Attack source identification system, attack source identification device, attack source identification method and program

Abstract

An attack source identification system according to an embodiment of the present disclosure comprises a plurality of electronic control devices, a gateway device communicably connected to the plurality of electronic control devices, and an analysis device communicably connected to the plurality of electronic control devices, wherein: each electronic control device includes a creation unit configured to create history information of messages transmitted from a process executed by the electronic control device, and a transmission unit configured to transmit at least a portion of the history information to the analysis device; the gateway device includes a detection unit configured to detect an attack message from among the messages transmitted / received by the plurality of electronic control devices; and the analysis device includes an identification unit configured to, when the attack message is detected, identify the source of the attack message using detection information relating to the attack message and information received from the plurality of electronic control devices.

Description

[Technical Field]

[0001] The present disclosure relates to an attack source identification system, an attack source identification apparatus, an attack source identification method, and a program. [Background Art]

[0002] Some machines such as vehicles (e.g., automobiles, special vehicles, motorcycles, bicycles, etc.), machine tools, construction machinery, agricultural machinery, and industrial machinery are equipped with a plurality of electronic control units (ECUs: Electronic Control Units). A typical communication network connecting these ECUs is the Controller Area Network (CAN: Controller Area Network). Communication of each ECU on CAN (also referred to as CAN communication, CAN message, or simply message) includes an ID (also referred to as CAN-ID) and a payload. The CAN-ID is used for identification of data content, transmitting nodes, etc., and determination of priority for communication arbitration. The payload can carry a maximum of 8 bytes of data, which contains values of one or more signals. Taking a vehicle as an example, signals include those related to the status and control of vehicle speed, lateral velocity, accelerator position, brake position, acceleration, steering angle, and the like.

[0003] In recent years, there has been concern about the risk of cyberattacks on communication networks such as CAN (i.e., control networks used to control machinery). For example, it is known that by connecting an unauthorized ECU to the network or illegally rewriting the operation of an existing ECU, it is possible to insert attack transmissions of CAN-IDs related to the target function and induce malicious operation of that function. Various methods have been considered for detecting such attacks on CAN. For example, Non-Patent Document 1 discloses a method (network-type CAN-IDS) that monitors the CAN communication network and detects the insertion of an attack CAN message as an anomaly. In this method, if an attack CAN message is inserted into the communication of a certain CAN-ID that is transmitted at a fixed interval, the observation period of the communication of that CAN-ID changes to a shorter period than the predetermined period, which is detected as an anomaly. Ideally, the network-type CAN-IDS should be installed in a location that can oversee the CAN communication. For example, in a central gateway (CGW) type network configuration, installing the network-type CAN-IDS at the GW is one example of an ideal installation method. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Toshifumi Otsuka, Yu Ishigooka, "Intrusion Detection Method for In-Vehicle LANs Without Modifying Existing ECUs," Information Processing Society of Japan Research Report, Vol.2013-EMB-28, No.6, pp.31-35, 2013. [Overview of the project] [Problems that the invention aims to solve]

[0005] Incidentally, when a cyberattack is detected, an analysis of the attack is conducted, and one of the important purposes of cyberattack analysis is to identify the attacking device and the malware process / program within that device. However, CAN communication does not have source and destination addresses, so network-type CAN-IDS cannot identify which device (or even which process within that device) is the source of the attack.

[0006] On the other hand, if a host-type CAN-IDS is installed within each ECU, it can detect the attack and identify the source of the attack if that ECU is the source of the attack. However, host-type CAN-IDS may not be able to detect attacks that involve inserting attacking CAN messages. For example, consider a case where attacking CAN messages are sent at predetermined intervals from an ECU connected to a different CAN bus than the ECU that sends normal CAN messages. In this case, the host-type CAN-IDS of the ECU sending the attacking CAN messages cannot observe the normal CAN messages because it is on a different CAN bus than the ECU sending the normal CAN messages. Therefore, the host-type CAN-IDS of the ECU sending the attacking CAN messages may perceive the observation period of those attacking CAN messages as a predetermined period, and the attack may not be detected.

[0007] This disclosure is made in view of the above points and provides a technology for identifying the source of attack communications. [Means for solving the problem]

[0008] An attack source identification system according to one aspect of the present disclosure includes a plurality of electronic control devices, a gateway device communicateably connected to the plurality of electronic control devices, and an analysis device communicateably connected to the plurality of electronic control devices, wherein each electronic control device has a creation unit configured to create history information of messages sent from a process it executes, and a transmission unit configured to transmit at least a portion of the history information to the analysis device, the gateway device has a detection unit configured to detect attack messages from messages sent and received by the plurality of electronic control devices, and the analysis device has an identification unit configured to identify the source of the attack message when the attack message is detected, using detection information relating to the attack message and information received from the plurality of electronic control devices. [Effects of the Invention]

[0009] Technology is provided to identify the source of attack communications. [Brief explanation of the drawing]

[0010] [Figure 1] This diagram shows the overall configuration of the attack source identification system in Example 1. [Figure 2] This diagram shows an example of a detailed functional configuration of the history collection unit. [Figure 3] This figure shows an example of historical information. [Figure 4] This flowchart shows the recording and transmission process of historical information in Example 1. [Figure 5] This is a flowchart showing the attack detection and attack source identification process in Example 1. [Figure 6] This figure shows the overall configuration of the attack source identification system in Example 2. [Figure 7] This is a flowchart showing the recording and transmission process of historical information in Example 2. [Figure 8] This is a diagram (part 1) showing an example of bit assignment for an excerpt of historical information. [Figure 9] This is a diagram (part 2) showing an example of bit assignment for an excerpt of historical information. [Figure 10] This is a flowchart showing the attack detection and attack source identification process in Example 2. [Modes for carrying out the invention]

[0011] The following describes one embodiment of the present invention. In the following embodiment, a CAN control network is assumed to be the primary control network, and an attack source identification system 1 capable of identifying the source of an attacking CAN communication (i.e., the ECU or process within that ECU that sent the attacking CAN communication) is described. Attacking CAN communication refers to malicious CAN communication intended to carry out some kind of attack. Note that CAN communication may also be called, for example, a CAN message or simply a message.

[0012] In the attack source identification system 1 according to this embodiment, an attacking CAN communication is detected using a network-type CAN-IDS, and when an attacking CAN communication is detected, the attack source is identified by comparing the history of CAN communication transmitted (issued) by each ECU with the detection result. To this end, the attack source identification system according to this embodiment mainly comprises the following three functional units.

[0013] History collection unit 110: A functional unit that records CAN communications transmitted by the processes of a device such as an ECU as history and transmits that history to the analysis unit 310.

[0014] Detection unit 210: A functional unit that detects attack CAN communications using a network-type CAN-IDS.

[0015] Analysis unit 310: A functional unit that identifies the source of the attacking CAN communication by comparing the detection results from the detection unit 210 with the history received from the history collection unit 110.

[0016] Hereinafter, an example of the attack source identification system 1 according to the present embodiment will be described. In the following description, CAN is assumed as the control network, but the control network is not limited to CAN. For example, the present embodiment is also applicable to network-type attack detection targeting communication protocols in which a source address is not included in a communication message or communication protocols in which a source address can be easily spoofed even if such an address exists.

[0017] [Example 1] First, Example 1 will be described. Example 1 is a case where the attack source identification system 1 has a monitoring network implemented by an arbitrary communication method in addition to a control network implemented by a CAN bus.

[0018] <Overall Configuration>[] The overall configuration of the attack source identification system 1 according to Example 1 is shown in Fig. 1. As shown in Fig. 1, the attack source identification system 1 according to Example 1 includes a plurality of ECUs, a CGW, and an analysis device. Each ECU and the CGW are connected to a CAN bus. Further, each ECU, the CGW, and the analysis device are connected to a monitoring NW, which is a monitoring network.

[0019] In the example shown in Fig. 1, each of the plurality of ECUs is denoted as "ECU 10-1", "ECU 10-2", "ECU 10-11", "ECU 10-12", etc. Further, in the example shown in Fig. 1, there are a plurality of CAN buses, and each of the plurality of CAN buses is denoted as "CAN bus 40-1", "CAN bus 40-2", etc.

[0020] Here, the attack source identification system 1 according to Example 1 has a central gateway-type network configuration. In the example shown in Fig. 1, ECU 10-1, ECU 10-2, and the like are connected to CAN bus 40-1, and ECU 10-11, ECU 10-12, and the like are connected to CAN bus 40-2. Further, the CGW is provided as a central gateway and is connected to both CAN bus 40-1 and CAN bus 40-2.

[0021] The ECU10 is an electronic control unit. Each ECU10 has a history collection unit 110. The history collection unit 110 is realized, for example, by causing one or more programs (including modules) held by the ECU10 to be executed by a processing unit such as a processor. In the example shown in Figure 1, the history collection unit 110 of ECU10-1 is referred to as "history collection unit 110-1", the history collection unit 110 of ECU10-2 is referred to as "history collection unit 110-2", the history collection unit 110 of ECU10-11 is referred to as "history collection unit 110-11", the history collection unit 110 of ECU10-12 is referred to as "history collection unit 110-12", and so on.

[0022] Here, the detailed functional configuration of the history collection unit 110 is shown in Figure 2. As shown in Figure 2, the history collection unit 110 includes a monitor unit 111, a history information creation unit 112, and a recording / transmission unit 113.

[0023] The monitoring unit 111 monitors the process of the ECU 10 having the history collection unit 110, and when that process transmits (issues) CAN communication, it acquires information such as the CAN-ID, payload, and process name of the process that issued the CAN communication from that CAN communication. The monitoring unit 111 may acquire information such as the CAN-ID, payload, and process name not only from CAN communication transmitted by the process, but also from CAN communication received by the process.

[0024] Since high speed is required for the monitor unit 111, it is preferable that it be implemented by a kernel module or a program that operates in kernel space. When implementing the monitor unit 111 by a program that operates in kernel space, for example, eBPF (extended Berkeley Packet Filter) can be used in Linux®, and BPF, DTrace, etc. can be used in BSD and QNX.

[0025] The history information creation unit 112 creates history information from various types of information acquired by the monitoring unit 111. At this time, the history information creation unit 112 creates history information by performing predetermined statistical processing and necessary processing on these types of information.

[0026] The recording and transmission unit 113 records the history information created by the history information creation unit 112 into the memory of the ECU 10, and transmits the history information, which has its own ECU name attached to it, to the analysis device 30 via the monitoring network 50. When the recording and transmission unit 113 transmits the history information, which has its own ECU name attached to it, to the analysis device 30, it may transmit all of the history information, or it may select and send only some of the history information (for example, only the history information that has not yet been transmitted) as needed.

[0027] Here, an example of history information is shown in Figure 3. As shown in Figure 3, the history information consists of multiple rows (records), and each row includes the time, issuing CAN-ID, number of transmissions, entropy, and issuing process name. Each row that makes up the history information is the result of statistical processing of various information acquired by the monitor unit 111 for the same CAN-ID at predetermined intervals (1 minute in the example shown in Figure 3). For example, the number of transmissions is the number of CAN communications with that CAN-ID transmitted during that period. The entropy is the magnitude of the change in the payload of the CAN communications with that CAN-ID during that period. The issuing process name is the name of the process that issued (transmitted) the CAN communication with that CAN-ID.

[0028] The example shown in Figure 3 is history information created by the history collection unit 110 of a certain ECU 10 that typically receives CAN communications with one of three CAN-IDs (32A, 32C, 32E). As shown in Figure 3, this history information records that the malware process attack has sent a large number of CAN communications (500 transmissions) with the same payload (i.e., entropy "0") under CAN-ID "0AA".

[0029] CGW20 is a central gateway that functions as a network-type CAN-IDS. CGW20 has a detection unit 210. The detection unit 210 is implemented, for example, by a process in which one or more programs (including modules) held by CGW20 cause a processing unit such as a processor to execute.

[0030] The detection unit 210 detects an attacking CAN communication and transmits detection information representing the detection result to the analysis device 30 via the monitoring network 50. The detection information includes, for example, the time the attacking CAN communication was detected (detection time) and the CAN-ID included in the attacking CAN communication. The detection unit 210 can detect attacking CAN communications using the same method as known network-type CAN-IDS.

[0031] The analysis device 30 is a device that identifies the source (attack source) of an attacking CAN communication. The analysis device 30 has an analysis unit 310. The analysis unit 310 is realized, for example, by causing one or more programs (including modules) held by the analysis device 30 to be executed by a processing unit such as a processor.

[0032] The analysis unit 310 stores the history information (history information with an assigned ECU name) received from the history collection unit 110 in the memory of the analysis device 30. The analysis unit 310 may delete (clear) the history information stored in its memory, for example, when a predetermined period of time has elapsed or when it receives history information with the same ECU name as history information already stored.

[0033] Furthermore, when the analysis unit 310 receives detection information from the detection unit 210, it compares this detection information with the history information stored in memory to identify the source of the attacking CAN communication. Specifically, the analysis unit 310 compares the time (detection time) and CAN-ID included in the detection information with the time and CAN-ID included in each history information, and identifies the ECU 10 with the ECU name assigned to the history information containing the matching time and CAN-ID, and the process with the issuing process name corresponding to that time and CAN-ID, as the source of the attacking CAN communication (attack source). However, the times do not need to match perfectly; they can be considered to match if the difference is within a certain predetermined range. Alternatively, only the CAN-ID may be used for matching without using the time.

[0034] The analysis device 30 may be located inside machinery (for example, a vehicle) that is equipped with the ECU 10 and CGW 20, or it may be located outside the machinery and be able to communicate with the equipment by wired or wireless means.

[0035] <Recording and transmission of historical information> The recording and transmission process of history information in Example 1 will be described below with reference to Figure 4. As an example, the recording and transmission process of history information for a certain ECU 10 will be described below.

[0036] The monitoring unit 111 of the history collection unit 110 acquires information such as the CAN-ID, payload, and process name from the CAN communication each time a CAN communication is issued (transmitted) from the process of the ECU 10 (step S101).

[0037] The history information creation unit 112 of the history collection unit 110 creates history information from various information acquired by the monitor unit 111 at predetermined intervals (for example, every minute) (step S102). At this time, the history information creation unit 112 creates history information by performing predetermined statistical processing (for example, calculation of the number of issuances, calculation of entropy, etc.) and necessary processing (for example, conversion of data format as needed) on this various information.

[0038] The recording and transmission unit 113 of the history collection unit 110 records the history information created by the history information creation unit 112 into the memory of the ECU 10, and transmits the history information, which has the ECU name of the ECU 10 assigned to it, to the analysis device 30 via the monitoring network 50 (step S103). As a result, the analysis unit 310 of the analysis device 30 stores the history information, which has the ECU name assigned to it, in the memory of the analysis device 30.

[0039] <Attack detection and attack source identification process> The attack detection and attack source identification processes in Example 1 will be described below with reference to Figure 5.

[0040] If the detection unit 210 of CGW20 detects an attacking CAN communication (YES in step S201), it transmits the detection information to the analysis device 30 (step S202).

[0041] The analysis unit 310 of the analysis device 30 compares the time (detection time) and CAN-ID included in the detection information received from CGW20 with the time and CAN-ID included in each history information held in memory to identify the name of the attacking ECU and process name (step S203).

[0042] Depending on the interval at which the history collection unit 110 transmits history information, there may be ECUs 10 that have not yet transmitted their latest history information when the analysis unit 310 receives detection information. For this reason, the analysis unit 310 may, for example, wait until it receives the latest history information from all ECUs 10 before performing the above matching.

[0043] Furthermore, as mentioned above, the CAN-ID alone may be used for matching without using the time. In this case, the analysis unit 310 can match the CAN-ID included in the detection information received from CGW20 with the CAN-ID included in each history information held in memory, and identify the ECU name and process name corresponding to the matching CAN-ID as the source of the attack.

[0044] In this case, if an attack is carried out that involves inserting an attacking CAN communication, the CAN communication of the CAN-ID used in the attack will be sent from at least two sources: a legitimate source (ECU name and process name) and an unauthorized source (ECU name and process name). Therefore, in this case, the analysis unit 310 identifies multiple sources as attack source candidates through the above matching process, and then identifies the actual attack source from among these candidates. One method for identifying the actual attack source from among multiple attack source candidates is to use the association information between ECU names and process names and CAN-IDs, which is predetermined by the design, etc., and identify the ECU names and process names not included in that association information as the actual attack source. Alternatively, for example, if attack source candidates are identified by matching only CAN-IDs without using time, the attack source candidate that sent the CAN communication of the CAN-ID at a time matching the time included in the detection information (detection time) may be identified as the actual attack source.

[0045] [Example 2] Next, we will describe Example 2. Example 2 is a case where, for example, the attack source identification system 1 does not have a monitoring network 50 due to cost constraints, etc. In Example 2, we will mainly describe the differences from Example 1, and will omit the explanation of components that are the same as in Example 1.

[0046] <Overall Structure> Figure 6 shows the overall configuration of the attack source identification system 1 in Example 2. As shown in Figure 6, unlike Example 1, the attack source identification system 1 in Example 2 does not have a monitoring network 50. Therefore, the history collection unit 110 of each ECU 10 transmits history information to the analysis device 30 via the CAN bus 40 (and CGW 20). At this time, in order to avoid putting pressure on the communication bandwidth of the CAN bus 40, it is preferable to keep the amount of history information transmitted as small as possible. Therefore, in this embodiment, the recording and transmission unit 113 of the history collection unit 110 transmits an excerpt of the history information to the analysis device 30. Note that the CGW 20 and the analysis device 30 are connected to communicate using any communication method.

[0047] <Recording and transmission of historical information> The recording and transmission process of history information in Example 2 will be described below with reference to Figure 7. As an example, the recording and transmission process of history information for a certain ECU 10 will be described below.

[0048] Steps S301 to S302 in Figure 7 are the same as steps S101 to S102 in Figure 4, so their explanation will be omitted.

[0049] Following step S302, the recording and transmission unit 113 of the history collection unit 110 records the history information created by the history information creation unit 112 into the memory of the ECU 10, and transmits an excerpt of the history information (hereinafter referred to as the history information excerpt) to the analysis device 30 via the CAN bus 40 to which it is connected (step S303). As a result, the analysis unit 310 of the analysis device 30 stores the history information excerpt in the memory of the analysis device 30.

[0050] At this time, the recording and transmission unit 113 can, for example, create an excerpt of history information from lines within a predetermined period of history information (for example, 1 minute) and transmit the excerpt in one frame of CAN communication. The recording and transmission unit 113 also transmits the CAN communication with a value unique to the ECU 10 as the CAN-ID. By making the CAN-ID of the CAN communication representing the excerpt of history information a unique value for each ECU 10, the analysis unit 310 of the analysis device 30 can identify which ECU 10 the excerpt of history information in the CAN communication belongs to.

[0051] Here, Figure 8 shows an example of bit assignment (bit allocation of CAN frames) when representing a history information excerpt in a single frame of the standard CAN communication format. Figure 8 is an example of bit assignment when the history information excerpt is a CAN-ID issued during a predetermined period (e.g., 1 minute). Furthermore, the example shown in Figure 8 indicates that the CAN-ID "700" is specified for the CAN communication when ECU10-1 transmits the history information excerpt.

[0052] In the standard format, a CAN-ID is represented by 11 bits. Therefore, if the number of CAN-IDs transmitted from the ECU 10 is five or less, the history information excerpt can be transmitted in a single frame by specifying those CAN-IDs directly in the payload (maximum 64 bits). On the other hand, if malware or the like transmits additional CAN-IDs, the number of CAN-IDs transmitted from that ECU 10 may be six or more, in which case there may be CAN-IDs that are not specified in the history information excerpt in a single frame. Even in this case, the "number of issued CAN-IDs" specified by the 9 bits starting from Offset "0" can be used to indicate the existence of unspecified CAN-IDs. Furthermore, if there is sufficient communication bandwidth on the CAN bus 40, the history information excerpt may be represented in multiple frames instead of just one.

[0053] Figure 9 shows an example of bit assignment (bit allocation of CAN frames) when representing history information excerpts in one frame of the extended format of CAN communication. Figure 9 is an example of bit assignment when the number of CAN-IDs issued during a predetermined period (e.g., 1 minute) is used as the history information excerpt. In the example shown in Figure 9, it is indicated that CAN-ID "700" is specified for the CAN communication when ECU10-1 transmits the history information excerpt. Note that in the extended format, the CAN-ID is represented by a length of 29 bits.

[0054] As shown in Figure 9, the extended format allows you to specify the number of CAN-IDs to be issued for every 4 bits, for example. In this case, if malware or the like sends additional CAN-IDs, the number of those CAN-IDs will be specified together in "Number of other IDs issued".

[0055] <Attack detection and attack source identification process> The attack detection and attack source identification processes in Example 2 will be described below with reference to Figure 10.

[0056] Steps S401 to S402 in Figure 10 are the same as steps S201 to S202 in Figure 5, so their explanation is omitted.

[0057] Following step S402, the analysis unit 310 of the analysis device 30 identifies the source of the attack using the detection information received from the CGW20 and the excerpts of history information held in memory (step S403). At this time, the analysis unit 310 may, if necessary, obtain history information other than the excerpts from the relevant ECU10 and then identify the source of the attack by performing a matching in the same manner as in Example 1.

[0058] For example, if the history information of the bit assignments shown in Figure 8 is stored in memory, the analysis unit 310 can identify the source of the attack (ECU 10) by matching the CAN-ID included in the detection information with the CAN-ID included in each history information excerpt. For this reason, the analysis unit 310 may further acquire history information from this ECU 10 and then identify the process that caused the attack.

[0059] Furthermore, for example, if an excerpt of bit assignment history information shown in Figure 9 is stored in memory, the analysis unit 310 may, when a value of 1 or more is specified for "Number of other IDs issued" in the history information excerpt, obtain the history information corresponding to that history information excerpt from the relevant ECU 10, and then perform a matching similar to that in Example 1 to identify the source of the attack.

[0060] Furthermore, historical information can be obtained via the CAN bus 40, for example, by implementing the analysis unit 310 as an ECU diagnostic function.

[0061] [Example 3] Next, Example 3 will be described. The attack source identification system 1 in Example 3 may be a combination of Example 1 and Example 2. That is, in the attack source identification system 1 in Example 3, only some ECU10 (e.g., ECU10-1 and ECU10-2) are connected to the monitoring network 50, and other ECU10 (e.g., ECU10-11 and ECU10-12) do not need to be connected to the monitoring network 50. In this case, the ECU10 connected to the monitoring network 50 can be treated the same as in Example 1, and the ECU10 not connected to the monitoring network 50 can be treated the same as in Example 3.

[0062] [summary] As described above, the attack source identification system 1 according to this embodiment can identify the attack source even when the source address cannot be obtained from the message (or when it is difficult to obtain), by cross-referencing it with historical information such as the message transmission history. For this reason, for example, it becomes possible to efficiently conduct cyberattack analysis.

[0063] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of Symbols]

[0064] 1. Attack source identification system 10 ECU 20 CGW 30 Analyzer 40 CAN bus 50 Monitoring Network 110 History Collection Department 111 Monitor Section 112 History Information Creation Department 113 Recording and Transmission Unit 210 Detection unit 310 Analysis Department

Claims

1. An attack source identification system comprising a plurality of electronic control devices, a gateway device that is communicatively connected to the plurality of electronic control devices, and an analysis device that is communicatively connected to the plurality of electronic control devices, The aforementioned electronic control device is A creation unit is configured to create history information that includes a message ID indicating identification information of a message sent from a process it is executing, and a process name indicating the name of the process, The system includes a transmitting unit configured to transmit information to the analyzer that includes at least the message ID and the process name contained in the history information, The gateway device is The system includes a detection unit configured to detect attack messages from among the messages transmitted and received by the aforementioned plurality of electronic control devices, The aforementioned analytical device is The identification unit is configured to, when the aforementioned attack message is detected, match the message ID included in the detection information relating to the attack message with the message ID included in each of the pieces of information received from the plurality of electronic control units, and to identify the process whose process name is included in the information containing the matching message IDs, and the electronic control unit that sent the information containing the matching message IDs, as the source of the attack message. A system for identifying the source of an attack.

2. The aforementioned transmitting unit The system is configured to transmit information that further includes the time the message was sent to the analyzer. The specified part is, The attack source identification system according to claim 1, further comprising comparing the time the attack message was detected, which is included in the detection information, with the time included in each of the information received from the plurality of electronic control devices, and identifying the process with the process name corresponding to the matching message ID and time, and the electronic control device that sent the information containing the message ID and time, as the source of the attack message.

3. The aforementioned electronic control device is The system further includes an acquisition unit configured to acquire the message ID of the message and the process name of the process each time a message is sent from the process it is executing, The aforementioned creation unit, The attack source identification system according to claim 1 or 2, configured to create the history information using the message ID and process name acquired by the acquisition unit.

4. The aforementioned message is a CAN message, The acquisition unit is, The attack source identification system according to claim 3, configured to obtain the CAN-ID of the CAN message and the process name of the process each time a CAN message is sent from a process it is executing.

5. An attack source identification device comprising a plurality of electronic control devices, a gateway device that is communicatively connected to the plurality of electronic control devices, and an analysis device that is communicatively connected to the plurality of electronic control devices, The aforementioned electronic control device is A creation unit is configured to create history information that includes a message ID indicating identification information of a message sent from a process it is executing, and a process name indicating the name of the process, The system includes a transmitting unit configured to transmit information to the analyzer that includes at least the message ID and the process name contained in the history information, The gateway device is The system includes a detection unit configured to detect attack messages from among the messages transmitted and received by the aforementioned plurality of electronic control devices, The aforementioned analytical device is The identification unit is configured to, when the aforementioned attack message is detected, match the message ID included in the detection information relating to the attack message with the message ID included in each of the pieces of information received from the plurality of electronic control units, and to identify the process whose process name is included in the information containing the matching message IDs, and the electronic control unit that sent the information containing the matching message IDs, as the source of the attack message. A device for identifying the source of an attack.

6. A method for identifying the source of an attack used in an attack source identification system which includes a plurality of electronic control devices, a gateway device that is communicatively connected to the plurality of electronic control devices, and an analysis device that is communicatively connected to the plurality of electronic control devices, The aforementioned electronic control device A procedure for creating history information that includes a message ID indicating the identification information of a message sent from a process that it is executing, and a process name indicating the name of the process, A transmission procedure is performed to send information to the analysis device that includes at least the message ID and the process name contained in the history information, The gateway device, A detection procedure is performed to detect attack messages from among the messages sent and received by the aforementioned multiple electronic control devices, The aforementioned analytical device If the aforementioned attack message is detected, the following identification procedure is performed: the message ID included in the detection information relating to the attack message is compared with the message ID included in each of the pieces of information received from the multiple electronic control units, and the process whose process name is included in the information containing the matching message IDs and the electronic control unit that sent the information containing the matching message IDs are identified as the source of the attack message. Methods for identifying the source of an attack.

7. A program for an attack source identification system which includes a plurality of electronic control devices, a gateway device that is communicatively connected to the plurality of electronic control devices, and an analysis device that is communicatively connected to the plurality of electronic control devices, The aforementioned electronic control device, A procedure for creating history information that includes a message ID indicating the identification information of a message sent from a process that it is executing, and a process name indicating the name of the process, A transmission procedure is performed to send information to the analysis device that includes at least the message ID and the process name contained in the history information, The gateway device, The aforementioned multiple electronic control devices execute a detection procedure to detect attack messages from among the messages sent and received by the devices, The aforementioned analytical device, If the aforementioned attack message is detected, the system will perform an identification procedure to match the message ID included in the detection information relating to the attack message with the message ID included in each of the pieces of information received from the multiple electronic control units, and to identify the process whose process name is included in the information containing the matching message IDs, and the electronic control unit that sent the information containing the matching message IDs, as the source of the attack message. program.

Images