Log Analysis Device Prioritizing Transmission for Cyber Attack Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing log analysis systems for vehicle-mounted electronic control systems lack an efficient method to determine priority for log transmission based on analysis results, which is crucial for effective cyber attack detection and response.

Innovation Solution

A log analysis device with a receiver unit, log analyzer unit, priority determiner unit, instruction generator unit, and transmitter unit that analyzes logs from vehicle-mounted systems, determines priority for log transmission, and generates instruction information to control the transmission process, allowing for targeted and efficient data collection and analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all logs are transmitted continuously to the log analysis device, then complete monitoring data is available for cyber attack detection, but communication bandwidth is wasted and transmission time increases

Engineering Contradiction:

Improvecyber attack detection accuracyVSAvoidlog transmission time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The log analysis device performs preliminary analysis of logs before determining transmission priority. By analyzing logs in advance and assigning priority levels based on the analysis results, the system prepares transmission schedules proactively rather than reactively, reducing overall transmission time while ensuring critical logs are prioritized

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements a feedback mechanism where the log analysis device sends priority determination results back to the log collection device. This feedback loop allows the transmission priority to be dynamically adjusted based on the actual content and security relevance of each log, optimizing bandwidth usage while maintaining detection accuracy

Inventive Principle:

Principle #23Feedback

2Productivity

If high priority is assigned to all logs, then all logs are transmitted quickly, but communication resources are wasted on non-critical logs

Engineering Contradiction:

Improvelog transmission efficiencyVSAvoidcommunication bandwidth consumption

Core Design Contradiction:

ProductivityVSLoss of energy

Solution Approach 1:

The patent applies different transmission priorities to different logs based on their specific characteristics and security relevance. Instead of uniform high priority for all logs, the system assigns localized priority levels (high, medium, low) to individual logs or log groups based on their content, ensuring communication resources are concentrated on critical security-related logs

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system changes the transmission parameter (priority level) based on the analysis results of each log. By dynamically adjusting the priority parameter according to log content, the system optimizes bandwidth consumption while ensuring that logs with higher security relevance are transmitted with higher priority

Inventive Principle:

Principle #35Parameter changes

3Device complexity

If log transmission priority is determined without analysis, then transmission control is simple, but cyber attack detection accuracy decreases

Engineering Contradiction:

Improvepriority determination processVSAvoidabnormality detection accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary priority determination process between log generation and log transmission. This intermediary layer analyzes log content and assigns priority levels, acting as a mediator that balances the need for simple transmission control with the requirement for accurate cyber attack detection

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11971982B2Log analysis device

Publication Date: 2024.04.30 DENSO CORP

AI summary

A log analysis device is provided. The log analysis device receives a log indicating status of an electronic control system mounted in a movable object from the electronic control system, analyzes an abnormality in the electronic control system by using the log received. Depending on a result of the analyzing, the log analysis device determines, on a log-by-log basis, priority for the electronic control system to transmit the log to the log analysis device. Based on the priority determined, the log analysis device generates instruction information that gives an instruction for controlling transmission of the log, and transmits the instruction information to the electronic control system.