Attack Analyzer Using Alive Signals for Route Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the accuracy in estimating attack routes during cyber attacks on electronic control systems in vehicles, which are increasingly vulnerable due to connectivity advancements, necessitating a more precise analysis method.
Innovation Solution
An attack analyzer is developed that utilizes a prediction table and alive signals from security sensors to estimate attack routes, incorporating a reliability calculation unit to enhance estimation accuracy by considering the operational status of security sensors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing analysis systems are used to estimate attack routes, then the analysis can be performed, but the accuracy of attack route estimation is insufficient
Solution Approach 1:
The system implements feedback by acquiring alive signals from security sensors during attack analysis. These alive signals provide real-time information about sensor operational status, which is fed back into the attack route estimation process to correct and refine accuracy assessments, thereby resolving the contradiction between measurement precision and reliability
Solution Approach 2:
The system performs preliminary verification of security sensor operational status by acquiring alive signals before finalizing attack route estimation. This preliminary action ensures that only data from functioning sensors is used, preventing erroneous estimates from compromising overall reliability while maintaining high measurement precision
Data Source
AI summary
An attack analyzer includes: a security log acquisition unit acquiring a security log including an abnormality detection signal generated by a security sensor mounted on an electronic control device constituting part of an electronic control system and indicating that the security sensor has detected an abnormality; an alive signal acquisition unit acquiring an alive signal; a prediction table storage unit storing a prediction table showing a correspondence relationship between a predicted attack route in the electronic control system and a predicted abnormality detection signal predicted to be generated by the security sensor; an attack route estimation unit estimating, using the prediction table, the attack route of an attack received by the electronic control system from the abnormality detection signal and the alive signal included in the security log; and an attack information output unit outputting attack information indicating the attack route.