Attack Route Estimation Using Security Logs and ECU Failure Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the accuracy in estimating attack routes during cyber attacks on electronic control systems in vehicles, which are increasingly vulnerable due to connectivity advancements, necessitating a more precise analysis method.
Innovation Solution
An attack analyzer device that utilizes a prediction table and reliability calculation unit to estimate attack routes by combining security log data from security sensors and failure information, enhancing the accuracy of route estimation and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If attack route estimation is performed using only security log data, then processing load on vehicle systems is reduced, but estimation accuracy is insufficient
Solution Approach 1:
The attack route estimation process is segmented into two independent parts: (1) generating candidate attack routes using security log data and system configuration information, and (2) evaluating reliability of each candidate using failure information from multiple ECUs. This segmentation allows complex estimation to be broken down into manageable steps that can be executed with distributed processing.
Solution Approach 2:
The system performs preliminary actions by pre-collecting failure information from multiple ECUs and pre-generating candidate attack routes before final estimation. This preliminary preparation enables the main estimation process to focus on evaluating candidates rather than generating them from scratch, improving both accuracy and efficiency.
2Measurement precision
If multiple data sources are integrated for attack analysis, then estimation accuracy improves, but processing load increases
Solution Approach 1:
The attack route estimation device acts as an intermediary that collects and integrates failure information from multiple ECUs and security log data, then processes this information to generate attack route estimates. This intermediary approach allows distributed data collection with centralized intelligent processing, improving accuracy while managing energy consumption through efficient data fusion rather than redundant processing across all ECUs.
3Reliability
If failure information from multiple ECUs is collected, then reliability of attack route estimation improves, but communication overhead increases
Solution Approach 1:
The system extracts only the necessary failure information from multiple ECUs that is relevant to attack route estimation, rather than collecting all possible data. This selective extraction reduces communication overhead while maintaining the reliability needed for accurate attack route estimation by focusing on critical failure data from ECUs along potential attack paths.
Data Source
AI summary
An attack analyzer includes: a security log acquisition unit acquiring a security log including an abnormality detection signal generated by a security sensor mounted on an electronic control device constituting an electronic control system and indicating that the security sensor has detected an abnormality; a failure information acquisition unit acquiring failure information indicating a failure occurred in the electronic control device; a prediction table storage unit storing a prediction table showing a correspondence relationship between a predicted attack route in the electronic control system and a predicted abnormality detection signal predicted to be generated by the security sensor; an attack route estimation unit; and an attack information output unit outputting attack information indicating the attack route.