Vehicle Security Log Analysis by Device-Type Logic Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The diverse configurations of in-vehicle devices in vehicles lead to a significant increase in processing load and a decrease in analysis throughput at the vehicle SOC due to the vast number and types of log data items collected, complicating cyberthreat analysis.
Innovation Solution
An apparatus and method that utilize correspondence information to associate vehicle types with pre-prepared analysis logics, determining the in-vehicle device type from acquired data and applying the corresponding analysis logic for distributed processing of sensor log data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If all types of log data items from diverse in-vehicle devices are collected and analyzed using a unified approach, then comprehensive security analysis coverage is achieved, but processing load increases significantly and analysis throughput decreases
Solution Approach 1:
The patent segments the unified analysis approach into device-type-specific analysis logics. Each analysis logic is tailored to process log data from specific in-vehicle device types (e.g., ECU, sensor, infotainment system). This segmentation allows the system to handle diverse device configurations efficiently by routing log data to appropriate specialized analysis modules, thereby maintaining comprehensive coverage while reducing overall processing load through targeted analysis.
2Productivity
If device-type-specific analysis logics are implemented, then processing load is reduced and analysis throughput is maintained, but system complexity increases due to multiple analysis logics
Solution Approach 1:
The patent introduces a logic selection unit as an intermediary component that manages the complexity of multiple analysis logics. This selection unit receives log data, identifies the source device type, and routes the data to the appropriate analysis logic. By centralizing the decision-making process in this intermediary component, the system maintains manageable complexity while enabling efficient device-type-specific analysis across multiple device types.
3Device complexity
If a unified analysis logic processes all log data items, then system simplicity is maintained, but processing load increases and analysis throughput decreases
Solution Approach 1:
The patent implements a dynamic analysis system where the analysis logic is not fixed but selected based on the device type of the log data source. The system dynamically adapts its processing approach by switching between different analysis logics according to the specific device type encountered. This dynamic selection mechanism allows the system to maintain simplicity in terms of logic selection while achieving efficient processing through specialized analysis methods for each device type.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In the vehicle security analysis device, correspondence information representing correspondence between vehicle components and a plurality of analysis logics prepared in advance for each vehicle component is stored in a storage unit. Every time the analysis target data is acquired, the type of the vehicle component, which is the generation source of the analysis target data, is determined based on the vehicle identification information included in the attribute information in the acquired analysis target data, and the analysis logic corresponding to the determined type of the vehicle component is selected from the correspondence information. Then, the analysis target data is analyzed in accordance with the selected analysis logic to identify the type of the cyberattack, and an analysis report including this result is generated and output.