Detection device, detection method, and detection program

Abstract

This detection device detects an abnormal operation of software being monitored, the detection device comprising: a creation unit that selects a plurality of target functions that are a subset of functions from among a plurality of functions corresponding to a use case defined in the software being monitored, and creates reference data related to calling of the plurality of selected target functions; an acquisition unit that acquires the call history of the target functions in the software being monitored; and a detection unit that detects the abnormal operation on the basis of the result of comparison between the reference data created by the creation unit and the call history acquired by the acquisition unit.

Description

Detection device, detection method, and detection program

[0001] This application claims priority from Japanese Patent Application No. 2024-113036, filed on July 16, 2024, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Patent Document 1 (JP 2021-89632 A) discloses the following information processing device: That is, the information processing device is an information processing device connected to a mobility network mounted on a mobility, and includes a storage unit that stores judgment criteria information indicating criteria for determining whether the behavior of an application running on a device mounted on the mobility is normal, and a detection unit that acquires behavior information indicating the behavior of the application and detects abnormal behavior of the application based on the acquired behavior information and the judgment criteria information stored in the storage unit.

[0003] Japanese Patent Application Laid-Open No. 2021-89632

[0004] The detection device of the present disclosure is a detection device that detects abnormal operation of monitored software, and includes a creation unit that selects multiple target functions, which are some of multiple functions from multiple functions corresponding to use cases defined in the monitored software, and creates reference data regarding calls to the selected multiple target functions, an acquisition unit that acquires call histories of the target functions in the monitored software, and a detection unit that detects the abnormal operation based on the comparison results between the reference data created by the creation unit and the call history acquired by the acquisition unit.

[0005] One aspect of the present disclosure can be realized not only as a detection device equipped with such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the detection device, or as a system that includes the detection device.

[0006] FIG. 1 is a diagram illustrating a configuration of a detection system according to a first embodiment of the present disclosure. FIG. 2 is a diagram illustrating a configuration of an information processing device according to the first embodiment of the present disclosure. FIG. 3 is a diagram illustrating an example of a process executed by an application in the information processing device according to the first embodiment of the present disclosure. FIG. 4 is a diagram illustrating an example of a process executed by an application in the information processing device according to the first embodiment of the present disclosure. FIG. 5 is a diagram illustrating an example of a function order list created by a creation unit in the information processing device according to the first embodiment of the present disclosure. FIG. 6 is a diagram illustrating an example of a function order list created by the creation unit in the information processing device according to the first embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of a profile list created by the creation unit in the information processing device according to the first embodiment of the present disclosure. FIG. 8 is a diagram illustrating an example of an integrated profile list created by the creation unit in the information processing device according to the first embodiment of the present disclosure. FIG. 9 is a diagram illustrating an example of a frequency profile list created by the creation unit in the information processing device according to the first embodiment of the present disclosure. FIG. 10 is a flowchart defining an example of an operation procedure when the information processing device according to the first embodiment of the present disclosure creates reference data. Fig. 11 is a flowchart defining an example of an operation procedure when an information processing device according to a first embodiment of the present disclosure performs detection processing. Fig. 12 is a diagram illustrating a configuration of a detection system according to a second embodiment of the present disclosure. Fig. 13 is a diagram illustrating a configuration of an information processing device according to the second embodiment of the present disclosure. Fig. 14 is a diagram illustrating a configuration of a detection device according to the second embodiment of the present disclosure.

[0007] Conventionally, techniques for detecting software anomalies have been proposed.

[0008] [Problem to be Solved by the Present Disclosure] The technology described in Patent Literature 1 may miss detection of abnormal software operation. Furthermore, security technology using CFI (Control Flow Integrity) may increase processing load due to overhead.

[0009] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection device, a detection method, and a detection program that can more reliably detect abnormal software operation while suppressing an increase in processing load.

[0010] Effect of the Present Disclosure According to the present disclosure, it is possible to more reliably detect abnormal software operation while suppressing an increase in processing load.

[0011] [Description of Embodiments of the Present Disclosure] First, the contents of embodiments of the present disclosure will be listed and described. (1) A detection device according to an embodiment of the present disclosure is a detection device that detects abnormal operation of monitored software, and includes a creation unit that selects a plurality of target functions that are some of a plurality of functions corresponding to use cases defined in the monitored software and creates reference data related to calls of the selected plurality of target functions, an acquisition unit that acquires call histories of the target functions in the monitored software, and a detection unit that detects the abnormal operation based on a comparison result between the reference data created by the creation unit and the call history acquired by the acquisition unit.

[0012] This configuration allows for the creation of reference data with high coverage of functions according to the call functions predetermined for each use case, thereby enabling the use of this reference data to more reliably detect abnormal behavior in the software being monitored. Furthermore, by creating reference data by selecting some functions from multiple functions, it is possible to create reference data related to calls to functions with high monitoring priorities, thereby reducing the increase in the processing load of the detection process using the reference data. Therefore, it is possible to more reliably detect abnormal behavior in the software while minimizing the increase in processing load.

[0013] (2) In the above (1), the detection unit may detect the abnormal operation based on a comparison result between the reference data and the call order of the target function indicated by the call history.

[0014] With this configuration, abnormal function call behavior by the monitored software, such as skipping function calls and unnecessary function calls, can be detected based on the consistency between the normal function call order indicated by the reference data and the actual call order.

[0015] (3) In the above (1) or (2), the detection unit may detect the abnormal operation based on a comparison result between the reference data and the call frequency of the target function indicated by the call history.

[0016] With this configuration, abnormal function call behavior by the monitored software, such as skipping function calls and unnecessary function calls, can be detected based on the consistency between the normal function call frequency indicated by the reference data and the actual call frequency.

[0017] (4) In any one of (1) to (3) above, the creation unit may select the target function based on the result of a threat analysis of the software to be monitored.

[0018] With this configuration, it is possible to create reference data by selecting functions with a high monitoring priority based on the results of threat analysis, thereby more effectively detecting attacks on software to be monitored.

[0019] (5) In the above (4), the creation unit may select the target function based on vulnerability to attacks against the monitoring target software.

[0020] With this configuration, it is possible to create reference data by selecting functions with high priority from the viewpoint of vulnerability, thereby more reliably detecting attacks that pose a high security risk.

[0021] (6) In the above (4) or (5), the creation unit may select the target function based on the impact of an attack on the software to be monitored.

[0022] With this configuration, it is possible to create reference data by selecting functions with a high priority in terms of the impact of the attack, thereby more reliably detecting attacks that have a high impact on the software to be monitored.

[0023] (7) In the above (6), the creation unit may select the target function based on the impact of the attack on the security of a system that uses the software to be monitored.

[0024] This configuration makes it possible to more reliably detect attacks that have a significant impact on the security of the system.

[0025] (8) A detection method according to an embodiment of the present disclosure is a detection method in a detection device that detects abnormal operation of monitored software, and includes the steps of selecting a plurality of target functions that are some of a plurality of functions corresponding to use cases defined in the monitored software, and creating reference data regarding calls to the selected plurality of target functions, acquiring a call history of the target functions in the monitored software, and detecting the abnormal operation based on a comparison result between the created reference data and the acquired call history.

[0026] This method allows for the creation of reference data with high coverage of functions according to the call functions predetermined for each use case, thereby enabling the use of this reference data to more reliably detect abnormal behavior in the software being monitored. Furthermore, by creating reference data by selecting some functions from multiple functions, it is possible to create reference data related to calls to functions with high monitoring priorities, thereby reducing the increase in the processing load of the detection process using the reference data. Therefore, it is possible to more reliably detect abnormal behavior in the software while minimizing the increase in processing load.

[0027] (9) A detection program according to an embodiment of the present disclosure is a detection program used in a detection device that detects abnormal operation of monitored software, and causes a computer to function as a creation unit that selects multiple target functions, which are some of multiple functions corresponding to use cases defined in the monitored software, and creates reference data regarding calls to the selected multiple target functions; an acquisition unit that acquires call histories of the target functions in the monitored software; and a detection unit that detects the abnormal operation based on the comparison results between the reference data created by the creation unit and the call history acquired by the acquisition unit.

[0028] This configuration allows for the creation of reference data with high coverage of functions according to the call functions predetermined for each use case, thereby enabling the use of this reference data to more reliably detect abnormal behavior in the software being monitored. Furthermore, by creating reference data by selecting some functions from multiple functions, it is possible to create reference data related to calls to functions with high monitoring priorities, thereby reducing the increase in the processing load of the detection process using the reference data. Therefore, it is possible to more reliably detect abnormal behavior in the software while minimizing the increase in processing load.

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0030] First Embodiment [Configuration and Basic Operation] Fig. 1 is a diagram illustrating the configuration of a detection system according to a first embodiment of the present disclosure. Referring to Fig. 1, a detection system 301 includes information processing devices 101 and 201. The information processing device 101 is an example of a detection device. For example, the detection system 301 is mounted on a vehicle 1. In this case, the information processing devices 101 and 201 are, for example, on-board ECUs (Electronic Control Units). Note that the detection system 301 may be used in, for example, network infrastructure or factory automation.

[0031] The information processing devices 101 and 201 are connected to each other via a transmission line 2. The transmission line 2 is, for example, an Ethernet (registered trademark) cable.

[0032] The information processing device 101 detects abnormal operation of software that is a monitoring target in the information processing device 101. The information processing device 101 transmits the detection result of the abnormal operation to the information processing device 201 via the transmission line 2.

[0033] (Configuration of Information Processing Device) Fig. 2 is a diagram showing the configuration of an information processing device according to the first embodiment of the present disclosure. Referring to Fig. 2, the information processing device 101 includes an information processing unit 10, a monitoring unit 20, and a storage unit 30. Some or all of the functions of the information processing unit 10 and the monitoring unit 20 are realized, for example, by a processing circuit including one or more processors. The storage unit 30 is, for example, a non-volatile memory included in the processing circuit.

[0034] The information processing unit 10 includes an application 11. The application 11 is an example of software to be monitored. The information processing unit 10 may be configured to include multiple applications 11. The memory unit 30 includes memory areas 31 and 32. The memory area 32 is a memory area with higher security than the memory area 31. The monitoring unit 20 includes a creation unit 21, an acquisition unit 22, a detection unit 23, and a communication unit 24. The monitoring unit 20 performs a detection process to detect abnormal operation of the application 11.

[0035] (Application) The application 11 is software that realizes a predetermined function. As an example, the application 11 realizes automatic driving assistance.

[0036] The application 11 has a plurality of functions, such as automatic parking assistance, vehicle emergency notification, automatic braking, lane keeping, and a user interface.

[0037] The application 11 realizes an automatic parking assist function using an environment recognition function, a position estimation function, an obstacle detection function, an automatic steering function, etc. The application 11 also realizes a vehicle emergency call function using a collision detection function, a position information provision function, a call function, an accident information recording function, etc. The application 11 also realizes an automatic braking function using an obstacle detection function, a brake control function, a traffic signal information acquisition function, etc. The application 11 also realizes a lane keeping function using a lane detection function, a surrounding vehicle detection function, a steering angle control function, etc. The application 11 also realizes a user interface function using a communication function, a request processing function, etc.

[0038] To realize autonomous driving assistance, the application 11 calls and executes a corresponding function in a program. Every time the application 11 calls a function, it saves an operation log L including an identifier of the called function in a storage area 31 in the storage unit 30. Hereinafter, the identifier of a function is also referred to as a function ID (IDentifier).

[0039] (Creating Reference Data) Before the monitoring unit 20 starts the detection process, the creation unit 21 creates reference data regarding calls to multiple functions by the application 11. The procedure for creating reference data by the creation unit 21 will be described in detail below. (1) Creating a Function Order List Lst The creation unit 21 acquires design information for the application 11. For example, the creation unit 21 receives the design information from the manufacturer of the information processing device 101. The design information includes information related to the design of the application 11, such as a requirements definition document and a design document for the application 11.

[0040] The creation unit 21 acquires, from the design information, use cases UC of the application 11 defined in the design information. For example, in the design information of the application 11, use cases UC defined include "automatic parking assistance in parking lots with white lines," "emergency notification in the event of an accident while the vehicle 1 is traveling," and "lane keeping while the vehicle 1 is traveling on a highway."

[0041] 3 and 4 are diagrams illustrating an example of processing executed by an application in the information processing device according to the first embodiment of the present disclosure. Fig. 3 illustrates a flow of processing executed by the application 11 in use case UC1, which is a use case UC of "automatic parking assistance in a parking lot with white lines." Fig. 4 illustrates a flow of processing executed by the application 11 in use case UC2, which is a use case UC of "emergency notification when an accident occurs while the vehicle 1 is traveling."

[0042] 3 and 4 , the creation unit 21 acquires, from the design information, flow information indicating the flow of processing executed by the application 11 for each use case UC. The creation unit 21 also acquires, from the design information, function information indicating functions to be called when the application 11 executes each processing in the flow information.

[0043] 5 and 6 are diagrams illustrating examples of function order lists created by a creation unit in the information processing device according to the first embodiment of the present disclosure. Fig. 5 illustrates a function order list Lst1 that is a function order list Lst corresponding to use case UC1. Fig. 6 illustrates a function order list Lst2 that is a function order list Lst corresponding to use case UC2.

[0044] Referring to Figures 5 and 6, based on the flow information and function information, the creation unit 21 creates, for each use case UC, a function order list Lst that indicates the correspondence between the processing in the use case UC, the function that the application 11 calls when executing the processing, and the function ID of the function.

[0045] (2) Function Exclusion Processing The creation unit 21 selects some functions from among a plurality of functions corresponding to a use case UC defined in the application 11. For example, the creation unit 21 selects some functions from among a plurality of functions in the function order list Lst based on the results of a threat analysis of the application 11.

[0046] More specifically, the creation unit 21 performs a threat analysis method in accordance with ISO (International Organization for Standardization) 21434. Then, the creation unit 21 creates a threat scenario, which is a scenario of an attack that is assumed against the application 11, based on the location of the threat, the threat agent, the opportunity for the threat to occur, the reason for the threat to occur, and the content of the threat. As an example, the creation unit 21 creates a threat scenario in which "an attacker who has infiltrated the application 11 tampers with sensor information."

[0047] The creation unit 21 calculates, for each function in the function order list Lst, an evaluation value V1 indicating vulnerability with respect to a threat scenario and an evaluation value V2 indicating the impact of the threat scenario.

[0048] More specifically, the creation unit 21 calculates the evaluation value V1 based on a CVSS base value and a CVSS environment value according to the Common Vulnerability Scoring System (CVSS). The evaluation value V1 is an index of vulnerability of the application 11 to attacks.

[0049] The creation unit 21 also calculates an evaluation value V2 indicating the degree of impact of a threat scenario on assets related to SFOP (Safety, Financial, Operational, Privacy) according to the following formula (1): V2=S×ws+F×wf+O×wo+P×wp (1)

[0050] Here, S is the severity of damage related to safety, F is the severity of damage related to finances, O is the severity of damage related to operations, and P is the severity of damage related to privacy. ws, wf, wo, and wp are coefficients that are set in advance according to the importance of safety, finance, operations, and privacy, respectively.

[0051] The creation unit 21 determines the values ​​of severity S, F, O, and P for the threat scenario for each function in the function order list Lst. For example, the creation unit 21 determines the values ​​of severity S, F, O, and P as "10" if the magnitude of damage is "serious," "8" if the magnitude of damage is "moderate," "6" if the magnitude of damage is "minor," and "zero" if the magnitude of damage is "no impact." The creation unit 21 calculates an evaluation value V2 corresponding to the determined severity S, F, O, and P according to equation (1). The evaluation value V2 is an index of the impact of an attack on the application 11. The evaluation value V2 is also an index of the impact of an attack on the system that uses the application 11, i.e., the safety of the vehicle 1.

[0052] The creation unit 21 selects some functions from the plurality of functions in the function order list Lst based on the calculated evaluation values ​​V1 and V2. More specifically, the creation unit 21 calculates a priority evaluation value Sum, which is the sum of the evaluation values ​​V1 and V2, for each function in the function order list Lst, and compares the calculated priority evaluation value Sum with a predetermined threshold value Th1. The threshold value Th1 is set in advance depending on the processing load of the detection unit 23, etc. The creation unit 21 selects functions from the plurality of functions in the function order list Lst whose priority evaluation value Sum is equal to or greater than the threshold value Th1.

[0053] For example, the creation unit 21 performs an exclusion process to exclude from the function order list Lst, functions that have not been selected from among the multiple functions in the function order list Lst. The functions in the function order list Lst after the exclusion process are examples of target functions.

[0054] (3) Creation of Profile List PL Fig. 7 is a diagram illustrating an example of a profile list created by a creation unit in the information processing device according to the first embodiment of the present disclosure. Fig. 7 illustrates a profile list PL1, which is a profile list PL created based on the function order list Lst1 after the exclusion process.

[0055] Referring to Figure 7, the creation unit 21 creates a profile list PL1 that indicates the correspondence between the function ID of a function and the function ID of the previous function, which is a function that can be called immediately before the function, based on the function order list Lst1 after the exclusion process.

[0056] The creation unit 21 creates a profile list PL for each use case UC based on the function order list Lst after the exclusion process.

[0057] FIG. 8 is a diagram illustrating an example of an integrated profile list created by the creation unit in the information processing device according to the first embodiment of the present disclosure.

[0058] 8, the creation unit 21 creates an integrated profile list Pt1 by merging a plurality of profile lists PL corresponding to a plurality of use cases UC, respectively. The integrated profile list Pt1 is an example of reference data.

[0059] FIG. 9 is a diagram illustrating an example of a frequency profile list created by the creation unit in the information processing device according to the first embodiment of the present disclosure.

[0060] 9 , the creation unit 21 creates, based on the integrated profile list Pt1, a frequency profile list Pt2 indicating a correspondence between the function ID of a function, the function ID of a prior function that can be called in the most recent N call opportunities counting from the time the function is called, and the allowable range Rp of the number of calls of the prior function in those call opportunities. Here, N is an integer greater than or equal to 3. The frequency profile list Pt2 is an example of reference data. The creation unit 21 stores the created integrated profile list Pt1 and frequency profile list Pt2 in a storage area 32 in the storage unit 30.

[0061] 2 again, the acquisition unit 22 acquires a call history of a function in the application 11. More specifically, after the monitoring unit 20 starts the detection process, for example, the acquisition unit 22 monitors the memory area 31 in the memory unit 30 and waits for the application 11 to save the operation log L in the memory area 31.

[0062] When a new operation log La, which is a new operation log L, is saved in the memory area 31 by the application 11, the acquisition unit 22 acquires from the memory area 31 the new operation log La and a past operation log Lb, which is an operation log L saved in the memory area 31 before the new operation log La.

[0063] More specifically, the acquisition unit 22 acquires a new operation log La and N past operation logs Lb from the storage area 31. The new operation log La and the past operation logs Lb are examples of a call history. The acquisition unit 22 outputs history information including the acquired new operation log La and the N past operation logs Lb to the detection unit 23. Hereinafter, the past operation log Lb saved immediately before the new operation log La is also referred to as the immediately preceding operation log Lb1.

[0064] The detection unit 23 detects abnormal operation of the application 11 based on the comparison result between the reference data created by the creation unit 21 and the call history acquired by the acquisition unit 22 .

[0065] More specifically, every time the detection unit 23 receives history information from the acquisition unit 22, the detection unit 23 compares the reference data in the storage area 32 of the storage unit 30 with the new operation log La and the past operation log Lb included in the history information. The detection unit 23 detects abnormal operation of the application 11 based on the comparison result between the reference data and the new operation log La and the past operation log Lb.

[0066] (Detection Process Using Integrated Profile List Pt1) The detection unit 23 performs detection process based on the comparison result between the integrated profile list Pt1, which is reference data, and the function call order indicated by the new operation log La and the past operation log Lb.

[0067] More specifically, the detection unit 23 receives history information from the acquisition unit 22 and compares the integrated profile list Pt1 in the memory area 32 with the function call order indicated by the new action log La and the previous action log Lb1 included in the history information.

[0068] If the function ID of the most recent action log Lb1 is not registered in the integrated profile list Pt1 as the function ID of the most recent function corresponding to the function ID of the new action log La, the detection unit 23 determines that the order of function calls by the application 11 is inconsistent with the integrated profile list Pt1. In this case, the detection unit 23 determines that the operation of the application 11 is abnormal. The detection unit 23 then creates a determination log including the determination result and the history information used in the determination, and saves the created determination log in the memory area 32 of the memory unit 30.

[0069] On the other hand, if the function ID of the most recent operation log Lb1 is registered in the integrated profile list Pt1 as the function ID of the most recent function corresponding to the function ID of the new operation log La, the detection unit 23 determines that the order in which functions are called by the application 11 is consistent with the integrated profile list Pt1.

[0070] For example, if the detection unit 23 determines that the order of function calls by the application 11 is consistent with the integrated profile list Pt1 and the determination result based on the previous history information received from the acquisition unit 22 is "abnormal," the detection unit 23 makes a gray judgment on the operation of the application 11. The detection unit 23 then creates a judgment log including the determination result and the history information used in the judgment, and saves the created judgment log in the storage area 32 of the storage unit 30. In this way, making a gray judgment based on the previous judgment result can prevent erroneous judgments.

[0071] Furthermore, for example, if the detection unit 23 determines that the order in which functions are called by the application 11 is consistent with the integrated profile list Pt1, and if the determination result based on the previous history information received from the acquisition unit 22 is not "abnormal," the detection unit 23 determines that the operation of the application 11 is normal. Then, the detection unit 23 creates a determination log including the determination result and the history information used for the determination, and saves the created determination log in the memory area 32 of the memory unit 30.

[0072] (Detection Process Using Frequency Profile List Pt2) The detection unit 23 performs detection process based on the comparison result between the frequency profile list Pt2, which is reference data, and the function call frequencies indicated by the new operation log La and the past operation log Lb.

[0073] More specifically, the detection unit 23 receives history information from the acquisition unit 22 and compares the frequency profile list Pt2 in the memory area 32 with the call frequency of the function indicated by the new operation log La and N past operation logs Lb included in the history information.

[0074] If the number of calls to the prior function corresponding to the function ID in the new operation log La in the frequency profile list Pt2 is a value outside the corresponding allowable range Rp, the detection unit 23 determines that the frequency of calls to the function by the application 11 is inconsistent with the frequency profile list Pt2. In this case, the detection unit 23 determines that the operation of the application 11 is abnormal. The detection unit 23 then creates a determination log including the determination result and history information used in the determination, and saves the created determination log in the memory area 32 in the memory unit 30.

[0075] On the other hand, if the number of calls to all pre-functions corresponding to the function IDs of the new operation log La in the frequency profile list Pt2 is within the corresponding tolerance range Rp, the detection unit 23 determines that the frequency of function calls by the application 11 is consistent with the frequency profile list Pt2.

[0076] For example, when the detection unit 23 determines that the frequency of function calls by the application 11 is consistent with the frequency profile list Pt2 and the determination result based on the previous history information received from the acquisition unit 22 is "abnormal," the detection unit 23 determines that the operation of the application 11 is gray. Then, the detection unit 23 creates a determination log including the determination result and the history information used for the determination, and saves the created determination log in the storage area 32 in the storage unit 30.

[0077] Furthermore, for example, when the detection unit 23 determines that the frequency of function calls by the application 11 is consistent with the frequency profile list Pt2 and the determination result based on the previous history information received from the acquisition unit 22 is not "abnormal," the detection unit 23 determines that the operation of the application 11 is normal. Then, the detection unit 23 creates a determination log including the determination result and the history information used for the determination, and saves the created determination log in the memory area 32 in the memory unit 30.

[0078] (Notification of Detection Result) For example, when the detection unit 23 determines that an abnormal operation of the application 11 has occurred, the detection unit 23 outputs a determination log to the communication unit 24 .

[0079] The communication unit 24 receives the determination log from the detection unit 23 and transmits the received determination log to the information processing device 201 via the transmission line 2 .

[0080] The information processing device 201 receives a determination log from the information processing device 101 and determines whether or not to stop the application 11 based on the received determination log and the results of a threat analysis on the application 11. If the information processing device 201 determines that the application 11 should be stopped, it transmits a stop instruction to the information processing device 101 via the transmission line 2.

[0081] When the communication unit 24 in the information processing device 101 receives the stop instruction from the information processing device 201 , the communication unit 24 performs processing to stop the operation of the application 11 in the information processing unit 10 .

[0082] [Operation Flow] FIG. 10 is a flowchart defining an example of an operation procedure when the information processing device according to the first embodiment of the present disclosure creates reference data.

[0083] Referring to FIG. 10, first, the information processing device 101 acquires design information of the application 11 (step S11).

[0084] Next, the information processing apparatus 101 acquires, from the design information, the use cases UC of the application 11 defined in the design information (step S12).

[0085] Next, the information processing apparatus 101 acquires, from the design information, flow information indicating the flow of processing executed by the application 11 for each use case UC (step S13).

[0086] Next, the information processing apparatus 101 acquires, from the design information, function information indicating the function to be called when the application 11 executes each process in the flow information (step S14).

[0087] Next, the information processing apparatus 101 creates a function order list Lst for each use case UC based on the flow information and function information (step S15).

[0088] Next, the information processing device 101 performs an exclusion process to select some functions from the multiple functions in the function order list Lst based on the results of the threat analysis against the application 11, and excludes the functions not selected from the function order list Lst (step S16).

[0089] Next, the information processing apparatus 101 creates a profile list PL for each use case UC based on the function order list Lst after the exclusion process (step S17).

[0090] Next, the information processing apparatus 101 creates an integrated profile list Pt1 by merging a plurality of profile lists PL corresponding to a plurality of use cases UC (step S18).

[0091] Next, the information processing apparatus 101 creates a frequency profile list Pt2 based on the integrated profile list Pt1 (step S19).

[0092] 11 is a flowchart illustrating an example of an operation procedure when the information processing device according to the first embodiment of the present disclosure performs a detection process using the integrated profile list Pt1.

[0093] Referring to Figure 11, the information processing device 101 waits for the application 11 to save the operation log L in the memory area 31 (NO in step S21), and when the application 11 saves the operation log L in the memory area 31 (YES in step S21), it retrieves the new operation log La and the past operation log Lb from the memory area 31 (step S22).

[0094] Next, the information processing apparatus 101 compares the integrated profile list Pt1 with the function calling order indicated by the new action log La and the previous action log Lb1 (step S23).

[0095] Next, if the calling order does not match the integrated profile list Pt1 (NO in step S24), the information processing apparatus 101 determines that the operation of the application 11 is abnormal (step S25).

[0096] Next, the information processing device 101 stores the determination log in the storage area 32 of the storage unit 30 (step S26).

[0097] Next, the information processing device 101 transmits the determination log to the information processing device 201 via the transmission line 2 (step S27), and waits for the application 11 to save a new operation log L in the storage area 31 (NO in step S21).

[0098] On the other hand, if the call order is consistent with the integrated profile list Pt1 (YES in step S24) and the previous judgment result is "abnormal" (YES in step S28), the information processing device 101 judges the operation of the application 11 as gray (step S29).

[0099] Next, the information processing device 101 stores the determination log in the storage area 32 of the storage unit 30 (step S30), and waits for a new operation log L to be stored in the storage area 31 by the application 11 (NO in step S21).

[0100] On the other hand, if the call order is consistent with the integrated profile list Pt1 (YES in step S24) and the previous judgment result is "normal" or "gray judgment" (NO in step S28), the information processing device 101 judges that the operation of the application 11 is normal (step S31).

[0101] Next, the information processing device 101 stores the determination log in the storage area 32 in the storage unit 30 (step S32), and waits for a new operation log L to be stored in the storage area 31 by the application 11 (NO in step S21).

[0102] In addition, in the detection process using the frequency profile list Pt2, in step S24, instead of determining whether the call order is consistent with the integrated profile list Pt1, it is determined whether the call frequency is consistent with the frequency profile list Pt2.

[0103] Furthermore, in the information processing device 101 according to the first embodiment of the present disclosure, the detection unit 23 is configured to perform both the detection process using the integrated profile list Pt1 and the detection process using the frequency profile list Pt2, but this is not limited to this. The detection unit 23 may be configured not to perform either the detection process using the integrated profile list Pt1 or the detection process using the frequency profile list Pt2.

[0104] Furthermore, in the information processing device 101 according to the first embodiment of the present disclosure, the creation unit 21 is configured to select some functions from among the multiple functions in the function order list Lst based on the results of threat analysis against the application 11, but this is not limited to this. The creation unit 21 may be configured to randomly select a number of functions according to the processing load of the detection unit 23 without using the results of threat analysis against the application 11.

[0105] Furthermore, in the information processing device 101 according to the first embodiment of the present disclosure, the creation unit 21 is configured to select some functions from among the multiple functions in the function order list Lst based on the evaluation values ​​V1 and V2, but this is not limited to this. The creation unit 21 may also be configured to select some functions from among the multiple functions in the function order list Lst based on either the evaluation values ​​V1 or V2.

[0106] Furthermore, in the information processing device 101 according to the first embodiment of the present disclosure, the creation unit 21 is configured to calculate the evaluation value V2 corresponding to the severity levels S, F, O, and P according to the above-described formula (1) and select a function based on the calculated evaluation value V2, but this is not limitative. The creation unit 21 may also be configured to calculate the evaluation value V2 based on the severity levels F, O, and P excluding the severity level S.

[0107] Furthermore, in the information processing device 101 according to the first embodiment of the present disclosure, the creation unit 21 is configured to perform an exclusion process in which some functions are selected from the plurality of functions in the function order list Lst and the unselected functions are excluded from the function order list Lst. However, this is not limited to this. In addition to or instead of the exclusion process, the creation unit 21 may be configured to select some use cases UC from the plurality of use cases UC acquired from the design information based on the results of threat analysis of the application 11 and create a function order list Lst corresponding to the selected use cases UC. That is, the creation unit 21 may select and exclude functions on a use case UC basis. In this case, the creation unit 21 may select use cases UC using criteria other than the threshold value Th1.

[0108] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0109] Second Embodiment This embodiment relates to a detection system 302 that differs from the detection system 301 according to the first embodiment in that the detection system 302 performs detection processing based on an operation log L acquired from another device. Other than the details described below, the detection system 302 is the same as the detection system 301 according to the first embodiment.

[0110] 12 is a diagram illustrating a configuration of a detection system according to a second embodiment of the present disclosure. Referring to FIG. 12 , compared to the detection system 301, the detection system 302 includes an information processing device 102 instead of the information processing device 101, and includes a detection device 202 instead of the information processing device 201. For example, the detection system 302 is mounted on the vehicle 1. Note that the detection device 202 may be a server provided outside the vehicle 1.

[0111] 13 is a diagram illustrating a configuration of an information processing device according to a second embodiment of the present disclosure. Compared to the information processing device 101, the information processing device 102 includes a communication unit 41 instead of the monitoring unit 20.

[0112] The communication unit 41 monitors the storage unit 30 and waits for the application 11 to save the operation log L. When the application 11 saves the new operation log La in the storage unit 30, the communication unit 41 acquires the new operation log La and N past operation logs Lb from the storage unit 30. The communication unit 41 transmits history information including the acquired new operation log La and N past operation logs Lb to the detection device 202 via the transmission line 2.

[0113] 14 is a diagram illustrating a configuration of a detection device according to the second embodiment of the present disclosure. Referring to FIG. 14, detection device 202 includes a monitoring unit 50 and a storage unit 60. Compared to monitoring unit 20, monitoring unit 50 includes a stop instruction unit 51 instead of communication unit 24.

[0114] The creation unit 21 creates an integrated profile list Pt1 and a frequency profile list Pt2, and stores the created integrated profile list Pt1 and frequency profile list Pt2 in the storage unit 60.

[0115] The acquisition unit 22 waits for the arrival of history information from the information processing device 102 , and upon receiving the history information from the information processing device 102 via the transmission line 2 , outputs the received history information to the detection unit 23 .

[0116] The detection unit 23 performs a detection process using the integrated profile list Pt1 and a detection process using the frequency profile list Pt2 every time it receives history information from the acquisition unit 22. When the detection unit 23 determines that an abnormal operation of the application 11 has occurred, it outputs a determination log to the stop instruction unit 51.

[0117] The stop instruction unit 51 receives the determination log from the detection unit 23 and determines whether or not it is necessary to stop the application 11 based on the received determination log and the results of a threat analysis of the application 11. If the stop instruction unit 51 determines that the application 11 should be stopped, it transmits a stop instruction to the information processing device 102 via the transmission line 2.

[0118] Referring again to FIG. 13, when the communication unit 41 in the information processing device 102 receives the stop instruction from the detection device 202, the communication unit 41 performs processing to stop the operation of the application 11 in the information processing unit 10.

[0119] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0120] Each process (each function) in the above-described embodiments is realized by a processing circuit (circuitry) including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or may execute each of the processes according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet to execute the processes. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed into the memory from the recording medium.

[0121] The above description includes the features noted below: [Note 1] A detection device that detects abnormal behavior in monitored software, comprising: a creation unit that selects a plurality of target functions that are some of a plurality of functions corresponding to use cases defined in the monitored software, and creates reference data related to calls of the selected plurality of target functions, an acquisition unit that acquires call histories of the target functions in the monitored software, and a detection unit that detects the abnormal behavior based on a comparison result between the reference data created by the creation unit and the call histories acquired by the acquisition unit, wherein the creation unit selects the target functions based on a result of a threat analysis of the monitored software, and the creation unit creates the reference data based on design information of the monitored software.

[0122] [Supplementary Note 2] A detection device that detects abnormal operation of monitored software, comprising a processing circuit, wherein the processing circuit: selects a plurality of target functions that are some of a plurality of functions corresponding to use cases defined in the monitored software; creates reference data regarding calls of the selected plurality of target functions; acquires a call history of the target functions in the monitored software; and detects the abnormal operation based on a comparison result between the created reference data and the acquired call history.

[0123] REFERENCE SIGNS LIST 1 vehicle 2 transmission line 10 information processing unit 11 application 20, 50 monitoring unit 21 creation unit 22 acquisition unit 23 detection unit 24 communication unit 30, 60 storage unit 31, 32 storage area 41 communication unit 51 stop instruction unit 101, 102, 201 information processing device 202 detection device 301, 302 detection system Lst, Lst1, Lst2 function order list PL, PL1 profile list Pt1 integrated profile list Pt2 frequency profile list

Claims

1. A detection device that detects abnormal behavior in monitored software, comprising: a creation unit that selects multiple target functions that are some of multiple functions corresponding to use cases defined in the monitored software, and creates reference data regarding calls to the selected multiple target functions; an acquisition unit that acquires call histories of the target functions in the monitored software; and a detection unit that detects the abnormal behavior based on the results of comparing the reference data created by the creation unit with the call history acquired by the acquisition unit.

2. The detection device according to claim 1, wherein the detection unit detects the abnormal operation based on a comparison result between the reference data and the call order of the target function indicated by the call history.

3. The detection device according to claim 1, wherein the detection unit detects the abnormal operation based on a comparison result between the reference data and the call frequency of the target function indicated by the call history.

4. The detection device according to any one of claims 1 to 3, wherein the creation unit selects the target function based on the results of a threat analysis of the monitored software.

5. The detection device according to claim 4, wherein the creation unit selects the target function based on vulnerability to attacks on the software to be monitored.

6. The detection device according to claim 4 or claim 5, wherein the creation unit selects the target function based on the impact of an attack on the software to be monitored.

7. The detection device according to claim 6, wherein the creation unit selects the target function based on the impact of the attack on the security of a system that uses the software to be monitored.

8. A detection method in a detection device that detects abnormal behavior of monitored software, comprising the steps of: selecting a plurality of target functions that are some of a plurality of functions corresponding to use cases defined in the monitored software, and creating reference data regarding calls to the selected plurality of target functions; acquiring a call history of the target functions in the monitored software; and detecting the abnormal behavior based on the results of comparing the created reference data with the acquired call history.

9. A detection program used in a detection device that detects abnormal behavior in monitored software, causing a computer to function as: a creation unit that selects multiple target functions that are some of the multiple functions corresponding to use cases defined in the monitored software, and creates reference data regarding calls to the selected multiple target functions; an acquisition unit that acquires the call history of the target functions in the monitored software; and a detection unit that detects the abnormal behavior based on the comparison result between the reference data created by the creation unit and the call history acquired by the acquisition unit.

Images