the determination step, an attack path in the first vehicle attack event is calculated, and an undetected anomaly detection unit that is located upstream of the one or more first anomaly detection units in the attack path and did not detect an anomaly in the first vehicle attack event is calculated. When the undetected anomaly detection unit matches an end point anomaly detection unit that detected an anomaly the latest among the one or more second anomaly detection units, the continuity is determined to be continuity. The method for determining continuity of a vehicle attack event according to claim 1 or 2.

4. In the determination step, the continuity is determined for the second vehicle attack event that occurred within a first predetermined period from the occurrence time of the first vehicle attack event. The vehicle attack event continuity determination method according to claim 3 .

5. The acquiring step further includes acquiring vehicle function event information related to a vehicle function event that has occurred in a vehicle equipped with the in-vehicle network, In the determining step, the continuity is determined based on the vehicle function event information. The vehicle attack event continuity determination method according to claim 4 .

6. The vehicle function event information includes a vehicle function utilization rate related to the number of times or a period during which a first vehicle function event, which is the same as a vehicle function event that occurred within a second predetermined period from an earliest first time among the times at which the one or more first anomaly detection units detected an anomaly, occurred within a third predetermined period from the first time to the past, the third predetermined period being longer than the second predetermined period; The vehicle attack event continuity determination method further includes a period update step of updating the first predetermined period based on the vehicle function utilization rate, In the determination step, the continuity is determined by using the first predetermined period updated in the period update step. The vehicle attack event continuity determination method according to claim 5 .

7. In the period updating step, the first predetermined period is updated so as to (1) not change the first predetermined period if the first vehicle function event has not occurred within the third predetermined period from the first time to the past, (2) shorten the first predetermined period if the first vehicle function event has occurred within the third predetermined period from the first time to the past and has occurred a number of times or for a period equal to or greater than a predetermined threshold, or (3) lengthen the first predetermined period if the first vehicle function event has occurred within the third predetermined period from the first time to the past and has occurred a number of times or for a period less than a predetermined threshold. The vehicle attack event continuity determination method according to claim 6 .

8. The first vehicle function event is an engine start event starting an engine of the vehicle. The method for determining vehicle attack event continuity according to claim 6 or 7.

9. The first vehicle function event is an automatic driving start event that starts automatic driving of the vehicle. The method for determining vehicle attack event continuity according to claim 6 or 7.

10. The first vehicle function event is a high speed driving event in which the vehicle is driving at a high speed. The method for determining vehicle attack event continuity according to claim 6 or 7.

11. The first vehicle function event is a software update event for updating software of the vehicle. The method for determining vehicle attack event continuity according to claim 6 or 7.

12. The method further includes a combining step of combining the first vehicle attack event and the second vehicle attack event when the determining step determines that there is continuity. The method for determining vehicle attack event continuity according to any one of claims 1 to 11.

13. The method further includes a reliability calculation step of calculating a reliability of a combined vehicle attack event obtained by combining the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information and the second vehicle attack event information when the first vehicle attack event and the second vehicle attack event are combined in the combining step, The output step further includes outputting the reliability. The vehicle attack event continuity determination method according to claim 12.

14. an acquisition unit that acquires first vehicle attack event information related to a first vehicle attack event that has occurred in an in-vehicle network, second vehicle attack event information related to a second vehicle attack event that has occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network; a determination unit that determines continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information; An output unit that outputs the result of the determination. Vehicle attack event continuity determination device.

15. A program for causing a computer to execute a vehicle attack event continuity determination process, The vehicle attack event continuity determination process includes: an acquisition step of acquiring first vehicle attack event information relating to a first vehicle attack event that has occurred in an in-vehicle network, second vehicle attack event information relating to a second vehicle attack event that has occurred in the in-vehicle network prior to the first vehicle attack event, and in-vehicle network information indicating a configuration of the in-vehicle network; a determining step of determining continuity between the first vehicle attack event and the second vehicle attack event based on the first vehicle attack event information, the second vehicle attack event information, and the in-vehicle network information; and an output step of outputting the result of the determination. program.

Images