Vehicle Security Log Filtering by False Positive Frequency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to accurately distinguish between cyberattack-induced abnormalities and those caused by user errors in vehicle systems, leading to decreased analysis accuracy in cyberattack detection.
Innovation Solution
A log determination device that acquires security logs and determines false positive logs based on the frequency of log generation, identifying abnormalities caused by user errors rather than cyberattacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If frequency-based false positive determination is implemented, then analysis precision is improved, but device complexity increases
Solution Approach 1:
The system pre-calculates and stores frequency thresholds for different log types before actual security analysis. When logs are generated, the determination unit simply compares against these pre-stored thresholds rather than performing complex real-time analysis, thus improving precision while limiting complexity increase to the initial setup phase only.
2Reliability
If all security logs are processed and transmitted, then completeness of security monitoring is improved, but communication load and processing overhead increase
Solution Approach 1:
The determination unit extracts and identifies false positive logs from the complete set of security logs using frequency comparison. Only the identified false positive logs are then excluded from transmission and further processing. This maintains complete monitoring capability while removing unnecessary communication overhead for logs that are determined to be false positives.
3Adaptability or versatility
If frequency threshold values are made configurable, then adaptability to different systems is improved, but ease of operation deteriorates
Solution Approach 1:
The system provides pre-configured frequency threshold values that are prepared in advance for common electronic control unit types and security log categories. These default thresholds enable immediate deployment without requiring operators to perform complex configuration, thus maintaining ease of operation while providing adaptability through pre-prepared settings for different system types.
Data Source
AI summary
A log determination acquires a set of security logs each generated upon detecting an abnormality in an electronic control system mounted on a vehicle, specifies a specific security log based on abnormality type information, specifies a frequency of generation of the specific security log, determines whether or not the specific security log is a false positive log, generates false positive log information, and outputs the generated false positive log information to analyze an attack on the electronic control system and to take a countermeasure against the attack based on the analyzing.