Cyber ​​attack detection device and cyber attack detection method

Abstract

This cyber attack detection device comprises: a communication header monitoring unit that monitors a header of received communication data; a communication monitoring unit that monitors a payload of the communication data; an attack detection unit that detects, from the communication data, signs of a DoS attack which would lead to the function failure of the communication monitoring unit; an additional information request unit that identifies a transmission source from the communication data when the signs are detected, and requests the identified transmission source to add additional information to a header of communication data to be newly transmitted; and an update unit that, when the signs are detected, performs an update determination for adding the additional information as a monitored item. The communication header monitoring unit adds the additional information as a monitored item on the basis of the update determination, and determines that newly received communication data is abnormal when the additional information has not been added to the header of the newly received communication data, or when the information added to the header of the newly received communication data does not match the additional information.

Description

[Technical Field]

[0001] The present disclosure relates to cyber-attack detection technology. [Background technology]

[0002] Patent Document 1 discloses, as an example of cyber-attack detection technology, a technology relating to an in-vehicle network device that communicates data between multiple in-vehicle devices, which has a status acquisition unit that acquires the status of the vehicle itself and a communication monitoring unit that monitors the data, and is characterized by changing the method of monitoring the data based on the status of the vehicle itself. [Prior art documents] [Non-patent literature]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2017-47835 Summary of the Invention [Problem to be solved by the invention]

[0004] The device disclosed in Patent Document 1 simply changes the monitoring method depending on the state, so there is a problem in that if it is subjected to an attack that sends a large amount of communication data, known as a DoS (Denial of Service) attack, the communication monitoring unit may stop functioning.

[0005] The present disclosure has been made to solve such problems, and aims to provide a cyber-attack detection technology that can deal with DoS attacks. [Means for solving the problem]

[0006] One aspect of the cyber attack detection device disclosed herein comprises a communication header monitoring unit that monitors the header of received communication data, a communication monitoring unit that monitors the payload of the communication data, an attack detection unit that detects signs of a DoS attack that will cause the communication monitoring unit to malfunction from the communication data, an additional information request unit that, when the signs are detected, identifies a sender from the communication data and requests the identified sender to add additional information to the header of newly sent communication data, and an update unit that, when the signs are detected, makes an update decision to add the additional information as a monitoring item, and the communication header monitoring unit adds the additional information as a monitoring item based on the update decision, and if the additional information has not been added to the header of the newly received communication data, or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal. [Effects of the Invention]

[0007] The cyber attack detection technology disclosed herein can deal with DoS attacks. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 2 is a functional block diagram of a control device. [Figure 2] 10 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. [Figure 3] 10 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. [Figure 4] 10 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. [Figure 5] 10 is a flowchart showing an abnormality detection process when there is no DoS attack. [Figure 6] 10 is a flowchart showing a sign determination process for determining a sign of a DoS attack. [Figure 7] 10 is a flowchart showing an abnormality detection process when a sign of a DoS attack is detected. DETAILED DESCRIPTION OF THE INVENTION

[0009] Various embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Note that components with the same or similar reference numerals in the drawings have the same or similar configurations or functions, and redundant descriptions of such components will be omitted.

[0010] Embodiment 1 <Outline of configuration> (Control device) 1 is a functional block diagram of an on-board electronic control device (hereinafter simply referred to as a "control device") when the cyber-attack detection device of the present disclosure is applied as the control device. The control device 10 is a device that controls a vehicle (not shown). The control device 10 is connected to other control devices (not shown) inside the vehicle via communication lines (not shown), such as Ethernet or a CAN (Controller Area Network). The control device 10 includes a VM (Virtual Machine) 20, a network switch 30, hardware 40, and a hypervisor 50.

[0011] (Network Switch) The network switch 30 is a network switch that connects the control device 10 to other control devices (not shown) inside the vehicle. The network switch 30 is, for example, an Ethernet switch equipped with a security function. As an example, as shown in FIG. 1, the network switch 30 may include a communication header monitoring unit 100 that monitors the header of communication data. The function and operation of the communication header monitoring unit 100 will be described in more detail below.

[0012] (VM) The VM (Virtual Machine) 20 is a virtual machine that has the function of controlling a vehicle. For example, the VM 20 includes Linux (registered trademark), which is an operating system (OS). The VM 20 includes a communication monitoring unit 101, an attack detection unit 103, an additional information request unit 104, an update unit 105, and an encryption unit 109. Details of these functional units will be described later.

[0013] (Hardware) The hardware 40 is the hardware of the control device 10, and includes a processor 401 and a memory 402. The hardware 40 may include a function for routing communication data and a security function.

[0014] The processor 401 executes the programs stored in the memory 402 to perform the functions executed by each functional unit of the VM 20. The processor 401 also executes the programs stored in the memory 402 to perform the functions executed by the communication header monitor 100. Examples of the memory 402 include RAM (random access memory), ROM (read-only memory), flash memory, and EPROM (erasable programmable read only memory). only memory), EEPROM (electrically erasable programmable read-only) This includes non-volatile or volatile semiconductor memories such as hard disks, magnetic disks, flexible disks, optical disks, compact disks, minidisks, and DVDs.

[0015] (hypervisor) The hypervisor 50 is a hypervisor for the control device 10, and is software for running one or more VMs 20 on the hardware 40. Generally, a hypervisor is software for running multiple different operating systems simultaneously on hardware, so if the control device 10 has a single VM 20, the hypervisor 50 may not be necessary. The hypervisor 50 may have a function for routing communication data and a security function.

[0016] <Configuration details> (Communication header monitoring section) As an example, the network switch 30 may include a communication header monitor 100 that includes an abnormality determination unit 102A.

[0017] The communication header monitoring unit 100 is a functional unit that transmits and receives communication data to and from a control device (not shown) other than the control device 10, and has a function of inspecting the header of the communication data. The communication header monitoring unit 100 transmits and receives communication data of, for example, Ethernet communication, and inspects the header of the communication data.

[0018] The abnormality determination unit 102A has a function of storing a list of normal communication data as normal values, and comparing the monitoring results with the normal values ​​using newly acquired communication data as monitoring results. The list of normal communication data is created by a control unit (not shown) of the VM 20 when the control device 10 is operating normally, and is stored in memory. The abnormality determination unit 102A acquires and stores this created list by referring to the memory.

[0019] For example, in the case of Ethernet communication data, the header inspection of the communication data includes inspection of layer 2, layer 3, or layer 4.

[0020] Layer 2 inspection includes, for example, inspection of a source MAC (Media Access Control) address, inspection of a destination MAC address, and inspection of a VLAN (Virtual LAN) port.

[0021] Layer 3 inspection includes, for example, inspection of a source IP (Internet Protocol) address and inspection of a destination IP address.

[0022] Layer 4 inspection includes, for example, inspection of the source port number, the destination port number, and TCP (Transmission Control Protocol) flags.

[0023] 1 illustrates a configuration in which the network switch 30 includes the communication header monitor 100, but the communication header monitor 100 may be located in any of the hardware 40, the hypervisor 50, or the VM 20. A communication header monitor may also be located for each layer. For example, the network switch 30 may be located with a communication header monitor that inspects layer 2, and the hardware 40 may be located with communication header monitors that inspect layers 3 and 4.

[0024] (Communications Monitoring Department) The communication monitoring unit 101 includes an abnormality determination unit 102B, and monitors the area other than the header of the communication data monitored by the communication header monitoring unit 100, i.e., the payload information. The payload information includes, for example, the data, reception cycle, and reception frequency of the communication data.

[0025] The communication monitoring unit 101 may monitor the header of the communication data monitored by the communication header monitoring unit 100. By configuring the communication monitoring unit 101 to perform a double check so that it also monitors the header of the communication data in addition to the communication header monitoring unit 100, the communication monitoring unit 101 can monitor the header of the communication data even when the communication header monitoring unit 100 does not operate normally.

[0026] The abnormality determination unit 102B has a function of retaining a list of normal communication data as normal values, and comparing newly acquired communication data as monitoring results with the normal values. The list of normal communication data is created by a control unit (not shown) of the VM 20 when the control device 10 is operating normally, and is stored in memory. The abnormality determination unit 102B acquires and stores this created list by referring to the memory. If the comparison result between the monitoring result and the normal value does not match, the abnormality determination unit 102B determines that the newly acquired communication data is abnormal.

[0027] If the abnormality determination unit 102B determines that the newly acquired communication data is abnormal, it can cut off communication as an abnormality response process. Other abnormality response processes may also be performed. Examples of other abnormality response processes include switching the communication line, switching the control device 10 to a standby control device, and degrading the functions of the control device 10. If it determines that the newly acquired communication data is normal, the control device 10 continues to perform its normal control process.

[0028] (Attack detection section) The attack detection unit 103 is a functional unit that performs a sign determination function that determines whether or not there are signs of a DoS attack as an incident. If a DoS attack occurs, the communication monitoring unit 101 will stop functioning, so by detecting signs of a DoS attack, the communication monitoring unit 101 is prevented from malfunctioning. Additionally, the attack detection unit 103 may perform an attack end determination function that determines that no attack has occurred when the DoS attack has subsided. In order to perform the sign determination function and the additional attack end determination function, the attack detection unit 103 includes a communication bandwidth monitoring unit 106, a resource monitoring unit 107, a memory monitoring unit 108, and an attack determination unit 120.

[0029] (Communication Bandwidth Monitoring Unit) The communication bandwidth monitoring unit 106 is a functional unit that monitors the communication bandwidth usage, which is the amount of communication bandwidth used by the communication monitoring unit 101 when receiving communication data, and determines whether there is enough communication bandwidth. For example, an upper limit is set based on the normal communication bandwidth, and if the communication bandwidth exceeds the set upper limit, it is determined that an abnormality has occurred.

[0030] (Resource Monitoring Unit) The resource monitoring unit 107 has a function of monitoring the processing load of the communication monitoring unit 101 and determining whether there is a margin for the processing load. For example, the resource monitoring unit 107 compares the normal processor utilization rate with the current processor utilization rate for the processor assigned to the resource monitoring unit 107 and determines whether there is an abnormality.

[0031] (Memory monitoring section) The memory monitoring unit 108 has a function of monitoring the memory usage of the communication monitoring unit 101 and determining whether there is sufficient memory space. For example, the memory monitoring unit 108 compares the normal memory usage with the current memory usage of the memory allocated to the memory monitoring unit 108, and determines whether there is an abnormality.

[0032] (Attack determination section) The attack determination unit 120 determines whether there are signs of an incident due to a DoS attack based on the monitoring results of the communication bandwidth monitoring unit 106, the resource monitoring unit 107, and the memory monitoring unit 108. The attack determination unit 120 may determine that there are signs of an incident when all of the monitoring results of the communication bandwidth monitoring unit 106, the resource monitoring unit 107, and the memory monitoring unit 108 indicate an abnormality, or may determine that there are signs of an incident when any one of the monitoring results indicates an abnormality. Furthermore, the state of the vehicle may also be taken into consideration when determining whether there are signs of an incident. For example, a strict upper limit on the processing load may be set while the vehicle is traveling.

[0033] The attack detection unit 103 may operate based on the abnormality result of the communication monitoring unit 101. For example, the attack detection unit 103 may be configured to operate when the abnormality result of the communication monitoring unit 101 is a periodic abnormality.

[0034] When the attack detection unit 103 detects a sign of an incident, it transmits a detection result indicating that there is a sign to the additional information request unit 104 and the update unit 105 .

[0035] (Additional Information Request Department) The additional information request unit 104 is a functional unit that, when the attack detection unit 103 determines that there is a sign of an incident, identifies the sender from the large amount of received communication data and requests the sender to add additional information to the header of newly sent communication data. For example, in the case of an attack that spoofs the IP address of a legitimate device, since a large amount of communication data from the spoofed legitimate device is being received, the additional information request unit 104 requests the sender to add additional information to the header, with the spoofed legitimate device as the sender.

[0036] Note that specifying the sender includes not only uniquely identifying the sender address, but also narrowing down the sender address to a certain extent.

[0037] The additional information may be dynamic information that changes with each transmission or over time, or may be encrypted information in which the dynamic information is encrypted. Examples of dynamic information include counter values ​​and timestamps.

[0038] The additional information requesting unit 104 may select a random value or a random item as the additional information. As an example, the additional information requesting unit 104 selects a counter value that counts up from a random number as the additional information. As an example, the additional information requesting unit 104 randomly selects a counter value and a timestamp as the additional information. That is, instead of selecting a counter value every time, the additional information requesting unit 104 sometimes selects a counter value and sometimes selects a timestamp.

[0039] The additional information requesting unit 104 may request that information encrypted using a predetermined encryption key, which will be described later, be added as additional information.

[0040] In addition, if the attack detection unit 103 no longer detects any signs of an incident after requesting that additional information be added, the additional information request unit 104 may request the sender to remove the additional information that it has requested the sender to add.

[0041] The additional information requested by the additional information request unit 104 is transmitted to the sender and also to the update unit 105. In one embodiment, the additional information may be transmitted to the encryption unit 109.

[0042] (cipher section) The encryption unit 109 is a functional unit that encrypts the additional information requested by the additional information request unit 104. The encryption unit 109 encrypts, for example, a counter value or a timestamp. For encryption, for example, MAC (Message Authentication Code), common key encryption, or public key encryption is used.

[0043] The encryption key used by the encryption unit 109 is also held in advance by the authorized transmission source. That is, the control device 10 and the authorized transmission source hold the same common key.

[0044] The encryption process is performed by the VM 20 or the hardware 40. For example, a high-speed HSM (Hardware Security Module) is used for encryption.

[0045] (Update section) The updating unit 105 is a functional unit that makes an update judgment to add the additional information to the monitoring items of the communication data when the additional information requesting unit 104 requests the sender to add additional information to the header of the communication data. Based on this update judgment, the monitoring items by the communication header monitoring unit 100 are updated. The monitoring items may be updated by the updating unit 105 or the communication header monitoring unit 100. When the communication header monitoring unit 100 updates the monitoring items, the updating unit 105 transmits an instruction to the communication header monitoring unit 100 to update the monitoring items based on the update judgment. Part of the communication data may be monitored as binary.

[0046] Furthermore, when a removal request to remove additional information is made by the additional information requesting unit 104, the updating unit 105 may make a removal update decision to remove the additional information from the monitoring items of the communication data. Based on this update decision, the monitoring items monitored by the communication header monitoring unit 100 are updated. That is, the additional information is removed from the monitoring items monitored by the communication header monitoring unit 100.

[0047] (Details of the abnormality detection method) Hereinafter, with reference to FIGS. 2 to 4, a detailed procedure of an abnormality determination method in which the communication header monitoring unit 100 determines that communication data is abnormal will be described.

[0048] 2 shows a method for determining that an abnormality exists when additional information is added to the monitoring items of the communication header monitoring unit 100 and the absence of additional information in the header of communication data. A newly connected unauthorized device B is attempting to launch a DoS attack on the control device 10 by spoofing the IP address in the header of legitimate device A.

[0049] In the control device 10, the attack detection unit 103 detects signs of an incident (DoS attack). If a sign is detected, the additional information request unit 104 identifies the sender from the large amount of received communication data and requests the sender to attach additional information. Also, if a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

[0050] The control device 10 (additional information request unit 104) requests the legitimate device A, which is the sender, to add additional information. On the other hand, since the unauthorized device B is merely masquerading as the legitimate device A, the communication data requesting additional information does not reach the unauthorized device B.

[0051] After requesting the addition of the additional information, regular device A attaches the additional information to the header and transmits the communication data to control device 10. In control device 10 that receives this communication data, abnormality determination unit 102A determines that the communication data from regular device A is normal based on the monitoring result of communication header monitoring unit 100.

[0052] On the other hand, unauthorized device B transmits communication data to the control device 10 without adding additional information to the header. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from unauthorized device B is abnormal based on the monitoring result of the communication header monitoring unit 100. If an abnormality is determined, the communication header monitoring unit 100 may block communication with unauthorized device B.

[0053] In this way, it is possible to detect abnormalities in communication data when an attack using a spoofed IP address is made. In addition, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

[0054] 3 shows a method for determining an abnormality when additional information is added to the monitoring items of the communication header monitoring unit 100 and the additional information added to the header of communication data is incorrect. A newly connected unauthorized device B is eavesdropping on the communication of legitimate device A, and adding additional information by spoofing the IP address in the header of legitimate device A, in an attempt to perform a DoS attack on the control device 10.

[0055] In the control device 10, the attack detection unit 103 detects signs of an incident. When a sign is detected, the additional information request unit 104 identifies the sender from the large amount of received communication data and requests the sender to attach additional information. In the example of FIG. 3, the additional information is a counter value. Furthermore, when a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

[0056] The control device 10 (additional information request unit 104) requests legitimate device A, which is the sender, to add additional information. On the other hand, since unauthorized device B is merely impersonating legitimate device A, the communication data for which additional information is requested does not reach unauthorized device B. However, unauthorized device B eavesdrops on the communication of legitimate device A and confirms that additional information has been added.

[0057] After requesting the addition of the additional information, regular device A sends communication data to control device 10 with the correct additional information counter value of 1 added to the header. In control device 10 receiving this communication data, abnormality determination unit 102A determines that the communication data from regular device A is normal based on the monitoring result of communication header monitoring unit 100.

[0058] On the other hand, unauthorized device B eavesdrops on communications from authorized device A, spoofs the IP address in the header of authorized device A, and sends communication data to the control device 10 with the intercepted additional information having a counter value of 1. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from unauthorized device B is abnormal based on the monitoring results of the communication header monitoring unit 100, since the counter value has not counted up. If an abnormality is determined, the communication header monitoring unit 100 may block communication with unauthorized device B.

[0059] In this way, it is possible to detect abnormalities in communication data when a replay attack is launched by spoofing an IP address. In addition, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

[0060] 4 shows a method for determining an abnormality when additional information is added to the monitoring items of the communication header monitoring unit 100 and the encrypted additional information added to the header of communication data is incorrect. A newly connected unauthorized device B eavesdrops on the communication of legitimate device A, spoofs the MAC address in the header of legitimate device A, and masquerades as legitimate device A, adding imitation additional information to the control device 10 in an attempt to launch a DoS attack.

[0061] In the control device 10, the attack detection unit 103 detects signs of an incident. When a sign is detected, the additional information request unit 104 identifies the sender from the large amount of received communication data and requests the sender to attach additional information in which predetermined information is encrypted. In the example of FIG. 4, the additional information is assumed to be information in which a counter value is encrypted. Furthermore, when a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

[0062] The control device 10 (additional information request unit 104) requests the legitimate device A, which is the sender, to attach additional information in which the counter value is encrypted. On the other hand, since the unauthorized device B has spoofed the MAC address of the legitimate device A, the communication data for which additional information is requested also reaches the unauthorized device B.

[0063] After requesting the addition of the additional information, legitimate device A sends the communication data to the control device 10 with the additional information 0110, which is the encrypted counter value, attached to the header. In the control device 10 receiving this communication data, the abnormality determination unit 102A determines that the communication data from legitimate device A is normal based on the monitoring result of the communication header monitoring unit 100.

[0064] On the other hand, the unauthorized device B eavesdrops on the communication of the authorized device A, spoofs the header of the authorized device A, and transmits the eavesdropped additional information 0110 to the control device 10. In the control device 10 that receives this communication data, the abnormality determination unit 100 determines whether or not the communication header is 0110 based on the monitoring result of the communication header monitoring unit 100. 102A Since the counted-up counter value is not encrypted additional information, the communication header monitor 100 determines that the communication data from the unauthorized device B is abnormal. If an abnormality is determined, the communication header monitor 100 may block communication with the unauthorized device B.

[0065] In this way, it is possible to detect abnormalities in communication data when a replay attack is carried out by spoofing a MAC address. Also, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

[0066] <Operation> Hereinafter, the operation of the control device 10 relating to the cyber-attack detection method will be described with reference to FIGS.

[0067] (Abnormality detection process when there is no DoS attack) First, the abnormality detection process performed when the control device 10 is not under a DoS attack will be described in detail with reference to Fig. 5. Fig. 5 is a flowchart showing the flow of a series of processes from the process of receiving communication data, through the process of determining abnormality, to the process of executing the determination result.

[0068] In step S201, the communication header monitor 100 receives communication data. After the process in step S201 ends, the process proceeds to step S202.

[0069] In step S202, the communication header monitoring unit 100 inspects the header of the communication data. The abnormality determination unit 102A compares the monitoring result of the communication header monitoring unit 100 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S202, the process proceeds to step S204. If no abnormality (normality) is determined in step S202, the process proceeds to step S203.

[0070] In step S203, the communication monitoring unit 101 inspects data in areas other than the header of the communication data. The abnormality determination unit 102B compares the monitoring result of the communication monitoring unit 101 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S203, the process proceeds to step S204. If a normality is determined in step S203, the process proceeds to step S205.

[0071] If the abnormality determination unit 102A or the abnormality determination unit 102B determines that an abnormality has occurred, then in step S204, the abnormality determination unit 102A or the abnormality determination unit 102B performs abnormality processing. For example, the abnormality determination unit 102A or the abnormality determination unit 102B cuts off communication that has been determined to be abnormal. After step S204 ends, the abnormality detection processing ends.

[0072] In step S205, if the abnormality determination units 102A and 102B determine that the system is normal, the abnormality determination units 102A and 102B perform normal processing. Normal processing refers to normal control processing. After step S205 is completed, the abnormality detection processing ends.

[0073] (DoS attack prediction process) Next, the sign determination process in which the control device 10 determines signs of a DoS attack will be described in detail with reference to Fig. 6. Fig. 6 is a flowchart showing the flow of a series of processes from determining signs of an incident (DoS attack), identifying the sender, requesting the sender to add additional information, to updating the header monitoring items to add the additional information.

[0074] In step S301, the communication band monitoring unit 106 monitors the communication band of the communication monitoring unit 101. If the communication band exceeds a predetermined threshold, it is determined to be abnormal. If an abnormality is determined in step S301, the process proceeds to step S302.

[0075] In step S302, the resource monitoring unit 107 monitors the processing load of the communication monitoring unit 101. If the processing load exceeds a predetermined threshold, it is determined to be abnormal. If an abnormality is determined in step S302, the process proceeds to step S303.

[0076] In step S303, the memory monitoring unit 108 monitors the memory usage of the communication monitoring unit 101. If the memory usage exceeds a predetermined threshold, it is determined to be an abnormality. After step S303 is completed, if an abnormality is determined, the process proceeds to step S304. Note that steps S301, S302, and S303 may be performed in any order.

[0077] In step S304, the attack determination unit 120 determines whether there is a sign of an incident caused by a DoS attack based on the abnormality result of the communication bandwidth monitoring unit 106, the abnormality result of the resource monitoring unit 107, and the abnormality determination result of the memory monitoring unit 108. The attack determination unit 120 may determine that there is a sign of an incident when any of the abnormality determination results indicates an abnormality. If it is determined in step S304 that there is a sign of an incident, the process proceeds to step S305.

[0078] In step S305, the additional information request unit 104 identifies the sender from the large amount of received data. After the process in step S305 ends, the process proceeds to step S306.

[0079] In step S306, the additional information request unit 104 requests the identified sender to add additional information. The additional information request unit 104 may request encrypted information as additional information. In this case, the encryption unit 109 encrypts the expected value of the monitoring item (e.g., a counter value) and uses the encrypted data as additional information. After the processing in step S306 is completed, the processing proceeds to step S307.

[0080] In step S307, the update unit 105 makes an update decision to add the additional information requested by the additional information request unit 104 to the sender as a monitoring item of the communication data. Based on this update decision, as one example, the update unit 105 adds the requested additional information to the monitoring items of the communication header monitoring unit 100. As another example, the communication header monitoring unit 100 may add the requested additional information to the monitoring items. After the processing in step S307 ends, the incident sign determination processing ends.

[0081] (Anomaly detection process when a DoS attack warning is detected) Next, the abnormality detection process when the control device 10 detects a sign of a DoS attack will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing the flow of a series of processes from the communication data reception process, through the abnormality detection process, to the execution of the determination result process.

[0082] In step S401, the communication header monitor 100 receives communication data. After the process in step S401 ends, the process proceeds to step S402.

[0083] In step S402, the communication header monitoring unit 100 inspects the header of the communication data. The abnormality determination unit 102A compares the monitoring result of the communication header monitoring unit 100 with a list of normal communication data to which additional information has been added, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S402, the process proceeds to step S404. If no abnormality (normal) is determined in step S402, the process proceeds to step S403.

[0084] In step S403, the communication monitoring unit 101 inspects data in areas other than the header of the communication data. The abnormality determination unit 102B compares the monitoring result of the communication monitoring unit 101 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S403, the process proceeds to step S404. If a normality is determined in step S403, the process proceeds to step S405.

[0085] If the abnormality determination unit 102A or 102B determines that an abnormality has occurred, then in step S404, the abnormality determination unit 102A or 102B performs abnormality processing. For example, the abnormality determination unit 102A or 102B cuts off communication that has been determined to be abnormal. After step 404 is completed, the abnormality detection processing ends.

[0086] In step S405, if the abnormality determination units 102A and 102B determine that the system is normal, the abnormality determination units 102A and 102B perform normal processing. Normal processing refers to normal control processing. After step 405 is completed, the abnormality detection processing ends.

[0087] In the above-described first embodiment, an example has been described in which the cyber-attack detection device according to the present disclosure is used as an in-vehicle electronic control device. However, the cyber-attack detection device according to the present disclosure is not limited to this example. For example, it can also be used as a device connected to a communication line that requires high security strength and a mechanism for early detection of abnormalities.

[0088] According to the first embodiment described above, the following effects can be obtained.

[0089] One aspect of the control device (cyber attack detection device) of the present disclosure includes a communication header monitoring unit (100) that monitors the header of received communication data, a communication monitoring unit (101) that monitors the payload of the communication data, an attack detection unit (103) that detects from the communication data signs of a DoS attack that will cause the communication monitoring unit to malfunction, an additional information request unit (104) that, when the signs are detected, identifies a sender from the communication data and requests the identified sender to add additional information to the header of communication data to be newly sent, and an update unit (105) that, when the signs are detected, makes an update decision to add the additional information as a monitoring item, and the communication header monitoring unit (100) adds the additional information as a monitoring item based on the update decision, and if the additional information is not added to the header of the newly received communication data or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal.

[0090] In this way, a sign of a DoS attack is detected, a request is made to the sender to add additional information to the header of the transmitted data, and monitoring is performed to determine whether the requested additional information has been added. Therefore, since a DoS attack is dealt with in advance before it is carried out, the control device (cyber-attack detection device) of the present disclosure can deal with DoS attacks.

[0091] According to one aspect of the control device (cyber-attack detection device) of the present disclosure, the communication header monitoring unit blocks communication with the sender when it determines that the newly received communication data is abnormal. Therefore, since there is no need for the communication monitoring unit, which monitors the payload, to process a large amount of received data, the processing load on the communication monitoring unit can be reduced.

[0092] Furthermore, according to one aspect of the control device (cyber-attack detection device) of the present disclosure, if a request to add additional information is made and no signs of a DoS attack are detected, a request to remove the additional information for which addition was requested is made. In this way, by dynamically adding additional information, it is possible to increase the possibility of preventing eavesdropping and spoofing attacks based on guesswork.

[0093] According to one aspect of the control device (cyber-attack detection device) of the present disclosure, the additional information is dynamic information that changes with each transmission or over time. By adding dynamically changing additional information, even if the data is intercepted and a replay attack is attempted, the attack can be prevented.

[0094] According to one aspect of the control device (cyber-attack detection device) of the present disclosure, the dynamic information is a timestamp or a counter value, and the additional information request unit randomly selects the timestamp or the counter value as the additional information, and when the counter value is selected, the counter value is counted up from a random value. This increases the possibility of preventing eavesdropping and spoofing attacks based on guesswork.

[0095] Furthermore, one aspect of the control device (cyber attack detection device) of the present disclosure further includes an encryption unit (109) that encrypts the dynamic information into encrypted information using a predetermined encryption key, the additional information request unit requests the sender to add information obtained by encrypting the dynamic information using the encryption key as the additional information, the update unit makes a further update decision to add the encrypted information as a monitoring item when the sign is detected, the communication header monitoring unit adds the encrypted information as a monitoring item based on the further update decision, and if the encrypted information has not been added to the header of newly received communication data or if the information added to the header of the newly received communication data does not match the encrypted information, determines that the newly received communication data is abnormal.

[0096] This configuration makes it possible to deal with DoS attacks using spoofed MAC addresses.

[0097] It is possible to combine the embodiments, and to modify or omit each embodiment as appropriate. [Industrial Applicability]

[0098] The cyber attack detection device disclosed herein can be used, for example, as an electronic control device installed in a vehicle. [Explanation of symbols]

[0099] 10 Control device (cyber attack detection device), 30 Network switch, 40 Hardware, 50 Hypervisor, 100 Communication header monitoring unit, 101 Communication monitoring unit, 102 (102A, 102B) Abnormality determination unit, 103 Attack detection unit, 104 Additional information request unit, 105 Update unit, 106 Communication bandwidth monitoring unit, 107 Resource monitoring unit, 108 Memory monitoring unit, 109 Encryption unit, 120 Attack determination unit, 401 Processor, 402 Memory.

Claims

1. a communication header monitoring unit that monitors the header of received communication data; a communication monitoring unit that monitors the payload of the communication data; an attack detection unit that detects, from the communication data, a sign of a DoS attack that may cause a malfunction of the communication monitoring unit; an additional information request unit that, when the sign is detected, identifies a sender from the communication data and requests the identified sender to add additional information to a header of communication data to be newly transmitted; an update unit that determines whether to add the additional information as a monitoring item when the symptom is detected; Equipped with the communication header monitoring unit adds the additional information as a monitoring item based on the update determination, and if the additional information is not added to the header of the newly received communication data, or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal; the additional information is dynamic information that changes with each transmission or over time; the dynamic information is a timestamp or a counter value; the additional information request unit randomly selects the timestamp or the counter value as the additional information, and when selecting the counter value, the counter value is counted up from a random value; Cyber ​​attack detection device.

2. When the communication header monitoring unit determines that the newly received communication data is abnormal, it cuts off communication with the sender. The cyber-attack detection device according to claim 1.

3. The attack detection unit a communication bandwidth monitoring unit that monitors the communication bandwidth usage of the communication bandwidth used by the communication monitoring unit; a resource monitoring unit that monitors the processing load of the communication monitoring unit; a memory monitoring unit that monitors the memory usage of the communication monitoring unit; an attack determination unit that determines whether the warning sign exists based on all or part of the communication bandwidth usage, the processing load, and the memory usage; Equipped with The cyber-attack detection device according to claim 1.

4. If the sign is not detected after the request is made, the additional information requesting unit issues a removal request to the identified sender to remove the additional information for which addition has been requested; The update unit makes a removal / update decision to remove the additional information from the monitoring items, the communication header monitoring unit removes the additional information added as a monitoring item based on the removal / update determination. The cyber-attack detection device according to claim 1.

5. the communication header monitoring unit determines that the newly received communication data is abnormal if the value of the dynamic information does not increase or exceeds a predetermined upper limit value; The cyber-attack detection device according to claim 1.

6. further comprising an encryption unit that encrypts the dynamic information into encrypted information using a predetermined encryption key; the additional information request unit requests the transmission source to add information obtained by encrypting the dynamic information using the encryption key as the additional information; the update unit, when the symptom is detected, makes a further update determination to add the encryption information as a monitoring item; the communication header monitoring unit adds the encryption information as a monitoring item based on the further update determination, and if the encryption information is not added to the header of the newly received communication data, or if the information added to the header of the newly received communication data does not match the encryption information, determines that the newly received communication data is abnormal. The cyber-attack detection device according to claim 1.

7. The cyber-attack detection device according to claim 6 , wherein the dynamic information is a timestamp or a counter value.

8. A cyber-attack detection method performed by a cyber-attack detection device including a communication header monitoring unit, a communication monitoring unit, an attack detection unit, an additional information request unit, and an update unit, a step of the communication header monitoring unit monitoring a header of received communication data; a step of the communication monitoring unit monitoring a payload of the communication data; the attack detection unit detecting, from the communication data, a sign of a DoS attack that will cause a malfunction of the communication monitoring unit; a step in which the additional information requesting unit, when detecting the sign, identifies a source of transmission from the communication data and requests the identified source of transmission to add additional information to a header of communication data to be newly transmitted; a step of the update unit making an update decision to add the additional information as a monitoring item when the sign is detected; Equipped with a step in which the communication header monitoring unit adds the additional information as a monitoring item based on the update determination, and determines that the newly received communication data is abnormal if the additional information is not added to the header of the newly received communication data or if the information added to the header of the newly received communication data does not match the additional information; Further provided with the additional information is dynamic information that changes with each transmission or over time; the dynamic information is a timestamp or a counter value; the additional information request unit randomly selects the timestamp or the counter value as the additional information, and when selecting the counter value, the counter value is counted up from a random value; Cyber ​​attack detection methods.

Images