KR102414334B1 - Method and apparatus for detecting threats of cooperative-intelligent transport road infrastructure - Google Patents

Abstract

A method and apparatus for detecting threats to autonomous cooperative driving road infrastructure are provided. The method includes the steps of: enriching autonomous cooperative driving-related data collected from an autonomous cooperative driving-related system; correlating the enriched data based on a preset detection policy for each type of threat; and detecting at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat based on the correlation analysis result.

Description

METHOD AND APPARATUS FOR DETECTING THREATS OF COOPERATIVE-INTELLIGENT TRANSPORT ROAD INFRASTRUCTURE

The present invention relates to a method and apparatus for detecting threats to road infrastructure for autonomous cooperative driving.

In order to develop smart road infrastructure for the safe operation of autonomous vehicles, the core industry of future automobiles, major countries around the world are competitively promoting core technology development and road infrastructure construction.

Autonomous cooperative driving road infrastructure is a smart road equipped with a legal system, communication facilities, precise maps, on-site sensors, traffic control, etc. for sharing real-time traffic information between road infrastructure and vehicles so that fully autonomous vehicles can actually run on major roads. say

Autonomous cooperative driving road infrastructure can cause serious damage to drivers or pedestrians when security threats related to availability, integrity, confidentiality and authentication occur, so it is possible to quickly and accurately detect security threats in all areas of autonomous cooperative driving road infrastructure. You need an efficient system that can do that.

Laid-open Patent Publication No. 10-2015-0075774, 2015.07.06.

The problem to be solved by the present invention is to provide a method and apparatus for detecting threats to autonomous cooperative driving road infrastructure.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

In an autonomous cooperative driving road infrastructure threat detection method according to an aspect of the present invention for solving the above-mentioned problems, the step of enriching autonomous cooperative driving-related data collected from autonomous cooperative driving-related systems, a preset threat Correlating the enriched data based on a detection policy for each type and detecting at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat based on the correlation analysis result, The enriching includes generating a data model based on the collected autonomous cooperative driving-related data, and generating metadata by parsing the generated data model for each data source.

In the present invention, the data model includes a local data model and a global data model, wherein the local data model includes an integrity model, confidentiality model, availability model, operation information, statistical information and vehicle information, and the global data The model may include authentication information, threat information, and asset information.

In the present invention, the data source of the integrity model includes location-based traffic information, road danger section information, road work section information, vehicle emergency warning information, road surface condition information, weather information, vcpe log and road firewall log, The data source of the confidentiality model includes c-its database access record, operation management web log, data access information, OS log, firewall log, vcpe log and road infrastructure opening and closing device information, and the data source of the availability model is, It can include c-its traffic information, smart plugs and sdn logs.

In the present invention, meta data for threat detection can be generated for each data source by performing at least one of transformation and purification, tagging, and statistical data generation and transfer on the collected autonomous cooperative driving-related data. .

In the present invention, the correlation analysis step includes in-memory ( in-memory) based local correlation analysis, and based on at least one of a preset authentication threat detection-related policy, an event attack severity analysis-related policy, and an insider anomaly detection-related policy, on the metadata generated for each data source Search-based global correlation analysis can be performed.

In the present invention, the integrity threat includes a false messages inject attack, a replay attack, an abnormal access attempt, and an abnormal node, and the confidentiality threat is privacy information leakage, V2X certificate data leakage , system configuration information reconnaissance and road infrastructure unauthorized access, the availability threats include c-its message flooding attack (c-its msg flooding attack), server availability, blackhole attack, power failure and flooding ), and the authentication threat may include a certificate replication attack, a Sybil attack, a masquerading attack, an illegal use of an anonymous certificate, and an abnormal system access.

In the present invention, when at least one of the integrity threat, the confidentiality threat, the availability threat, and the authentication threat is detected, performing event monitoring for monitoring and analyzing the detected threat, generating a report related to the detected threat and setting control environment information related to failure, performance, and capacity management of the threat detection system based on the detected threats, and setting the threat detection policy related to registration, change, and deletion of policies for the detected threats. It may further include the step of performing.

An autonomous cooperative driving road infrastructure threat detection apparatus according to another aspect of the present invention for solving the above-described problems operates according to a communication unit, a memory storing at least one process for autonomous cooperative driving road infrastructure threat detection, and the process and a processor that, based on the process, enriches the autonomous cooperative driving-related data collected from the autonomous cooperative driving-related system through the communication unit, and based on a preset detection policy for each type of threat to correlate the enriched data, and based on the correlation analysis result, detect at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat, and when the processor performs the enrichment, A data model is generated based on the collected autonomous cooperative driving-related data, and meta data is generated by parsing the generated data model for each data source.

In the present invention, the data model includes a local data model and a global data model, wherein the local data model includes an integrity model, confidentiality model, availability model, operation information, statistical information and vehicle information, and the global data The model may include authentication information, threat information, and asset information.

In the present invention, the data source of the integrity model includes location-based traffic information, road danger section information, road work section information, vehicle emergency warning information, road surface condition information, weather information, vcpe log and road firewall log, The data source of the confidentiality model includes c-its database access record, operation management web log, data access information, OS log, firewall log, vcpe log and road infrastructure opening and closing device information, and the data source of the availability model is, It can include c-its traffic information, smart plugs and sdn logs.

In addition to this, another method for implementing the present invention, another system, and a computer-readable recording medium for recording a computer program for executing the method may be further provided.

The autonomous cooperative driving road infrastructure threat detection system of the present invention can efficiently detect various types of threats.

The threat detection system of the present invention has a difference as shown in FIG. 1 when compared with the conventional general-purpose IT system.

According to the present invention, the existing network-oriented general-purpose security control data collection method cannot collect and identify data to detect threats due to communication encryption, whereas the autonomous cooperative driving environment of the present invention has a closed communication environment and limited applications and It uses a protocol and has the advantage of using volatile data that has less data diversity and does not require long-term storage of the data.

In addition, conventionally, it is impossible to collect data based on the C-ITS service security context, so excessive false positives occur because security control data is extracted from system data, whereas the present invention routes traffic in the traffic receiver of the C-ITS service application. It is possible to extract data specialized for autonomous driving by performing data modeling and pre-processing based on autonomous driving context.

In addition, conventionally, performance issues occur and the accuracy of detection is lowered due to the collection and processing of unnecessary large amounts of data, and the AI-based anomaly detection has a lot of false positives and a large number of detections. , the present invention enables rapid and accurate threat detection through correlation analysis for each threat type.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram showing the difference between the threat detection system of the present invention and the conventional general-purpose IT system.
2 is a view for explaining the autonomous cooperative driving road infrastructure threat detection system according to the present invention.
3 is a flowchart of a method for detecting threats to autonomous cooperative driving road infrastructure according to the present invention.
4 is a diagram for explaining event correlation according to the present invention.
5 is a view for explaining an autonomous cooperative driving road infrastructure threat detection device according to the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and those of ordinary skill in the art to which the present invention pertains. It is provided to fully understand the scope of the present invention to those skilled in the art, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components. Like reference numerals refer to like elements throughout, and "and/or" includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various elements, these elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may be the second component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein will have the meaning commonly understood by those of ordinary skill in the art to which this invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Before the description, the meaning of the terms used in this specification will be briefly described. However, it should be noted that, since the description of the term is for the purpose of helping the understanding of the present specification, it is not used in the meaning of limiting the technical idea of the present invention unless explicitly described as limiting the present invention.

As used herein, the term 'device' includes various devices capable of providing a result to a user by performing arithmetic processing. For example, the device may be in the form of a computer or mobile terminal. The computer may be in the form of a server that receives a request from a client and processes information. In addition, the computer may correspond to a sequencing device for performing sequencing. The mobile terminal includes a mobile phone, a smart phone, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation system, a notebook PC, a slate PC, a tablet PC, and an ultrabook. ), a wearable device, for example, a watch-type terminal (smartwatch), a glass-type terminal (smart glass), a head mounted display (HMD), etc. may be included.

2 is a view for explaining the autonomous cooperative driving road infrastructure threat detection system according to the present invention.

3 is a flowchart of a method for detecting threats to autonomous cooperative driving road infrastructure according to the present invention.

4 is a diagram for explaining event correlation according to the present invention.

5 is a view for explaining an autonomous cooperative driving road infrastructure threat detection device according to the present invention.

Hereinafter, with reference to FIG. 2, an autonomous cooperative driving road infrastructure threat detection system according to the present invention will be described.

Prior to this, the types of security threats of autonomous cooperative driving road infrastructure will be described.

Security threats may include integrity threats, confidentiality threats, availability threats, and authentication and access control threats.

First, integrity threats may include threats related to unauthorized modification of information. In more detail, the integrity threat may include a replay attack, a false messages inject attack, that is, a forgery attack. However, without being limited thereto, integrity threats may include all kinds of threats related to unintended modification.

Here, the threat content of the retransmission attack may be unauthorized intrusion into the C-ITS server or V2X server, causing malfunctions, and generating and transmitting false data.

The threat content of a forgery attack may include interception, alteration, deletion, and delay of messages transmitted and received in the field system, vehicle system, and central system, or storing or transmitting/receiving by forgery.

Second, confidentiality threats may include threats related to the unauthorized disclosure of information deemed sensitive. More specifically, confidentiality threats may include data leakage, configuration information leakage, and privacy information leakage. However, without being limited thereto, confidentiality threats may include all kinds of threats related to performance degradation or denial.

Here, the data leakage may be downloading and leaking information stored in the C-ITS service and the V2X system.

Configuration information leakage may be identifying system configuration information for secondary intrusion or attack by identifying configuration information of the central system, support system, and field system.

Privacy information leakage may be leakage of personal information such as personal signature, resident registration number, vehicle information, driving information, location information, etc. through unauthorized access to the LDM server, V2X authentication server, etc.

Next, availability threats may include threats related to performance degradation or denial of ITS services. More specifically, availability threats may include blackhole attacks, flooding attacks, and malware intrusion. However, without being limited thereto, availability threats may include all kinds of threats related to unauthorized disclosure of information.

Here, the black hole attack may be an attack that paralyzes the function of a service by infecting a node to stop or delay message transmission.

A flooding attack may be an attack that reduces or paralyzes the performance and availability of services by sending numerous dummy messages to the V2X server, vehicle, and RSU (Road-Sied Unit) to induce system overhead.

Malware inflow may be to install illegal malicious code in the central center or road equipment and to encrypt important files to paralyze the service, or to perform malicious activities through a botnet. For example, it may be (message transmission interruption, forgery, personal information leakage, configuration information scan, etc.).

Next, authentication and access control threats may be threats related to the fraudulent use of user and device IDs. In more detail, authentication and access control threats may include Sybil attack, that is, multi-use, certificate replication attack, brute force attack, and road infrastructure physical unauthorized access. However, without being limited thereto, authentication and access control threats may include all kinds of threats related to identity fraud.

Here, the civil attack may be one in which a malicious station (eg, on-site sensor and device) disguises itself as a plurality of stations to disguise it as if there are several stations.

A certificate cloning attack may be illegally copying a certificate and using it illegally to delete a certificate from the black list.

Abnormal login is an attack that checks all possible key values and may be illegally acquiring the certificate of the C-ITS station object.

Road infrastructure physical unauthorized access may be unauthorized access due to physical access to road infrastructure.

2, the threat detection system of the present invention receives the traffic routed by the autonomous cooperative driving related system (specifically, the autonomous cooperative driving C-ITS application and the integrated security authentication system), and enriches the received data. By performing enrichment and correlation analysis, it is possible to detect security threats of autonomous and cooperative driving road infrastructure.

The data model consists of a model for each type of autonomous cooperative driving road infrastructure security threat, i.e., integrity threat, confidentiality threat, availability threat, and authentication and access control threat (hereinafter, authentication threat). It can consist of necessary autonomous cooperative driving road infrastructure asset information, maintenance work information, and global threat information model.

Data enrichment receives traffic routed by the autonomous cooperative driving C-ITS application and integrated security authentication system, parses the received information, and adds tagging and threat detection correlation information to the free cooperative driving road infrastructure context It may consist of functions of removing unnecessary noise data for correlation, data conversion, and periodic statistical data generation, and periodically migrating past data to optimize detection performance and resource use.

Threat detection correlation can be composed of a rule-based detection policy that detects each type of autonomous cooperative driving road infrastructure security threat, that is, an integrity threat, confidentiality threat, availability threat, and authentication threat, and a correlation analysis engine that processes them. .

Monitoring can consist of event monitoring to monitor and analyze security threats detected by the correlation analysis engine, detection policy settings to register, change, and delete detection policies, and monitoring functions to manage failure, performance and capacity of the threat detection system. .

Here, the threat detection system of the present invention may receive various data from the autonomous cooperative driving-related system through a communication network.

Here, the autonomous cooperative driving-related system may include a central system for operating an autonomous driving service, a field system close to a roadside network, and a vehicle system related to a vehicle running on a road.

Here, as the communication network, various types of communication networks may be used, for example, wireless LAN (Wireless LAN), Wi-Fi, Wibro, Wimax, High Speed Downlink Packet Access (HSDPA), etc. A communication method or a wired communication method such as Ethernet, xDSL (ADSL, VDSL), HFC (Hybrid Fiber Coax), FTTC (Fiber to The Curb), FTTH (Fiber To The Home) may be used.

Meanwhile, the communication network is not limited to the communication method presented above, and may include all types of communication methods that are well known or to be developed in the future in addition to the above communication methods.

Hereinafter, a method in which the server of the threat detection system detects a threat of autonomous cooperative driving road infrastructure will be described with reference to FIGS. 3 and 4 .

Referring to FIG. 3 , the server may enrich autonomous cooperative driving-related data collected from the autonomous cooperative driving-related system ( S110 ).

In step S110, the server may generate a data model based on the collected autonomous cooperative driving-related data, and parse the generated data model for each data source to generate metadata.

Here, the data model may include a local data model and a global data model.

Specifically, as shown in FIG. 2 , the local data model includes an integrity model, confidentiality model, availability model, operation information, statistical information and vehicle information, and the global data model includes authentication information, threat information and assets may contain information.

As described above, each of the autonomous cooperative driving-related data is classified into an appropriate data model and can be used as a data source for subsequent threat detection.

Here, each threat may include different types of attack types.

First, the integrity threat may include a false messages inject attack, a replay attack, an abnormal access attempt, and an abnormal node.

In order to detect an attack type of such an integrity threat, data included in the integrity model may be used as a data source. The data source of the integrity model may include location-based traffic information, road danger section information, road work section information, vehicle emergency warning information, road surface condition information, weather information, vcpe log, and road firewall log. The data source of the integrity model may be different depending on the attack type.

- C-ITS road infrastructure MSG integrity threat

Threat type data source - Inject false messages attack - Location-based traffic information- Road danger section information
- Road work section information
- Vehicle emergency warning information
- Road surface condition weather information

- C-ITS road infrastructure device integrity threat

Threat type data source - Abnormal approach attempt - vcpe log - Black hole detection (inactive abnormal node detection) - vcpe logs - road firewall logs and events - Unregistered abnormal node detection - vcpe logs - road firewall logs and events

As shown in Tables 1 and 2 above, different data sources may be used for each attack type of an erroneous message injection attack, an abnormal access attempt, a black hole attack, and an unregistered abnormal node. Next, confidentiality threats may include privacy information leakage, V2X certificate data leakage, system configuration information reconnaissance, and unauthorized access to road infrastructure.

In order to detect an attack type of such a confidentiality threat, data included in the confidentiality model may be used as a data source. The data source of the confidentiality model may include c-its database access record, operation management web log, data access information, OS log, firewall log, vcpe log, and road infrastructure switchgear information. The data source of the confidentiality model may be different depending on the attack type.

- Central system confidentiality

Threat type data source - Data breach
- Privacy information leak - c-its database access history - Operation management web log (ldm, facility monitoring) - Certificate data leak - data access information - Configuration information leakage - OS log - Firewall log

- Road system confidentiality

Threat type data source - Configuration information leakage - vcpe log - unauthorized physical access - Road infrastructure opening and closing devices

As shown in Tables 3 and 4 above, different data sources may be used for each attack type of privacy information leakage, certificate data leakage, configuration information leakage, and unauthorized physical access. Next, availability threats may include c-its msg flooding attack, server availability, blackhole attack, power failure and flooding.

In order to detect the attack type of the availability threat, data included in the availability model may be used as a data source. Data sources of the availability model may include c-its traffic information, smart plugs and sdn logs. The data source of the availability model may be different depending on the attack type.

- Central System DDOS Attack

Threat type data source - c-its msg flooding attack - c-its traffic information

- Road system Device Failure

Threat type data source - power failure - Smart Plug - communication failure - sdn log - traffic flooding - sdn log

As shown in Tables 5 and 6 above, different data sources may be used for each attack type of the C-ITS msg flooding attack, power failure, communication failure, and traffic flooding. Next, the authentication threat may include a certificate replication attack, a Sybil attack, a masquerading attack, an illegal use of an anonymous certificate, and an abnormal system access.

In order to detect an attack type of such an authentication threat, data included in the authentication model may be used as a data source. The data source of the authentication model may include C/A and R/A authentication audit logs.

- Device authentication integrity

Threat type data source - certificate replication attack - Sybil attack
- brute force attack - C/A, R/A authentication audit log

In addition to the attack type, the server can utilize different data sources depending on the asset type. Specifically, in the case of the vehicle location data model, different data sources may be utilized depending on the asset type including the autonomous vehicle, the amount of speed change, the number of occurrences of the location change amount message, and the like. In addition, in the case of the asset data model, different data sources may be utilized depending on the asset type, including HW asset information, SW asset information, C-ITS application information, network protocol information, certificate blacklist, IP blacklist, and the like. In addition, in the case of the work information data model, different data sources may be utilized according to the work information.

In addition, in step S110, the server performs (pre-processing) at least one of transformation and refinement, tagging, generation and transfer of statistical data on the collected autonomous cooperative driving-related data, to detect threats for each data source. You can create metadata.

The transformation and refinement may target c-its message (v2x message) and log-based collected data. The transformation and refinement defines delimiters for extracting feature points from data as fields, refines regular expression data, adds user-defined field values, duplicates and deletes field data, maps field values, and sets data types can be changed

Depending on the embodiment, data fields such as data identification key generation, IP numeric value addition, asset status, etc. may be added, data field conversion, codebook or dictionary data conversion, and a specific value extracted from the field may be converted.

The tagging can link new vulnerabilities and new threat information collected from an external threat information system through an open API.

According to an embodiment, an asset data model and a work information data model may be generated by linking the asset information and work information database operated in the autonomous cooperative driving road infrastructure.

The statistical data generation may generate C-ITS traffic statistical information, C-ITS database access record statistical information, and certificate database access record statistical information according to a preset rule.

Here, the C-ITS traffic statistical information may include the number of communication packets, PPS (packet/sec), communication byte value, BPS (bytes/sec), number of MSG cases, MSG occurrence time, etc. .

The C-ITS database access record statistical information may include repetitive query information, access period, number of query results, time related to data transmission, number of cases, transmission amount (bytes), packet amount (packets), and the like.

The access record statistical information of the certificate database may include repetitive query information, access period, number of query results, time related to data transmission, number of cases, transmission amount (bytes) and packet amount (packets), etc. can

In the transfer, a transfer policy including a transfer range, conditions, method, and date and time of transfer operation may be set to periodically transfer past data, and this may be performed periodically. Thereby, optimization of detection performance and resource usage is possible.

Hereinafter, metadata for each data source generated by performing the enrichment in S110 will be described through tables.

- C-ITS road infrastructure MSG integrity

Threat type data source metadata - Inject false messages attack - Location-based traffic information- Road danger section information
- Road work section information
- Vehicle emergency warning information
- Road surface condition weather information - RSU ID
- MSG ID
- MSG generation time
- Occurrence location information
- MSG contents

- C-ITS road infrastructure device integrity

Threat type data source data source - Abnormal approach attempt - vcpe log - node ID (vcpe) - road firewall logs and events
- Firewall allow/reject information (malicious access settings) - Black hole detection (inactive abnormal node detection) - vcpe logs - road firewall logs and events - node ID
- Statistics on the number of data occurrences per cycle by node - Unregistered abnormal node detection - vcpe logs - road firewall logs and events - node ID
- Whether to register in asset information

- Central system confidentiality

Threat type data source metadata - Data breach
- Privacy information leak - c-its database access history - S-Device information (ip, object type, protocol, location)
- D-Device information (ip, object type, protocol, location)
- Repeated query information, time, query, number of query results
-Data transmission: time, number of cases, transmission amount (bytes), packet amount (packets) - Operation management web log (ldm, facility monitoring) - origin ip, name
- s-ip, d-port
- http_status
-url, query, method, referrer, user agent - Certificate data leak - data access information - Authentication system login information (departure information, login ID, time)
- Authentication system query information (time, query, number of query results)
- Certificate data transmission (time, transmission amount, packet amount) - Configuration information leakage - OS log -Remote command protocol - Firewall log - Date of detection
-Internal network firewall scan log
-Detection policy name
- Protocol name

- Road system confidentiality

Threat type data source metadata - Configuration information leakage - vcpe log - Road sensor ID- serial NO.
- Date of occurrence,
- module name
- action type (ex, deny)
- action policy name
- Protocol name - unauthorized physical access - Road infrastructure opening and closing devices - Asset ID- Road system opening date and time
- Road system switch close date and time

- Central System DDOS Attack

Threat type data source metadata - c-its msg flooding attack - c-its traffic information - node ID (source) - c-its MSG ID
- Number of communication packets, PPS (packets/sec)
- Communication byte value, BPS (bytes/sec)
- Number of MSG cases
- MSG generation time

- Road system Device Failure

Threat type data source metadata - power failure - Smart Plug - Road sensor ID- power on/off information, flag
- Periodic monitoring of status information (script method) - communication failure - sdn log - Road network communication live/down status- Improved network availability through SDN-based flow control - traffic flooding - sdn log - Provides SDN-based security function

- Device authentication integrity

Threat type data source metadata - certificate replication attack - Sybil attack
- brute force attack - C/A, R/A authentication audit log - Certificate ID, serial number
- Certificate device type
- Certificate type (real name, anonymous)
- Certificate validity period
- Type of certificate request action (issuance, revocation, request for use, termination of use)
- Certificate usage information (request date, location upon request)
- Result of certificate use request (success/failure, use)
- Certificate DN information

Next, the server may correlate the enriched data based on a preset detection policy for each threat type ( S120 ). Next, the server may detect at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat, based on the result of the correlation analysis ( S130 ).

In step S110, by performing correlation analysis (correlation analysis) of the metadata generated through the enrichment, an integrity threat, a confidentiality threat, an availability threat, or an authentication threat may be detected.

As shown in FIG. 4 , the correlation analysis may be performed through a search-based global correlation analysis and an in-memory-based local correlation analysis.

Specifically, referring to FIG. 2 , in step S120, the server stores metadata generated for each data source based on at least one of a preset integrity threat detection-related policy, confidentiality threat detection-related policy, and availability threat detection-related policy. It is possible to perform in-memory-based local correlation analysis.

The server may perform a search-based global correlation analysis on the metadata generated for each data source based on at least one of a preset authentication threat detection-related policy, an event attack severity analysis-related policy, and an insider anomaly detection-related policy. .

Here, autonomous driving road infrastructure is an environment in which only authenticated systems, users, and devices are connected in a closed environment such as center system, field system, and office system. Unlike systems for general unspecified users, IT environment such as service, system type, communication protocol Since the component complexity is small, it is possible to detect anomalies through the application of basic validity and consistency checks to all received messages, and rapid detection is essential to protect vehicles moving at high speed. The present invention can quickly calculate basic validity and consistency checks for all received messages through in-memory-based local correlation analysis and efficiently detect anomalies that violate rules.

In addition, in order to detect an intelligent and advanced cyber attack, it is necessary to find data that does not follow the characteristics generally expected in a specific domain or data that has characteristics different from those defined as normal. The present invention can prepare for cases in which detection of various methods is required without following a set rule through search-based global correlation analysis.

The server can detect each threat by performing in-memory-based local correlation analysis and search-based global correlation analysis on metadata based on a detection policy preset for each attack type for each threat.

First, an in-memory-based local correlation analysis will be described.

Prior to the description, in the present invention, in order to perform c-its service integrity threat detection, rules for in-memory-based local correlation analysis can be established using the validity principle, the consistency principle, and the variance principle. .

First, the feasibility principle may include feasibility type, range plausibility, location plausibility, and velocity plausibility. Feasibility types may include range validity, location validity, velocity validity, and movement validity. Range validity can be based on the principle that the location of the transmitting ITS station should be within the maximum wireless reception range. Location validity can be based on the principle that the location of the transmitting ITS station should be in a logically reasonable location. For example, it may mean that physical obstacles do not overlap on a road. The rate validity can be in principle that the rate advertised by the sending ITS station must be less than a predefined threshold.

Next, the consistency principle and the variance principle may in principle use relationships between packets from different participants to determine the reliability of newly received data (e.g., deviations from previously calculated average vehicle speeds on highways). message). Also, it can be in principle that two consecutive beacons coming from the same ITS have similar separation distances (positional coherence). Also, it can be in principle that two consecutive beacons coming from the same ITS should have similar accelerations or decelerations (speed consistency). In addition, two consecutive beacons from the same ITS should have a constant velocity and separation distance in principle (position velocity consistency).

First, as described above, the integrity threat may include a false messages inject attack, an abnormal access attempt, and an abnormal node.

In this case, for an erroneous message injection attack, integrity threat detection-related policies such as false weather information detection policy, false vehicle status detection policy, false congestion information detection policy, and false broadcasting information detection policy may be preset.

According to the embodiment, the false weather information detection policy is based on whether the weather information changes rapidly within a short time, comparison of the contents between the weather information received by the vehicle node in the same RSU, and the weather information received by the vehicle node from the adjacent (front and rear) RSUs. Comparisons of the contents may be included. The server may detect erroneous weather information according to this detection policy, and thus may detect a service integrity threat.

According to the embodiment, the false vehicle state detection policy determines whether multiple vehicle information within the same RSU is similar, whether vehicle information transmitted by vehicle nodes from adjacent (front and rear) RSUs is similar (speed and RPM for a certain period of time) ), whether the msg type transmitted from the vehicle to the RSU is a vehicle data type. The server may detect an incorrect vehicle state according to this detection policy, and thus may detect a service integrity threat.

According to the embodiment, the false congestion information detection policy may include calculating the number of vehicle nodes occurring in the same RSU, calculating the congestion level using the interval and speed information between vehicle nodes, and whether the calculated congestion level meets the criteria. . The server may detect erroneous congestion information according to such a detection policy, and thus may detect a service integrity threat.

According to the embodiment, the false broadcasting information detection policy includes event notification information such as danger section notification, signal notification, emergency detection, weather information, traffic control, road surface work section information, and information broadcast by vehicle from RSU. and correlation analysis of information broadcast to the center. The server may detect erroneous broadcasting information according to this detection policy, and thus may detect a service integrity threat.

In this case, for the abnormal access attempt attack, integrity threat detection-related policies such as a network access detection policy, a service access detection policy, and an abnormal access behavior detection policy may be preset.

According to the embodiment, the network access detection policy and service access detection policy include internal network network logs, internal network logs and events (firewall, IDS/IPS), vulnerable application scan (Application SCAN) attempts (based on CVE), and unnecessary service port scans. (Port SCAN) attempt. The server may detect abnormal access to networks and services according to this detection policy, and thus may detect service integrity threats.

According to an embodiment, the abnormal access behavior detection policy may include firewall permission/denial (malicious access setting) detection. The server may detect an abnormal approach behavior according to such a detection policy, and thus may detect a road system integrity threat.

In this case, for the abnormal node, integrity threat detection related policies such as an inactive abnormal node detection policy and a new/unregistered node detection policy may be preset.

According to an embodiment, the inactive anomaly node detection policy may include C-ITS MSG occurrence below a threshold value for a certain period of time, VCPE occurrence below a threshold value for a certain period of time, and C-ITS and VCPE log correlation analysis. The server can detect an inactive abnormal node according to this detection policy, and thus can detect a road system integrity threat.

According to an embodiment, the new/unregistered node detection policy may include C-ITS that has not occurred for a predetermined period in the past, a VCPE log that has not occurred for a predetermined period of the past, and correlation analysis between C-ITS and VCPE logs. The server can detect new/unregistered nodes according to this detection policy, and thus can detect road system integrity threats.

Next, as described above, the confidentiality threat may include data leakage, privacy information leakage, V2X certificate data leakage, system configuration information reconnaissance, and unauthorized access to road infrastructure.

In this case, for data leakage and privacy information leakage, confidentiality threat detection-related policies such as c-its information abnormal access detection policy and vehicle location information tracking detection policy may be preset.

According to the embodiment, the c-its information abnormal access detection policy detects an attempt to access the C-ITS DB administrator page from an IP that is not allowed access, detects repeated query information exceeding the threshold, and accesses multiple C-ITS DBs during off-hours It may include detection. The server can detect abnormal access to C-ITS information according to this detection policy, and thus can detect service confidentiality threats.

In this case, for V2X certificate data leakage, confidentiality threat detection-related policies such as a certificate data unauthorized access detection policy and a certificate data fraud detection policy may be preset.

According to an embodiment, the certificate data illegal access detection policy may include detection of an access attempt to the authentication system manager page from an IP to which access is not permitted. The server may detect unauthorized access to certificate data according to this detection policy, and thus may detect a service confidentiality threat.

According to an embodiment, the certificate data fraud detection policy may include detection of repeated query information exceeding a threshold and detection of multiple C-ITS DB accesses outside of business hours. The server may detect the illegal leakage of certificate data according to this detection policy, and thus may detect a service confidentiality threat.

In this case, for system configuration information reconnaissance, confidentiality threat detection-related policies such as system configuration information leakage threat detection policy and information scan detection policy may be preset.

According to an embodiment, the system configuration information leakage threat detection policy may include network host scan (Host SCAN) and port scan (Port SCAN) event detection. The server may detect the leakage of system configuration information according to such a detection policy, and thus may detect a service confidentiality threat.

According to an embodiment, the information scan detection policy may include network host scan (Host SCAN) and port scan (Port SCAN) event detection. The server may detect the information scan according to this detection policy, and thus may detect the road system confidentiality threat.

In this case, for unauthorized access to road infrastructure, confidentiality threat detection-related policies such as unauthorized on/off detection policy may be preset.

According to an embodiment, the unauthorized on/off detection policy may include a road infrastructure on/off check outside of a predetermined time for the road infrastructure work. The server can detect unauthorized on-off according to this detection policy, and thus can detect road system confidentiality threats.

Next, as described above, the availability threat may include c-its msg flooding attack, server availability, blackhole attack, power failure and flooding. .

In this case, for a c-its msg flooding attack, availability threat detection-related policies such as a msg flooding detection policy and an attack node detection policy may be preset.

According to an embodiment, the msg flooding detection policy and attack node detection policy may include standard threshold-based detection based on the daily/weekly/monthly average change for each time period (here, the detection criteria are the number of messages, the number of communication packets, bytes, etc.). . The server can detect msg flooding and attack nodes according to these detection policies, and thus can detect service availability threats.

In this case, for server availability, availability threat detection-related policies such as a resource information monitoring detection policy and a network traffic monitoring detection policy may be preset.

According to the embodiment, the resource information monitoring detection policy and the network traffic monitoring detection policy are based on the daily/weekly/monthly variation of the CPU and Memory values of the server based on threshold-based detection, and the daily/weekly/monthly variation of the server’s network traffic volume based on the threshold It may include threshold-based detection. The server may monitor resource information and network traffic according to such a detection policy, and thus may detect a service availability threat.

In this case, for a blackhole attack, an availability threat detection-related policy such as an inactive node detection policy (including a communication device) may be preset.

According to an embodiment, the inactive node detection policy (including communication block) may include detecting non-occurring nodes by comparing the communication of objects in adjacent areas, and detecting road nodes that do not transmit or receive messages in the road node system for a certain period of time. . The server can detect inactive nodes (including communication failures) according to this detection policy, and thus can detect road system availability threats.

At this time, for power failure, availability threat detection-related policies such as road system node power failure detection policy may be preset.

According to an embodiment, the road system node power failure detection policy may include power on/off information detection for each road sensor. The server may detect a road system node power failure according to this detection policy, and thus may detect a road system availability threat.

In this case, for flooding, an availability threat detection-related policy such as a traffic flooding (RSU) detection policy may be preset.

According to an embodiment, the traffic flooding (RSU) detection policy may include a threshold-based detection of a daily/weekly/monthly variation of a network traffic amount of a node. The server may detect traffic flooding according to this detection policy, and thus may detect a road system availability threat.

Next, the search-based global correlation analysis will be described.

First, as described above, the authentication threat may include a certificate replication attack, a Sybil attack, illegal use of an anonymous certificate, and an abnormal system access.

In this case, for a certificate replication attack, an authentication threat detection-related policy such as an anonymous certificate replication use detection policy may be preset.

According to the embodiment, the anonymous certificate duplication detection policy is to collect real-name certificate information of an anonymous certificate stored in C/A, detect an anonymous certificate vehicle node accessed at the same time with a real-name certificate, and detect use of one real-name certificate in multiple vehicle nodes , may include detection of the use of a single real-name certificate across multiple RSUs. The server may detect the use of anonymous certificate replication according to this detection policy, and may detect authentication threats accordingly.

In this case, for a Sybil attack, an authentication threat detection-related policy such as an anonymous certificate multiple use detection policy may be preset.

According to the embodiment, the anonymous certificate multi-use detection policy uses a detection scheme (detection scheme using proofs of work and location), whether the Sybil trajectory is physically present in one vehicle, and time restrictions (using two consecutive RSUs) time constraint), trajectory distance constraint (maximum number of RSUs that a single vehicle travels for a given period of time), use of the same anonymous certificate at a distance that cannot be physically moved by comparing vehicle locations, the number of anonymous certificates generated from vehicles within RSU, and vehicles from RSU It may contain the same number of MSGs that a node receives. The server may detect multiple use of anonymous certificates according to this detection policy, and may detect authentication threats accordingly.

In this case, for the illegal use of anonymous certificates, authentication threat detection-related policies such as an abnormal login attempt detection policy may be preset.

According to an embodiment, the abnormal login attempt detection policy may include the number of failed requests for autonomous cooperative driving road infrastructure object authentication. The server can detect an abnormal login attempt according to this detection policy, and thus can detect an authentication threat.

In this case, an authentication threat detection-related policy, such as a user access attempt detection policy that is not allowed for abnormal system access, may be preset.

According to an embodiment, the disallowed user access attempt detection policy may include an attempt to access the operation management manager page other than the insider IP, count the number of login failures, and count the number of login attempts within a unit time. The server may detect unauthorized user access attempts according to this detection policy, and may detect authentication threats accordingly.

Next, the event attack severity analysis may include an attack site risk analysis and an attack damage analysis.

In this case, for the attack site risk analysis, an event attack severity analysis-related policy such as a global threat information detection policy may be preset.

According to an embodiment, the global threat information detection policy may include vulnerability code (CVE) and IOC information (IP, MD5, HASH, C2 URL). The server can detect global threat information according to this detection policy, and can analyze the severity of the event attack accordingly.

In this case, for the analysis of whether or not there is an attack damage, an event attack severity analysis-related policy such as an asset information detection policy may be preset.

According to an embodiment, the asset information detection policy may include detailed inquiry/analysis of weak asset configuration information, inquiry/analysis of the corresponding asset-related log, and inquiry/analysis of the corresponding asset-related event. The server can detect asset information according to this detection policy, and can analyze the event attack severity accordingly.

Next, insider anomaly detection may include malicious code inflow, internal reconnaissance, internal information leakage, and unauthorized access.

In this case, an insider anomaly detection policy may be preset for the inflow of malicious code.

According to the embodiment, the insider anomaly detection policy detects users attempting to access a blocked site, outputs the site name and number of times that a specific user has attempted to access, detects a specific user accesses more than a specific number of times in 1 hour, and N attempts by a specific user in 1 hour It may include detecting more than one site access attempt. The server can detect insider anomalies according to this detection policy.

In this case, for the internal reconnaissance, an insider anomaly detection related policy such as a scenario-based scan detection policy may be preset.

Depending on the embodiment, the scenario-based scan detection policy may include TCP_FLAG abnormal behavior, NETWORK SCAN access attempt, PING SCAN access attempt, PORT SCAN access attempt, excessive access to a specific server detection, and long-term session maintenance user detection. The server can detect scenario-based scans according to these detection policies. Accordingly, it is possible to detect insider anomalies.

In this case, for inside information leakage, an insider anomaly detection related policy such as a suspicious data transmission detection policy may be preset.

According to an embodiment, the suspicious data transmission detection policy may include continuous transmission of fixed data, a large amount of data leakage, and continuous file download. The server can detect suspicious data transmission according to this detection policy. Accordingly, insider anomalies can be detected.

In this case, for unauthorized access, an insider anomaly detection related policy such as an administrator account access detection policy may be preset.

According to an embodiment, the administrator account access detection policy may include web server administrator account access, server administrator account access, dbms administrator account access, web server administrator account access, and CA/RA server administrator account access. The server can detect administrator account access according to this detection policy. Accordingly, insider anomalies can be detected.

As such, in steps S120 and S130, when at least one of the integrity threat, the confidentiality threat, the availability threat, and the authentication threat is detected by analyzing the necessary metadata for each threat with a detection policy for each threat, the server detects the detected threat can be monitored and reported (S140). Then, the server may perform control environment information setting and threat detection policy setting based on the detected threat (S150).

Specifically, in step S140, the server may perform event monitoring to monitor and analyze the detected threat. The server can inquire, analyze, and confirm events and evidence data (logs, etc.) that have occurred in the detection system. The server can search the normalized log for logs and events stored in the database. The server can perform statistical analysis on the generated log and inquire about the underlying event.

Also, in step S140, the server may generate a report related to the detected threat. The server can transmit an abnormal behavior report to the central MA (Misbehavior Agency) by analyzing the source IP, event type, attack basis data, etc. for the event generated in the event monitoring. The server can automatically generate and transmit a report for an event exceeding the threshold set in the detection policy. In this case, the report format may be composed of a header container such as generation time, sender ID, reported ID and report type, and an Evidence Container that supports the MA to investigate the event and support the conclusion.

Further, in step S140, the server nt dlTek to perform system monitoring. The server can monitor the traffic and collection status of security control information generated in the center system and field system. The server can monitor the resource performance (CPU, MEMORY, storage usage rate, etc.) of the server, security equipment, and network equipment system. The server can perform failure monitoring such as process operation, response time, and failure occurrence of the server, security equipment, and network equipment system.

In step S150, the server configures control environment information related to failure, performance and capacity management of the threat detection system based on the detected threat, and detects threats related to registration, change, and deletion of policies for the detected threat Policy settings can be performed.

In performing the control environment information setting, the server can duplicate the certificate data of the blacklist (CRL: Ceritficate revocation list) in the R/A and C/A servers. This may be to synchronize CRL information by duplicating replication, API method, or the like. In addition, the server may register and manage the blacklist IP/IP band. This may include registering, modifying, deleting and inquiring harmful IPs and harmful URLs, registering, modifying and deleting exception handling IP/IP bands, and registering, modifying, deleting and inquiring white IP/URLs. In addition, the server may manage operator and user information, ID and authority, and an SMS/Email address book. This may be registering, modifying and deleting user information, ID, password, registering, modifying and deleting user authority/role, and registering, modifying and deleting SMS information.

In performing the threat detection policy setting, the server may set, modify, delete, and inquire a real-time policy. In addition, the server can set policies and inquire about logs collected in real time by using thresholds and filtering. In addition, the server can apply a grouping function such as a distribution map to set policies and inquire about the log. In addition, the server can generate, store, and inquire statistics on key fields for the detected event. In addition, the server can register and inquire a threshold-based policy for automatically sending a report to the central MA authority for the detected event.

3 shows that steps S110 to S150 are sequentially executed, but this is merely illustrative of the technical idea of this embodiment, and those of ordinary skill in the art to which this embodiment belongs. As it will be applicable by changing the order described in FIG. 3 and executing it or executing one or more of steps S110 to S150 in parallel within a range that does not deviate from the essential characteristics, it will be possible to apply various modifications and variations, FIG. 3 is a time series sequence It is not limited.

Meanwhile, in the above description, steps S110 to S150 may be further divided into additional steps or combined into fewer steps according to an embodiment of the present invention. In addition, some steps may be omitted if necessary, and the order between steps may be changed. In addition, even if other contents are omitted, the contents of FIG. 5 to be described later may also be applied to the autonomous cooperative driving road infrastructure threat detection method described with reference to FIGS. 2 to 4 .

Hereinafter, the autonomous cooperative driving road infrastructure threat detection apparatus 200 according to the present invention will be described with reference to FIG. 5 .

Referring to FIG. 5 , the autonomous cooperative driving road infrastructure threat detection device 200 (hereinafter, the device) includes a communication unit 210 , a memory 220 , and a processor 230 .

The communication unit 210 may collect autonomous cooperative driving-related data from the autonomous cooperative driving-related system.

At least one process for detecting threats to the autonomous cooperative driving road infrastructure is stored in the memory 220 .

The processor 230 executes a process stored in the memory 220 . As the processor 230 executes the process stored in the memory 520 , the processor 230 enriches the autonomous cooperative driving-related data collected from the autonomous cooperative driving-related system through the communication unit 210 , and a preset threat Based on the detection policy for each type, the enriched data is correlated, and based on the correlation analysis result, at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat is detected.

In this case, during the enrichment, the processor may generate a data model based on the collected autonomous cooperative driving-related data, and parse the generated data model for each data source to generate metadata.

The device 200 described with reference to FIG. 5 may be provided as a server of the aforementioned threat detection system.

The method according to an embodiment of the present invention described above may be implemented as a program (or application) to be executed in combination with a computer, which is hardware, and stored in a medium. Here, the computer may be a server of the aforementioned threat detection system.

The above-described program is C, C++, JAVA, machine language, etc. that a processor (CPU) of the computer can read through a device interface of the computer in order for the computer to read the program and execute the methods implemented as a program It may include code (Code) coded in the computer language of Such code may include functional code related to a function defining functions necessary for executing the methods, etc., and includes an execution procedure related control code necessary for the processor of the computer to execute the functions according to a predetermined procedure. can do. In addition, the code may further include additional information necessary for the processor of the computer to execute the functions or code related to memory reference for which location (address address) in the internal or external memory of the computer to be referenced. have. In addition, when the processor of the computer needs to communicate with any other computer or server located remotely in order to execute the above functions, the code uses the communication module of the computer to determine how to communicate with any other computer or server remotely. It may further include a communication-related code for whether to communicate and what information or media to transmit and receive during communication.

The steps of a method or algorithm described in connection with an embodiment of the present invention may be implemented directly in hardware, as a software module executed by hardware, or by a combination thereof. A software module may include random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, CD-ROM, or It may reside in any type of computer-readable recording medium well known in the art to which the present invention pertains.

In the above, embodiments of the present invention have been described with reference to the accompanying drawings, but those of ordinary skill in the art to which the present invention pertains can realize that the present invention can be embodied in other specific forms without changing the technical spirit or essential features thereof. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

200: device
210: communication department
220: memory
230: processor

Claims (10)

In the autonomous cooperative driving road infrastructure threat detection method performed by the server,
Enriching the security control information collected from the autonomous cooperative driving-related system (enrichment);
Correlating the enriched data based on a preset detection policy for each threat type; and
Detecting at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat based on the correlation analysis result;
The enriching step is
generating a data model based on the collected security control information; and
Including; parsing for each data source of the generated data model to generate meta data;
The meta data generation step is
By performing at least one of transformation and purification, tagging, generation and transfer of statistical data on the collected security control information, metadata for threat detection is generated for each data source,
The data model includes a local data model and a global data model,
The local data model includes an integrity model, confidentiality model, availability model, work information, statistical information and vehicle information,
The global data model includes authentication information, threat information, and asset information,
The data source of the integrity model includes location-based traffic information, road danger section information, road work section information, vehicle emergency warning information, road surface condition information, weather information, vcpe log and road firewall log,
The data source of the confidentiality model includes c-its database access record, operation management web log, data access information, OS log, firewall log, vcpe log, and road infrastructure switching device information,
The data sources of the availability model include c-its traffic information, smart plugs and sdn logs,
The integrity threat includes a false messages inject attack, a replay attack, an abnormal access attempt, and inactive and unregistered abnormal nodes,
The confidentiality threat includes privacy information leakage, V2X certificate data leakage, system configuration information reconnaissance, and unauthorized access to road infrastructure,
The availability threats include c-its message flooding attack (c-its msg flooding attack), server availability, blackhole attack, power failure and flooding,
Among the data sources of the integrity model, the location-based traffic information, the road danger section information, the road work section information, the vehicle emergency warning information, the road surface condition information, and the weather information are the erroneous message injection attacks among the integrity threats. used to detect
Among the data sources of the integrity model, the vcpe log is used to detect the abnormal access attempt among the integrity threats,
Among the data sources of the integrity model, the vcpe log and the road firewall log are used to detect the inactive and unregistered abnormal nodes among the integrity threats,
Among the data sources of the confidentiality model, the c-its database access record and the operation management weblog are used to detect the privacy information leakage among the confidentiality threats,
The data access information among the data sources of the confidentiality model is used to detect the V2X certificate data leakage among the confidentiality threats,
Among the data sources of the confidentiality model, the OS log and the firewall log are used to detect a first system configuration information reconnaissance among the confidentiality threats,
Among the data sources of the confidentiality model, the vcpe log is used to detect a second system configuration information reconnaissance among the confidentiality threats,
Among the data sources of the confidentiality model, the road infrastructure switchgear information is used to detect unauthorized physical access to the road infrastructure among the confidentiality threats,
The c-its traffic information among the data sources of the availability model is used to detect the c-its message flood attack among the availability threats;
The smart plug among the data sources of the availability model is used to detect the power failure among the availability threats,
The sdn log of the data sources of the availability model is used to detect the flooding of the availability threat. delete delete delete According to claim 1,
The correlation analysis step is
Based on at least one of a preset integrity threat detection-related policy, confidentiality threat detection-related policy, and availability threat detection-related policy, in-memory-based local correlation analysis is performed on the metadata generated for each data source do,
A method of performing a search-based global correlation analysis on the metadata generated for each data source based on at least one of a preset authentication threat detection-related policy, an event attack severity analysis-related policy, and an insider anomaly detection-related policy. According to claim 1,
The authentication threat includes a certificate replication attack, a Sybil attack, a masquerading attack, an anonymous certificate fraudulent use, and an abnormal system access. According to claim 1,
When at least one of the integrity threat, the confidentiality threat, the availability threat, and the authentication threat is detected,
performing event monitoring to monitor and analyze detected threats;
generating a report related to the detected threat; and
Setting up control environment information related to failure, performance and capacity management of the threat detection system based on the detected threat, and setting up a threat detection policy related to registration, change, and deletion of policies for the detected threat ; further comprising a method. In the autonomous cooperative driving road infrastructure threat detection device,
communication department;
a memory storing at least one process for autonomous cooperative driving road infrastructure threat detection; and
Including; a processor operating according to the process;
The processor, based on the process,
Enrich the security control information collected from the autonomous cooperative driving-related system through the communication unit,
Correlating the enriched data based on a preset detection policy for each type of threat,
Detect at least one of an integrity threat, a confidentiality threat, an availability threat, and an authentication threat based on the correlation analysis result,
When the processor, the enrichment,
Create a data model based on the collected security control information,
Parsing for each data source of the generated data model to generate metadata,
When the processor is enriched,
By performing at least one of transformation and purification, tagging, generation and transfer of statistical data on the collected security control information, metadata for threat detection is generated for each data source,
The data model includes a local data model and a global data model,
The local data model includes an integrity model, confidentiality model, availability model, work information, statistical information and vehicle information,
The global data model includes authentication information, threat information, and asset information,
The data source of the integrity model includes location-based traffic information, road danger section information, road work section information, vehicle emergency warning information, road surface condition information, weather information, vcpe log and road firewall log,
The data source of the confidentiality model includes c-its database access record, operation management web log, data access information, OS log, firewall log, vcpe log, and road infrastructure switching device information,
The data sources of the availability model include c-its traffic information, smart plugs and sdn logs,
The integrity threat includes a false messages inject attack, a replay attack, an abnormal access attempt, and inactive and unregistered abnormal nodes,
The confidentiality threat includes privacy information leakage, V2X certificate data leakage, system configuration information reconnaissance, and unauthorized access to road infrastructure,
The availability threats include c-its message flooding attack (c-its msg flooding attack), server availability, blackhole attack, power failure and flooding,
Among the data sources of the integrity model, the location-based traffic information, the road danger section information, the road work section information, the vehicle emergency warning information, the road surface condition information, and the weather information are the erroneous message injection attacks among the integrity threats. used to detect
Among the data sources of the integrity model, the vcpe log is used to detect the abnormal access attempt among the integrity threats,
Among the data sources of the integrity model, the vcpe log and the road firewall log are used to detect the inactive and unregistered abnormal nodes among the integrity threats,
Among the data sources of the confidentiality model, the c-its database access record and the operation management weblog are used to detect the privacy information leakage among the confidentiality threats,
The data access information among the data sources of the confidentiality model is used to detect the V2X certificate data leakage among the confidentiality threats,
Among the data sources of the confidentiality model, the OS log and the firewall log are used to detect a first system configuration information reconnaissance among the confidentiality threats,
Among the data sources of the confidentiality model, the vcpe log is used to detect a second system configuration information reconnaissance among the confidentiality threats,
Among the data sources of the confidentiality model, the road infrastructure switchgear information is used to detect unauthorized physical access to the road infrastructure among the confidentiality threats,
The c-its traffic information among the data sources of the availability model is used to detect the c-its message flood attack among the availability threats;
The smart plug among the data sources of the availability model is used to detect the power failure among the availability threats,
wherein the sdn log of data sources of the availability model is used to detect the flooding of the availability threat. delete delete

Images