Attack monitoring device, attack monitoring system, and attack monitoring method

Abstract

This attack monitoring device 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 that analyzes a log of a first monitoring target 501 on the basis of a threat scenario to calculate the possibility of a cyber attack occurring; and an offload determination unit 124 that determines whether to cause a server-side attack analysis unit 222, which is installed in a server 200 outside of the vehicle V and analyzes a log of a second monitoring target 502 on the basis of the threat scenario to calculate an occurrence possibility of a cyber attack, to execute an offload of processing for the analysis of the log of the first monitoring target 501 by the vehicle-side attack analysis unit 122.

Description

Attack monitoring device, attack monitoring system, and attack monitoring method

[0001] The present invention relates to an attack monitoring device, an attack monitoring system, and an attack monitoring method.

[0002] In recent years, in-vehicle systems have been providing various services to users by connecting to devices outside the vehicle via communication networks such as the Internet. For this reason, it is important for recent in-vehicle systems to be prepared for external cyber attacks. For example, Patent Literature 1 discloses a monitoring system that includes a monitoring server outside the vehicle and an in-vehicle system implemented in the vehicle, and the monitoring server and the in-vehicle system are connected via an external network. The in-vehicle system includes three or more monitoring units. The three or more monitoring units operate with execution permissions that differ in reliability, and a monitoring unit with a more reliable execution permission monitors the software of a monitoring unit with a less reliable execution permission.

[0003] Japanese Patent Application Laid-Open No. 2023-2832

[0004] However, when detecting a cyber-attack in an in-vehicle system with limited computing resources, such as the monitoring system of Patent Document 1, there is a possibility that the in-vehicle system may run out of computing resources depending on the situation of the cyber-attack, the operating status of the intrusion detection system (IDS), and the operating status of vehicle functions other than security.

[0005] The present invention has been made in consideration of the above points, and aims to provide an attack monitoring device, an attack monitoring system, and an attack monitoring method that can continue to monitor cyber attacks in a lower-resource in-vehicle system.

[0006] The attack monitoring device of the present invention is an attack monitoring device implemented in a vehicle, and is characterized by having a vehicle-side attack analysis unit that calculates the possibility of a cyber-attack occurring by analyzing the logs of a first monitored target based on a threat scenario, and an offload determination unit that determines whether to offload the process of analyzing the logs of the first monitored target by the vehicle-side attack analysis unit to a server-side attack analysis unit that is implemented in a server outside the vehicle and calculates the possibility of a cyber-attack occurring by analyzing the logs of a second monitored target based on a threat scenario.

[0007] According to the present invention, it is possible to continue monitoring for cyber attacks in a resource-constrained in-vehicle system. Further features related to the present invention will become apparent from the description of this specification and the accompanying drawings. In addition, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0008] 1 is a schematic diagram showing an attack monitoring system according to an embodiment. A functional block diagram of the attack monitoring device of FIG. 1. A table showing an example of the threat scenario table of FIG. 2. A table showing an example of the scenario progress management table of FIG. 2. A table showing an example of the priority monitoring list of FIG. 2. A table showing an example of the offload list of FIG. 2. A functional block diagram of the server of FIG. 1. A table showing an example of the monitoring status table of FIG. 7. A graph showing an example of the processing load graph of FIG. 7. (A), (B), and (C) are diagrams showing a mapping of security sensors for each cyber attack assumed in a threat scenario. (A), (B), and (C) are diagrams showing the allocation of responsibilities for integrated analysis of logs for each cyber attack assumed in a threat scenario under normal circumstances. A flowchart showing the processing of executing and stopping priority monitoring in the attack monitoring device. A flowchart showing the processing of executing offloading, stopping offloading, and forcibly stopping priority monitoring in the attack monitoring device. A flowchart showing the processing of executing and stopping offloading in the server. A flowchart showing the processing of executing priority monitoring in the attack monitoring device. A flowchart showing the processing of stopping priority monitoring in the attack monitoring device. A flowchart showing the processing of executing offloading in the attack monitoring device. A flowchart showing the process of stopping offloading in an attack monitoring device. A flowchart showing the process of forcibly stopping priority monitoring in an attack monitoring device. (A), (B), and (C) are diagrams showing the division of responsibilities for integrated analysis of logs for each cyber attack assumed in a threat scenario when the attack monitoring device is under high load. (A), (B), and (C) are diagrams showing the division of responsibilities for integrated analysis of logs for each cyber attack assumed in a threat scenario when an attack occurs.

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of an attack monitoring device, an attack monitoring system, and an attack monitoring method according to the present invention will be described with reference to the drawings.

[0010] First, the attack monitoring system 300 of this embodiment will be described. As shown in Fig. 1, the attack monitoring system 300 of this embodiment includes an attack monitoring device 100 implemented in a vehicle V and a server 200 external to the vehicle V. In the attack monitoring system 300 of this embodiment, the attack monitoring device 100 inside the vehicle V and the server 200 external to the vehicle V work together to analyze cyber-attacks. The attack monitoring device 100 is an integrated ECU (Electronic Control Unit) of the vehicle V, and integrates the detection of attacks by the zone ECUs 103, 104, and 105. The attack monitoring device 100 is a high-performance on-board analysis engine.

[0011] The attack monitoring device 100 is composed of a control device 101 and a database 102. The control device 101 is implemented in, for example, a central gateway, which is one of the integrated ECUs that is the attack monitoring device 100, and performs the functions of a system called SIEM (Security Information and Event Management). The control device 101 performs processing as SIEM by having the CPU (Central Processing Unit) of the control device 101 execute computer programs stored in the ROM (Read Only Memory), RAM (Random Access Memory) and database 102 of the control device 101.

[0012] The SIEM realized by the control device 101 centrally aggregates logs from the zone ECUs 103, 104, and 105 in the vehicle V, combines the data, and performs correlation analysis based on detection rules stored in the database 102, thereby detecting cyber-attacks while reducing false positives. The detection rules stored in the database 102 can respond to new attacks by quickly updating the detection rules.

[0013] The zone ECUs 103, 104, and 105 are examples of various ECUs mounted on the vehicle V and controlling various parts of the vehicle V based on information detected by various sensors. The zone ECUs 103, 104, and 105 are, for example, ECUs that perform one or more of the following functions: powertrain system, chassis system, body system, multimedia system, and ADAS system. Examples of the powertrain system ECUs include an engine ECU, a transmission ECU, and a hybrid ECU. Examples of the chassis system ECUs include a power steering ECU and a brake / accelerator ECU.

[0014] Body-related ECUs include, for example, ECUs for wipers, automatic doors, power windows, keyless entry, power door mirrors, interior lighting, headlights, tire pressure monitoring systems, and immobilizers (anti-theft devices).Multimedia-related ECUs include, for example, ECUs for navigation systems, ETC (Electronic Toll Collection Systems), audio systems, and backup monitors.ADAS (Advanced Driver Assistance Systems)-related ECUs include, for example, driving assistance ECUs, stereo camera ECUs, perimeter monitoring ECUs, locator ECUs, and autonomous driving ECUs.

[0015] The zone ECUs 103, 104, and 105 of the vehicle V are each composed of a control device 106, 107, and 108 and a database 109, 110, and 111. The control devices 106, 107, and 108 function as an intrusion detection system (IDS). The control devices 106, 107, and 108 perform IDS processing by having the CPUs of the control devices 106, 107, and 108 execute computer programs stored in the ROM and RAM of the control devices 106, 107, and 108 and the databases 109, 110, and 111.

[0016] The IDS realized by the control devices 106, 107, and 108 detects attacks on the nodes of each part of the vehicle V based on detection rules stored in databases 109, 110, and 111. Detection logs from the control devices 106, 107, and 108 are sent to the control device 101 of the attack monitoring device 100, where correlation analysis is performed.

[0017] The server 200 is composed of a control device 201 and a database 202. Note that the server 200 is intended as a processing device capable of transmitting and receiving information to and from a communication device via a communication line or the like, and does not refer to hardware such as a personal computer or embedded information device. The control device 201 performs the functions of a system called a SIEM in, for example, a VSOC (Vehicle Security Operations Center). The control device 201 performs processing as a SIEM by having the CPU of the control device 201 execute computer programs stored in the ROM, RAM, and database 202 of the control device 201.

[0018] The SIEM realized by the control device 201 detects cyber-attacks by centrally aggregating logs from the control device 101 of the attack monitoring device 100 in the server 200, combining the data, and performing correlation analysis based on detection rules stored in the database 202. The detection rules stored in the database 202 are reliable and effective detection rules. The detection rules stored in the database 202 are created using an automotive risk assessment method to address threats stipulated in UNR155, a cybersecurity regulation for automobiles issued by the United Nations Economic Commission for Europe (UNECE).

[0019] The SIEM realized by the control device 201, the SIEM realized by the control device 101, and the control devices 106, 107, and 108 can be optimized for various vehicle V architectures by hierarchically sharing the log analysis.

[0020] The configuration of the attack monitoring device 100 will be described in more detail below. In the attack monitoring device 100, the control device 101 constructs functional blocks as shown in FIG. 2 by having the CPU of the control device 101 execute computer programs stored in the ROM, RAM, and database 102 of the control device 101. The attack monitoring device 100 includes, as functional blocks, a log collection unit 121, a vehicle-side attack analysis unit 122, a priority monitoring determination unit 123, an offload determination unit 124, a processing load measurement unit 125, a communication unit 126, and a memory unit 130. The memory unit 130 includes a threat scenario table 131, a scenario progress management table 132, a priority monitoring list 133, an offload list 134, and a log 135. The contents of the threat scenario table 131, the scenario progress management table 132, the priority monitoring list 133, and the offload list 134 reflect the detection rules stored in the database 102.

[0021] The log collection unit 121 collects logs from the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The log collection unit 121 also collects security events from the security sensors of the server 200.

[0022] The vehicle-side attack analysis unit 122 calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of the first monitoring target (described later) based on the threat scenarios in the threat scenario table 131. A threat scenario is information summarizing the steps of a cyber-attack, including the critical path and events that will occur, for a predicted cyber-attack, and is, for example, in accordance with MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge).

[0023] The vehicle-side attack analysis unit 122 calculates the likelihood of a cyber-attack assumed in each threat scenario by analyzing the logs and security events of the first monitoring target based on the multiple threat scenarios in the scenario progress management table 132. If the likelihood of a cyber-attack calculated by the vehicle-side attack analysis unit 122 exceeds the cyber-attack occurrence threshold assumed in each threat scenario in the threat scenario table 131, the vehicle-side attack analysis unit 122 determines that a cyber-attack assumed in the threat scenario has occurred.

[0024] The priority monitoring determination unit 123 determines whether to execute priority monitoring of a cyber-attack assumed in the threat scenario. The priority monitoring determination unit 123 determines to have the vehicle-side attack analysis unit 122 execute priority monitoring when the likelihood of a cyber-attack assumed in the threat scenario calculated by the vehicle-side attack analysis unit 122 exceeds the likelihood threshold of the priority monitoring list 133. The priority monitoring involves changing either the scope of a first monitoring target for which the vehicle-side attack analysis unit 122 processes logs and security events based on the threat scenario, or the content of the processing of the log and security event analysis of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit 122.

[0025] The likelihood of a cyber-attack assumed in a threat scenario is, for example, a value indicating how many of the events constituting the threat scenario have been observed. The value indicating how many of the events constituting the threat scenario have been observed is, for example, the percentage of nodes in which anomalies have been observed among the number of nodes constituting the critical path in a threat scenario conforming to ATT&CK. The occurrence threshold and the likelihood threshold are both thresholds for the likelihood of a cyber-attack assumed in each threat scenario, but the likelihood threshold for determining whether to perform priority monitoring is set to a lower value than the occurrence threshold for determining whether a cyber-attack has occurred.

[0026] When the likelihood of a cyberattack assumed in a threat scenario exceeds a likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyberattack assumed in the threat scenario. The priority monitoring determination unit 123 performs priority monitoring in the order of the cyberattacks assumed in the threat scenarios with the highest priority monitoring priority in the priority monitoring list 133, which records the priority monitoring priority for each cyberattack assumed in each threat scenario. Performing priority monitoring in the order of the highest priority monitoring priority means, for example, that when there are multiple cyberattacks assumed in threat scenarios whose likelihood exceeds the likelihood threshold, priority monitoring is first performed on the cyberattack assumed in the threat scenario with the highest priority monitoring priority, and then priority monitoring is sequentially performed on the cyberattacks assumed in the threat scenarios with the second or subsequent priority monitoring priorities. This is because the likelihood of a cyberattack assumed in a threat scenario increases, making it necessary to strengthen monitoring of cyberattacks.

[0027] On the other hand, when the likelihood of a cyber-attack assumed in a threat scenario for which intensive monitoring is being performed is equal to or less than the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to stop intensive monitoring of the cyber-attack assumed in the threat scenario for which intensive monitoring is being performed. This is because the likelihood of a cyber-attack assumed in a threat scenario for which intensive monitoring is being performed decreases, making it unnecessary to strengthen monitoring of the cyber-attack, and making it necessary to reduce the processing load of the attack monitoring device 100. Note that the intensive monitoring priority is, for example, a priority based on the ranking of cyber-attacks assumed in a threat scenario for which intensive monitoring is being performed. The higher the intensive monitoring priority of a cyber-attack assumed in a threat scenario, the more important it is to monitor the cyber-attack.

[0028] The offload determination unit 124 determines whether to offload the processing of analyzing the logs and security events of the first monitoring target by the vehicle-side attack analysis unit 122 to a server-side attack analysis unit 222 that is implemented in a server 200 outside the vehicle V (described later) and calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of a second monitoring target based on a threat scenario. Offloading specifically refers to transferring the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 of the server 200, i.e., spatial offloading. Stopping offloading (described later) specifically refers to restoring the state in which the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122 was transferred to the server-side attack analysis unit 222 of the server 200, and causing the vehicle-side attack analysis unit 122 to execute the processing of analyzing the logs of the first monitoring target.

[0029] When the processing load measured by the processing load measurement unit 125, which measures the processing load of the attack monitoring device 100, exceeds the processing load threshold for starting offloading (first processing load threshold), the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the processing of analyzing the logs and security events of the first monitoring target by the vehicle-side attack analysis unit 122.

[0030] When the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the processing of analyzing logs and security events of the first monitoring target based on threat scenarios by the vehicle-side attack analysis unit 122 in the order of the processing of analyzing logs of the first monitoring target based on threat scenarios with the highest offload priority in the offload list 134, which records the offload priority for each processing of analyzing logs of the first monitoring target based on each threat scenario. This is because the processing of analyzing logs of the first monitoring target based on threat scenarios with the highest offload priority is less important for monitoring cyberattacks, and offloading is preferable to reduce the processing load of the attack monitoring device 100. Note that the offload priority is, for example, a priority based on the ranking of the processing of analyzing logs of the first monitoring target based on the threat scenario to be offloaded. The higher the offload priority, the less important the cyberattack is to be monitored for a cyberattack anticipated in a threat scenario.

[0031] On the other hand, when the processing load measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offloading (second processing load threshold), the offload determination unit 124 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing logs and security events of the first monitoring target based on a threat scenario having a low offload priority in the offload list 134, in order of the processing of analyzing logs of the first monitoring target based on a threat scenario having a low offload priority. The processing of analyzing logs of the first monitoring target based on a threat scenario having a low offload priority is of high importance for cyberattack monitoring by the attack monitoring device 100 on the vehicle V. Therefore, it is preferable to stop offloading to return to the original state in which the vehicle-side attack analysis unit 122 executes the processing of analyzing logs of the first monitoring target, thereby strengthening cyberattack monitoring by the attack monitoring device 100 on the vehicle V. The processing load threshold for starting offloading and the processing load threshold for stopping offloading may be different values, and the processing load threshold for starting offloading is equal to or greater than the processing load threshold for stopping offloading.

[0032] The processing load measurement unit 125 measures the processing load of the attack monitoring device 100. The processing load measurement unit 125 measures, for example, the utilization rate of the CPU (Central Processing Unit) of the integrated ECU of the attack monitoring device 100 as the processing load.

[0033] The communication unit 126 communicates with the server 200 and the zone ECUs 103, 104, and 105. The communication unit 126 transmits the processing load measured by the processing load measurement unit 125 to the server 200 outside the vehicle V. The communication unit 126 also transmits to the server 200 an offloading execution request including processing for analyzing the log of the first monitoring target based on a threat scenario for performing offloading, offloading details, and detection logic for when offloading is performed. The communication unit 126 also transmits to the server 200 an offloading stop request including processing for analyzing the log of the first monitoring target based on a threat scenario for stopping offloading.

[0034] The threat scenario table 131 is a table in which threat scenarios, detection logic for calculating the likelihood of a cyber-attack occurring based on the threat scenario, and a cyber-attack occurrence threshold value based on the threat scenario are recorded in association with each other. As shown in FIG. 3 , for example, the threat scenario table 131 records a threat scenario ID, a threat scenario name, a monitoring logic, and a cyber-attack occurrence threshold value based on each threat scenario in association with each other. In the monitoring logic, f_i() refers to the logic executed by the attack monitoring device 100 of the vehicle V, and g_j() refers to the logic executed by the server 200. In the monitoring logic, for example, g_2(log 8, f_2(log 6, log 7)) means that the server 200 analyzes log 8 and the output of the attack monitoring device 100 of the vehicle V analyzing logs 6 and 7.

[0035] The scenario progress management table 132 shown in Fig. 2 is a table in which the likelihood of a cyber-attack occurring assumed in a threat scenario calculated by the vehicle-side attack analysis unit 122 and a list of logs used for the calculation are recorded in association with each other. As shown in Fig. 4, for example, the scenario progress management table 132 records the ID of an ongoing threat scenario in which a cyber-attack is likely to occur, the name of the threat scenario, a log list, and the likelihood of a cyber-attack occurring assumed in the threat scenario in association with each other.

[0036] The priority monitoring list 133 shown in Figure 2 is a table that records threat scenarios and the priority monitoring priorities for each cyber attack assumed in each threat scenario. The priority monitoring list 133 records, in association with each other, the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring details of the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the detection logic for the priority monitoring, the probability threshold of the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring priority, and the priority monitoring status. As shown in Figure 5, for example, the priority monitoring list 133 records, in association with each other, the priority monitoring ID indicating the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the name of the threat scenario, the priority monitoring details, the priority monitoring logic, the probability threshold of the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring priority, and the priority monitoring status.

[0037] The focused monitoring content is, for example, a method for focused monitoring of cyber attacks assumed in a threat scenario. The method for focused monitoring of cyber attacks assumed in a threat scenario is, for example, expanding the monitoring range of the logs of the threat scenario and expanding the range of logs for which correlation analysis is performed in the detection logic of the cyber attacks assumed in the threat scenario. The focused monitoring state is, for example, one of three states: "in progress" in which focused monitoring is being performed, "stopped" in which focused monitoring is not being performed, and "forced stopped" in which focused monitoring, described below, is forcibly stopped.

[0038] The offload list 134 shown in Fig. 2 is a table that records the offload priority for each process of analyzing the log of the first monitoring target based on each threat scenario. The offload list 134 records, in association with each other, the process of analyzing the log of the first monitoring target based on the threat scenario to be offloaded, the offload content, the detection logic in the case of offloading, the offload priority, and the offload status. As shown in Fig. 6, for example, the offload list 134 records, in association with each other, an offload ID indicating the process of analyzing the log of the first monitoring target based on the threat scenario to be offloaded, the threat scenario name, the offload content indicating the details of the offload, the offload details indicating the detection logic in the server 200 in the case of offloading, the offload priority, and the offload status.

[0039] The offloading content may be, for example, moving the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 of the server 200, i.e., spatial offloading, as described above. The offloading content may also include, for example, delaying the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122, i.e., temporal offloading. The offloading content may also include, for example, reducing the range of logs that are analyzed by the vehicle-side attack analysis unit 122 for the first monitoring target. The offloading state may be one of two states: "running," in which offloading is being performed, or "stopped," in which offloading is not being performed.

[0040] 2 stores logs and security events collected by the log collection unit 121. The log 135 stores logs output by the vehicle-side attack analysis unit 122, the priority monitoring determination unit 123, the offload determination unit 124, and the processing load measurement unit 125.

[0041] The configuration of the server 200 will be described in further detail below. In the server 200, the control device 201 constructs functional blocks as shown in FIG. 7 by having the CPU of the control device 201 execute computer programs stored in the ROM, RAM, and database 202 of the control device 201 in accordance with detection rules stored in the database 202. As shown in FIG. 7 , the server 200 includes a log collection unit 221, a server-side attack analysis unit 222, an offload reception unit 223, a display unit 224, a communication unit 227, and a memory unit 230. The display unit 224 includes a monitoring status table 225 and a processing load graph 226. The memory unit 230 includes a threat scenario table 231, a scenario progress management table 232, an offload list 233, and a log 234. The contents of the threat scenario table 231, the scenario progress management table 232, and the offload list 233 reflect the detection rules stored in the database 202.

[0042] The log collection unit 221 collects logs from the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The log collection unit 221 also collects security events from the security sensors of the server 200.

[0043] The server-side attack analysis unit 222 is implemented in the server 200 outside the vehicle V and calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of the second monitoring target, which will be described later, based on a threat scenario. The server-side attack analysis unit 222 calculates the likelihood of a cyber-attack assumed in each threat scenario by analyzing the logs and security events of the second monitoring target based on a plurality of threat scenarios in the threat scenario table 231. If the likelihood of a cyber-attack calculated by the server-side attack analysis unit 222 exceeds the threshold for occurrence of a cyber-attack assumed in each threat scenario in the threat scenario table 231, the server-side attack analysis unit 222 determines that a cyber-attack assumed in the threat scenario has occurred.

[0044] The offload reception unit 223 receives an offload execution request from the attack monitoring device 100. When the offload determination unit 124 of the attack monitoring device 100 determines to have the server-side attack analysis unit 222 offload the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122, and the offload reception unit 223 receives the offload execution request from the attack monitoring device 100, the server-side attack analysis unit 222 executes at least a part of the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122. In other words, the server-side attack analysis unit 222 includes at least a part of the first monitoring target by the vehicle-side attack analysis unit 122 in the second monitoring target.

[0045] The server-side attack analysis unit 222 performs processing to analyze the logs and security events of the first monitoring target included in the second monitoring target, in accordance with the offload content and detection logic for offloading included in the offload request from the attack monitoring device 100 received by the offload reception unit 223. The offload reception unit 223 receives an offload stop request from the attack monitoring device 100. When the offload determination unit 124 of the attack monitoring device 100 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122, and the offload reception unit 223 receives the offload stop request from the attack monitoring device 100, the server-side attack analysis unit 222 stops the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122.

[0046] The display unit 224 displays a monitoring status table 225 and a processing load graph 226 on the screen. As shown in Fig. 8, for example, the monitoring status table 225 is a table that displays, for each threat scenario ID, the threat scenario name, the intensive monitoring status, and the offload status. As shown in Fig. 9, for example, the processing load graph 226 displays the CPU usage rate, which is the processing load measured by the processing load measurement unit 125 of the attack monitoring device 100 for each hour. In the example of Fig. 9, the CPU usage rate increases after intensive monitoring is performed, and decreases after offloading is performed.

[0047] 7 communicates with the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The communication unit 227 receives the processing load of the attack monitoring device 100 transmitted by the communication unit 126 of the attack monitoring device 100. The communication unit 227 also receives an offload execution request transmitted by the communication unit 126 of the attack monitoring device 100, which includes processing for analyzing the logs of the first monitoring target based on a threat scenario for offloading, offload content, and detection logic for when offloading is performed. The communication unit 227 also receives an offload stop request transmitted by the communication unit 126 of the attack monitoring device 100, which includes processing for analyzing the logs of the first monitoring target based on a threat scenario for stopping offloading.

[0048] The threat scenario table 231, scenario progress management table 232, and offload list 233 in the memory unit 230 correspond to the threat scenario table 131, scenario progress management table 132, and offload list 134 in the memory unit 130 of the attack monitoring device 100, respectively. The log 234 stores logs and security events collected by the log collection unit 221. The log 234 stores logs output by the server-side attack analysis unit 222 and the offload reception unit 223.

[0049] In operations related to the server 200, the priority monitoring judgment unit 123 of the attack monitoring device 100 shown in Figure 2 judges that when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading and there is no processing of analyzing the logs of the first monitoring target based on a threat scenario that has not caused the server-side attack analysis unit 222 to offload the processing of analyzing the logs of the first monitoring target based on a threat scenario by the vehicle-side attack analysis unit 122, the priority monitoring judgment unit 123 determines that the vehicle-side attack analysis unit 122 should forcibly stop the priority monitoring of the cyber attacks assumed in the threat scenarios, in the order of the cyber attacks assumed in the threat scenarios with the lowest priority monitoring priority in the priority monitoring list 133.

[0050] This is because the processing load on the attack monitoring device 100 is high, there is no processing to analyze the logs of the first monitoring target based on a threat scenario for which offloading is not being performed, and further offloading is not possible, so it is preferable to forcibly stop priority monitoring and reduce the processing load on the attack monitoring device 100.

[0051] The intensive monitoring determination unit 123 determines that the vehicle-side attack analysis unit 122 should not perform intensive monitoring of the cyber-attack assumed in the threat scenario that caused the intensive monitoring to be forcibly stopped, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold before the specified time has elapsed. This is because, since the time that has passed since the forced stop is short and there is a high likelihood that the situation will not change much, it is preferable to continue the forced stop and reduce the processing load on the attack monitoring device 100.

[0052] On the other hand, when the likelihood of a cyber-attack assumed in the threat scenario that caused the intensive monitoring to be forcibly stopped exceeds the likelihood threshold after a specified time has elapsed, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario. Because a long time has passed since the forced stop and there is a high likelihood that the situation will change significantly, it is preferable to stop the forced stop and strengthen monitoring against the cyber-attack whose likelihood of occurrence has increased.

[0053] The following describes the division of responsibilities for the integrated analysis of logs against cyber-attacks assumed in the threat scenario. Figure 10(A) shows nodes 401, 402, 403, 404, 411, 412, and 421 that constitute the critical path in the case of unauthorized operation of vehicle V by a malicious ECU. Cyber-attacks against nodes 401, 402, 403, and 404 are detected by sensors in control devices 106, 107, and 108 of zone ECUs 103, 104, and 105. Cyber-attacks against nodes 411 and 412 are detected by sensors in the control device 101 of the attack monitoring device 100, i.e., by the vehicle-side attack analysis unit 122. Cyber-attacks against node 421 are detected by sensors in the control device 201 of the server 200, i.e., by the server-side attack analysis unit 222.

[0054] 10(B) shows nodes 405, 406, 413, and 422 that make up the critical path in a vehicle theft by a Controller Area Network (CAN) invader. A cyberattack on nodes 405 and 406 is detected by sensors in the control devices 106, 107, and 108 of the zone ECUs 103, 104, and 105. A cyberattack on node 413 is detected by a sensor in the control device 101 of the attack monitoring device 100, i.e., by the vehicle-side attack analysis unit 122. A cyberattack on node 422 is detected by a sensor in the control device 201 of the server 200, i.e., by the server-side attack analysis unit 222.

[0055] 10(C) shows nodes 423, 424, 414, 407, and 408 that make up the critical path in unauthorized remote operation from server 200. Cyberattacks on nodes 423 and 424 are detected by a sensor in control device 201 of server 200, i.e., by the server-side attack analysis unit 222. Cyberattacks on node 414 are detected by a sensor in control device 101 of attack monitoring device 100, i.e., by the vehicle-side attack analysis unit 122. Cyberattacks on nodes 407 and 408 are detected by sensors in control devices 106, 107, and 108 of zone ECUs 103, 104, and 105.

[0056] The integrated analysis of the logs of the nodes that make up the critical path of these cyber attacks is shared between the vehicle-side attack analysis unit 122 of the attack monitoring device 100 and the server-side attack analysis unit 222 of the server 200. As shown in Figure 11 (A) , in the case of unauthorized operation of the vehicle V by a fraudulent ECU, under normal circumstances, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber attack occurring by analyzing the logs of the nodes 401, 402, 403, 404, 411, and 412, which are the first monitoring target 501, based on a threat scenario, and the server-side attack analysis unit 222 of the server 200 calculates the possibility of a cyber attack occurring by analyzing the logs of the nodes 412 and 421, which are the second monitoring target 502, based on the threat scenario.

[0057] As shown in Figure 11 (B), in the case of vehicle theft by a CAN invader, under normal circumstances, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 405, 406, and 413, which are the first monitoring target 501, based on the threat scenario, and the server-side attack analysis unit 222 of the server 200 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 413 and 422, which are the second monitoring target 502, based on the threat scenario.

[0058] As shown in Figure 11 (C), in the event of unauthorized remote operation from server 200, under normal circumstances, the server-side attack analysis unit 222 of server 200 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 423, 424, and 414, which are the second monitoring target 502, based on the threat scenario, and the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 414, 407, and 408, which are the first monitoring target 501, based on the threat scenario.

[0059] For nodes where the first monitoring target 501 and the second monitoring target 502 overlap, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 and the server-side attack analysis unit 222 of the server 200 work together to analyze logs based on threat scenarios. In this embodiment, the execution location of the cyber-attack detection logic is dynamically changed between the attack monitoring device 100 and the server 200 depending on the processing load of the attack monitoring device 100 and the status of the cyber-attack, and the first monitoring target 501 and the second monitoring target 502 of the cyber-attack detection logic are expanded and contracted relative to each other.

[0060] Below, an outline of the priority monitoring and off-road operations of the attack monitoring device 100 will be described with reference to Figures 12 and 13. The priority monitoring operation shown in Figure 12 and the off-road operation shown in Figure 13 are performed in parallel. As shown in Figure 12, in the priority monitoring operation, the priority monitoring determination unit 123 of the attack monitoring device 100 determines whether there is a cyber-attack predicted in a threat scenario in which the possibility of an attack is increasing (S11). When the priority monitoring determination unit 123 determines that there is a cyber-attack predicted in a threat scenario in which the possibility of an attack is increasing (S11), the priority monitoring determination unit 123 determines whether to perform priority monitoring (S12). When the priority monitoring determination unit 123 determines to perform priority monitoring, the priority monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to perform priority monitoring (S13).

[0061] When the vehicle-side attack analysis unit 122 is performing intensive monitoring, the intensive monitoring determination unit 123 determines whether to continue intensive monitoring (S14). When the intensive monitoring determination unit 123 determines to continue intensive monitoring (S14), the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to perform intensive monitoring (S13). When the intensive monitoring determination unit 123 determines not to continue intensive monitoring (S14), the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to stop intensive monitoring (S15). Note that when the intensive monitoring determination unit 123 determines that there is no cyber-attack predicted in the threat scenario in which the possibility of attack is increasing (S11), the intensive monitoring determination unit 123 terminates processing. When the intensive monitoring determination unit 123 determines not to perform intensive monitoring (S12), the intensive monitoring determination unit 123 terminates processing.

[0062] 13 , in the offloading operation, the offloading determination unit 124 determines whether the processing load on the attack monitoring device 100 is increasing (S21). When the offloading determination unit 124 determines that the processing load on the attack monitoring device 100 is increasing (S21), the offloading determination unit 124 determines whether offloading to the server 200 is possible (S22). When the offloading determination unit 124 determines that offloading to the server 200 is possible (S22), the offloading determination unit 124 causes the communication unit 126 to send an offloading execution request to the server 200, causing the server 200 to execute the offloading (S23).

[0063] When the offload determination unit 124 is causing the server 200 to perform offloading (S23), the offload determination unit 124 determines whether the processing load has sufficiently decreased (S24). When the offload determination unit 124 determines that the processing load has not sufficiently decreased (S24), the offload determination unit 124 causes the server 200 to perform offloading (S23). When the offload determination unit 124 determines that the processing load has sufficiently decreased (S24), the offload determination unit 124 causes the communication unit 126 to send an offload stop request to the server 200, causing the server 200 to stop offloading (S25).

[0064] When the offload determination unit 124 determines that the processing load of the attack monitoring device 100 is not high (S21), the offload determination unit 124 terminates processing. When the offload determination unit 124 determines that offloading to the server 200 is not possible (S22), the intensive monitoring determination unit 123 determines whether or not there is a cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26). When the intensive monitoring determination unit 123 determines that there is a cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26), the intensive monitoring determination unit 123 forcibly stops the intensive monitoring by the vehicle-side attack analysis unit 122 (S27). When the intensive monitoring determination unit 123 determines that there is no cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26), the intensive monitoring determination unit 123 terminates processing.

[0065] The offloading operation of the server 200 will be described below with reference to Figure 14. The offloading reception unit 223 of the server 200 determines whether the communication unit 227 has received an offloading execution request from the communication unit 126 of the attack monitoring device 100 (S31). When the offloading reception unit 223 determines that the communication unit 227 has received an offloading execution request (S31), the server-side attack analysis unit 222 executes the offloading (S32). The server-side attack analysis unit 222 executes at least a part of the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122.

[0066] When the server-side attack analysis unit 222 is performing offloading (S32), the offload reception unit 223 determines whether the communication unit 227 has received an offloading stop request from the communication unit 126 of the attack monitoring device 100 (S33). When the offload reception unit 223 determines that the communication unit 227 has not received an offloading stop request (S33), the server-side attack analysis unit 222 performs offloading (S32). When the offload reception unit 223 determines that the communication unit 227 has received an offloading stop request (S33), the server-side attack analysis unit 222 stops offloading (S34). The server-side attack analysis unit 222 stops the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122. When the offload reception unit 223 determines that the communication unit 227 has not received an offloading execution request (S31), the offload reception unit 223 ends the process.

[0067] Specifically, the above-described priority monitoring operation shown in Fig. 12 and the off-load operation shown in Fig. 13 in the attack monitoring device 100 are realized by the integrated ECU, which is the attack monitoring device 100, periodically and repeatedly executing the flowcharts shown in Figs. 15 to 19, which will be described below. First, the priority monitoring execution process will be described. As shown in Fig. 15, the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and determines whether there is a cyber-attack assumed in a threat scenario whose likelihood of occurrence exceeds the likelihood threshold and for which the priority monitoring status is currently suspended (S101).

[0068] When the priority monitoring determination unit 123 determines that there is a cyber-attack assumed in a threat scenario whose likelihood exceeds the likelihood threshold and whose priority monitoring status is currently stopped (S101), the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and causes the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyber-attack assumed in the threat scenario with the highest priority monitoring priority among the cyber-attacks assumed in the threat scenarios that satisfy the conditions that the likelihood exceeds the likelihood threshold and the priority monitoring status is currently stopped, and changes the priority monitoring status of the cyber-attack assumed in the threat scenario in the priority monitoring list 133 to "ongoing" (S102). When the priority monitoring determination unit 123 determines that there is no cyber-attack assumed in a threat scenario whose likelihood exceeds the likelihood threshold and whose priority monitoring status is currently stopped (S101), the priority monitoring determination unit 123 terminates processing.

[0069] 16, the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and determines whether or not there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is active and the likelihood of occurrence is equal to or less than the likelihood threshold (S201).

[0070] When the priority monitoring determination unit 123 determines that the priority monitoring state is active and that there is a cyber-attack assumed in a threat scenario whose likelihood of occurrence is equal to or less than the likelihood threshold (S201), the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and causes the vehicle-side attack analysis unit 122 to stop the corresponding priority monitoring for all threat scenarios for which the priority monitoring state is active and whose likelihood of occurrence is equal to or less than the likelihood threshold, and changes the priority monitoring state of the threat scenario in the priority monitoring list 133 to "stopped" (S202).When the priority monitoring determination unit 123 determines that the priority monitoring state is active and that there is no cyber-attack assumed in a threat scenario whose likelihood of occurrence is equal to or less than the likelihood threshold (S201), the priority monitoring determination unit 123 ends the processing.

[0071] Next, the offload execution process will be described. As shown in Fig. 17 , the offload determination unit 124 determines whether the processing load of the attack monitoring device 100 measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading (S301). When the offload determination unit 124 determines that the processing load exceeds the processing load threshold for starting offloading (S301), the offload determination unit 124 refers to the offload list 134 and determines whether there is a process for analyzing the log of the first monitoring target 501 based on a threat scenario for which the offload status is stopped (S302).

[0072] When the offload determination unit 124 determines that there is a process for analyzing the log of the first monitoring target 501 based on a threat scenario for which the offload state is stopped (S302), the offload determination unit 124 refers to the offload list 134, determines to execute offloading of the process for analyzing the log of the first monitoring target 501 based on the threat scenario with the highest offload priority among the processes for analyzing the log of the first monitoring target 501 based on the threat scenario for which the offload state is stopped, and changes the offload state of the process for analyzing the log of the first monitoring target 501 based on the threat scenario in the offload list 134 to "in progress" (S303). The offload determination unit 124 causes the vehicle-side attack analysis unit 122 to change the process for analyzing the log of the first monitoring target 501 based on the threat scenario for which the offload state is stopped, according to the offload content and offload details in the offload list 134, and causes the communication unit 126 to send an offload execution request to the server 200.

[0073] When the offload determination unit 124 determines that the processing load does not exceed the processing load threshold for starting offloading (S301), the offload determination unit 124 terminates the processing. When the offload determination unit 124 determines that there is no processing of log analysis of the first monitoring target 501 based on a threat scenario for which the offload state is stopped (S302), that is, when the offload state of processing of log analysis of the first monitoring target 501 based on all threat scenarios is running, the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to execute processing to forcibly stop the intensive monitoring of cyber-attacks assumed in the threat scenarios, as shown in FIG.

[0074] 18 , the offload determination unit 124 refers to the offload list 134 and determines whether the processing load of the attack monitoring device 100 measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offloading and whether there is a log analysis process for the first monitoring target 501 based on a threat scenario in which the offload state is active (S401).

[0075] When the offload determination unit 124 determines that the processing load is equal to or less than the processing load threshold for stopping offloading and that there is processing of log analysis of the first monitoring target 501 based on a threat scenario for which the offload state is running (S401), the offload determination unit 124 refers to the offload list 134, determines to stop offloading of the processing of log analysis of the first monitoring target 501 based on the threat scenario with the lowest offload priority, and changes the offload state of the processing of log analysis of the first monitoring target 501 based on that threat scenario in the offload list 134 to stopped (S402). The offload determination unit 124 causes the vehicle-side attack analysis unit 122 to change the processing of log analysis of the first monitoring target 501 to normal processing, and causes the communication unit 126 to send an offload stop request to the server 200. When the offload determination unit 124 determines that the processing load is below the processing load threshold for stopping offloading and there is no processing to analyze the log of the first monitoring target 501 based on a threat scenario in which the offload state is running (S401), the offload determination unit 124 terminates processing.

[0076] Finally, the process of forcibly stopping priority monitoring will be described. When the offload determination unit 124 determines that the processing load exceeds the processing load threshold for starting offloading and that there is no threat scenario in which the offload state is stopped, the priority monitoring determination unit 123 refers to the priority monitoring list 133 and determines whether there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is currently active in the priority monitoring list 133 (S501), as shown in FIG. 19 . When the priority monitoring determination unit 123 determines that there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is currently active (S501), the priority monitoring determination unit 123 refers to the priority monitoring list 133 and forcibly stops the priority monitoring of the cyber-attack assumed in the threat scenario with the lowest priority monitoring priority among the cyber-attacks assumed in the threat scenario in which the priority monitoring state is currently active, and changes the priority monitoring status of the cyber-attack assumed in that threat scenario in the priority monitoring list 133 to forced stop (S502).

[0077] After forcibly stopping the intensive monitoring of the cyberattack assumed in the threat scenario, the intensive monitoring determination unit 123 changes the intensive monitoring status of the cyberattack assumed in the threat scenario in the intensive monitoring list 133 to "stopped" after a specified time has elapsed (S503). In other words, for the cyberattack assumed in the threat scenario for which the intensive monitoring was forcibly stopped, the intensive monitoring determination unit 123 determines not to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyberattack assumed in the threat scenario even if the likelihood of the cyberattack assumed in the threat scenario exceeds the likelihood threshold before the specified time has elapsed. On the other hand, for the cyberattack assumed in the threat scenario for which the intensive monitoring was forcibly stopped, when the likelihood of the cyberattack assumed in the threat scenario exceeds the likelihood threshold after the specified time has elapsed, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyberattack assumed in the threat scenario.

[0078] When the intensive monitoring determination unit 123 determines that there is no cyber attack assumed in the threat scenario in which the intensive monitoring state is being executed (S501), the intensive monitoring determination unit 123 ends the processing.

[0079] The processing of S11 to S13 in the execution of priority monitoring shown in Fig. 12 is realized by periodic processing F1 in the flowchart of Fig. 15. The processing of S14 to S15 in the stop of priority monitoring shown in Fig. 12 is realized by periodic processing F2 in the flowchart of Fig. 16. The processing of S21 to S23 in the execution of offloading shown in Fig. 13 is realized by periodic processing F3 in the flowchart of Fig. 17. The processing of S24 to S25 in the stop of offloading shown in Fig. 13 is realized by periodic processing F4 in the flowchart of Fig. 18. The processing of forcibly stopping priority monitoring shown in Fig. 13 is realized by periodic processing F5 in the flowchart of Fig. 19.

[0080] The following describes how the first monitoring target 501 and the second monitoring target 502 are changed by the above-mentioned focused monitoring and offloading processes. In the first monitoring target 501 and the second monitoring target 502 shown in Figures 11(A) to (C), when the processing load of the attack monitoring device 100 exceeds the processing load threshold for starting offloading in a multi-function operating state, as shown in Figures 20(A) to (C), part of the processing of the log analysis of the first monitoring target 501 by the attack monitoring device 100 is offloaded to the second monitoring target 502 by the server 200. Comparing Figures 11(A) to (C) with Figures 19(A) to (C), the first monitoring target 501 by the attack monitoring device 100 has been reduced, and the second monitoring target 502 by the server 200 has been expanded.

[0081] Furthermore, in the first monitoring target 501 and the second monitoring target 502 shown in Figures 11(A) to 11(C), when the likelihood of vehicle theft by a CAN invader in Figure 11(B) exceeds the likelihood threshold, as shown in Figure 21(B), for cyber attacks assumed in the threat scenario of vehicle theft by a CAN invader, the first monitoring target 501 and the second monitoring target 502 remain unchanged, and the attack monitoring device 100 performs focused monitoring of the first monitoring target 501. On the other hand, in the case of unauthorized operation of the vehicle V by a fraudulent ECU in Figure 21(A) and unauthorized remote operation from the server 200 in Figure 22(C), the entire process of analyzing the logs of the first monitoring target 501 by the attack monitoring device 100 is offloaded to the second monitoring target 502 by the server 200. This makes it possible to strengthen monitoring of cyber attacks with a high likelihood of occurrence while reducing the processing load.

[0082] 21(A) to 21(C), in the case where the attack monitoring device 100 performs focused monitoring of cyber-attacks assumed in a threat scenario and offloads the processing of log analysis of the first monitoring target 501 based on another threat scenario to the server 200, the cyber-attacks assumed in the threat scenario where the processing is not offloaded to the server 200 but is left to the first monitoring target 501 by the attack monitoring device 100 and focused monitoring is performed are, for example, cyber-attacks assumed in threat scenarios that are difficult to monitor unless on the side of the vehicle V. Cyber-attacks assumed in threat scenarios that are difficult to monitor unless on the side of the vehicle V are, for example, attacks on the navigation system and tampering with CAN messages.

[0083] According to this embodiment, the attack monitoring device 100 installed in the vehicle V includes a vehicle-side attack analysis unit 122 that calculates the likelihood of a cyberattack by analyzing the logs of the first monitoring target 501 based on a threat scenario, and an offload determination unit 124 that determines whether to offload the analysis of the logs of the first monitoring target 501 by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 installed in the server 200 outside the vehicle V that calculates the likelihood of a cyberattack by analyzing the logs of the second monitoring target 502 based on a threat scenario. In other words, in this embodiment, offloading dynamically changes the execution location of the attack detection logic between the attack monitoring device 100 and the server 200, expanding and contracting the first monitoring target 501 and the second monitoring target 502 of the detection logic. This allows for continued cyberattack monitoring using a resource-constrained in-vehicle system.

[0084] Furthermore, according to this embodiment, the attack monitoring device 100 further includes a processing load measurement unit 125 that measures the processing load of the attack monitoring device 100, and when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the processing of analyzing the logs of the first monitoring target 501 by the vehicle-side attack analysis unit 122. This makes it possible to offload according to the processing load of the attack monitoring device 100.

[0085] Furthermore, according to this embodiment, the vehicle-side attack analysis unit 122 analyzes the logs of the first monitoring target based on multiple threat scenarios to calculate the likelihood of a cyber-attack occurring for each of the threat scenarios, and further includes an offload list 134 in which the offload priority for each process of analyzing the logs of the first monitoring target 501 based on each of the threat scenarios is recorded, and when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the process of analyzing the logs of the first monitoring target 501 based on the threat scenarios by the vehicle-side attack analysis unit 122 in the order of the processes of analyzing the logs of the first monitoring target 501 based on the threat scenarios with the highest offload priority in the offload list 134. This makes it possible to offload according to the offload priority for each process of analyzing the logs of the first monitoring target 501 based on each of the threat scenarios.

[0086] Furthermore, according to this embodiment, when the processing load measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offloading, the offload determination unit 124 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing the log of the first monitoring target 501 based on a threat scenario by the vehicle-side attack analysis unit 122, in the order of processing of analyzing the log of the first monitoring target 501 based on a threat scenario with a low offload priority in the offload list. This makes it possible to stop offloading according to the processing load and offload priority.

[0087] Furthermore, according to this embodiment, the system further includes a priority monitoring determination unit 123 that determines whether to perform priority monitoring of a threat scenario, and when the likelihood of a cyber-attack assumed in the threat scenario exceeds an occurrence likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring that involves changing either the range of the first monitoring target 501 for which the vehicle-side attack analysis unit 122 will perform log analysis processing based on the threat scenario or the content of the processing of the log of the first monitoring target 501 based on the threat scenario by the vehicle-side attack analysis unit 122. Therefore, priority monitoring is performed in accordance with the likelihood of a cyber-attack assumed in the threat scenario, and it is possible to improve the accuracy of detecting cyber-attacks assumed in threat scenarios with increased likelihood.

[0088] Furthermore, according to this embodiment, the system further includes a priority monitoring list 133 that records the priority monitoring priority for each cyber-attack assumed in each threat scenario, and when the likelihood of a cyber-attack assumed in a threat scenario exceeds the likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyber-attacks assumed in the threat scenarios, in descending order of priority monitoring priority in the priority monitoring list 133. Therefore, priority monitoring can be performed according to the likelihood of an attack occurring in a threat scenario and the priority monitoring priority.

[0089] Furthermore, according to this embodiment, when the likelihood of a cyber-attack assumed in a threat scenario for which intensive monitoring has been started is equal to or less than the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to stop intensive monitoring of the cyber-attack assumed in the threat scenario for which the likelihood is equal to or less than the likelihood threshold. Therefore, intensive monitoring can be stopped depending on the likelihood of a cyber-attack assumed in the threat scenario.

[0090] Furthermore, according to this embodiment, when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading and the server-side attack analysis unit 222 is not performing the processing of analyzing the log of the first monitoring target 501 based on a threat scenario that does not involve offloading of the processing of analyzing the log of the first monitoring target 501 by the vehicle-side attack analysis unit 122, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to forcibly stop the priority monitoring of the cyber-attacks assumed in the threat scenarios, in the order of the cyber-attacks assumed in the threat scenarios with the lowest priority monitoring priority in the priority monitoring list 133. Therefore, priority monitoring can be forcibly stopped depending on the processing load and whether offloading is possible.

[0091] Furthermore, according to this embodiment, with regard to a cyber-attack assumed in a threat scenario for which intensive monitoring was forcibly stopped, before a specified time has elapsed, the intensive monitoring determination unit 123 determines not to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold, and after the specified time has elapsed, when the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario. Therefore, the forced stop can be canceled and intensive monitoring can be performed again depending on the time since the intensive monitoring was forcibly stopped.

[0092] Furthermore, according to this embodiment, the vehicle V further includes a communication unit 126 that transmits the processing load measured by the processing load measurement unit 125 to a server 200 external to the vehicle V. This allows the server 200 to grasp the processing load of the attack monitoring device 100. Furthermore, according to this embodiment, the server 200 includes a display unit 224 that includes a monitoring status table 225 and a processing load graph 226, making it easy for the server 200 to monitor the status of the attack monitoring device 100 of the vehicle V.

[0093] According to the present embodiment described above, appropriate offloading allows security monitoring to continue without affecting other functions, even when the integrated ECU of the attack monitoring device 100 is under high load. Furthermore, in this embodiment, appropriate focused monitoring and offloading allow the attack monitoring device 100 to quickly and accurately detect cyber-attacks assumed in threat scenarios that are suspected to occur.

[0094] Furthermore, when the attack monitoring device 100 of this embodiment is applied to a vehicle V, appropriate focused monitoring and offloading can improve the availability of security monitoring and attack detection accuracy without significantly adding resources to the ECU of the attack monitoring device 100, resulting in improved safety for the vehicle V. Furthermore, according to this embodiment, when applied to a vehicle V, it can be implemented as a periodic process suitable for processing by the on-board ECU. Furthermore, according to this embodiment, highly cost-effective cybersecurity measures are possible.

[0095] The present invention is not limited to the above-described embodiments, and various design modifications can be made without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments have been described in detail to facilitate understanding of the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configurations of the above-described embodiments with other configurations, and it is also possible to add other configurations to the configurations of the above-described embodiments. Furthermore, it is possible to add, delete, or replace other configurations with part of the configurations of the above-described embodiments.

[0096] REFERENCE SIGNS LIST 100 Attack monitoring device 101 Control device 102 Database 103, 104, 105 Zone ECU 106, 107, 108 Control device 109, 110, 111 Database 121 Log collection unit 122 Vehicle-side attack analysis unit 123 Priority monitoring determination unit 124 Offload determination unit 125 Processing load measurement unit 126 Communication unit 130 Memory unit 131 Threat scenario table 132 Scenario progress management table 133 Priority monitoring list 134 Offload list 135 Log 200 Server 201 Control device 202 Database 221 Log collection unit 222 Server-side attack analysis unit 223 Offload reception unit 224 Display unit 225 Monitoring status table 226 Processing load graph 300 Attack monitoring system 401, 402, 403, 404, 405, 406, 407, 408 nodes 411, 412, 413, 414 nodes 421, 422, 423, 424 nodes 501 First monitoring object 502 Second monitoring object F1, F2, F3, F4, F5 Processing V Vehicle

Claims

1. An attack monitoring device implemented in a vehicle, comprising: a vehicle-side attack analysis unit that calculates the likelihood of a cyber-attack occurring by analyzing the logs of a first monitored object based on a threat scenario; and an offload determination unit that determines whether to offload the process of analyzing the logs of the first monitored object from the vehicle-side attack analysis unit to a server-side attack analysis unit that is implemented in a server external to the vehicle and calculates the likelihood of a cyber-attack occurring by analyzing the logs of a second monitored object based on the threat scenario.

2. An attack monitoring device as described in claim 1, further comprising a processing load measurement unit that measures the processing load of the attack monitoring device, and wherein the offload determination unit determines to cause the server-side attack analysis unit to offload the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit when the processing load measured by the processing load measurement unit exceeds a first processing load threshold.

3. The attack monitoring device described in claim 2, characterized in that the vehicle-side attack analysis unit calculates the likelihood of a cyber-attack occurring for each of the threat scenarios by analyzing the logs of the first monitored target based on multiple threat scenarios, and further has an offload list in which an offload priority is recorded for each process of analyzing the logs of the first monitored target based on each of the threat scenarios, and the offload determination unit determines, when the processing load measured by the processing load measurement unit exceeds the first processing load threshold, to have the server-side attack analysis unit offload the process of analyzing the logs of the first monitored target based on the threat scenarios by the vehicle-side attack analysis unit in the order of the processes of analyzing the logs of the first monitored target based on the threat scenarios with the highest offload priority in the offload list.

4. The attack monitoring device described in claim 3, characterized in that when the processing load measured by the processing load measurement unit is equal to or less than a second processing load threshold, the offload determination unit determines to cause the server-side attack analysis unit to stop offloading the processing of analyzing the logs of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit in the order of the processing of analyzing the logs of the first monitoring target based on the threat scenario with a lower offload priority in the offload list.

5. An attack monitoring device as described in claim 4, further comprising a priority monitoring determination unit that determines whether to perform priority monitoring of cyber attacks assumed in the threat scenario, wherein the priority monitoring determination unit determines, when the likelihood of a cyber attack assumed in the threat scenario exceeds a likelihood threshold, to cause the vehicle-side attack analysis unit to perform the priority monitoring, which involves changing either the scope of the first monitoring target for which the vehicle-side attack analysis unit processes logs based on the threat scenario, or the content of the processing of the log analysis of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit.

6. The attack monitoring device described in claim 5, further comprising a priority monitoring list in which the priority monitoring priority for each cyber attack assumed in each of the threat scenarios is recorded, and wherein the priority monitoring determination unit determines, when the likelihood of a cyber attack assumed in the threat scenario exceeds the likelihood threshold, to cause the vehicle-side attack analysis unit to perform the priority monitoring of the cyber attacks assumed in the threat scenarios in the order of the cyber attacks assumed in the threat scenarios with the highest priority monitoring priority in the priority monitoring list.

7. The attack monitoring device described in claim 6, characterized in that when the likelihood of a cyber-attack assumed in the threat scenario for which the intensive monitoring is being performed is below the likelihood threshold, the intensive monitoring judgment unit judges to cause the vehicle-side attack analysis unit to stop the intensive monitoring of a cyber-attack assumed in the threat scenario for which the likelihood of the cyber-attack is below the likelihood threshold.

8. The attack monitoring device described in claim 7, characterized in that when the processing load measured by the processing load measurement unit exceeds the first processing load threshold and there is no processing of analysis of the logs of the first monitoring target based on the threat scenario that does not cause the server-side attack analysis unit to offload the processing of analysis of the logs of the first monitoring target by the vehicle-side attack analysis unit, the priority monitoring determination unit determines to force the vehicle-side attack analysis unit to stop the priority monitoring of the cyber attacks assumed in the threat scenario in the order of the priority monitoring priority in the priority monitoring list.

9. The attack monitoring device described in claim 8, characterized in that the priority monitoring judgment unit judges not to cause the vehicle-side attack analysis unit to perform the priority monitoring of the cyber-attack assumed in the threat scenario that forcibly stopped the priority monitoring before the specified time has elapsed, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold, and judges to cause the vehicle-side attack analysis unit to perform the priority monitoring of the cyber-attack assumed in the threat scenario after the specified time has elapsed, when the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold.

10. The attack monitoring device according to claim 9, further comprising a communication unit that transmits the processing load measured by the processing load measurement unit to the server outside the vehicle.

11. An attack monitoring system comprising: an attack monitoring device according to any one of claims 1 to 10; and a server external to the vehicle having a server-side attack analysis unit that calculates the likelihood of a cyber-attack occurring by analyzing the logs of the second monitored target based on the threat scenario, wherein when the offload determination unit determines to offload the processing of analyzing the logs of the first monitored target by the vehicle-side attack analysis unit to the server-side attack analysis unit, the server-side attack analysis unit executes at least a part of the processing of analyzing the logs of the first monitored target by the vehicle-side attack analysis unit.

12. An attack monitoring method characterized in that a vehicle-side attack analysis unit implemented in a vehicle calculates the possibility of a cyber-attack occurring by analyzing the logs of a first monitored object based on a threat scenario, a server-side attack analysis unit implemented in a server external to the vehicle calculates the possibility of a cyber-attack occurring by analyzing the logs of a second monitored object based on the threat scenario, and an offload determination unit implemented in the vehicle determines whether to offload the process of analyzing the logs of the first monitored object by the vehicle-side attack analysis unit to the server-side attack analysis unit.

Images