WO2019142474A1

WO2019142474A1 - Data analysis device and program

Info

Publication number: WO2019142474A1
Application number: PCT/JP2018/042234
Authority: WO
Inventors: 崇光佐々木; 松島　秀樹
Original assignee: パナソニックインテレクチュアルプロパティコーポレーションオブアメリカ
Priority date: 2018-01-22
Filing date: 2018-11-15
Publication date: 2019-07-25

Abstract

Provided is a data analysis device, comprising: a data acquisition unit (210) for acquiring data indicating an abnormality level based on occurrence probability of a cyberattack from a plurality of vehicles equipped with on-vehicle networks; a data analysis unit (220) for taking statistics of the abnormality level indicated by the data for each group of a plurality of vehicles classified on the basis of predetermined conditions; a determination unit (230) for determining, in the case where the abnormality level of a first vehicle as one of the plurality of vehicles is less than a predetermined level, when the number of cases indicating an abnormality level of the predetermined level or higher is equal to or larger than a predetermined criterion in the statistics of the group in which the first vehicle is classified, that the abnormality level of the first vehicle to a corrected level that is equal to or larger than a predetermined level; and an information transmission unit (270) for transmitting, when it has been determined to change the abnormality level of the first vehicle to the corrected level, an instruction to recognize the corrected level as an abnormality level in the on-vehicle network in the first vehicle.

Description

Data analysis device and program

The present invention relates to security technology against cyber attacks on vehicles equipped with in-vehicle networks.

Security technology against cyber attacks on vehicles equipped with in-vehicle networks has been proposed. For example, there has been proposed a technology for detecting fraudulent data of an attack hidden in CAN data by analyzing CAN data flowing through an on-vehicle network conforming to CAN (Controller Area Network) which is a communication standard (Patent Document 1 and Patent Reference 2).

JP 2014-146868 A JP, 2008-114806, A

However, there is a possibility that advanced attacks can not be detected by the impersonation method or the like.

Therefore, the present invention provides a data analysis device that can detect advanced attacks with higher accuracy.

A data analysis apparatus according to an aspect of the present invention is a data acquisition unit that acquires data indicating an abnormal level based on the probability of occurrence of a cyber attack on a vehicle from each of a plurality of vehicles equipped with an in-vehicle network; A data analysis unit that takes statistics of the abnormal level indicated by the data for each group in which the vehicle is classified based on a predetermined condition, and the abnormal level of the first vehicle which is one of the plurality of vehicles is less than a predetermined height And in the statistics of the group into which the first vehicle is classified, when the number of cases indicating an abnormal level equal to or higher than the predetermined height is equal to or higher than a predetermined reference, the abnormality level of the first vehicle is determined as the predetermined A determination unit that determines to change the correction level to a height higher than the height of the first vehicle, and the determination unit determines that the abnormality level of the first vehicle is changed to the correction level; An instruction to recognize the modification level as an abnormal level in-vehicle network, and an information transmitting unit that transmits to the first vehicle.

Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, a system, a method, an integrated circuit, a computer program And any combination of recording media.

The data analysis apparatus according to an aspect of the present invention can detect even advanced attacks with higher accuracy.

FIG. 1 is a diagram for explaining an outline of a network security system including a data analysis apparatus according to the first embodiment. FIG. 2 is a view showing a configuration example of an in-vehicle network in the network security system shown in FIG. FIG. 3 is a block diagram showing an example of a functional configuration of the above-mentioned in-vehicle network. FIG. 4 is a block diagram showing an example of the functional configuration of the data analysis server shown in FIG. FIG. 5 is a view showing an example of a data structure of vehicle data provided from the vehicle shown in FIG. 1 to the data analysis server. FIG. 6 is a diagram showing another example of the data structure of vehicle data indicating the traveling state of the vehicle described above. FIG. 7 is a view showing an example of the data structure of the external data provided from the traffic infrastructure system shown in FIG. 1 to the data analysis server. FIG. 8 is a flow chart showing an example of the procedure of processing by the data analysis server in the first embodiment. FIG. 9 is a sequence diagram when it is determined in the first embodiment that an abnormality has occurred in a vehicle. FIG. 10 is a sequence diagram in the case where it is determined in the traffic base system that an abnormality has occurred in the first embodiment. FIG. 11 is a flowchart showing an example of a procedure of processing by the vehicle data analysis device in the first embodiment. FIG. 12 is a flow chart showing an example of the procedure of processing by the traffic infrastructure system in the first embodiment. FIG. 13A is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 13B is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 13C is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 13D is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 13E is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 13F is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment. FIG. 14 is a flowchart showing an example of a procedure of processing by a vehicle data analysis device provided in each vehicle in the second embodiment. FIG. 15 is a diagram showing an example of a data structure as a result of analysis of vehicle data executed to determine an abnormal level in the second embodiment. FIG. 16A is a flowchart showing an example of a procedure of processing by the data analysis server in the second embodiment. FIG. 16B is a flowchart showing another example of the procedure of the process by the data analysis server in the second embodiment. FIG. 17 is a sequence diagram of the network security system in the second embodiment. FIG. 18 is a flow chart showing an example of a procedure of processing by a vehicle data analysis device provided in each vehicle in the third embodiment. FIG. 19 is a flow chart showing an example of a procedure of processing by the data analysis server in the third embodiment. FIG. 20 is a diagram showing an example of data indicating an association between a vehicle-mounted information processing apparatus (ECU) and a transmission CAN message, which is used in the third embodiment. FIG. 21 is a diagram showing an example of data indicating the association between a bus making up a vehicle-mounted network and an ECU connected to each bus, which is used in the third embodiment. FIG. 22 is a sequence diagram of the network security system in the third embodiment. FIG. 23 is a flow chart showing an example of the procedure of presenting information to the user of the network security system in the third embodiment.

(Findings that formed the basis of the present invention)
The inventor has found that the following problems occur with the security technology described in the "Background" section.

Today's automobiles are equipped with a plurality of information processing devices called ECUs (Electronic Control Units). These ECUs perform various functions to improve safety, convenience or comfort, and exchange and cooperate data via in-vehicle network such as CAN network, and more advanced including automatic driving. It is also possible to realize the function. In addition, the word of ECU in the present disclosure is connected to an in-vehicle network called another name such as IVI (In-Vehicle Infotainment), TCU (Telematics Communication Unit), or gateway according to each application, and is connected to an in-vehicle network to transmit data. Alternatively, it can be used to indicate various devices to be received.

As a cyber attack on a vehicle, there has conventionally been a method of disrupting the function of the vehicle by flowing attack data from an unauthorized device connected to an in-vehicle network or an ECU whose program has been illegally rewritten. The technology described in Patent Document 1 or 2 is proposed as a countermeasure against such an attack method.

However, the conventional technology is a technology for detecting attack data by comparing normal data of a target vehicle with attack data, and there is a problem that detection is difficult for attack data which imitates normal data highly. Also, although the prior art can detect the transmitted fraudulent data and prevent the adverse effect of the attack, the identification of the device transmitting the fraudulent data is not targeted, and the device for transmitting the fraudulent data is stopped, etc. Sometimes the more fundamental solution is difficult.

In addition, vehicles equipped with in-vehicle networks that transmit and receive data to and from other vehicles or traffic infrastructure systems directly or via communication networks such as the Internet have also appeared to realize more advanced functions. . The data distribution channel expanded in this way can also be an unauthorized data transmission channel, which may cause damage. However, the prior art can not prevent the propagation of fraudulent data leading to the spread of damage.

In order to solve such a problem, a data analysis device according to an aspect of the present invention is data indicating an abnormal level based on the probability of occurrence of a cyber attack on the vehicle from each of a plurality of vehicles equipped with an in-vehicle network. A data acquisition unit for acquiring the data, a data analysis unit for taking statistics of the abnormal level indicated by the data for each group in which the plurality of vehicles are classified based on a predetermined condition, and a first one of the plurality of vehicles When the abnormal level of the vehicle is less than a predetermined height, in the statistics of the group to which the first vehicle is classified, the number of cases indicating the abnormal level equal to or higher than the predetermined height is equal to or higher than a predetermined standard; A determination unit that determines that the abnormality level of the first vehicle is to be changed to a correction level higher than the predetermined height and the determination unit change the abnormality level of the first vehicle to the correction level If it is determined that that, instructed to recognize the modification level as an abnormal level in-vehicle network of the first vehicle, and an information transmitting unit that transmits to the first vehicle.

Thus, for example, even when the data of a single vehicle is determined to be medium level, the determination result is high when the probability of high level abnormality is high based on the determination result of another vehicle having commonality with the vehicle. Is changed to a higher level, so that attacks can be detected with higher accuracy.

For example, the abnormal level of the predetermined height may be a level at which a countermeasure against a cyber attack is executed in the first vehicle when recognized by the in-vehicle network of the first vehicle. Also, for example, the abnormal level of the predetermined height is a level at which a countermeasure against a cyber attack is not executed in the plurality of vehicles when recognized by the in-vehicle network of the first vehicle, and the correction level is The first vehicle may have a level at which a countermeasure against a cyber attack is executed when it is recognized in the in-vehicle network of the first vehicle.

As a result, even if the analysis of the data of the vehicle itself does not lead to the attack countermeasure, the countermeasure is executed, the security against the cyber attack of the vehicle is strengthened, and the spread of the fraudulent data is suppressed.

For example, the predetermined conditions include (1) traveling in a predetermined area within a predetermined period, (2) the same type of vehicle, (3) the same manufacturer, and (4) the above The configuration of the in-vehicle network may be common, and (5) the time zone of generation of the data may be common, or any combination thereof.

As a result, it is possible to collect data on abnormal levels of analysis results from vehicles close to attack conditions, such as similar or identical in-vehicle networks, and to take statistics, allowing a clearer determination of intermediate abnormal levels become.

Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, and the system, the method, the integrated circuit, the computer It may be realized by any combination of programs or recording media.

Hereinafter, a data analysis apparatus according to an embodiment will be described with reference to the drawings.

Each of the following embodiments is a generic or specific example of the present invention. Therefore, the numerical values, the components, the arrangements and the connection forms of the components, the order of steps (steps) and steps, and the like described in the following embodiments are merely examples and do not limit the present invention. Among the components in the following embodiments, components not described in the independent claims are components that can be added arbitrarily. Further, each drawing is a schematic view, and is not necessarily illustrated exactly.

Embodiment 1
[1. Overview]
FIG. 1 is a diagram for explaining an outline of a network security system including a data analysis apparatus according to the first embodiment. The network security system 1 is a security system for a countermeasure against a cyber attack that targets a vehicle that performs V2X communication and the other party of the communication. As shown in FIG. 1, in the network security system 1, a vehicle 10A and a vehicle 10B (hereinafter, collectively referred to as “vehicle 10 also pointing to one without distinction or together), data analysis server 200 and traffic infrastructure system 300 exchanges data via a communication network 900 established using a communication line such as the Internet. Also, the vehicle 10A and the vehicle 10B exchange data directly with each other and with the traffic infrastructure system 300. The traffic base system 300 refers to various traffic base related devices installed along the road on which the vehicle 10 travels, such as traffic lights, ETC (Electronic Toll Collection) gates, traffic volume measuring devices, etc. Are also referred to as roadside units (not shown), and systems for communicating with, and controlling and managing these roadside units.

In the network security system 1, a cyber attack targeting the vehicle 10 or the traffic infrastructure system 300 is accurately detected, and measures are taken to suppress the spread of damage. Hereinafter, the present embodiment will be described by way of example in which the data analysis server 200 provides the function of the data analysis device responsible for detecting such a cyber attack.

[2. Constitution]
[2-1. Vehicle Information System Configuration]
The information system configuration of the vehicle 10 will be described using the vehicle 10A as an example. FIG. 2 is a diagram showing a configuration example of the in-vehicle network 100 provided in the vehicle 10A.

The vehicle 10A includes an in-vehicle network 100. The data transmitted from the vehicle 10A to the vehicle 10B, the data analysis server 200, and the traffic infrastructure system 300 by V2X communication is data flowing through the in-vehicle network 100.

The in-vehicle network 100 includes an external communication device 110, a gateway 120, a vehicle data analysis device 130, and a plurality of ECUs 150. The ECU 150 in this example is connected to a common bus for each functional system such as an information system and a control system to constitute one functional system network. These functional systems are examples, and the in-vehicle network 100 may include further functional systems such as a body system. A device such as an on-vehicle sensor, switch or actuator not shown is connected to each ECU 150, and the ECU 150 sends sensing data indicating the result measured by this sensor to the bus or processes the measurement result of the sensor as an input It sends control signals output by the program to the switch or actuator. In the following description, an example in which the in-vehicle network 100 is a CAN network may be used, but the present embodiment and the modifications thereof described later are also applicable to an in-vehicle network conforming to a communication protocol other than CAN. is there. Further, in the in-vehicle network 100, networks conforming to different protocols may be mixed.

The external communication device 110 and the gateway 120 are also realized by using the ECUs, and as described above, are indicated using names appropriate to the application. The external communication device 110 is an information processing device including a communication module for communicating with an external communication network 900 or another vehicle 10B, and is called, for example, a TCU. The gateway 120 has a function of transferring data between the above-described functional systems and between each functional system and the external communication apparatus 110, and at the time of this transfer, the data corresponding to the difference in the communication protocol as necessary. It is an information processing apparatus that performs conversion.

The vehicle data analysis device 130 analyzes the vehicle data flowing through the in-vehicle network 100, and provides the analysis result to the data analysis server 200. In the configuration example used for describing the present embodiment, the in-vehicle network 100 is a functional component that is realized by execution of a program by a processor included in the gateway 120. FIG. 3 is a block diagram for explaining the functional configuration of the vehicle data analysis device 130 in more detail.

The vehicle data analysis device 130 includes a vehicle data acquisition unit 131, an external data acquisition unit 132, a traveling state analysis unit 133, an accumulation unit 135, an analysis result transmission unit 136, and a vehicle control data transmission unit 137.

The vehicle data acquisition unit 131 acquires vehicle data that flows through the in-vehicle network 100 and indicates the traveling state of the vehicle 10A. The example of the vehicle data indicating the traveling state includes sensing data sent from the ECU 150 described above.

The external data acquisition unit 132 acquires data received by the external communication device 110 by V2X communication. This data includes data acquired by a surrounding vehicle, in this example, the vehicle 10B or the traffic infrastructure system 300. More specifically, the vehicle 10A receives, from the vehicle 10B, vehicle data flowing through the in-vehicle network of the vehicle 10B, and from the traffic infrastructure system 300, data obtained by the measurement function or the communication function of the roadside device Get as.

The traveling state analysis unit 133 analyzes the vehicle data acquired by the vehicle data acquisition unit 131, and as a result, acquires information on the traveling state of the vehicle 10A. This information may include, for example, vehicle speed, turning curvature, acceleration, yaw rate, accelerator opening, steering amount, shift position, position information of the vehicle, and the like.

The storage unit 135 holds in-vehicle data acquired by the vehicle data acquisition unit 131, external data acquired by the external data acquisition unit 132, or data of an analysis result by the traveling state analysis unit 133 as necessary. In this example, the storage unit 135 is realized using a storage device provided in the gateway 120.

The analysis result transmission unit 136 transmits the data of the analysis result by the traveling state analysis unit 133 to the data analysis server 200 via the external communication device 110.

The vehicle control data transmission unit 137 transmits an instruction for a predetermined operation to be executed according to the presence or absence or level of abnormality based on the analysis result by the traveling state analysis unit 133 or the external data acquisition unit 132. This instruction is sent to the bus connected to the gateway 120 and received by the associated ECU 150.

In addition, the vehicle data analysis device 130 which exists on the gateway 120 as mentioned above is an example of the mounting form of the vehicle data analysis device 130 on the vehicle-mounted network 100, and may be mounted in another form. For example, it may be realized using one or more information processing devices that are connected to the in-vehicle network 100 and are separate from the gateway 120.

Further, the information system with the above configuration is not essential for the vehicle 10 connected to the network security system 1. For example, the information system on the in-vehicle network 100 included in the vehicle 10B does not include the traveling state analysis unit 133, and instead of the analysis result transmission unit 136, a transmission unit that transmits unanalyzed vehicle data such as sensing data to the outside The configuration may be provided. In this case, the analysis of the traveling state based on the vehicle data of the vehicle 10B may be performed by the data analysis server 200 that receives the vehicle data of the vehicle 10B, for example, the vehicle 10B. Alternatively, it may be executed by the vehicle 10A or the traffic infrastructure system 300. When the analysis of the traveling state of the vehicle 10B is performed by the vehicle 10A or the traffic infrastructure system 300, the result is provided to the data analysis server 200 via the communication network 900.

[2-2. Data Analysis Server Configuration]
Next, the configuration of the data analysis server 200 will be described. FIG. 4 is a block diagram showing an example of the functional configuration of the data analysis server 200. As shown in FIG. The data analysis server 200 is realized using one or more computer resources including a processor and a memory. The data analysis server 200 analyzes data received from the vehicle 10 and the traffic infrastructure system 300 via the communication network 900 to detect an abnormality due to a cyber attack, or to execute determination of an abnormality level, and the vehicle 10 as necessary. Or provide information to the traffic infrastructure system 300. The data analysis server 200 provides such a function by executing a predetermined program. Also, in this program, for example, an anomaly detection model created by machine learning or a classification model is used.

The data analysis server 200 includes a data acquisition unit 210, a data analysis unit 220, a determination unit 230, an accumulation unit 240, an associated ECU identification unit 250, an access right management unit 260, an information transmission unit 270, and an information presentation unit 280. These are functional components, and are realized by the data analysis server 200 executing the predetermined program described above by the processor.

The data acquisition unit 210 acquires vehicle data indicating the traveling state of the vehicle 10. The vehicle data indicating the traveling state of the vehicle 10 here is, for example, data of a result of analysis by the traveling state analysis unit 133 transmitted from the above-described vehicle 10A. In addition, when the data transmitted to the data analysis server 200 is unanalyzed data as in the above-described vehicle 10B, the data is a result of analysis of the data by the data analysis unit 220. That is, the data analysis unit 220 executes the same analysis as the traveling state analysis unit 133.

FIG.5 and FIG.6 is a figure which shows an example of the data structure of the vehicle data which show the traveling state of the vehicle 10 which the data acquisition part 210 acquires.

In the example shown in FIG. 5, values indicating the traveling state of the vehicle 10 measured at different times at constant intervals (5 seconds in the illustrated example) are stored in time series. In the example shown in FIG. 6, as a value indicating the traveling state of the vehicle 10, an average value or the like calculated from measured values over a fixed period (10 minutes in the illustrated example) is stored in time series. The contents of the vehicle data are not limited to these examples. The items such as the speed and the turning curvature in the figure are shown for the purpose of illustration and are not essential, and further other items may be included. In addition, the value of each item is, for example, the maximum value and the minimum value for each fixed period, whether the predetermined threshold has been exceeded or fallen within a predetermined period, or the length of time the predetermined threshold is exceeded or fallen within a predetermined period Or the like. In addition, the analysis result may be acquired in response to an event that occurs in the vehicle 10, for example, a predetermined driving operation (for example, start, stop, gear change) by the user or the automatic driving system. In this case, there may be further items indicating an event that has occurred. Further, in FIG. 5 and FIG. 6, although the position information is indicated by latitude and longitude, it is not limited to this. For example, the place name or road where the vehicle is traveling, a road, a section, an intersection name, the name of the nearest landmark, or a zip code, or identification information indicating these (for example, a section of a road or an ID indicating its vertical direction) ) May be used. Moreover, identification information uniquely identifying the vehicle that is the transmission source is added to the data transmitted from each vehicle 10, and the data analysis server 200 manages each item of the vehicle data in association with the identification information. .

The data acquisition unit 210 further acquires, from the traffic infrastructure system 300, out-of-vehicle data indicating a situation (hereinafter referred to as an out-of-vehicle situation) recognized outside the vehicle 10 in an area where the vehicle 10 travels.

More specifically, the out-of-vehicle condition indicated by the out-of-vehicle data is, for example, road information or traffic information.

FIG. 7 is a diagram showing an example of the data structure of the external data provided from the traffic infrastructure system 300 to the data analysis server 200. As shown in FIG.

In the example shown in FIG. 7, as the data indicating the vehicle external condition, an average value or the like calculated from measurement values over a fixed period (five minutes in the illustrated example) by the roadside device is stored in time series. Such data is a result of analysis of sensing data in the roadside machine, and this analysis may be performed in the roadside machine or the traffic infrastructure system 300 or may be analyzed by the data analysis unit 220. The contents of the data outside the vehicle are not limited to this example. The items such as the speed limit and the restrictions in the figure are shown for the purpose of illustration and are not essential, and further other items may be included. In addition, the value of each item is, for example, the maximum value and the minimum value for each fixed period, whether the predetermined threshold has been exceeded or fallen within a predetermined period, or the length of time the predetermined threshold is exceeded or fallen within a predetermined period Or the like. Further, the analysis result may be acquired in response to an event that has occurred in the traffic infrastructure system 300, for example, a change in speed limit. In this case, there may be further items indicating an event that has occurred. In the example of FIG. 7, a road ID, which is identification information indicating a section of a road on which the roadside machine is installed, is used as position information of each roadside machine that is a transmission source of data indicating the vehicle external condition. . In addition, identification data that uniquely identifies a roadside device that has generated out-of-vehicle data may be added to the out-of-vehicle data transmitted from the transportation infrastructure system 300.

The determination unit 230 determines whether there is a mismatch between the traveling state of the vehicle 10 indicated by the vehicle data acquired by the data acquisition unit 210 and the external condition indicated by the external data, and outputs the result of this determination.

The storage unit 240 generates, as necessary, data generated or used by each functional component of the data analysis server 200, such as vehicle data and external data acquired by the data acquisition unit 210, data of the determination result by the determination unit 230, and the like. Hold. In this example, the storage unit 240 is realized using a storage device provided in the data analysis server 200.

If the determination unit 230 determines that there is an abnormality in the vehicle 10, the related ECU identification unit 250 identifies an ECU associated with the abnormality.

The access right management unit 260 manages the access right of the user of the data analysis server 200 to data acquired by the data acquisition unit 210, data of analysis results by the data analysis unit 220, or data such as determination results by the determination unit 230. . In addition, the user of the data analysis server 200 here is a maker of the vehicle 10 or its components, for example.

The information transmission unit 270 transmits data indicating information according to the result of the determination made by the determination unit 230 to the vehicle 10, the traffic infrastructure system 300, or both. The information presentation unit 280 displays, to the user, information according to the result of the determination made by the determination unit 230. Information according to the result of the determination will be described later.

[3. Operation]
Next, the operation of the data analysis server 200 that provides the function of the data analysis device in the present embodiment will be described. FIG. 8 is a flowchart showing an example of the procedure of processing by the data analysis server 200. Further, the sequence diagrams of FIG. 9 and FIG. 10 showing the flow of data (information) in the network security system 1 are also referred to in this description as appropriate. Moreover, the flowcharts of FIG. 11 and FIG. 12 showing the procedure of processing executed in the vehicle 10 and the traffic base system 300 are also referred to as appropriate.

In the data analysis server 200, the data acquisition unit 210 acquires vehicle data from the vehicle 10 and external data from the traffic infrastructure system 300 (Steps S10 and S11). In this example, the vehicle data is analyzed by the vehicle 10 and then provided to the data analysis server 200. FIG. 11 is a flowchart showing a procedure (steps S20 to S22) from acquisition of vehicle data in the vehicle 10 to transmission to the data analysis server 200. Further, the data outside the vehicle is analyzed by the traffic infrastructure system 300 and then provided to the data analysis server 200. FIG. 12 is a flow chart showing a procedure (steps S30 to S32) from acquisition of out-of-vehicle data in the traffic infrastructure system 300 to transmission to the data analysis server 200.

Next, in step S12 executed by the data analysis server 200, the vehicle data and the data outside the vehicle are compared to determine whether there is a mismatch between the traveling state of the vehicle 10 and the situation outside the vehicle 10. Be done. The vehicle data and the data outside the vehicle may be analyzed by the procedure of this comparison and information may be prepared as exemplified in FIGS. 5 to 7, and the location (subject) of the analysis is to provide each data. It may be the original, or may be the data analysis server 200 that has been provided with data. In the present disclosure, before and after this analysis is referred to vehicle data or external data without particular distinction. The mismatch between the traveling state of the vehicle 10 and the external situation of the vehicle 10 will be described later using an example.

Step S12 is performed by the determination unit 230. Determination unit 230 selects out-of-vehicle data to be compared with the vehicle data to be determined using the time and position information indicated by the vehicle data, and the time and position information indicated by the out-of-vehicle data. When the time or position information is expressed in different formats in the vehicle data and the vehicle external data, a correspondence table (not shown) held in the storage unit 240 is referred to or calculation for conversion is performed. You may Further, the determination unit 230 does not necessarily compare data having completely matching time information and position information with each other, but may select data having partial overlap or at least one overlap as comparison targets. Good. In addition, vehicle outside data indicating a time within a predetermined time period that goes back from the time indicated by the time information included in one vehicle data even if there is no overlap, or a predetermined number of vehicle outside data going back may be selected for comparison. By using data outside the vehicle that is likely to reflect current traffic conditions and current traffic conditions better because it is close in time, it is possible to obtain anomaly judgment results that are more suitable for the current situation. . In addition, the area indicated by the position information included in the vehicle data and the area geographically adjacent (for example, the same area or a surrounding area within a certain distance or travel range, or an area defined by a predetermined grid) The external data indicating the external condition of the vehicle may be treated as external data indicating the external condition of the vehicle 10 and may be selected as a target of comparison with the vehicle data.

If the determination unit 230 determines that there is no inconsistency (NO in step S13), the data analysis server 200 determines that there is no abnormality due to the cyber attack that is known from the received data in any of the vehicle 10 and the traffic infrastructure system 300. Processing ends.

If the determination unit 230 determines that there is a mismatch (YES in step S13), the determination unit 230 determines that an abnormality has occurred in either the vehicle 10 or the external data. As described above, by making abnormality determination using not only vehicle data but also out-of-vehicle data, it is possible to determine abnormality with higher accuracy than in the case of making abnormality determination with vehicle data alone. That is, in a case where a vehicle 10 is illegally controlled by a cyber attack, if the traveling state by the illegal control is in a possible category of the traveling state of the vehicle 10 alone, detecting abnormality by vehicle single data Have difficulty. For example, it is assumed that a certain vehicle 10 travels at 100 km / h as a result of a cyber attack while traveling at 30 km / h. At this time, since it is possible that the vehicle 10 travels at 100 km / h per hour, it can not be determined as abnormal only by this. However, by comparing the vehicle data with the data outside the vehicle, it is possible to detect an abnormality even in the case where the category of the unauthorized control is likely to be the traveling state of the vehicle itself. For example, in the above example, it is assumed that there is out-of-vehicle data that all vehicles surrounding the cyber attacked vehicle 10 are traveling at a speed of 30 km / h. Then, it can be understood that the traveling state of the vehicle 10 clearly deviates from the traveling state in which the vehicle 10 can travel in harmony with the surrounding vehicles, and it can be determined that the vehicle 10 has an abnormality.

In addition, when the determination unit 230 determines that there is a mismatch (YES in step S13), the determination unit 230 further determines the vehicle data provided from another vehicle 10 whose position is indicated by the position information in the above area. The determination result by comparison with the data outside the vehicle performed in the past is acquired from the storage unit 240. As described above, the determination result obtained by comparing the vehicle data of the other vehicle 10 with the data outside the vehicle is managed in association with each item of the vehicle data, and is selected with reference to the identification information of the vehicle that is the transmission source. Further, at this time, other vehicle data for which the determination result is acquired may be acquired, for example, from the one whose time shown is near in time, or a certain number of cases. Good.

Then, the determination unit 230 determines whether or not the number of vehicle data, which is a result indicating that there is a mismatch, is equal to or more than a predetermined reference (step S14). The criteria for this determination may be set at a rate such as, for example, 50% or more, may be set as a specific number of values, or a combination of these (for example, 30% or more and 5 or more). It may be done.

If the number of vehicle data, which is a result indicating that there is an inconsistency, is less than the predetermined standard (NO in step S14), the determination unit 230 determines that the abnormality due to cyber attack is determined to be an inconsistency in step S43. It is determined that it is generated in the vehicle 10 that is the transmission source of data (step S15). The determination unit 230 outputs the determination result to the information transmission unit 270. The information transmitting unit 270 that has received the input of the determination result transmits information indicating the vehicle 10 at least to the traffic base system 300 (step S16). Further, the information transmission unit 270 transmits, to the vehicle 10, information for causing the vehicle 10 to execute an operation at the time of occurrence of an abnormality (step S17). This information may simply be information indicating the result of the determination, or may be indicated by a control signal for the vehicle 10. In FIG. 8, an example in which the control signal is transmitted to the vehicle 10 is shown.

It is FIG. 9 which shows the flow of the data (information) in the network security system 1 in the case of being NO by step S14 in a series of procedures shown by FIG.

In the traffic infrastructure system 300 that receives the information ("abnormal vehicle information" in the figure) indicating the abnormal vehicle 10 transmitted from the information transmission unit 270 in step S16, the V2I communication (vehicle and traffic infrastructure system) from the vehicle 10 is performed. Stop the use of the data received in the The information provided by the vehicle 10 that has received a cyber attack may include false content. That is, if the determination using such information is performed by the traffic infrastructure system 300, there is a possibility that an adverse effect such as an operation that does not match the actual traffic situation may occur. Therefore, the spread of the adverse effect of such a cyber attack can be suppressed by providing the traffic infrastructure system 300 with information indicating the vehicle 10 that is experiencing an abnormality under the cyber attack. Such information may be provided not only to the traffic infrastructure system 300 but also to other vehicles 10 traveling around the vehicle 10 in which an abnormality has occurred. In the vehicle 10 performing V2V communication (communication in which the vehicle and the vehicle directly perform), the operation determination may be performed based on data from other vehicles 10, and this determination may be performed based on false information. To prevent

In addition, vehicles 10 undergoing a cyber attack may perform abnormal operations. Therefore, the information transmission unit 270 transmits the above information or control signal to the vehicle 10, and causes the vehicle 10 to perform an operation or the like for notifying the occurrence of an abnormality to the surrounding vehicle or its driver. Can reduce the possibility of The operation for notifying the occurrence of an abnormality is, for example, a warning by a hazard lamp or the like. Or when the said vehicle 10 respond | corresponds to remote control, you may perform retraction | saving operation.

On the other hand, when the number of vehicle data, which is a result indicating that there is inconsistency, is equal to or greater than a predetermined reference (YES in step S14), determination unit 230 determines that an abnormality due to cyber attack is inconsistent with vehicle data in step S13. It is determined that the traffic base system 300 which is the transmission source of the data outside the vehicle determined to be or the roadside machine which is a part thereof is generated (step S18). The determination unit 230 outputs the determination result to the information transmission unit 270. The information transmitting unit 270 that has received the input of the determination result transmits, to at least the traffic base system 300, information related to the roadside device that has transmitted the data outside the vehicle determined that the abnormality has occurred, for example (step S19). The information related to the roadside device may be, for example, identification information uniquely indicating an abnormal roadside device that has generated the out-of-vehicle data, or may be position information indicated by the out-of-vehicle data. In FIG. 8, an example in which what is transmitted to the traffic infrastructure system 300 is information indicating an abnormal roadside machine is shown.

Moreover, it is FIG. 10 which shows the flow of the data (information) in the network security system 1 in the case of YES in step S14 in a series of procedures shown in FIG.

In the traffic infrastructure system 300 that has received the information ("abnormal roadside machine information" in the figure) indicating the abnormal vehicle 10 transmitted from the information transmission unit 270 in step S19, the data outside the vehicle generated by measurement or the like by the roadside machine Stop the use of This suppresses the expansion of the negative effects of cyber attacks. Such information may be transmitted not only to the traffic infrastructure system 300 but also to the vehicle 10 that has transmitted the vehicle data targeted for the determination in step S13 or other vehicles 10 traveling around the abnormal roadside machine. It may be provided. In the vehicle 10 that performs V2I communication, the operation determination may be performed based on the data from the roadside device, and this is to prevent the determination from being performed based on false information.

In the description so far, the example in which the data analysis server 200 compares the external data with the vehicle data received from the vehicle 10 from the traffic infrastructure system 300 has been used, but the data to be compared with the vehicle data Is not limited to the data from the traffic infrastructure system 300. For example, data received from a vehicle 10B traveling around the vehicle 10A may be used as external data to be compared with vehicle data received from the vehicle 10A. For example, image data generated by an image sensor for photographing the periphery mounted by the vehicle 10B is analyzed, and the data analysis server 200 analyzes the condition of the vehicle 10A shown in the image indicated by the image data and the on-vehicle network of the vehicle 10A. It may be determined whether or not the traveling state of the vehicle 10A indicated by the acquired vehicle data is inconsistent. In addition, whether the traveling state such as acceleration / deceleration and steering of the vehicle 10A indicated by the vehicle data of the vehicle 10A and the traveling state such as acceleration / deceleration and steering of the vehicle 10B indicated by the vehicle data of the vehicle 10B are inconsistent. It may be determined. That is, the vehicle data of the vehicle 10B is external data indicating the situation recognized outside the vehicle 10A in terms of the relationship with the vehicle 10A, and the data analysis server 200 uses the vehicle data of the vehicle 10A in step S13. It can be used as a comparison object of Further, the same can be said even if the vehicle 10A and the vehicle 10B are switched.

Hereinafter, including the case where such a determination is performed, a specific example of the inconsistency will be described.

13A to 13F are flowcharts showing one specific example of the procedure of the process by the data analysis server 200 in the present embodiment. However, the difference from the flow chart of FIG. 8 is the determination step regarding the inconsistency in step S13, and thus the description of the other steps is omitted.

In step S13A of FIG. 13A, a mismatch is determined between the traveling speed of the vehicle 10 indicated by the in-vehicle data and the speed limit of the area in which the vehicle 10 travels indicated by the out-of-vehicle data. The information on the speed limit is, for example, one included in the "speed limit" column of the outside data from the traffic infrastructure system 300 as shown in FIG. As another example, the image data transmitted to the data analysis server 200 from another vehicle may be used. In this case, the display content of the road sign or road sign indicating the speed limit, which is included in the analysis result of the image data, is compared with the traveling speed of the vehicle 10 indicated by the in-vehicle data. For example, if the difference between the traveling speed and the speed limit is equal to or greater than a predetermined value or outside the predetermined speed range predetermined for the speed limit indicated by the display content, YES is determined in step S13A.

In step S13B in FIG. 13B, it is determined about the mismatch between the traveling speed of the vehicle 10 indicated by the in-vehicle data and the traveling speeds of other vehicles indicated by the data outside the vehicle and traveling around the vehicle 10. . The information on the traveling speed of the other vehicle is, for example, one included in the "average traveling speed" column of the traffic base system 300 outside-vehicle data as shown in FIG. As another example, the speed indicated by the in-vehicle data transmitted from the other vehicle to the data analysis server 200 may be an average thereof. Thus, in the network security system 1, in-vehicle data for one vehicle may be used as out-of-vehicle data for another vehicle. For example, if the difference between these traveling speeds is equal to or greater than a predetermined value, YES is determined in step S13B.

As shown in these examples, even if the speed of one vehicle 10 is within the normal range in light of the traveling performance, the data analysis server 200 is not limited to the speed limit or the traveling speed of surrounding vehicles. It can be determined whether the situation is normal or abnormal as well.

In step S13C in FIG. 13C, a mismatch is determined between the steering angle of the vehicle 10 indicated by the in-vehicle data and the road curvature of the area (road) on which the vehicle 10 travels indicated by the out-of-vehicle data. The information on the road curvature is, for example, one included in the data outside the vehicle from the traffic infrastructure system 300 (not shown). In this case, the road curvature included in the external data is compared with the steering angle of the vehicle 10 indicated by the in-vehicle data. For example, if the difference between the road curvature and the steering angle is equal to or greater than a predetermined value, it is determined as YES in step S13C.

As shown in this example, the data analysis server 200 is normal in light of the surrounding condition of the shape of the road even if the steering angle of one vehicle 10 is within the normal range in light of the steering performance. It can be determined whether there is a possibility or an abnormality.

In step S13D of FIG. 13D, the traveling speed of the vehicle 10 indicated by the in-vehicle data and the traveling speed of the vehicle 10 measured by another vehicle traveling around the vehicle 10 indicated by the external data indicate It is determined about the inconsistency of the The external data is the velocity of the vehicle obtained as an analysis result of sensing data of an apparatus capable of measuring the relative velocity of a surrounding object such as a radar provided in another vehicle. Alternatively, it may be obtained by analysis of image data generated by an image sensor in another vehicle as described above. For example, when the difference between these traveling speeds is equal to or greater than a predetermined value, YES is determined in step S13D.

As shown in this example, the data analysis server 200 detects the traveling speed of the vehicle recognized by the surrounding vehicles even if the traveling speed of one vehicle 10 is within the normal range in light of the traveling performance. It is possible to judge whether there is a possibility of being normal or abnormal in light of the surrounding situation.

In step S13E of FIG. 13E, a mismatch is determined between the operation state of the brake light of the vehicle 10 indicated by the in-vehicle data and the operation state of the brake light indicated by the outside-of-vehicle data. The external data in this case may be, for example, image data transmitted from the following vehicle of the vehicle 10 to the data analysis server 200. The temporal operation state of the brake light of the vehicle 10 included in the analysis result of the image data is compared with the temporal operation state of the brake light of the vehicle 10 indicated by the in-vehicle data transmitted from the vehicle 10. For example, in the case where there is a certain difference or more in this operation state, YES is determined in step S13E.

As shown in this example, the data analysis server 200 is a braking light of the own vehicle recognized by surrounding vehicles even when the operation of the braking light of one vehicle 10 is within the normal range in terms of specifications. It is possible to determine whether there is a possibility of being normal or abnormal in light of the surrounding situation of the operation of the

In step S13F of FIG. 13F, it is determined about a mismatch between the traveling state of the vehicle 10 indicated by the in-vehicle data and the traveling state of another vehicle indicated by the out-of-vehicle data. The external data in this case may be, for example, time-series data of the traveling state (speed, steering angle, etc.) of the leading vehicle indicated by the in-vehicle data transmitted to the data analysis server 200 from the leading vehicle of the vehicle 10 . That is, also in this example, in-vehicle data for one vehicle is used as out-of-vehicle data for other vehicles. The time-series data of the traveling state included in the analysis result of the in-vehicle data of the preceding vehicle is compared with the time-series data of the traveling state included in the analysis result of the in-vehicle data of the vehicle 10. For example, when there is a difference of a certain level or more in this traveling state, YES is determined in step S13F.

As shown in this example, the data analysis server 200 allows the traveling conditions of other vehicles traveling on the same road even if the overall traveling conditions of one vehicle 10 is within the normal range in light of performance or specifications. It is possible to judge whether there is a possibility of being normal or abnormal in light of the surrounding situation.

As described above, the determination as to the occurrence of a cyber attack on a certain vehicle includes data derived from the vehicle (vehicle data) and data derived from the outside of the vehicle to be determined, such as a traffic infrastructure system or another vehicle. Comparison with the environment where the vehicle travels or the data (data outside the vehicle) indicating the condition of the vehicle, and by checking its consistency, detection with higher accuracy than determination using only the data of the vehicle alone It will be possible.

Also, by accurately detecting a cyber attack, it is possible to suppress the spread of damage due to the spread of unauthorized data even in the situation where the spread of V2X communication, which is frequent in data communication, has progressed.

In addition, there is a possibility that the traffic infrastructure system will be the target of cyber attacks as the computerization progresses. The method of abnormality determination executed by the network security system 1 in the present embodiment is also useful as a means of detecting a cyber attack on the traffic base system. And, by such a series of judgments, it is possible to realize a car society that is high in detection sensitivity of cyber attacks, including vehicles and traffic infrastructure systems, and the spread of the damage can be suppressed.

In the above description, although the case where the data analysis server 200 provides the function of the data analysis device responsible for detecting a cyber attack on a vehicle is used as an example, the present embodiment is not limited to this. For example, a function equivalent to the data analysis server 200 described above may be provided by the vehicle data analysis device 130 mounted on the vehicle 10. For example, in the vehicle data analysis device 130, it is not between the situation indicated by the data outside the vehicle acquired from the other surrounding vehicle or roadside machine by V2X communication via the external communication device 110 and the traveling condition of the vehicle 10 indicated by the vehicle data. It is determined whether there is a match. If there is a mismatch, information on the occurrence of the mismatch in the area where the vehicle 10 is traveling is further obtained from the data stored in the storage unit 135 or through the external communication device 110. It may be acquired by inquiring to surrounding vehicles or roadside machines.

Second Embodiment
[1. Overview]
An embodiment according to another method for improving the accuracy of detection of a cyber attack in a situation where V2X communication is performed will be described.

In the network security system used in the situation where V2X communication is executed, if the abnormal level is another expression in the analysis on the abnormality of the vehicle data executed by the data analysis server or the vehicle data analysis device mounted on the vehicle, The probability of attack occurrence may be moderate. According to the conventional mechanism, from the data of a single vehicle, such vehicle data can not be used to determine the occurrence of a cyber attack, or it takes time until it can be used with practical certainty. In the present embodiment, with a new method of verifying the analysis result of such vehicle data and using it to determine the occurrence of a cyber attack, a more accurate and quick determination can be realized as compared with the prior art.

More specifically, in the network security system according to the present embodiment, it is necessary to immediately cope with a situation in which the medium abnormality is not immediately required according to the result of the determination of the abnormality level in a plurality of vehicles. Treat as anomalous.

Also in the present embodiment, a case where the data analysis server 200 provides the function of the data analysis device responsible for detecting a cyber attack will be described as an example. The configuration is the same as that of the first embodiment, so the description is omitted, and each component is indicated by the reference symbol shown in FIG. 1 to FIG.

Hereinafter, the operation of the data analysis server 200 in the present embodiment will be described.

[2. Operation]
In the network security system 1 according to the present embodiment, the level of abnormality due to cyber attack is determined from the plurality of vehicles 10 based on the analysis result of the vehicle data executed by the vehicle data analysis device 130 of each vehicle 10. Data is sent to data analysis server 200.

FIG. 14 is a flow chart showing an example of the procedure of processing by the vehicle data analysis device 130 provided in each vehicle 10 in the present embodiment.

When the vehicle data analysis device 130 acquires vehicle data flowing through the in-vehicle network (step S40), the vehicle data analysis device 130 analyzes the vehicle data to determine an abnormal level (step S41). The determination of the abnormal level is determined, for example, according to the degree of deviation from the reference indicating the normal state. For example, when the reference maximum speed indicating the normal state is 100 km / h and the traveling speed indicated by the vehicle data is 180 km / h, it is determined that the abnormal level is high and the traveling speed indicated by the vehicle data is 140 km / hour If there is, the abnormal level is determined to be medium. As another example, if the reference maximum steering rotation angle indicating the normal state is 720 degrees, if the steering rotation angle indicated by the vehicle data is 900 degrees, it is determined that the abnormal level is high and the vehicle If the steering rotation angle indicated by the data is 750 degrees, it is determined that the abnormal level is medium. The criteria for determining the abnormal level based on the probability of occurrence of such a cyber attack may be determined at the time of design of the information system of the vehicle 10 or may be dynamically set from the usage history.

When the result of the determination in step S41 is high (YES in step S42), the attack countermeasure is executed in the vehicle 10 (step S43). An example of the attack response measures here is a notification to surrounding vehicles by the operation of a hazard lamp or a forced evacuation operation for stopping the vehicle 10 in a place such as a roadside zone which does not hinder traffic. Further, the analysis result executed in step S41 is transmitted to the data analysis server 200 (step S44). FIG. 15 is a diagram showing an example of the data structure of the analysis result of vehicle data for determination of an abnormal level, which is transmitted to the data analysis server 200 in step S44. This example is data of an analysis result when a high level abnormality occurs in an in-vehicle network conforming to CAN. In this example, the vehicle 10 is uniquely added to information on data determined to be abnormal, such as the location of the abnormality in the vehicle 10, the level of the abnormality, and the ID of the CAN message indicating the type of CAN message in which the abnormality occurred. A vehicle ID for identification and information indicating the position of the vehicle 10 when an abnormality is detected are included. Note that the information included in the data transmitted to the data analysis server 200 when an abnormality occurs is not limited to these. For example, information related to a group described later may be included.

If the result of the determination in step S41 is medium (NO in step S42, YES in step S45), the analysis result executed in step S41 is transmitted to data analysis server 200 (step S46). The data structure in this case is also similar to that shown in FIG. When the abnormal level is medium, the attack countermeasure is not performed on the vehicle 10.

If step S45 is NO, that is, if the abnormal level is low (or normal), the process of determining the abnormal level for the vehicle data acquired in step S41 ends as it is.

Next, a procedure of processing of the data analysis server 200 that receives data of analysis results transmitted from the plurality of vehicles 10 in step S44 or step S46 will be described. FIG. 16A is a flow chart showing an example of the procedure of processing by the data analysis server 200 in the present embodiment.

In the data analysis server 200, the data acquisition unit 210 acquires data of an analysis result indicating an abnormal level based on the probability of occurrence of a cyber attack on the vehicle 10 from each of the plurality of vehicles 10 (step S50). In the description of this process, it is assumed for the sake of convenience that the abnormal level has three levels of high, medium and low.

Next, the data analysis unit 220 updates the statistics of the analysis result held in the storage unit 240 based on the analysis result acquired by the data acquisition unit 210 (step S51). This statistic is taken for each group into which analysis results are classified based on predetermined conditions. The predetermined conditions referred to here are: (1) traveling in a predetermined area within a predetermined period, (2) vehicle types being the same, (3) ) One or more of the same manufacturer, (4) common configuration of in-vehicle network mounted, and (5) common time zone of generation of analyzed in-vehicle data It is a combination. In-vehicle networks having commonality included in such conditions may receive, for example, the same fraudulent message from the same roadside device or vehicle in V2X communication, or may have a common vulnerability. That is, a group of vehicles 10 squeezed under such conditions is likely to be subjected to the same cyber attack. Therefore, by looking at the group unit of vehicles 10 narrowed down under such conditions, the possibility of being able to determine the level of abnormality with higher accuracy is increased. The configuration of the in-vehicle network of the condition (4) relates to a compliant communication standard, a model of the connected ECU, and its firmware.

Note that this group determination may be performed based on the information added to the analysis result transmitted from each vehicle 10 as described above, or is associated with each vehicle ID held in the storage unit 240 Data indicative of the selected group may be referred to and executed.

Next, the determination unit 230 acquires, from the storage unit 240, statistics of the same group as the vehicle 10 that is the transmission source of the data of the analysis result that is the target of verification of the abnormal level (step S52).

Next, the determination unit 230 checks whether or not the abnormal level indicated by the analysis result to be verified is high (step S53). If it is high (YES in step S53), the process ends.

In the case of NO at step S53, the determination unit 230 further confirms whether the abnormal level is medium (step S54).

If the abnormal level is medium (YES in step S54), determination unit 230 then determines whether the number of high abnormal levels is equal to or higher than a predetermined reference in the group acquired in step S52 (step S55A). ). That is, it is determined whether or not a high level abnormality has occurred to a certain extent or more within the group of vehicles 10 having commonality with regard to the possibility of being subjected to the cyber attack. The criteria for this determination may be set at a rate such as, for example, 50% or more, may be set as a specific number of values, or a combination of these (for example, 30% or more and 5 or more). It may be done.

In the case of YES at step S55A, an instruction to change the abnormal level from middle to high is transmitted from the information transmission unit 270 to the vehicle 10 of the transmission source of the analysis result data to be verified (step S56). If NO in step S54 or step S55A, the process ends.

FIG. 16B is a flowchart showing another example of the procedure of the process by the data analysis server 200 in the present embodiment.

The processing in this other example is different from the processing shown in FIG. 16A in the contents of the subsequent steps when the received abnormal level is medium (YES in step S54). In the process shown in FIG. 16A, in the verification of the data of the analysis result in which the abnormality level is medium, the number of analysis results indicating that the abnormality level is high in the vehicle 10 of the same group as the vehicle 10 of the data transmission source In this case, the abnormal level of the analysis result to be verified is raised to a high level. That is, there are many cases in which there is a high probability of being attacked by a cyber attack or a certainty that a cyber attack is under way in a group having commonality. It is a process to make a careful response.

On the other hand, in the process shown in FIG. 16B, in the verification of the data of the analysis result in which the abnormality level is medium, the number of analysis results in which the abnormality level is medium in the vehicle 10 of the same group as the data transmission source vehicle If there is a predetermined standard (for example, 50%) or more (YES in S55B), the abnormal level of the analysis result of the verification target is raised high. In other words, even if there are not many cases in which there is a high probability of being cyber attacked or certain that they are under cyber attack within a group having commonality, there are cases where medium level abnormalities occur. Is a process that makes the vehicle more cautious in the vehicle in which the medium level abnormality has occurred if the predetermined standard (for example, 70%) or more. In this case, the instruction in step S56 may be sent only to the vehicle 10 that is the source of the data of the analysis result to be verified, or in order to quickly improve the safety against traffic cyber attacks, this vehicle It may also be transmitted to all the vehicles 10 that have transmitted the analysis result that the middle level abnormality has occurred in the same group as 10.

FIG. 17 is a sequence diagram of the network security system 1 in the present embodiment. In FIG. 17, for convenience, the vehicle 10 which has transmitted the data to be verified of the analysis result is shown independently of the other vehicles 10.

As shown in FIG. 17, each vehicle 10 transmits data indicating the result that the abnormal level is determined to be medium or high by analysis to the data analysis server 200. The data analysis server 200 updates the statistics using the received data. When validating the analysis results, the statistics of the corresponding group are obtained from the latest statistics. If the analysis result of the verification target indicates the abnormal level is medium, and the number of abnormal levels indicated by the acquired statistics is high or medium or higher, the level indicated by the analysis result of the verification target is corrected to high . This high level is an example of the correction level in the present embodiment. Then, an instruction to change the abnormal level to the correction level is transmitted from the data analysis server 200 to the vehicle 10. In the vehicle 10 that has received this change instruction, the attack countermeasure in step S43 is executed as in the case where the determination in step S42 shown in FIG. 14 is YES.

In the vehicle 10 that has received the change instruction of step S56, in addition to the attack countermeasure, the reference of analysis of vehicle data by the traveling state analysis unit 133 may be changed. In other words, even for vehicle data that was previously determined to be an intermediate level abnormality by analysis, the criteria are changed so that it is determined to be high level when acquired by the vehicle data analysis device 130 next time or later. It is also good. As a result, in the on-vehicle network 100, the attack response measures of the vehicle 10 to the subsequent same type of attacks are executed more quickly.

Also, for convenience, in the above description, verification and correction between high, middle, and low three-step abnormal levels are described, but the idea of the present embodiment is to verify and correct between two or four or more abnormal levels. Is also applicable. In other words, regardless of the number of levels of abnormal levels set, the abnormal levels determined by analysis at the vehicle are verified using abnormal levels determined by other vehicles that are likely to be affected by the same cyber attack. And modifications may be made.

In addition, in the case where four or more stages of abnormal levels are set, the number of levels to be raised may be changed according to the determination status (the number or the ratio thereof) of higher abnormal levels in the same group of statistics. That is, according to the determination situation of the abnormal level in the same group, the data analysis server 200 may issue an instruction to raise the abnormal level by two or more steps. For example, it is assumed that abnormal levels are set in ascending order to levels 1 to 5, and levels 2 to 4 are determined to be "middle" in step S54. In the subsequent steps in this case, if, for example, the number of “medium” is a predetermined number or more, and the level 2 or 3 occupies the majority, then if the received abnormality level is level 2, the process proceeds to level 3 If level 3 is one step to level 4, if the majority is 4 level, then if the received abnormal level is level 2 then level 4; if level 3 or 4, then level 5 , One or two steps may be raised. As another example, if the number of "medium" is more than a predetermined number and the majority is occupied by level 2 or 3, even if the received abnormal level is level 2 or level 3 If one or two steps are raised to 4 and the majority is at level 4, the received anomaly level is raised from 1 to 3 steps to level 5 regardless of levels 2 to 4 It is also good.

Further, in the vehicle 10, the determination of the abnormal level is not executed, the vehicle data is transmitted to the data analysis server 200, and the data analysis unit 220 analyzes the vehicle data in the data analysis server 200 that has received the vehicle data. After the determination, the processes after step S51 may be performed.

Third Embodiment
[1. Overview]
In a situation where V2X communication is performed, an embodiment according to still another method for improving the accuracy of detection of a cyber attack will be described.

The conventional method of detecting an anomaly due to a cyber attack using vehicle data of a single vehicle can detect fraudulent data, but due to sophisticated techniques such as impersonation or limitations of the adopted communication protocol, It may not be possible to identify the device sending the fraudulent data. For example, in CAN, data to be transmitted (message) does not include information for specifying a transmission source. The message includes an ID indicating the type of message, and it is possible to identify a design source from this ID. However, it is also technically possible that the device sending out the fraudulent data is the source of the transmission. In the present embodiment, it is possible to narrow down the devices which are the sources of generation of fraudulent data even in such a situation.

More specifically, in the network security system according to the present embodiment, the device (ECU) related to any abnormality is identified from the device (ECU) related to the abnormality generated in each individual vehicle.

[2. Operation]
In the network security system 1 according to the present embodiment, the presence or absence of an abnormality due to a cyber attack is determined from the plurality of vehicles 10 based on the analysis result of the vehicle data executed by the vehicle data analysis device 130 of each vehicle 10. Data is sent to data analysis server 200.

FIG. 18 is a flow chart showing an example of a procedure of processing by the vehicle data analysis device 130 provided in each vehicle 10 in the present embodiment.

When the vehicle data analysis device 130 acquires vehicle data flowing through the in-vehicle network (step S60), the vehicle data analysis device 130 analyzes the vehicle data to determine an abnormal level (step S61). At this time, a CAN message (hereinafter referred to as an attack CAN message) including illegal vehicle data, in this example, illegal content for attack, is specified (step S62). If an attack CAN message is specified in step S62, that is, an attack occurs (YES in step S63), data specifying and indicating this attack CAN message is transmitted to the data analysis server 200 (step S64). The data transmitted here may be, for example, the same data as FIG. 15 referred to in the description of the second embodiment. In this data, an attack CAN message is identified using a message ID (see the attack CAN message ID column).

Next, a procedure of processing of the data analysis server 200 that receives data transmitted in step S64 from each of the plurality of vehicles 10 will be described. FIG. 19 is a flow chart showing an example of the procedure of processing by the data analysis server 200 in the present embodiment.

In the data analysis server 200, the data acquisition unit 210 acquires, from the vehicle 10, data of an abnormality analysis result that specifies and indicates an attack CAN message that has caused an abnormality in the vehicle 10 (step S70). The attack CAN message indicated by the abnormality analysis result is an example of the abnormality data in the present embodiment.

Next, using the data of the abnormality analysis result acquired by the data acquisition unit 210, the related ECU identification unit 250 is an ECU that is the original transmission source of the CAN message having the message ID of the attack CAN message (hereinafter, The primary ECU is also identified (steps S71 and S72). For this identification, reference is made to data held in the storage unit 240, in which the ID of the CAN message transmitted by the vehicle 10 is associated with the ECU that is the transmission source on the design. FIG. 20 is a diagram showing an example of data indicating the association between the ECUs constituting the on-vehicle network 100 of the vehicle 10 and the CAN messages transmitted by the respective ECUs in the present embodiment. For example, when the data of the analysis result received in step S70 is as shown in FIG. 15, the data of the analysis result is referenced to acquire the ID of the attack CAN message, CAN-001 (step S71). Next, the related ECU identifying unit 250 refers to the data shown in FIG. 20, and the transmission message ID associated with the ECU ID includes the attack CAN message ID CAN-001, that is, the ECU ID is ECU in this example. The ECU of -001 is specified as a primary ECU (step S72).

Since the primary ECU is an ECU that transmits a CAN message of the same message ID as the attack CAN message on the design, it can be said that the ECU has a high possibility of transmitting the attack CAN message. For example, when the primary ECU has been fraudulently taken over and is not operating in design. However, it can not be said that the attack CAN message has been sent reliably. This is because, for example, there is a possibility that an ECU other than the primary ECU is hijacked and transmits an attack CAN message having a message ID which is not transmitted in design.

Therefore, next, ECUs other than the primary ECU are specified, and ECUs which may have transmitted the attack CAN message as described above are specified as the secondary ECU group.

The related ECU identification unit 250 identifies an ECU on the same bus as the primary ECU identified in step S72 as the secondary ECU group in the on-vehicle network 100 of the vehicle 10 (step S73). For this specification, reference is made to data held in the storage unit 240, in which the buses in the in-vehicle network 100 of the vehicle 10 are associated with the ECUs connected to the respective buses. FIG. 21 is a diagram showing an example of data indicating the association between the buses forming the in-vehicle network 100 of the vehicle 10 and the ECUs connected to the respective buses in the present embodiment. Using the example of the primary ECU identified in step S72, the secondary ECU group identified in step S73 includes ECU-001, ECU-002, ECU-003, ECU-004, and ECU-005. If there is a secondary ECU group identified in step S74 (YES in step S74), the identified secondary ECU group is temporarily held in storage unit 240.

Since the secondary ECU group is an ECU group connected to the same bus as the bus to which the attack CAN message was sent, there is a high possibility that any ECU in this secondary ECU group sent the attack CAN message. It can be said that However, analyzing the operation or transmission / reception data of each ECU in order to investigate whether all the ECUs in the secondary ECU group have transmitted attack CAN messages consumes a lot of computational resources and time. .

Then, next, in order to further narrow down the ECUs having a high possibility of transmitting the attack CAN message from among the secondary ECU group, the related ECU specifying unit 250 relates to the secondary ECU group and the vehicle 10 belonging to another group. Steps S70 to S73 are executed to compare with the specified secondary ECU group to determine whether a common ECU is included (step S75). The different groups mentioned here are: (1) different travel areas within a predetermined period, (2) different car types, (3) different manufacturers, (4) different in-vehicle network configurations, And (5) that the time zone in which the in-vehicle data is generated is different, means that the condition consisting of any one or a plurality of combinations is satisfied. The configuration of the in-vehicle network of (4) relates to the compliant communication standard, the model of the connected ECU, and the firmware thereof.

The secondary ECUs of the vehicle 10 that have been attacked or have detected an abnormality are compared with each other, and if there is a common ECU, the common ECU is likely to have transmitted an attack CAN message, or an attacker It can be said that the ECU is likely to have a vulnerability that allows it to enter the in-vehicle network 100. Here, among the secondary ECU groups of the vehicles 10 belonging to another group divided under the above conditions, the number of common ECUs is likely to be smaller than that between the secondary ECU groups of the vehicles 10 belonging to the same group. Therefore, by comparing the secondary ECU groups of the vehicles 10 belonging to different groups, the attacked ECUs can be narrowed down to fewer candidates and efficiently specified.

Note that the determination as to whether each ECU is common (one or more of the manufacturer, model name, model number, installed processor, processor firmware version, and processor manufacturer are the same) is, for example, the storage unit 240 A database (not shown) for each ECU ID is held and is performed with reference to this database.

If one or more common ECUs exist as a result of comparison in step S75 (YES in step S76), the related ECU specifying unit 250 specifies this common ECU as an attack related ECU (step S77). Further, the information presenting unit 280 presents the identified attack related ECU to the user of the data analysis server 200 (step S78). Here, the attack related ECU refers to, for example, an ECU that is a transmission source of an attack CAN message or an transmission source of an attack CAN message. It is an ECU that is likely to have a vulnerability that allows it. The attack related ECU is an example of the abnormality related ECU in the present embodiment.

If there is no secondary ECU group at step S74 (NO at step S74), or if there is no common ECU among multiple secondary ECU groups or if there is no secondary ECU group to be compared (step S76) And the process ends without identifying the attack related ECU.

As described above, in the process of the data analysis server 200 in the present embodiment, by combining the analysis results for a plurality of vehicles 10, it is possible to efficiently identify the ECU that has received an attack.

FIG. 22 is a sequence diagram of the network security system 1 corresponding to the processing by the data analysis server 200 shown in FIG. As shown in FIG. 22, presentation of information to the user may be made in response to the user's request. Further, the information to be presented includes not only the attack related ECU specified in step S77 but also other data contributing to the solution of the vulnerability, for example, data received from the vehicle 10 in S70, primary ECU, secondary ECU group Etc. may also be included. However, some of the users of the network security system 1 may include different manufacturers of vehicles or ECUs and other supplied components. In such a case, the information that can be presented from the data analysis server 200 may include information to be concealed by the user. In such a case, in the data analysis server 200, the access right management unit 260 that manages the access right of the user manages the access right to each data (information) for each user, and the presentation of the information according to the access right Is done. FIG. 23 is a flow chart showing an example of the procedure of presenting information to the user of the network security system 1 in the present embodiment.

The data analysis server 200 receives the information presentation request from the user via the user interface (not shown) (step S80). This user logs in to the data analysis server 200 using, for example, a unique ID and password. The access right management unit 260 checks the content of the access right of the user specified by the ID with reference to the access right management information (not shown) held in the storage unit 240 (step S81). Then, the access right management unit 260 presents the information accessible by the user or the list thereof to the user through the information presentation unit 280 according to the contents of the confirmed access right (step S 82). For example, it is assumed that a user belonging to a certain vehicle manufacturer has access rights controlled so that only information on his / her vehicle can be accessed. In this case, what is presented to the user in step S82 is an attack CAN message generated on a vehicle which is a product of a company to which the user belongs, a primary ECU associated with the attack CAN message, its secondary ECU group and the final It is possible to acquire only the information of the attack related ECU and the identified ECU.

By using such access right management together, usage of the data analysis server 200 by various users including manufacturers who handle data to be concealed from other companies is promoted. If utilization by various users is realized, vehicle data is collected from more and more diverse vehicles in data analysis server 200, and there are more secondary ECU groups to be compared in step S75 in the present embodiment. The possibility of doing is increased. As a result, the possibility of identifying attack related ECUs also increases.

In the above description, an ECU that sends an attack CAN message as a result of a cyber attack or an ECU that is likely to be vulnerable to intrusion into the in-vehicle network 100 is a specific target. The technique of the embodiment is not limited to the cyber attack, but may be applied to the identification of an ECU that is likely to have various abnormalities such as mechanical defects, bugs, or failures in use caused by manufacturing defects. it can. In this case, in the data analysis server 200, the process shown in FIG. 19 is executed using an abnormal message instead of the attack CAN message. That is, an abnormality analysis result indicating and indicating an abnormal message transmitted from the ECU due to these abnormalities is acquired. This abnormal message is another example of abnormal data in the present embodiment. Further, the related ECU specifying unit 250 specifies the found common ECU as an abnormality related ECU in step S77.

Also in the present embodiment, what the data acquisition unit 210 acquires is not limited to the result of an anomaly such as an attack analyzed in each vehicle 10. For example, the result of analysis by the data analysis unit 220 may be a CAN message transmitted from the vehicle 10 that does not have the analysis function of the presence or absence of abnormality.

(Other embodiments)
As described above, the embodiment has been described as an example of the technology according to the present invention. However, the technology according to the present invention is not limited to this, and is also applicable to an embodiment in which changes, replacements, additions, omissions, and the like are appropriately made.

For example, in each of the above-described embodiments, each component may be configured by dedicated hardware or implemented by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded in a recording medium such as a hard disk or a semiconductor memory.

For example, this program causes a computer including a processor and a memory to acquire data indicating an abnormal level based on the probability of occurrence of a cyber attack on each vehicle from each of a plurality of vehicles equipped with an in-vehicle network, Statistics of the abnormal level indicated by the data are taken for each group classified based on a predetermined condition, and the abnormal level of the first vehicle, which is one of the plurality of vehicles, is less than a predetermined height, In the statistics of the group in which the first vehicle is classified, when the number indicating the abnormal level higher than the predetermined height is equal to or higher than a predetermined standard, the abnormal level of the first vehicle is equal to or higher than the predetermined height When it is determined to change to the correction level, and it is determined to change the abnormal level of the first vehicle to the correction level, the in-vehicle net of the first vehicle is An instruction to recognize the modification level as an abnormal level in over click a program to be transmitted to the first vehicle.

Further, an embodiment realized by arbitrarily combining each component and function shown in the above embodiment and the above modification is also included in the scope of the present invention.

The present invention is applicable to in-vehicle security systems including in-vehicle networks.

1

Network Security System

10, 10A, 10B Vehicle 100 Vehicle-mounted Network 110 External Communication Device 120 Gateway 130 Vehicle Data Analysis Device 131 Vehicle Data Acquisition Unit 132 Vehicle Data Acquisition Unit 133 Running State Analysis Unit 135 Accumulation Unit 136 Analysis Result Transmission Unit 137 Vehicle Control Data transmission unit 150 ECU
200 data analysis server 210 data acquisition unit 220 data analysis unit 230 determination unit 240 storage unit 250 related ECU identification unit 260 access right management unit 270 information transmission unit 280 information presentation unit 300 transportation infrastructure system 900 communication network

Claims

A data acquisition unit that acquires data indicating an abnormal level based on the probability of occurrence of a cyber attack on a vehicle from each of a plurality of vehicles equipped with an in-vehicle network;
A data analysis unit that takes statistics of the abnormal level indicated by the data for each group in which the plurality of vehicles are classified based on a predetermined condition;
When the abnormality level of the first vehicle, which is one of the plurality of vehicles, is less than a predetermined height, in the statistics of the group to which the first vehicle is classified, the abnormality level equal to or higher than the predetermined height A determination unit that determines that the abnormality level of the first vehicle is to be changed to a correction level equal to or higher than the predetermined height when the number of cases indicated is equal to or higher than the predetermined reference;
Information that transmits an instruction to cause the first vehicle to recognize the correction level as an abnormality level in the in-vehicle network of the first vehicle when the determination unit determines that the abnormality level of the first vehicle is to be changed to the correction level A data analysis apparatus comprising: a transmission unit.
The abnormal level of the predetermined height is a level at which a countermeasure against a cyber attack is executed in the first vehicle when recognized in the in-vehicle network of the first vehicle.
The data analysis device according to claim 1.
The abnormal level of the predetermined height is a level at which a countermeasure against a cyber attack is not executed in the plurality of vehicles when recognized in the in-vehicle network of the first vehicle,
The correction level is a level at which a countermeasure against a cyber attack is executed in the first vehicle when recognized in the in-vehicle network of the first vehicle.
The data analysis device according to claim 1.
The predetermined condition is
(1) Traveling in a predetermined area within a predetermined period,
(2) Car model is the same,
(3) The manufacturer is the same,
(4) The configuration of the in-vehicle network is common, and (5) the time zone of generation of the data is common.
The data analysis device according to any one of claims 1 to 3.
A computer comprising a processor and a memory,
The data indicating the abnormal level based on the probability of occurrence of the cyber attack on the vehicle is acquired from each of the plurality of vehicles equipped with the in-vehicle network,
The statistics of the abnormal level indicated by the data are taken for each group in which the plurality of vehicles are classified based on a predetermined condition,
When the abnormality level of the first vehicle, which is one of the plurality of vehicles, is less than a predetermined height, in the statistics of the group to which the first vehicle is classified, the abnormality level equal to or higher than the predetermined height When the number of cases indicated is equal to or greater than a predetermined reference, it is determined that the abnormal level of the first vehicle is to be changed to a correction level equal to or higher than the predetermined height,
If it is determined that the abnormality level of the first vehicle is to be changed to the correction level, an instruction to cause the first vehicle to recognize the correction level as an abnormality level in the in-vehicle network of the first vehicle is transmitted to the first vehicle.
program.