Analytical device, analytical method, and program

Abstract

To provide an analytic device capable of improving analysis accuracy.SOLUTION: A first analytic device 120 for transmitting report information based on an analysis result of a log on a vehicle V is provided with: an acquisition unit 121 acquiring a first anonymized log being a log including first anonymized data of the vehicle V; a link determination unit 125b carrying out link determination of a process determining second anonymized data corresponding to the first anonymized data as specific second anonymized data from the second anonymized data included in each of a plurality of second anonymized logs which a second system 200 has; a system cooperation unit 125c acquiring the second anonymized log including the specific second anonymized data as second anonymized logs to be integrated from the second system 200; and an integrated analysis unit 125d carrying out analysis on a log group including the first anonymized log and the second anonymized log to be integrated as integrated analysis.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an analysis device that analyzes logs. [Background technology]

[0002] For example, Patent Document 1 discloses a log analysis device as an analysis device. This log analysis device outputs an alert when a log message of a monitoring target satisfies a predetermined condition, and extracts related logs from the log messages that are related to the alert. The log analysis device then outputs information according to the related logs for each time period. This makes it possible to narrow down the logs that need to be checked, even when there is a large number of logs. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7078114 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the log analysis device of Patent Document 1 narrows down the logs to be analyzed, making it difficult to improve the accuracy of the analysis. In other words, the log analysis device of Patent Document 1 integrates and analyzes extracted related logs, but these related logs are narrowed down and many logs are not used. For example, integrating and analyzing logs obtained by two or more systems may increase the possibility of improving the accuracy of the analysis, rather than each system collecting and analyzing logs from the monitored vehicle according to its purpose. However, if each system anonymizes the logs in a different manner, it is difficult to integrate the logs of the monitored vehicle. Therefore, many logs cannot be used for analysis, making it difficult to improve the accuracy of the analysis.

[0005] Therefore, the present disclosure provides an analysis device and the like that can improve the accuracy of analysis. [Means for solving the problem]

[0006] An analysis device according to one embodiment of the present disclosure is an analysis device that transmits report information based on analysis results of logs related to a monitored device, and includes: an acquisition unit that acquires a first anonymized log, which is the log including first anonymized data of the monitored device; a linking resolution unit that performs linking resolution, which is a process of determining, from the second anonymized data included in each of a plurality of second anonymized logs held by a linked monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; a system integration unit that acquires the second anonymized log including the specific second anonymized data from the linked monitoring system as a second anonymized log to be integrated; and an integration analysis unit that performs an integrated analysis of a group of logs including the first anonymized log and the second anonymized log to be integrated.

[0007] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of the system, the method, the integrated circuit, the computer program, and the recording medium. The recording medium may also be a non-transitory recording medium. [Effects of the Invention]

[0008] The analytical device of the present disclosure can improve analytical accuracy.

[0009] Further advantages and effects of one aspect of the present disclosure will become apparent from the specification and drawings. Such advantages and / or effects are provided by the configurations described in the embodiments and the specification and drawings, but not all of the configurations are necessarily required. [Brief explanation of the drawings]

[0010] [Figure 1]FIG. 1 is a diagram showing the overall configuration of an analysis system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of a first analyzer according to the embodiment. [Figure 3] FIG. 3 is a diagram for explaining the processing operations related to the integrated processing unit among the processing of the first system and the second system in the embodiment. [Figure 4] FIG. 4 is a flowchart showing an example of the processing operation of the first analyzer according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating processing operations related to the integrated processing unit in the processing of the first system and the second system in the first modification of the embodiment. [Figure 6] FIG. 6 is a flowchart showing an example of a processing operation of the first analyzer in the first modification of the embodiment. [Figure 7] FIG. 7 is a diagram illustrating the processing operations of the integrated processing unit in the processing of the first system and the second system in the second modification of the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of re-anonymization in the second modification of the embodiment. [Figure 9] FIG. 9 is a flowchart showing an example of the processing operation of the first analyzer in the second modification of the embodiment. [Figure 10] FIG. 10 is a diagram for explaining the processing operation related to the second analyzer in the processing of the first system and the second system in the third modification of the embodiment. [Figure 11] FIG. 11 is a flowchart showing an example of the processing operation of the first analyzer in the third modification of the embodiment. [Figure 12] FIG. 12 is a diagram illustrating the processing operations of the integrated processing unit in the processing of the first system and the second system in the fourth modification of the embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of the linking information according to the fourth modification of the embodiment. [Figure 14]FIG. 14 is a flowchart showing an example of the processing operation of the first analyzer in the fourth modification of the embodiment. [Figure 15] FIG. 15 is a flowchart showing an example of the processing operation of the second analyzer in the fourth modification of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] An analysis device according to a first aspect of the present disclosure transmits report information based on analysis results of logs related to a monitored device, and includes: an acquisition unit that acquires a first anonymized log, the log including first anonymized data of the monitored device; a linking unit that performs linking, which is a process of determining, from second anonymized data included in each of a plurality of second anonymized logs held by a linked monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; a system integration unit that acquires the second anonymized log including the specific second anonymized data from the linked monitoring system as a second anonymized log to be integrated; and an integration analysis unit that performs an integrated analysis of a group of logs including the first anonymized log and the second anonymized log to be integrated. For example, the system including the analysis device and the linked monitoring system each acquire logs related to one or more devices and anonymize the logs in different manners. An example of a device is a vehicle. In addition, when anonymizing a log, identification data contained in the log, such as a VIN (Vehicle Identification Number) or an IP (Internet Protocol) address, used to identify a device or user recorded in the log is anonymized into anonymized data. In a system having an analysis device, logs related to a monitored device are managed as a first anonymized log including first anonymized data. In a linked monitoring system, logs related to each device, including a monitored device, are managed as a second anonymized log including second anonymized data.

[0012] Here, in the analysis device according to the first aspect of the present disclosure, second anonymized data corresponding to the first anonymized data is determined as the specific second anonymized data through linking resolution. That is, second anonymized data corresponding to the same monitoring target device as the first anonymized data is determined as the specific second anonymized data and linked to the first anonymized data. Therefore, a second anonymized log related to the same monitoring target device as the first anonymized log can be acquired from the linked monitoring system as the second anonymized log to be integrated. As a result, an integrated analysis can be performed on the first anonymized log and the second anonymized log related to the same monitoring target device, thereby improving the analytical accuracy compared to analysis using only the first anonymized log. That is, even if the system including the analysis device and the linked monitoring system anonymize logs in different ways, the logs related to the same monitoring target device can be integrated and analyzed, thereby improving the analytical accuracy.

[0013] In addition, an analysis device according to a second aspect dependent on the first aspect may further include an integration determination unit that determines whether the integrated analysis is necessary, and the linking resolution unit may perform the linking resolution when the integration determination unit determines that the integrated analysis is necessary.

[0014] As a result, linking resolution is performed when it is determined that integrated analysis is necessary, so linking resolution can be prevented from being performed even when integrated analysis is not necessary, thereby reducing the processing burden. Also, when integrated analysis is not necessary, analysis of the first anonymized log can be performed without using the second anonymized log, thereby reducing the processing burden. Note that whether integrated analysis is necessary may be determined based on the analysis results of the first anonymized log.

[0015] In addition, an analysis device according to a third aspect dependent on the first or second aspect may further include a destination determination unit that determines a destination based on the results of the integrated analysis, and a transmission unit that transmits the report information indicating the results of the integrated analysis to the destination determined by the destination determination unit.

[0016] This allows the report information to be sent to a destination according to the results of the integrated analysis, making it possible to notify the appropriate destination of the results of the integrated analysis. In other words, depending on the scope of impact of the status of the monitored device, the results of the integrated analysis can be notified to, for example, the Security Incident Response Team (SIRT) that corresponds to that scope.

[0017] In addition, in an analysis device according to a fourth aspect dependent on any one of the first to third aspects, the system cooperation unit may acquire the second anonymized log to be integrated from one or more second anonymized logs among the plurality of second anonymized logs that correspond to at least one of a type and a time period determined in accordance with the first anonymized log. Alternatively, in an analysis device according to a fifth aspect dependent on any one of the first to third aspects, the system cooperation unit may acquire the second anonymized log as the second anonymized log to be integrated by specifying, from the plurality of second anonymized logs, a second anonymized log that matches a condition determined in accordance with the first anonymized log, using at least one of a type and a time period.

[0018] This allows the types and time periods of the acquired second anonymized logs to be integrated to be limited to the types and time periods determined according to the first anonymized logs. For example, if the monitored device is a vehicle, second anonymized logs to be integrated of a type related to traffic congestion prediction or second anonymized logs to be integrated corresponding to traffic congestion time periods can be acquired. As a result, because the types and time periods of the second anonymized logs to be integrated are limited, acquisition of second anonymized logs that contribute little to the integrated analysis can be suppressed, thereby realizing efficient integrated analysis.

[0019] In addition, in an analysis device according to a fifth aspect that is dependent on any one of the first to fourth aspects, the system collaboration unit may further anonymize the specific second anonymized data included in the acquired second anonymized log to be integrated.

[0020] That is, the second anonymized logs to be integrated or the specific second anonymized data are re-anonymized. This increases the confidentiality of those logs and data. That is, it is possible to prevent the linked monitoring system from recognizing the device corresponding to the log from the re-anonymized logs or data. As a result, it is possible to increase the security of the second anonymized logs to be integrated.

[0021] In addition, in an analysis device according to a sixth aspect that is dependent on any one of the first to fifth aspects, the system collaboration unit may further transmit the first anonymized log to the associated monitoring system in response to a request from the associated monitoring system.

[0022] This allows not only the analysis device but also the linked monitoring system to acquire the first anonymized log and the second anonymized log corresponding to the same monitored device and perform integrated analysis. In other words, it is possible to realize mutual cooperation between the system having the analysis device and the linked monitoring system, and to perform effective analysis of the logs.

[0023] In addition, in the analysis device according to a seventh aspect which is dependent on any one of the first to sixth aspects, the linking resolution unit may further store linking information indicating an association between the first anonymized data and the specified second anonymized data in a recording medium, and when repeatedly performing the linking resolution for the first anonymized data, may perform the linking resolution by referring to the linking information stored in the recording medium.

[0024] This allows the analysis device to resolve the linking by referencing the linking information when the linking is repeatedly executed, eliminating the need for the analysis device to communicate with other devices to resolve the linking, thereby enabling efficient linking resolution and integrated analysis.

[0025] In addition, in an analysis device according to an eighth aspect that is dependent on the seventh aspect, the linking resolution unit may further set an expiration date for the linking information, and if the timing of repeatedly executing the linking resolution for the first anonymized data has not passed the expiration date, perform the linking resolution by referring to the linking information stored on the recording medium.

[0026] As a result, an expiration date is set for the linking information, and the correspondence between the first anonymized data and the second anonymized data is guaranteed until the expiration date, and the correspondence can be changed after the expiration date. In other words, after the expiration date, the anonymization modes of the system having the analysis device and the linked monitoring system can be changed. As a result, the flexibility of the overall processing operations of these systems can be increased.

[0027] In addition, in a ninth aspect of the analysis device that is dependent on the seventh or eighth aspect, the system collaboration unit may further transmit the linking information stored in the recording medium to the collaboration monitoring system.

[0028] This allows the linking information to be sent to the partner monitoring system, which can then use the linking information to resolve the linking. As a result, the partner monitoring system can also perform integrated analysis, just like the analysis device.

[0029] In addition, in an analysis device according to a tenth aspect that is dependent on the ninth aspect, the system collaboration unit may further transmit the updated linking information to the partner monitoring system when the linking information stored in the recording medium is updated by the linking resolution unit.

[0030] This allows the analysis device and the associated monitoring system to synchronously manage the common linking information, thereby improving the efficiency of the integrated analysis performed by the analysis device and the associated monitoring system.

[0031] In addition, in an analysis device according to an eleventh aspect that is dependent on any one of the first to tenth aspects, the acquisition unit may acquire the first anonymized log from a first server; when the first server acquires the first log related to the monitoring target device, the first server may anonymize first identification data of the monitoring target device included in the first log to generate the first anonymized log including the first anonymized data; when the second server of the linked monitoring system acquires a second log related to the monitoring target device, anonymize second identification data included in the second log to generate the second anonymized log including the second anonymized data; and the linking resolution unit may transmit the first anonymized data to the first server and perform the linking resolution by querying the second server via the first server for second anonymized data corresponding to the first anonymized data.

[0032] As a result, the first server and the second server each perform anonymization, and the linking is resolved by an inquiry to the second server via the first server, so that accurate linking can be resolved.

[0033] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0034] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as optional components.

[0035] In addition, each drawing is a schematic diagram and is not necessarily an exact illustration. In addition, the same components are denoted by the same reference numerals in each drawing.

[0036] (Embodiment) FIG. 1 is a diagram showing the overall configuration of an analysis system according to this embodiment.

[0037] The analysis system 1 in this embodiment is a system that analyzes and monitors processing operations in a vehicle V, which is a device to be monitored, and includes the vehicle V, a base station R, a first system 100, and a second system 200. Note that the base station R does not necessarily have to be included in the analysis system 1.

[0038] The vehicle V is equipped with equipment that receives telematics services, such as equipment used in a car navigation system, and performs vehicle control such as steering and vehicle speed. The vehicle V then transmits multiple logs to the first system 100 and the second system 200 via the base station R. These logs include logs related to telematics and logs related to vehicle control. Each log also includes privacy information. The privacy information is, for example, identification data for identifying the vehicle V, such as a VIN (Vehicle Identification Number) and an IP (Internet Protocol) address. These logs may also be referred to as vehicle data.

[0039] The first system 100 is also called, for example, a vehicle monitoring system, and monitors vehicle control of each vehicle including the vehicle V. The first system 100 includes a first server 110 and a first analysis device 120.

[0040] The first server 110, which is also referred to as a vehicle log server, receives a first log corresponding to the analysis purpose of the first system 100 from among logs transmitted from each vehicle, including the vehicle V. For example, the first log is a log related to vehicle control of the vehicle V. The first server 110 generates a first anonymized log by anonymizing the first log and outputs the first anonymized log to the first analysis device 120. Specifically, in anonymizing the first log, the first server 110 generates first anonymized data by anonymizing first identification data included in the first log. The first anonymized log can be said to be a first log that includes the first anonymized data instead of the first identification data. The first identification data is, for example, a VIN for identifying the vehicle V. Note that in this embodiment, since anonymization is performed, devices other than the first server 110 cannot identify the vehicle V from the first anonymized data and the first anonymized log. Such anonymization is performed to protect privacy information as required by the General Data Protection Regulation (GDPR) and the like.

[0041] The first analysis device 120 is a device used in a SOC (Security Operation Center) for vehicle control, and analyzes one or more first anonymized logs upon acquiring the first anonymized logs from the first server 110. For example, the first analysis device 120 analyzes the first anonymized logs to determine whether or not there has been an attack on a vehicle corresponding to the first anonymized data.

[0042] The second system 200 is also called, for example, an IT (Information Technology) system, and monitors telematics services of each vehicle including the vehicle V. Such second system 200 includes a second server 210 and a second analysis device 220.

[0043] The second server 210, which may also be referred to as a telematics server, receives second logs corresponding to the analysis purpose of the second system 200 from logs transmitted from each vehicle, including the vehicle V. For example, the second logs may be logs related to telematics, such as a car navigation system. The second server 210 generates second anonymized logs by anonymizing the second logs and outputs the second anonymized logs to the second analysis device 220. Specifically, in anonymizing the second logs, the second server 210 generates second anonymized data by anonymizing second identification data included in the second logs. The second anonymized logs can be considered as second logs that include the second anonymized data instead of the second identification data. The second identification data may be, for example, an IP address for identifying the vehicle V. Note that in this embodiment, because anonymization is performed, devices other than the second server 210 cannot identify the vehicle V from the second anonymized data and the second anonymized logs. Similar to the first server 110, such anonymization is performed to protect privacy information as required by GDPR and other regulations.

[0044] The second analysis device 220 is a device used in an IT SOC, and analyzes one or more second anonymized logs upon acquiring the second anonymized logs from the second server 210. For example, the second analysis device 220 analyzes the second anonymized logs to predict congestion on a road on which a vehicle corresponding to the second anonymized data is scheduled to travel.

[0045] The first log and the second log each include first identification data and second identification data, but the first anonymized log may or may not include data obtained by anonymizing the second identification data. Similarly, the second anonymized log may or may not include data obtained by anonymizing the first identification data. The first server 110 and the second server 210 are devices operated by, for example, a vehicle manufacturer, and the first analysis device 120 and the second analysis device 220 are devices operated by an organization that provides a service.

[0046] Here, when an integrated analysis is required, the first analysis device 120 in this embodiment acquires one or more second anonymized logs of the vehicle V from the second analysis device 220 and integrates the one or more second anonymized logs of the vehicle V into one or more first anonymized logs of the vehicle V. Then, the first analysis device 120 performs an integrated analysis of the integrated one or more first anonymized logs and one or more second anonymized logs. When performing this integrated analysis, the first analysis device 120 also performs linking resolution, which is a process for linking the first anonymized log and the second anonymized log related to the vehicle V.

[0047] In this embodiment, the first server 110 and the second server 210 acquire the log of the vehicle V from the vehicle V via the base station R, but the log of the vehicle V may also be acquired from a device or server other than the vehicle V. In other words, the log of the vehicle V in this embodiment is a log related to the vehicle V and is not limited to a log generated by the vehicle V or a log obtained from the vehicle V. Therefore, the log of the vehicle V may include a log generated by another device or server, or a log acquired by another device or server, such as a communication log between the vehicle V and an external network.

[0048] FIG. 2 is a block diagram showing an example of the functional configuration of the first analyzer 120 in this embodiment.

[0049] The first analysis device 120 in this embodiment is a device that transmits report information based on the analysis results of a log related to a monitored device, a vehicle V. The first analysis device 120 includes an acquisition unit 121, a log analysis unit 122, a destination determination unit 123, a transmission unit 124, an integration processing unit 125, a control unit 126, a storage unit 127, and a communication unit 128.

[0050] The communication unit 128 communicates with each of the first server 110 and the second analysis device 220 via a telecommunications line such as the Internet.

[0051] The acquisition unit 121 acquires the first anonymized log of the vehicle V from the first server 110 via the communication unit 128. That is, the acquisition unit 121 acquires the first anonymized log, which is a log including the first anonymized data of the vehicle V, which is a monitored device, from the first server 110. Then, the acquisition unit 121 stores the first anonymized log in the storage unit 127.

[0052] The log analysis unit 122 analyzes one or more first anonymized logs acquired by the acquisition unit 121 and stored in the storage unit 127 .

[0053] The destination determination unit 123 determines a destination of report information indicating an analysis result of one or more logs of the vehicle V. In other words, the destination determination unit 123 determines a destination of report information indicating a result of analysis of one or more first anonymized logs by the log analysis unit 122. Alternatively, the destination determination unit 123 determines a destination of report information indicating a result of integrated analysis by the integration processing unit 125. For example, the destination determination unit 123 determines a destination of the report information according to the result of the integrated analysis. The destination is, for example, at least one SIRT among multiple types of SIRTs (Security Incident Response Teams). Specifically, the multiple types of SIRTs include a first SIRT that is a SIRT responsible for vehicle control and a second SIRT that is a SIRT responsible for vehicle control and telematics.

[0054] The transmitter 124 transmits the report information via the communication unit 128 to the destination determined by the destination determination unit 123. For example, when an integrated analysis is performed, the transmitter 124 transmits the report information indicating the results of the integrated analysis to a destination according to the results of the integrated analysis, that is, to the destination determined by the destination determination unit 123. The destination is the SIRT described above, and more specifically, is a device or system owned by the SIRT.

[0055] The integration processing unit 125 performs the above-mentioned integration analysis. Specifically, the integration processing unit 125 includes an integration determination unit 125a, a linking resolution unit 125b, a system cooperation unit 125c, and an integration analysis unit 125d.

[0056] The integrated determination unit 125a determines whether or not an integrated analysis is necessary based on the analysis result by the log analysis unit 122, that is, the analysis result of one or more first anonymized logs.

[0057] The linking resolution unit 125b performs linking resolution when the integration determination unit 125a determines that integrated analysis is necessary. Linking resolution is a process for linking first anonymized logs and second anonymized logs related to the same vehicle V. Specifically, the second analysis device 220 of the second system 200 has a plurality of second anonymized logs obtained from each vehicle, including the vehicle V. These second anonymized logs include not only the second anonymized log of the vehicle V but also second anonymized logs of other vehicles. Therefore, the linking resolution unit 125b performs linking resolution to link a second anonymized log, which is a log of the vehicle V like the first anonymized log, to the first anonymized log among the plurality of second anonymized logs. In other words, the linking resolution unit 125b performs linking resolution, which is a process for determining, as specific second anonymized data, second anonymized data corresponding to first anonymized data from the second anonymized data included in each of the plurality of second anonymized logs held by the second system 200, which is the associated monitoring system. This links the first anonymized data to the specified second anonymized data, and as a result, links the first anonymized log including the first anonymized data to the second anonymized log including the specified second anonymized data.

[0058] The system cooperation unit 125c requests and acquires a second anonymized log linked to the first anonymized log from the second analysis device 220 via the communication unit 128. The second anonymized log is a log used for integration into the first anonymized log. That is, the system cooperation unit 125c acquires the second anonymized log including the above-mentioned specific second anonymized data from the second system 200 (i.e., the cooperation destination monitoring system) as the second anonymized log to be integrated.

[0059] The integration analysis unit 125d integrates one or more first anonymized logs and one or more second anonymized logs to be integrated, and performs an analysis on the integrated one or more first anonymized logs and one or more second anonymized logs to be integrated. In other words, the integration analysis unit 125d performs an analysis of a log group including the first anonymized logs and the second anonymized logs to be integrated as an integrated analysis.

[0060] The control unit 126 controls each component included in the first analysis device 120. That is, the control unit 126 controls the acquisition unit 121, the log analysis unit 122, the destination determination unit 123, the transmission unit 124, the integration processing unit 125, the storage unit 127, and the communication unit 128.

[0061] The storage unit 127 is a recording medium for storing data, information, etc. generated by the above-mentioned components. For example, the storage unit 127 is a hard disk drive, a RAM (Random Access Memory), a ROM (Read Only Memory), or a semiconductor memory. Note that such storage unit 127 may be volatile or non-volatile.

[0062] FIG. 3 is a diagram for explaining the processing operations related to the integrated processing unit 125 among the processing of the first system 100 and the second system 200. As shown in FIG.

[0063] When the integration determination unit 125a determines that an integrated analysis is necessary, the linking resolution unit 125b of the integration processing unit 125 makes an inquiry to the second server 210 from the communication unit 128 via the first server 110, as in process (1) in Fig. 3. The inquiry is for second anonymized data corresponding to the first anonymized data. At this time, the linking resolution unit 125b transmits the first anonymized data to the first server 110 via the communication unit 128.

[0064] As shown in process (2) of Fig. 3, when the first server 110 acquires the first anonymized data from the linking resolution unit 125b, it identifies the first identification data corresponding to the first anonymized data. Note that when the first server 110 previously transmits the above-described first log to the first analysis device 120, the first server 110 generates the first anonymized data by anonymizing the first identification data included in the first log, and therefore can identify the first identification data corresponding to the first anonymized data. Then, as shown in process (3) of Fig. 3, the first server 110 transmits the identified first identification data to the second server 210 and queries the second server 210 for the second anonymized data corresponding to the first identification data.

[0065] The second server 210 acquires the first identification data from the first server 110 and, upon receiving the above-mentioned inquiry, identifies the second anonymized data corresponding to the first identification data, as in process (4) of FIG. 3 . Note that, when the second server 210 previously transmits the above-mentioned second log to the second analysis device 220, the second server 210 acquires the second log including the first identification data and the second identification data and generates the second anonymized data by anonymizing the second identification data. Therefore, the second server 210 can identify the second anonymized data corresponding to the first identification data. Then, as in process (5) of FIG. 3 , the second server 210 responds to the inquiry from the first server 110 by transmitting the identified second anonymized data to the first server 110. Note that the second server 210 may separately store data for identifying the second identification data corresponding to the first identification data, and may identify the second identification data corresponding to the first identification data and further identify the second anonymized data corresponding to the second identification data.

[0066] When the first server 110 receives the second anonymized data from the second server 210, it transmits the second anonymized data to the first analysis device 120, as in process (6) of Fig. 3. As a result, the linking resolution unit 125b receives the second anonymized data as a response to the inquiry in process (1) of Fig. 3, for example, via the communication unit 128. This second anonymized data is data corresponding to the first anonymized data and is data for identifying the same vehicle V as the first anonymized data. The linking resolution unit 125b outputs the second anonymized data to the system collaboration unit 125c.

[0067] When the system collaboration unit 125c acquires the second anonymized data from the linking resolution unit 125b, it transmits the second anonymized data to the second analysis device 220, as in process (7) of Figure 3, thereby requesting a second anonymized log including the second anonymized data from the second analysis device 220.

[0068] When the second analysis device 220 receives the second anonymized data from the system collaboration unit 125c and further receives the above-mentioned request, it transmits the second anonymized log including the second anonymized data to the first analysis device 120 as a second anonymized log to be integrated, as shown in process (8) of Figure 3.

[0069] When the system cooperation unit 125c of the first analysis device 120 acquires the second anonymized log to be integrated from the second analysis device 220 via the communication unit 128, the system cooperation unit 125c stores the second anonymized log to be integrated in the storage unit 127.

[0070] Then, the integrated analysis unit 125d of the first analysis device 120 generates a log group including one or more first anonymized logs and one or more second anonymized logs to be integrated by integrating one or more first anonymized logs and one or more second anonymized logs to be integrated, which are stored in the storage unit 127. Furthermore, the integrated analysis unit 125d performs an integrated analysis of the log group, generates report information indicating the results of the integrated analysis, and stores the report information in the storage unit 127. This report information is transmitted via the transmission unit 124 to the destination determined by the destination determination unit 123.

[0071] As described above, in this embodiment, the first analysis device 120 performs linking resolution by making an inquiry. Specifically, in this embodiment, the acquisition unit 121 of the first analysis device 120 acquires a first anonymized log from the vehicle V via the first server 110 and the communication unit 128. The vehicle V is a monitored device. When the first server 110 acquires the first log related to the vehicle V, the first server 110 generates a first anonymized log including the first anonymized data by anonymizing the first identification data of the vehicle V included in the first log. When the second server 210 of the linked monitoring system, which is the second system 200, acquires the second log related to the vehicle V, the second server 210 generates a second anonymized log including the second anonymized data by anonymizing the second identification data included in the second log. Then, the linking resolution unit 125b of the first analysis device 120 transmits the first anonymized data to the first server 110 via the communication unit 128. Furthermore, the link resolving unit 125b performs link resolving by making an inquiry to the second server 210 via the communication unit 128 and the first server 110 about the second anonymized data corresponding to the first anonymized data.

[0072] As a result, the first server 110 and the second server 210 each perform anonymization, and the linking is resolved by an inquiry to the second server 210 via the first server 110, so that accurate linking can be resolved.

[0073] FIG. 4 is a flowchart showing an example of the processing operation of the first analyzer 120 in this embodiment.

[0074] First, the acquisition unit 121 of the first analysis device 120 acquires one or more first anonymized logs from the first server 110 (step S1). Then, the log analysis unit 122 analyzes the one or more first anonymized logs (step S2).

[0075] The integration determination unit 125a of the integration processing unit 125 determines whether an integrated analysis is necessary based on the analysis result of the one or more first anonymized logs (step S3). For example, the integration determination unit 125a determines that an integrated analysis is necessary when the analysis result indicates an attack related to a network external to the vehicle V. An example of such an attack is an attack on the vehicle V via the monitored Out-Car system. Another example of such an attack is an attack from the vehicle V to another device via the monitored Out-Car system. Another example of such an attack may be an attack in which the vehicle V is the source or destination of the attack from the perspective of the Out-Car system.

[0076] Here, when the integration determination unit 125a determines that an integrated analysis is necessary (Yes in step S3), the linking resolution unit 125b makes an inquiry using the first anonymized data (step S4). Note that in step S4, the linking resolution unit 125b may use information that serves as a parameter of the anonymization process in addition to the first anonymized data. That is, the information may be used in addition to the first anonymized data, or the information may be used instead of the first anonymized data. The anonymization process is a process of obtaining the first anonymized data by anonymizing the first identification data (as a specific example, the VIN). Such information that serves as a parameter of the anonymization process may be time information indicating the time when the first anonymized log including the first anonymized data was generated, or may be location information indicating the location of the vehicle V at that time.

[0077] On the other hand, if the integration determination unit 125a determines that the integrated analysis is not necessary (No in step S3), the log analysis unit 122 stores the analysis results of the one or more first anonymized logs obtained in the processing of step S2 in the storage unit 127 (step S9). That is, the log analysis unit 122 stores report information indicating the analysis results in the storage unit 127.

[0078] After the process of step S4, the link resolving unit 125b receives second anonymized data corresponding to the first anonymized data (that is, identified second anonymized data) as a result of the inquiry that is the process of step S4 (step S5).

[0079] The system cooperation unit 125c acquires the second anonymized log including the second anonymized data received in step S5 from the second analysis device 220 as the second anonymized log to be integrated (step S6). The second anonymized log to be integrated is stored in the storage unit 127.

[0080] Next, the integrated analysis unit 125d generates a log group by integrating one or more first anonymized logs and one or more second anonymized logs to be integrated, and performs an integrated analysis of the log group (step S7).The integrated analysis unit 125d then stores the result of the integrated analysis obtained by the processing of step S7 in the storage unit 127 (step S8).That is, the integrated analysis unit 125d stores report information indicating the result of the integrated analysis in the storage unit 127.

[0081] When the report information is stored in the storage unit 127 by the process of step S8 or step S9, the destination determination unit 123 determines whether the destination of the report information is the first SIRT (step S10). Specifically, the destination determination unit 123 determines whether the analysis result indicated by the report information is related only to the vehicle or related not only to the vehicle but also to IT or telematics. If the destination determination unit 123 determines that the analysis result is related only to the vehicle, it determines the first SIRT as the destination of the report information. If the analysis result is related to the vehicle and IT or telematics, it determines the second SIRT as the destination of the report information. In other words, depending on the scope of the impact of the status of the monitored device, which is the vehicle V, a SIRT corresponding to that scope is determined as the destination. If the scope of the impact is limited to the vehicle, the first SIRT responsible for the limited scope is determined as the destination. If the scope of the impact is not limited to the vehicle but extends to IT or telematics, the second SIRT responsible for the wider scope is determined as the destination.

[0082] If the destination determination unit 123 determines that the destination of the report information is the first SIRT (Yes in step S10), the transmitter 124 transmits the report information to the first SIRT via the communication unit 128 (step S11). On the other hand, if the destination determination unit 123 determines that the destination of the report information is not the first SIRT (No in step S10), the transmitter 124 transmits the report information to the second SIRT via the communication unit 128 (step S12).

[0083] As described above, in the first analysis device 120 according to the present embodiment, the second anonymized data corresponding to the first anonymized data is determined as the specific second anonymized data through the linking solution. That is, the second anonymized data corresponding to the same vehicle V as the first anonymized data is determined as the specific second anonymized data and linked to the first anonymized data. Therefore, the second anonymized log related to the same vehicle V as the first anonymized log can be acquired from the second system 200 as the second anonymized log to be integrated. As a result, an integrated analysis can be performed on the first anonymized log and the second anonymized log to be integrated related to the same vehicle V, thereby improving the analytical accuracy compared to an analysis using only the first anonymized log. That is, even if the first system 100 and the second system 200 anonymize the logs in different ways, the logs related to the same vehicle V can be integrated and analyzed, thereby improving the analytical accuracy.

[0084] Furthermore, in this embodiment, since linking is resolved when it is determined that integrated analysis is necessary, it is possible to prevent linking from being resolved even when integrated analysis is not necessary, thereby reducing the processing load. Furthermore, when integrated analysis is not necessary, it is possible to analyze the first anonymized log without using the second anonymized log, thereby reducing the processing load.

[0085] In addition, in this embodiment, since the report information is sent to a destination according to the result of the integrated analysis, the result of the integrated analysis can be notified to an appropriate destination. That is, depending on the range of the impact of the situation of the vehicle V, the result of the integrated analysis can be notified to the SIRT corresponding to that range.

[0086] In this embodiment, in step S10, destination determination unit 123 determines whether the report information should be sent to the first SIRT or the second SIRT, but it may determine both the first SIRT and the second SIRT as destinations depending on the analysis results indicated in the report information. In this case, transmitter 124 sends the report information to both the first SIRT and the second SIRT.

[0087] (Variation 1) In the above embodiment, as in process (7) in Fig. 3 , the system cooperation unit 125c transmits the second anonymized data to the second analysis device 220, thereby requesting a second anonymized log including the second anonymized data from the second analysis device 220. At this time, in this modification, the system cooperation unit 125c transmits not only the second anonymized data but also the log condition information to the second analysis device 220.

[0088] FIG. 5 is a diagram for explaining the processing operations related to the integrated processing unit 125 among the processing of the first system 100 and the second system 200. In FIG.

[0089] In this modification, the first system 100 and the second system 200 also execute processes (1) to (6) in FIG. 5, similar to processes (1) to (6) in FIG. 3. Then, when the system cooperation unit 125c acquires the second anonymized data from the first server 110 via the communication unit 128 in process (6) in FIG. 5, the system cooperation unit 125c determines the log condition information as in process (6.1) in FIG. 5. The log condition information is information indicating the conditions of the second anonymized logs. For example, the system cooperation unit 125c may determine the log condition information based on the analysis results of one or more first anonymized logs by the log analysis unit 122. Specifically, the conditions indicated by the log condition information may be the type of the second anonymized logs to be integrated (hereinafter also referred to as the log type) or the recording time period of the second anonymized logs to be integrated. Furthermore, the log condition information may indicate a timestamp as a condition.

[0090] 5, the system cooperation unit 125c transmits not only the second anonymized data but also the log condition information to the second analysis device 220 via the communication unit 128. That is, the system cooperation unit 125c requests the second analysis device 220 to provide a second anonymized log that includes the second anonymized data and satisfies the condition indicated by the log condition information. As a result, the system cooperation unit 125c acquires the second anonymized log in response to the request from the second analysis device 220 via the communication unit 128 as the second anonymized log to be integrated, as shown in process (8) in FIG.

[0091] FIG. 6 is a flowchart showing an example of the processing operation of the first analyzer 120 in this modified example.

[0092] The first analysis device 120 in this modification performs the processes of steps S1 to S5, similar to the flowchart shown in Fig. 4 of the above embodiment. After the process of step S5, the system cooperation unit 125c determines log condition information (step S21). Then, the system cooperation unit 125c acquires, from the second analysis device 220, the second anonymized log that includes the second anonymized data received in step S5 and satisfies the condition indicated by the log condition information, as the second anonymized log to be integrated (step S6a).

[0093] Then, the first analyzer 120 executes the processes of steps S7 to S12 in the same manner as in the flowchart shown in FIG. 4 of the above embodiment.

[0094] As described above, in this modification, the system cooperation unit 125c acquires a second anonymized log to be integrated from one or more second anonymized logs that satisfy the condition determined in accordance with the first anonymized log, among the plurality of second anonymized logs held by the second analysis device 220. Specifically, the system cooperation unit 125c acquires a second anonymized log to be integrated from one or more second anonymized logs that correspond to at least one of the log type and the time period determined in accordance with the first anonymized log, among the plurality of second anonymized logs. In other words, the system cooperation unit 125c acquires a second anonymized log that matches the condition determined in accordance with the first anonymized log as the second anonymized log to be integrated by specifying the second anonymized log from the plurality of second anonymized logs using at least one of the type and the time period.

[0095] This allows the log types and time periods of the acquired second anonymized logs to be integrated to be limited to the types and time periods determined according to the first anonymized logs. For example, it is possible to acquire second anonymized logs to be integrated of log types related to traffic congestion predictions, or second anonymized logs to be integrated corresponding to traffic congestion time periods. As a result, since the log types and time periods of the second anonymized logs to be integrated are limited, it is possible to suppress the acquisition of second anonymized logs that contribute little to the integrated analysis, thereby realizing efficient integrated analysis.

[0096] In this modification, in step S10, the destination determination unit 123 determines whether the report information should be sent to the first SIRT or the second SIRT, but it may determine both the first SIRT and the second SIRT as destinations depending on the analysis results indicated in the report information. In this case, the transmitter 124 sends the report information to both the first SIRT and the second SIRT.

[0097] (Variation 2) In this modification, the first analysis device 120 further anonymizes the second anonymized log to be integrated. In other words, the first analysis device 120 re-anonymizes the second anonymized log to be integrated. That is, the second log to be integrated is anonymized twice. This improves the security of the second anonymized log to be integrated.

[0098] FIG. 7 is a diagram for explaining the processing operations related to the integrated processing unit 125 among the processing of the first system 100 and the second system 200. In FIG.

[0099] In this modification, the first system 100 and the second system 200 also execute processes (1) to (8) in FIG. 7 , similar to processes (1) to (8) in FIG. 3 . Then, when the system cooperation unit 125c acquires the second anonymized log to be integrated from the second analysis device 220 in process (8) in FIG. 7 , it re-anonymizes the second anonymized log to be integrated, as in process (9) in FIG. 7 . That is, the system cooperation unit 125c further anonymizes the second anonymized data (i.e., the specific second anonymized data) included in the second anonymized log to be integrated. In other words, it re-anonymizes the second anonymized data. As a result, the system cooperation unit 125c generates a second anonymized log to be integrated that includes the re-anonymized second anonymized data. The second anonymized data is data obtained by anonymizing second identification data, such as an IP address. Therefore, in this modification, the second identification data included in the second log to be integrated is anonymized twice.

[0100] FIG. 8 is a diagram illustrating an example of re-anonymization.

[0101] For example, in response to the above-described inquiry, the first analysis device 120 receives second anonymized data corresponding to the first anonymized data "07b1f9f9", such as an anonymized VIN, from the first server 110. The second anonymized data is an anonymized IP address such as "a2.0e.42.98".

[0102] The system cooperation unit 125c transmits the second anonymized data "a2.0e.42.98" to the second analysis device 220 and requests the second anonymized log to be integrated, which includes the second anonymized data, from the second analysis device 220. Then, upon receiving the second anonymized log to be integrated from the second analysis device 220, the system cooperation unit 125c re-anonymizes the second anonymized data "a2.0e.42.98" included in the second anonymized log to be integrated. In a specific example, the system cooperation unit 125c re-anonymizes the second anonymized data "a2.0e.42.98" to "4a.6e.4f.88." The system cooperation unit 125c stores the second anonymized log to be integrated, which includes the re-anonymized second anonymized data, in the storage unit 127.

[0103] FIG. 9 is a flowchart showing an example of the processing operation of the first analyzer 120 in this modified example.

[0104] The first analysis device 120 in this modification performs the processes of steps S1 to S6, similar to the flowchart shown in Fig. 4 of the above embodiment. After the process of step S6, the system cooperation unit 125c re-anonymizes the second anonymized logs to be integrated and stores them in the storage unit 127 (step S22). Next, the integration analysis unit 125d generates a log group by integrating one or more first anonymized logs and one or more re-anonymized second anonymized logs to be integrated, and performs an analysis of the log group as an integrated analysis (step S7).

[0105] Then, the first analyzer 120 executes the processes of steps S8 to S12 in the same manner as in the flowchart shown in FIG. 4 of the above embodiment.

[0106] As described above, in this modification, the system cooperation unit 125c anonymizes the specific second anonymized data included in the acquired second anonymized log to be integrated. This increases the confidentiality of the second anonymized log to be integrated and the specific second anonymized data. That is, it is possible to prevent the second system 200 from recognizing the vehicle V corresponding to the log from the re-anonymized log or data. As a result, it is possible to increase the security of the second anonymized log to be integrated.

[0107] In this modification, in step S10, the destination determination unit 123 determines whether the report information should be sent to the first SIRT or the second SIRT, but it may determine both the first SIRT and the second SIRT as destinations depending on the analysis results indicated in the report information. In this case, the transmitter 124 sends the report information to both the first SIRT and the second SIRT.

[0108] (Variation 3) In this modification, the second analysis device 220 also performs processing operations similar to those of the first analysis device 120. Therefore, the first analysis device 120 in this modification transmits the first anonymized log to the second analysis device 220 in response to a request from the second analysis device 220. That is, in this modification, the first system 100 and the second system 200 cooperate with each other.

[0109] FIG. 10 is a diagram for explaining the processing operations related to the second analyzer 220 among the processing of the first system 100 and the second system 200. In FIG.

[0110] 10 , the second analysis device 220 makes an inquiry to the first server 110 via the second server 210. The inquiry is an inquiry about the first anonymized data corresponding to the second anonymized data. At this time, the second analysis device 220 transmits the second anonymized data to the second server 210.

[0111] As shown in process (2) of Fig. 10 , when the second server 210 acquires the second anonymized data from the second analysis device 220, it identifies the second identification data corresponding to the second anonymized data. Note that when the second server 210 previously transmits the second log to the second analysis device 220, the second server 210 generates the second anonymized data by anonymizing the second identification data included in the second log, and therefore can identify the second identification data corresponding to the second anonymized data. Then, as shown in process (3) of Fig. 10 , the second server 210 transmits the identified second identification data to the first server 110 and inquires about the first anonymized data corresponding to the second identification data.

[0112] When the first server 110 acquires the second identification data from the second server 210 and receives the above-mentioned inquiry, it identifies the first anonymized data corresponding to the second identification data, as in process (4) of FIG. 10 . Note that, when the first server 110 previously transmits the above-mentioned first log to the first analysis device 120, it acquires the first log including the first identification data and the second identification data and generates the first anonymized data by anonymizing the first identification data. Therefore, the first server 110 can identify the first anonymized data corresponding to the second identification data. Then, as in process (5) of FIG. 10 , the first server 110 responds to the inquiry from the second server 210 by transmitting the identified first anonymized data to the second server 210. Note that the first server 110 may separately store data for identifying the first identification data corresponding to the second identification data, and may identify the first identification data corresponding to the second identification data and further identify the first anonymized data corresponding to the first identification data.

[0113] When the second server 210 receives the first anonymized data from the first server 110, it transmits the first anonymized data to the second analysis device 220, as in process (6) of Fig. 10. As a result, the second analysis device 220 receives the first anonymized data as a response to the inquiry in process (1) of Fig. 10. This first anonymized data is data corresponding to the second anonymized data, and is data for identifying the same vehicle V as the second anonymized data.

[0114] The second analysis device 220 requests a first anonymized log including the first anonymized data from the first analysis device 120 by transmitting the first anonymized data to the first analysis device 120, as in process (7) of Figure 3.

[0115] When the first analysis device 120 receives the first anonymized data from the second analysis device 220 and further receives the above-mentioned request, it transmits the first anonymized log including the first anonymized data as a first anonymized log to be integrated to the second analysis device 220, as in process (8) of Fig. 10. That is, the system collaboration unit 125c of the first analysis device 120 receives the first anonymized data from the second analysis device 220 via the communication unit 128, and transmits the first anonymized log to be integrated to the second analysis device 220.

[0116] The second analysis device 220 acquires the first anonymized logs to be integrated from the first analysis device 120. Then, the second analysis device 220 generates a log group including one or more first anonymized logs to be integrated and one or more second anonymized logs by integrating the one or more first anonymized logs to be integrated and one or more second anonymized logs. Then, the second analysis device 220 analyzes the log group as an integrated analysis and generates report information indicating the results of the integrated analysis.

[0117] FIG. 11 is a flowchart showing an example of the processing operation of the first analyzer 120 in this modified example.

[0118] The first analysis device 120 in this modification further executes the processes of steps S31 and S32 shown in FIG. 11 . Specifically, the control unit 126 of the first analysis device 120 receives a request for a first anonymized log using the first anonymized data from the second analysis device 220, for example, via the acquisition unit 121 (step S31). That is, the control unit 126 acquires the first anonymized data from the second analysis device 220 and receives a request for a first anonymized log including the first anonymized data from the second analysis device 220. Then, the system collaboration unit 125c, under the control of the control unit 126, extracts one or more first anonymized logs, each including the first anonymized data, from the plurality of first anonymized logs stored in the storage unit 127. Then, the system collaboration unit 125c transmits the extracted one or more first anonymized logs to the second analysis device 220, for example, via the communication unit 128. That is, the system cooperation unit 125c transmits the first anonymized log in response to the request from the second analysis device 220 (step S32). Such a first anonymized log is treated as a first anonymized log to be integrated in the second analysis device 220, and is integrated into the second anonymized log for analysis.

[0119] As described above, in this modification, the system cooperation unit 125c transmits the first anonymized log to the second system 200, which is the cooperation destination monitoring system, in response to a request from the second system 200. This allows not only the first analysis device 120 but also the second analysis device 220 of the second system 200 to mutually acquire the first anonymized log and the second anonymized log corresponding to the same vehicle V and perform an integrated analysis. In other words, it is possible to realize mutual cooperation between the first system 100 and the second system 200, and to perform an effective analysis of the logs.

[0120] In this modification, the first analysis device 120 may transmit to the second analysis device 220, instead of one or more first anonymized logs in response to a request from the second analysis device 220, report information indicating the analysis results for the one or more first anonymized logs.

[0121] (Variation 4) In the above embodiment, the first analysis device 120 makes the above-mentioned inquiry to resolve the linking each time it determines that an integrated analysis is necessary. In this modification, the first analysis device 120 stores the results of past linking solutions. Then, when it determines that an integrated analysis is necessary, if the results of past linking solutions are stored, the first analysis device 120 uses the results of past linking solutions without making an inquiry.

[0122] FIG. 12 is a diagram for explaining the processing operations related to the integrated processing unit 125 among the processing of the first system 100 and the second system 200. In FIG.

[0123] In this modification, the first system 100 and the second system 200 also execute processes (1) to (6) in FIG. 12 , similar to processes (1) to (6) in FIG. 3 . Then, when the linking resolution unit 125b acquires the second anonymized data from the first server 110 in process (6) in FIG. 12 , the linking resolution unit 125b links the second anonymized data (i.e., the identified second anonymized data) to the first anonymized data and records it, as in process (6.1) in FIG. 12 . That is, the linking resolution unit 125b associates the second anonymized data with the first anonymized data used in the query in process (1) in FIG. 12 . Then, the linking resolution unit 125b generates linking information indicating the first anonymized data and second anonymized data associated with each other, and stores the linking information in the storage unit 127. Note that storing such linking information in the storage unit 127 may be referred to as caching.

[0124] Then, the first analyzer 120 executes the process (7) and the process (8) in Fig. 12. The process (7) and the process (8) in Fig. 12 are the same as the process (7) and the process (8) in Fig. 3.

[0125] Thereafter, when the integration determination unit 125a determines again that an integrated analysis is necessary, the linking resolution unit 125b of the first analysis device 120 determines whether linking information is stored in the storage unit 127. That is, the linking resolution unit 125b determines whether linking information indicating the first anonymized data included in the first anonymized log that is the target of the integrated analysis is stored in the storage unit 127. When the linking resolution unit 125b determines that the linking information is stored in the storage unit 127, it performs linking resolution using the linking information without making an inquiry. This makes it possible to reduce the number of inquiries.

[0126] FIG. 13 is a diagram illustrating an example of the linking information.

[0127] The linking information a1 stored in the storage unit 127 indicates, for example, for each of one or more first anonymized data, the second anonymized data associated with that first anonymized data and the expiration date of that association. For example, the linking information a1 indicates the first anonymized data "07b1f9f9," the second anonymized data "a2.0e.42.98," and the expiration date "2022 / 07 / 14 17:50," in association with each other. When the first anonymized data included in the first anonymized log that is the target of the integrated analysis is "07b1f9f9," the linking resolution unit 125b determines whether the linking information a1 indicating that first anonymized data is stored in the storage unit 127.

[0128] Then, when the linking resolution unit 125b determines that the linking information a1 is stored in the storage unit 127, it checks the expiration date "2022 / 07 / 14 17:50" associated with the first anonymized data "07b1f9f9" in the linking information a1. For example, the linking resolution unit 125b determines whether the current time at which the linking resolution is performed has passed the expiration date "2022 / 07 / 14 17:50". In other words, the linking resolution unit 125b determines whether the linking of the first anonymized data "07b1f9f9" has expired. If the linking resolution unit 125b determines that the current time has not passed the expiration date, that is, that the linking has not expired, it performs linking resolution without making an inquiry. Specifically, the link resolution unit 125b acquires the second anonymized data "a2.0e.42.98" associated with the first anonymized data "07b1f9f9" in the link information a1 from the storage unit 127. In this way, link resolution is performed.

[0129] It should be noted that the above-mentioned expiration date can also be said to be the expiration date of the linked information a1. Furthermore, in this modification, the expiration date is indicated in the linked information a1, but the expiration date does not have to be indicated.

[0130] FIG. 14 is a flowchart showing an example of the processing operation of the first analyzer 120 in this modified example.

[0131] In this modified example, the first analysis device 120 executes the processes of steps S4 to S6 and S41 to S45 shown in FIG. 14 from the time it determines that an integrated analysis is necessary until the time the integrated analysis is executed, that is, from Yes in step S3 in FIG. 3 to step S7.

[0132] Specifically, when the integration determination unit 125a determines that an integrated analysis is necessary, the linking resolution unit 125b determines whether or not linking information a1 is stored in the storage unit 127 (step S41). That is, the linking resolution unit 125b determines whether or not linking information a1 indicating the first anonymized data included in the first anonymized log that is the target of the integrated analysis is stored in the storage unit 127. Here, when the linking resolution unit 125b determines that linking information a1 is not stored (No in step S41), it executes the processes of steps S4 and S5, as in the above embodiment. Linking resolution is performed by the processes of steps S4 and S5.

[0133] Then, the linking resolution unit 125b generates linking information a1 that indicates the first anonymized data in association with the second anonymized data, and stores the generated linking information in the storage unit 127 (step S43). Note that if the linking information a1 is already stored in the storage unit 127 and the first anonymized data is not indicated in the linking information a1, the linking resolution unit 125b updates the linking information a1. That is, the linking resolution unit 125b updates the linking information a1 by writing the first anonymized data and the second anonymized data in association with each other into the linking information a1. This generates the updated linking information a1. Note that such an update of the linking information a1 may also be referred to as a cache update. Furthermore, the linking resolution unit 125b transmits the updated or generated latest linking information a1 to the second analysis device 220 via the transmission unit 124 (step S46). As a result, the latest linking information a1 is notified to the second analysis device 220 and is shared between the first analysis device 120 and the second analysis device 220. As a result, when the second analysis device 220 performs linking solution for integrated analysis, it can also perform linking solution without making an inquiry by referring to the shared latest linking information a1.

[0134] Thereafter, the system cooperation unit 125c uses the second anonymized data received in step S5 to acquire the second anonymized logs to be integrated from the second analysis device 220 (step S6).

[0135] On the other hand, when the linking resolution unit 125b determines in step S41 that the linking information a1 is stored in the storage unit 127 (Yes in step S41), it determines whether the expiration date indicated in the linking information a1 has expired (step S42). That is, the linking resolution unit 125b identifies the expiration date associated with the first anonymized data in the linking information a1. Note that the first anonymized data is data included in the first anonymized log that is the target of the integrated analysis. Then, the linking resolution unit 125b determines whether the expiration date has passed at the current time when the linking resolution is performed.

[0136] Here, if the linking resolution unit 125b determines that the current time has not passed the expiration date, i.e., the expiration date has not expired (No in step S42), it reads out the second anonymized data associated with the first anonymized data in the linking information a1 (step S45). That is, the second anonymized data is read out from the storage unit 127. By such processing in step S45, linking resolution is performed without an inquiry. Then, the system cooperation unit 125c executes the processing in step S6.

[0137] Furthermore, if the linking resolution unit 125b determines in step S42 that the current time is past the expiration date, i.e., that the expiration date has expired (Yes in step S42), it executes the acquisition of second anonymized data through an inquiry (i.e., the processes of steps S4 and S5). Then, the linking resolution unit 125b resets the expiration date (step S44). That is, the linking resolution unit 125b updates the expiration date indicated in the linking information a1 to a new expiration date that is a date further in the future. Then, the linking resolution unit 125b executes the process of step S46. Note that, in updating the expiration date, the linking resolution unit 125b may update the expiration date indicated in the linking information a1 to an expiration date determined by the first server 110.

[0138] FIG. 15 is a flowchart showing an example of the processing operation of the second analyzer 220 in this modified example.

[0139] The second analysis device 220 receives the linking information a1 transmitted from the first analysis device 120 (step S51). Then, the second analysis device 220 stores the linking information a1 in a recording medium possessed by the second analysis device 220. At this time, if existing linking information a1 is stored in the recording medium, the second analysis device 220 updates the existing linking information a1 to the new linking information a1 received in step S51 (step S52). In other words, a cache update is performed in the second analysis device 220.

[0140] As described above, in this modification, the linking resolution unit 125b stores linking information a1 indicating the association between the first anonymized data and the identified second anonymized data in the storage unit 127. When the linking resolution unit 125b repeatedly executes linking resolution for the first anonymized data, the linking resolution unit 125b performs linking resolution by referencing the linking information a1 stored in the storage unit 127. As a result, when linking resolution is repeatedly executed, the linking resolution is performed by referencing the linking information a1, which eliminates the need for the first analysis device 120 to communicate with the first server 110 or the like to perform linking resolution. As a result, efficient linking resolution and integrated analysis can be achieved. Furthermore, the number of inquiries can be reduced.

[0141] Furthermore, the linking resolution unit 125b sets an expiration date for the linking information a1, and if the timing for repeatedly executing linking resolution for the first anonymized data has not passed the expiration date, the linking resolution unit 125b performs linking resolution by referring to the linking information a1 stored in the storage unit 127. As a result, an expiration date is set for the linking information a1, and the correspondence between the first anonymized data and the second anonymized data is guaranteed until the expiration date, and the correspondence can be changed after the expiration date has passed. In other words, after the expiration date has passed, the anonymization modes of the first system 100 and the second system 200 can be changed. As a result, the flexibility of the overall processing operations of these systems can be increased.

[0142] Furthermore, the system cooperation unit 125c transmits the linking information a1 stored in the storage unit 127 to the second analysis device 220 of the second system 200, which is the cooperation destination monitoring system. As a result, the linking information a1 is transmitted to the second system 200, and the second system 200 can resolve the linking using the linking information a1. As a result, the second system 200 (specifically, the second analysis device 220) can also perform integrated analysis, similar to the first analysis device 120.

[0143] In addition, when the linking information a1 stored in the memory unit 127 is updated by the linking resolution unit 125b, the system collaboration unit 125c transmits the updated linking information a1 to the second analysis device 220 of the second system 200, which is the associated monitoring system.

[0144] This allows the first analysis device 120 and the second analysis device 220 to synchronously manage the common linking information a1. As a result, the efficiency of the integrated analysis performed by the first analysis device 120 and the second analysis device 220 can be improved.

[0145] The analytical device and analytical method of the present disclosure have been described above based on the above-mentioned embodiment and each modified example, but the present disclosure is not limited to the embodiment and each modified example. As long as it does not deviate from the spirit of the present disclosure, various modifications that a person skilled in the art can conceive of to the above-mentioned embodiment and each modified example may also be included in the present disclosure.

[0146] For example, in the above-described embodiment and each modification, a VIN is used as an example of first identification data, and an IP address is used as an example of second identification data, but the first identification data and the second identification data are not limited to a VIN or an IP address. The first identification data and the second identification data may be privacy information such as location information or a personal name. Furthermore, in the above-described embodiment and each modification, the first identification data and the second identification data are used, but only one of the first identification data and the second identification data may be used as long as anonymization is performed in different manners in two or more different systems.

[0147] Furthermore, in the above-described embodiment and each modification, a vehicle V is used as an example of a device to be monitored, but the device to be monitored is not limited to the vehicle V and may be other devices. Similarly, the first system and the second system are not limited to systems for vehicles and may be any systems that are compatible with the device to be monitored.

[0148] Furthermore, in the above-described embodiment and each modification, the system that cooperates with the first system 100 is only one second system 200, but the first system 100 may cooperate with multiple second systems 200. In other words, the number of cooperation destination monitoring systems that cooperate with the first system 100 is not limited to one, but may be multiple.

[0149] Furthermore, the anonymization method used in the above embodiment and each modification may be any method.

[0150] In the above-described embodiments and modifications, each component may be configured with dedicated hardware or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU (Central Processing Unit) or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that realizes the monitoring device of each of the above-described embodiments is a computer program that causes a computer to execute each step of the flowcharts shown in Figures 4, 6, 9, 11, 14, and 15.

[0151] The following cases are also included in this disclosure:

[0152] (1) The at least one device is specifically a computer system comprising a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. The at least one device achieves its function when the microprocessor operates in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate instructions to the computer to achieve a predetermined function.

[0153] (2) Some or all of the components constituting at least one of the above devices may be configured as a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured to include a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0154] (3) Some or all of the components constituting at least one of the above devices may be configured as an IC card or a standalone module that can be attached to the device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. This IC card or module may be tamper-resistant.

[0155] (4) The present disclosure may be embodied as the methods described above, a computer program for implementing these methods on a computer, or a digital signal comprising the computer program.

[0156] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0157] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0158] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system. [Industrial Applicability]

[0159] The analysis device of the present disclosure can be applied to systems that monitor, for example, vehicle control. [Explanation of symbols]

[0160] 1. Analysis System 100 System 1 110 First Server 120 1st analyzer 121 Acquisition Department 122 Log Analysis Department 123 Destination Determination Unit 124 Transmitter 125 Integrated Processing Unit 125a Integrated judgment section 125b Linking Resolution Department 125c System Integration Department 125d Integrated Analysis Department 126 Control Unit 127 Memory section 128 Communications Department 200 Second System 210 Second Server 220 Second analyzer a1 Linking information R base station V vehicle

Claims

1. An analysis device that transmits report information based on an analysis result of a log related to a monitored device, an acquisition unit that acquires a first anonymized log, the log including first anonymized data of the monitoring target device; a linking resolution unit that performs linking resolution, which is a process of determining, as specific second anonymized data, second anonymized data corresponding to the first anonymized data from second anonymized data included in each of a plurality of second anonymized logs held by the partner monitoring system; a system collaboration unit that acquires a second anonymized log including the specified second anonymized data from the collaboration destination monitoring system as a second anonymized log to be integrated; an integrated analysis unit that performs an integrated analysis of a log group including the first anonymized log and the second anonymized log to be integrated; An analytical device comprising:

2. The analysis device further comprises: an integration determination unit that determines whether the integrated analysis is necessary; the linking resolution unit performs the linking resolution when the integration determination unit determines that the integration analysis is necessary; The analytical device of claim 1 .

3. The analysis device further comprises: a destination determination unit that determines a destination according to a result of the integrated analysis; a transmission unit that transmits the report information indicating the result of the integrated analysis to the destination determined by the destination determination unit, The analytical device of claim 1 .

4. The system linkage unit acquiring the second anonymized log to be integrated from one or more second anonymized logs corresponding to at least one of a type and a time period determined according to the first anonymized log, among the plurality of second anonymized logs; The analytical device of claim 1 .

5. The system linkage unit acquiring, from the plurality of second anonymized logs, a second anonymized log that matches a condition determined according to the first anonymized log, by specifying the second anonymized log using at least one of a type and a time period, as the second anonymized log to be integrated; The analytical device of claim 1 .

6. The system cooperation unit further anonymizing the specific second anonymized data included in the acquired second anonymized log to be integrated; The analytical device of claim 1 .

7. The system cooperation unit further transmitting the first anonymized log to the partner monitoring system in response to a request from the partner monitoring system; The analytical device of claim 1 .

8. The linking resolution unit further storing, in a recording medium, linking information indicating an association between the first anonymized data and the specified second anonymized data; When repeatedly executing the linking solution for the first anonymized data, the linking solution is performed by referring to the linking information stored in the recording medium. The analytical device of claim 1 .

9. The linking resolution unit further setting an expiration date for the linking information; and if the timing of repeatedly executing the linking solution for the first anonymized data has not passed the expiration date, the linking solution is performed by referring to the linking information stored in the recording medium. The analytical device according to claim 8 .

10. The system cooperation unit further transmitting the linking information stored in the recording medium to the partner monitoring system; The analytical device according to claim 8 .

11. The system cooperation unit further When the linking information stored in the recording medium is updated by the linking resolution unit, the updated linking information is transmitted to the partner monitoring system. The analytical device according to claim 10.

12. The acquisition unit acquiring the first anonymized log from the first server; The first server When a first log related to the monitoring target device is acquired, anonymizing first identification data of the monitoring target device included in the first log to generate the first anonymized log including the first anonymized data; The second server of the partner monitoring system includes: When a second log related to the monitoring target device is acquired, anonymizing second identification data included in the second log to generate the second anonymized log including the second anonymized data; The linking resolution unit transmitting the first anonymized data to the first server, and performing the linking resolution by making an inquiry to the second server via the first server about second anonymized data corresponding to the first anonymized data; The analytical device according to any one of claims 1 to 11.

13. An analysis method for transmitting report information based on an analysis result of a log related to a monitored device, comprising: acquiring a first anonymized log, the log including first anonymized data of the monitoring target device; performing a linking resolution process that determines, from the second anonymized data included in each of the plurality of second anonymized logs held by the partner monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; acquiring a second anonymized log including the specified second anonymized data from the linked monitoring system as a second anonymized log to be integrated; performing an analysis of a log group including the first anonymized log and the second anonymized log to be integrated as an integrated analysis; Analysis method.

14. A program for transmitting report information based on an analysis result of a log related to a monitored device, acquiring a first anonymized log, the log including first anonymized data of the monitoring target device; performing a linking resolution process that determines, from the second anonymized data included in each of the plurality of second anonymized logs held by the partner monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; acquiring a second anonymized log including the specified second anonymized data from the linked monitoring system as a second anonymized log to be integrated; performing an analysis of a log group including the first anonymized log and the second anonymized log to be integrated as an integrated analysis; A program that makes a computer do something.

Images