WO2020158118A1

WO2020158118A1 - Security apparatus, attack identification method, program, and storage medium

Info

Publication number: WO2020158118A1
Application number: PCT/JP2019/045105
Authority: WO
Inventors: 泰生山本; 直樹廣部; 泰久渡辺; 徹小河原
Original assignee: オムロン株式会社
Priority date: 2019-01-29
Filing date: 2019-11-18
Publication date: 2020-08-06

Abstract

The purpose of the present invention is to provide a security apparatus that can identify an attack at reduced-load processing for a case in which a device network has been subjected to a security attack, the security apparatus included in the device network being provided with: an abnormality detection unit that detects an abnormality generated by an attack on the device network; an abnormality data collection unit that collects data on the detected abnormality; an abnormality data retention unit that retains the collected abnormality data; an abnormality detection pattern retention unit that retains an abnormality detection pattern for each attack, the abnormality detection pattern being configured so as to include combination data requiring or not requiring detection with respect to each of a plurality of abnormality detection items; and an attack identification unit that identifies, on the basis of the abnormality data and the abnormality detection pattern, the type of attack corresponding to the abnormality.

Description

Security device, attack identification method, program, and storage medium

The present invention relates to a security device, an attack identification method, a program, and a storage medium.

In Patent Document 1, an abnormality detection server on a cloud accumulates information about frames received from an on-vehicle network from each vehicle, adjusts a predetermined model by machine learning or the like, and a frame received on a certain in-vehicle network. There is disclosed a system for calculating the degree of abnormality in the above-mentioned condition by a calculation process related to a comparison between the information about the frame and a predetermined model.

According to the anomaly detection server described in Patent Document 1, it is possible to appropriately deal with various attack frames by calculating the anomaly level.

[Problems to be Solved by the Invention]
However, in the invention described in Patent Document 1, since it is necessary to communicate between the vehicle and the abnormality detection server, it is not possible to complete appropriate countermeasures (incident response) to the attack frame by the vehicle alone, and Since communication is via communication, incident response to the generated attack may be delayed, and when communication is not possible, there is a problem that the degree of abnormality cannot be calculated and incident response cannot be performed in the first place.

In addition, the amount of processing executed by the abnormality detection server is enormous, and it is difficult to implement such an abnormality detection server function in a vehicle in terms of processing capacity and cost of a device installed in the vehicle. There was a problem that was.

JP, 2017-1111796, A

Means for solving the problem and its effect

The present invention has been made in view of the above problem, and when one or more devices are subjected to a security attack on a device network connected via a communication path, the type of the attack is reduced in processing. It is an object of the present invention to provide a security device, an attack identifying method, a program, and a storage medium that can be identified by the method described above and that enables swift incident response.

To achieve the above object, a security device (1) according to the present disclosure is a security device included in a device network in which one or more devices are connected via a communication path.
An anomaly detection unit that detects an anomaly caused by an attack on the device network,
An abnormality data collection unit that collects the data of the abnormality detected by the abnormality detection unit;
An abnormal data holding unit that holds the abnormal data collected by the abnormal data collecting unit;
An abnormality detection pattern holding unit that holds an abnormality detection pattern for each of the types of attacks, which is configured to include combination data of detection necessity for each of a plurality of abnormality detection items,
An attack identification unit that identifies the type of attack corresponding to the anomaly based on the anomaly data held in the anomaly data holding unit and the anomaly detection pattern held in the anomaly detection pattern holding unit It is characterized by having and.

According to the security device (1), the abnormality detecting unit detects the abnormality, the detected abnormality data is collected by the abnormality data collecting unit, and the collected abnormality data is stored in the abnormal data holding unit. Retained by the department. Then, the attack identifying unit identifies the type of the attack corresponding to the abnormality. Therefore, when the device network receives the attack, the type of the attack can be specified by the security device alone. Further, since the abnormality detection pattern specified for each type of the attack is used to specify the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The type of the attack can be specified by the performed processing. The communication path may be a wired communication path, a wireless communication path, or a communication path including both wired and wireless communication paths.

A security device (2) according to the present disclosure is the same as the security device (1),
An attack estimation pattern holding unit configured to include combination data of weighting values for each of the plurality of abnormality detection items, which holds an attack estimation pattern for each type of the attack,
When the type of attack cannot be specified by the attack specifying unit, the abnormal data held in the abnormal data holding unit and the attack estimation pattern held in the attack estimation pattern holding unit And an attack estimation unit that estimates the type of the attack corresponding to the abnormality based on the above.

According to the security device (2), even if the attack identifying unit cannot identify the attack type, the attack estimating unit estimates the attack type corresponding to the abnormality. can do. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The performed process makes it possible to deduce whether the attack is similar to any known attack.

A security device (3) according to the present disclosure is the same as the security device (1),
The abnormality data stored in the abnormality data storage unit is
Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
The attack identification unit
It is characterized in that the type of the attack corresponding to the abnormality is specified by collating the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items with the abnormality detection pattern.

According to the security device (3), the attack identifying unit collates (in other words, matches) the data indicating the result of detection of each of the plurality of abnormality detection items with the abnormality detection pattern. Identifies the type of attack corresponding to the abnormality. Therefore, the type of attack can be quickly identified by the low-load processing.

The security device (4) according to the present disclosure is the same as the security device (2),
The abnormality data stored in the abnormality data storage unit is
Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
The attack estimation pattern is
A first total value indicating the sum of the combination data of the weighting values,
The attack estimation unit
A first calculation unit that calculates, for each type of the attack, a second total value that indicates a sum of products of the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items and the weighting value;
A second calculation unit that calculates the matching rate between the first total value and the second total value for each type of attack;
An estimating unit that estimates the type of the attack corresponding to the abnormality based on the matching rate calculated by the second calculating unit.

According to the security device (4), the attack estimation unit calculates the second total value for each type of the attack, and calculates the first total value and the second total value for each type of the attack. The match rate is calculated, and the type of the attack corresponding to the abnormality is estimated based on the calculated match rate. Therefore, the low-load processing makes it possible to quickly estimate which of the known attacks the attack is most similar to.

The security control unit (5) according to the present disclosure, in any of the security devices (1) to (4),
In the case where the message received via the communication path is normal, a message normal value holding unit that holds a normal value for each of the plurality of abnormality detection items is provided,
The plurality of abnormality detection items include one or more items relating to the abnormality of the message,
The abnormality detection unit,
A message abnormality detection unit that detects a message abnormality due to the attack based on the normal value of each of the plurality of abnormality detection items held in the message normal value holding unit,
The abnormal data collection unit,
Data of the message abnormality detected by the message abnormality detection unit is collected.

According to the security device (5), the message abnormality is detected based on the normal value of each of the plurality of abnormality detection items held in the message normal value holding unit. Even if the number is large, the message abnormality can be detected promptly by the processing with reduced load. Further, the attack identifying unit can quickly identify the type of the attack corresponding to the message abnormality, and the attack estimating unit can quickly estimate the type of attack corresponding to the message abnormality. Is possible.

The security control unit (6) according to the present disclosure, in any of the security devices (1) to (5),
When the state of the communication path is normal, the communication path normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
The plurality of abnormality detection items include one or more items relating to the abnormality of the communication path,
The abnormality detection unit,
Based on the normal value of each of the plurality of abnormality detection items held in the communication path normal value holding unit, a communication path abnormality detection unit for detecting a communication path abnormality due to the attack,
The abnormal data collection unit,
It is characterized in that data of the communication path abnormality detected by the communication path abnormality detection unit is collected.

According to the security device (6), the communication path abnormality is detected based on the normal value of each of the plurality of abnormality detection items held in the communication path normal value holding unit. Even if the number of items is large, the communication path abnormality can be detected promptly by the processing with reduced load. Further, the attack identifying unit can quickly identify the type of the attack corresponding to the communication path abnormality, and the attack estimating unit quickly estimates the type of attack corresponding to the communication path abnormality. It becomes possible to do.

The security control unit (7) according to the present disclosure, in any of the security devices (1) to (6),
When the internal processing of the security device is normal, the internal processing normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
The plurality of abnormality detection items include one or more items related to the abnormality of the internal processing,
The abnormality detection unit,
An internal processing abnormality detection unit that detects an abnormality in the internal processing, based on the normal value of each of the plurality of abnormality detection items held in the internal processing normal value holding unit,
The abnormal data collection unit,
Data of abnormality of the internal processing detected by the internal processing abnormality detection unit is collected.

According to the security device (7), based on the normal value of each of the plurality of abnormality detection items held in the internal processing normal value holding unit, an abnormality in the internal processing (hereinafter, also referred to as internal processing abnormality) Since it is detected, even if the number of the plurality of abnormality detection items is large, the internal processing abnormality can be detected promptly by the processing with reduced load. Further, the attack identification unit can quickly identify the type of the attack corresponding to the internal processing abnormality, and the attack estimation unit quickly estimates the type of the attack corresponding to the internal processing abnormality. It becomes possible to do. Therefore, it becomes possible to specify or estimate an abnormality due to the attack that cannot be detected from the communication channel or a message received via the communication channel based on the internal processing abnormality, and thus more various types can be obtained. It is possible to identify or estimate the attack of.

The security device (8) according to the present disclosure is the security device (1) to (7) according to any one of the above security devices.
The abnormal data collection unit,
Data of the abnormality detected within a predetermined time after the abnormality is detected by the abnormality detector is collected.

According to the security device (8), the abnormality data collection unit collects the abnormality data detected within a predetermined time after the abnormality is detected. Therefore, by using the data of the abnormality detected within the predetermined time, it is possible to improve the accuracy of identifying the type of attack by the attack identifying unit, and estimate the type of attack by the attack estimating unit. The accuracy can be increased.

Further, a security device (9) according to the present disclosure is, in any one of the security devices (1) to (8), an abnormal log accumulation unit that accumulates the abnormal data collected by the abnormal data collection unit as an abnormal log. It is characterized by having.

According to the security device (9), since the abnormality data is accumulated in the abnormality log storage unit as an abnormality log, it is possible to perform a post analysis using the abnormality log stored in the abnormality log storage unit. It will be possible.

Further, in the security device (10) according to the present disclosure, in the security device (1) or (3), when the attack identifying unit identifies the type of the attack corresponding to the abnormality, It is characterized by including a first incident handling unit that performs handling processing for types.

According to the security device (10), when the type of the attack corresponding to the abnormality is identified by the first incident response unit, it is possible to quickly take measures against the identified type of the attack.

Further, in the security device (2) or (4) according to the present disclosure, when the type of the attack corresponding to the abnormality is estimated by the attack estimation unit in the security device (2) or (4), the estimated attack It is characterized by including a second incident handling unit that performs handling processing for types.

According to the security device (11), when the type of the attack corresponding to the abnormality is estimated by the second incident response unit, it is possible to quickly take measures against the estimated type of the attack.

In addition, the security device (12) according to the present disclosure is, in any of the security devices (1) to (11), provided with a notification processing unit that operates the notification unit connected to the device network to notify the abnormality. It is characterized by

According to the security device (12), the notification processing unit can operate the notification unit to notify the abnormality, so that the user who receives the notification can appropriately respond to the abnormality. Can be carried out.

The security device (13) according to the present disclosure is, in any one of the security devices (1) to (12), a notification process for operating the external notification unit connected to the device network to notify the abnormality to the outside. It is characterized by having a section.

According to the security device (13), it is possible for the notification processing unit to operate the external notification unit to report the abnormality to the outside, so that an appropriate countermeasure is taken from the outside. can do.

A security device (14) according to the present disclosure is the control device according to any one of the security devices (1) to (13), wherein the device is mounted in a vehicle,
The device network is an in-vehicle network.

According to the security device (14), when one or more of the control devices receives a security attack on the in-vehicle network connected via the communication path, the type of the attack is loaded on the vehicle alone. It can be specified by the reduced processing. In addition, prompt incident response can be achieved, and the safety of the vehicle can be enhanced.

A security device (15) according to the present disclosure is the control device according to any one of the security devices (1) to (13), wherein the device is installed in an industrial device forming an FA (Factory Automation) system. ,
The device network is an industrial device network that constitutes the FA system.

According to the security device (15), when one or more of the control devices receives the attack on the industrial device network connected via the communication path, the type of the attack in the FA system. Can be specified by the processing with reduced load. In addition, quick incident response is possible, and the user (for example, operator) of the industrial device can use the industrial device with more peace of mind without worrying about security threats.

The attack identifying method (1) according to the present disclosure is an attack identifying method executed by at least one computer included in a device network in which one or more devices are connected via a communication path,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit Attack specific steps to
The abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.

According to the attack identification method (1), since the abnormality detection pattern is used to identify the type of the attack, when the device network receives the attack, the processing amount such as machine learning is enormous and the load is high. The type of the attack can be specified by the processing with reduced load, without performing the abnormality analysis of 1.

The attack identifying method (2) according to the present disclosure is held in the abnormal data holding unit when the attack identifying step cannot identify the attack type in the attack identifying method (1). Based on the abnormality data and the attack estimation pattern for each type of attack held in the attack estimation pattern holding unit, an attack estimation step of estimating the type of the attack corresponding to the abnormality,
The attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.

According to the attack identifying method (2), even if the attack identifying step fails to identify the attack type, the attack estimating step identifies the attack type corresponding to the abnormality. Can be estimated. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The performed process makes it possible to deduce whether the attack is similar to any known attack.

Further, the program (1) according to the present disclosure is a program for causing at least one or more computers included in a device network in which one or more devices are connected via a communication path,
The at least one or more computers,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit It is a program to execute the attack specific step
The abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.

According to the program (1), when the attack on the device network is received, it is possible to cause the at least one or more computers to execute the process of identifying the type of the attack. Therefore, the type of the attack can be specified by the computer itself. Further, since the abnormality detection pattern is used to identify the type of the attack, it is possible to perform the processing in which the load is reduced without causing the computer to execute a heavy load abnormality analysis such as machine learning. It becomes possible to execute the processing for specifying the type of attack. The program may be a program stored in a storage medium or a program that can be transferred via a communication network.

A program (2) according to the present disclosure is the same as the program (1) above.
The at least one or more computers,
When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit A program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of
The attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.

According to the program (2), even if the type of the attack cannot be specified by the attack specifying step, the attack estimating step causes the computer to detect the attack corresponding to the abnormality. A process of estimating the type can be executed. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, it is necessary to cause the computer to execute an abnormality analysis with a large amount of processing such as machine learning and a high load. Instead, it is possible to execute the process of estimating whether the attack is similar to any known attack by the process of reducing the load.

The computer-readable storage medium (1) according to the present disclosure is a computer in which a program for executing at least one computer included in a device network in which one or more devices are connected via a communication path is stored. A readable storage medium,
The at least one or more computers,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit The program for executing the attack specific step
The abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.

According to the computer-readable storage medium (1), when the at least one or more computers read the program and execute the steps, the attack is made on the device network, It is possible to execute processing for specifying the type of attack. Therefore, the type of the attack can be specified by the computer itself. Further, since the abnormality detection pattern is used to identify the type of the attack, it is possible to perform the processing in which the load is reduced without causing the computer to execute a heavy load abnormality analysis such as machine learning. It becomes possible to execute the processing for specifying the type of attack.

Further, a computer-readable storage medium (2) according to the present disclosure is provided in the at least one computer,
When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit A program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of
The attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.

According to the computer-readable storage medium (2), even if the type of the attack cannot be specified by the attack specifying step, the attack estimating step causes the computer to detect the abnormality. A process of estimating the type of the corresponding attack can be executed. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, it is necessary to cause the computer to execute an abnormality analysis with a large amount of processing such as machine learning and a high load. Instead, it is possible to execute the process of estimating whether the attack is similar to any known attack by the process of reducing the load.

It is a schematic block diagram of the vehicle-mounted network system to which the security device which concerns on embodiment (1) was applied. FIG. 3 is a block diagram showing a functional configuration example of a gateway ECU according to the embodiment (1). FIG. 7 is a diagram for explaining an example of an abnormality detection pattern held by an abnormality detection pattern holding unit for each type of attack. It is a figure for demonstrating the case where the kind of attack was able to be specified by the attack specific process which an attack specific part performs. It is a figure for demonstrating the case where the kind of attack cannot be specified by the attack specific process which an attack specific part performs. It is a figure for demonstrating an example of the attack estimation pattern for every kind of attack currently hold|maintained at the attack estimation pattern holding part. It is a figure for explaining an example of attack presumption processing which an attack presumption part performs. It is a figure which shows an example of the calculation result of the 2nd total value calculated by the 1st calculation part which comprises an attack estimation part. It is a figure which shows an example of the coincidence rate calculated by the 2nd calculation part which comprises an attack estimation part. 6 is a configuration example of attack identification data output to the incident response unit when the attack identification unit identifies the type of attack corresponding to the abnormality. It is a structural example of the attack estimation data output to the incident response unit when the type of attack corresponding to the abnormality is specified by the attack estimation unit. 7 is a schematic flowchart showing a processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1). 7 is a flowchart showing an abnormality detection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1). 7 is a flowchart showing an abnormality collection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1). 7 is a flowchart showing an attack identifying processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1). It is a block diagram which shows the functional structural example of the gateway ECU which concerns on embodiment (2). FIG. 7 is a diagram for explaining an example of an abnormality detection pattern held by an abnormality detection pattern holding unit for each type of attack. It is a figure for demonstrating an example of the attack estimation pattern for every kind of attack currently hold|maintained at the attack estimation pattern holding part. 7 is a flowchart showing an abnormality detection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (2). It is a schematic block diagram of the FA system which concerns on a modification. It is a schematic block diagram of the FA system which concerns on another modification.

Embodiments of a security device, an attack identifying method, a program, and a storage medium according to the present invention will be described below with reference to the drawings.

[Application example]
FIG. 1 is a schematic block diagram of an in-vehicle network system to which the security device according to the embodiment (1) is applied.

The in-vehicle network 2 is a communication network system mounted on the vehicle 1, and includes an OBDII (On-board diagnostics II) 4, a traveling system ECU (Electronic Control Unit) group 5, a body system ECU group 6, an information system ECU group 7, And a gateway ECU 10. The vehicle-mounted network 2 in the present embodiment is a network that communicates according to the CAN (Controller Area Network) protocol. Note that communication standards other than CAN may be adopted for the in-vehicle network 2.

The OBDII 4, the traveling system ECU group 5, the body system ECU group 6, and the information system ECU group 7 are connected to CH1, CH2, CH3, and CH4 of the gateway ECU 10 via the bus 3 which is a communication path, respectively. The number of communication CHs that the gateway ECU 10 has is not limited to four. Further, in the example of FIG. 1, a central gateway system in which the ECU group is connected to the gateway ECU 10 for each functional system is adopted, but the connection system of the gateway ECU 10 is not limited to this system, and the ECU group is connected between the ECU groups. The gateway ECU 10 may be provided in the system.

OBDII4 is equipped with a port to which a diagnostic device or scan tool for failure diagnosis or maintenance is connected.

The traveling system ECU group 5 includes a drive system ECU and a chassis system ECU. The drive system ECU includes a control unit for "running" functions such as engine control, motor control, fuel cell control, EV (Electric Vehicle) control, and transmission control. The chassis system ECU includes a control unit for "stop, bend" functions such as brake control or steering control.

The body system ECU group 6 includes a control unit related to the functions of the vehicle body such as a door lock, a power window, an air conditioner, a light, or a winker.

The information system ECU group 7 includes infotainment devices, telematics devices, or ITS (Intelligent Transport Systems) related devices. The infotainment device includes a car navigation device or an audio device, and the telematics device includes a communication unit for connecting to a mobile phone network or the like. The ITS-related device includes an ETC (Electronic Toll Collection System), a road-to-vehicle communication with a roadside device such as an ITS spot, or a communication unit for performing inter-vehicle communication.

In addition to these ECU groups, a safety function system ECU group may be connected to the gateway ECU 10. The safety function system ECU group includes a control unit relating to functions such as automatic braking, lane keeping control, inter-vehicle distance control, etc. that automatically improve safety or realize comfortable driving in cooperation with the traveling system ECU group 5 and the like. It is included.

Also, an external interface may be connected to the gateway ECU 10. The external interface includes, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), USB (Universal Serial Bus) port, memory card slot, or the like.

The gateway ECU 10 has a function of exchanging frames with each ECU group included in the in-vehicle network 2 according to the CAN protocol, and further functions as a security device according to the present embodiment. That is, the security device according to the present embodiment is mounted on the gateway ECU 10 connected to the bus 3 of the vehicle-mounted network 2.

When an attack (also referred to as a security attack or a cyber attack) to the in-vehicle network 2 is executed, the gateway ECU 10 determines the attack by the vehicle 1 alone, that is, in the gateway ECU 10 by the process of reducing the load (ie, the attack). , Identify or presume the type of attack) and execute incident response processing according to the determined attack. As a result, the driver of the vehicle 1 can drive the vehicle 1 without anxiety about the threat of a security attack.

The traveling system ECU group 5, the body system ECU group 6, the information system ECU group 7, and the gateway ECU 10 are configured by a computer device including one or more processors, a memory, a communication module, and the like, and a processor mounted in each ECU. However, by reading the program stored in the memory, interpreting and executing the program, each ECU executes predetermined control.

[Configuration example 1]
FIG. 2 is a block diagram showing a functional configuration example of the gateway ECU 10 according to the embodiment (1).
The gateway ECU 10 includes a gateway function unit 11 and a security control unit 12. The security control unit 12 is a part in which the functions of the security device according to the present embodiment are mounted. The gateway ECU 10 includes, as hardware, a memory including a ROM (Read Only Memory) and a RAM (Random Access Memory) in which a control program is stored, a processor such as a CPU (Central Processing Unit) that reads and executes the program from the memory. , And a communication module for connecting to the vehicle-mounted network 2 and the like.

The gateway function unit 11 has a function of performing control to transfer a frame via each ECU group and the bus 3, and includes, for example, a frame transmission/reception unit, a frame interpretation unit, and a frame conversion unit (not shown) of the vehicle-mounted network 2. The configuration required for mutual communication with each ECU group according to the CAN protocol is included. In the present embodiment, the bus 3 is an example of a communication path and the frame is an example of a message.

-Frames in the CAN protocol are configured to include data frames, remote frames, overload frames, and error frames. The data frame includes SOF (Start of Frame), ID, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit, DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence, CRC delimiter (CRC delimiter). DEL), ACK (Acknowledgement) slot, ACK delimiter (DEL), and EOF (End Of Frame) fields.

The security control unit 12 includes a frame reception unit 21, a frame abnormality detection unit 22, a bus monitoring unit 23, a bus abnormality detection unit 24, and a normal value holding unit 25. The security control unit 12 further includes an abnormal data collection unit 26, an abnormal data holding unit 27, a timer 28, an abnormality detection pattern holding unit 29, an attack identifying unit 30, an attack estimation pattern holding unit 31, an attack estimation unit 32, and an incident response. It is configured to include the portion 33.

The security control unit 12 is configured to include, as hardware, a ROM in which a control program is stored, a memory including a RAM, a processor that reads a program from the memory and executes the program, and the functions of the above-described units are realized by the hardware. Is being realized.

The frame receiving unit 21 receives, for example, a frame (CAN frame) that is a CAN signal from the gateway function unit 11, and sends the received frame to the frame abnormality detection unit 22 and the bus monitoring unit 23.

The frame abnormality detection unit 22 checks a plurality of abnormality detection items (also referred to as parameters) to determine whether the frame received by the frame reception unit 21 has an abnormality (that is, a frame abnormality) caused by an attack on the vehicle-mounted network 2. And detect. The plurality of abnormality detection items for detecting the frame abnormality may include, for example, parameters such as RTR, DLC, payload, and reception cycle set for each frame ID. The frame abnormality is an abnormality of the CAN signal alone. The frame abnormality detection unit 22 is an example of a message abnormality detection unit.

The bus monitoring unit 23 monitors the respective states of the buses 3 connected to CH1 to CH4 of the gateway ECU 10 and sends the monitoring data to the bus abnormality detection unit 24. The bus abnormality detection unit 24 is an example of a communication path abnormality detection unit.

The bus abnormality detection unit 24 determines whether or not the bus 3 connected to CH1 to CH4 has an abnormality (that is, a bus abnormality) caused by an attack on the vehicle-mounted network 2 by using a plurality of abnormality detection items (also referred to as parameters). Check and detect. The plurality of abnormality detection items for detecting a bus abnormality include, for example, a bus load factor of each bus 3 connected to CH1 to CH4, a bus state (state such as presence or absence of bus error), and an ID appearing on the bus 3. Parameters may be included. The bus abnormality indicates a situation abnormality of the CAN signal. The frame abnormality detection unit 22 and the bus abnormality detection unit 24 are an example of an abnormality detection unit that detects an abnormality caused by an attack on the vehicle-mounted network 2.

The normal value holding unit 25 holds in advance frame normal values (also referred to as normal patterns) for each of the plurality of abnormality detection items used by the frame abnormality detection unit 22 to determine whether or not there is a frame abnormality. Further, the normal value holding unit 25 holds in advance bus normal values (also referred to as normal patterns) of the plurality of abnormality detection items, which are used by the bus abnormality detection unit 24 to determine whether there is a bus abnormality. There is. The normal value holding unit 25 has functions as a frame normal value holding unit (message normal value holding unit) and a bus normal value holding unit (communication path normal value holding unit), but instead of the normal value holding unit 25 The frame normal value holding unit and the bus normal value holding unit may be separately provided.

The frame normal value is composed of a normal pattern of a plurality of items such as a reception cycle, DLC data length, and payload characteristics for each ID of a frame received on each CH. In addition, the bus normal value is composed of a normal pattern of a plurality of items such as a bus load factor, presence or absence of a bus error, and an appearance ID for each bus 3 connected to each CH.

The abnormal data collection unit 26 collects frame abnormal data detected within a predetermined time after the frame abnormal detection unit 22 detects the frame abnormal, and sends the collected frame abnormal data to the abnormal data holding unit 27. .. Further, the abnormal data collection unit 26 collects data of other bus abnormalities detected within a predetermined time after the bus abnormal detection unit 24 detects a bus abnormal condition, and retains the collected bus abnormal data as abnormal data. Send to section 27.

The abnormal data holding unit 27 temporarily holds the frame abnormal data and the bus abnormal data collected by the abnormal data collecting unit 26. The timer 28 counts a predetermined time for the abnormal data collecting unit 26 to collect abnormal data. The predetermined time is set to a time that does not hinder safe traveling even if the vehicle 1 is subjected to a security attack, for example.

The abnormality detection pattern holding unit 29 holds in advance an abnormality detection pattern for each type of attack. The abnormality detection pattern for each type of attack is configured to include combination data of the necessity of detection for each of the plurality of abnormality detection items.

FIG. 3 is a diagram for explaining an example of the abnormality detection pattern held by the abnormality detection pattern holding unit 29 for each type of attack.
The data indicating the abnormality detection pattern 29a for each type of attack includes an item of attack type and a plurality of abnormality detection items.

The types of attacks that can be assumed in the in-vehicle network 2 (attacks A1 to A5,...) Are set in the attack type item. The attack set in the attack type column is a threat analysis for the system of the in-vehicle network 2 (that is, the gateway ECU 10, the traveling system ECU group 5, the body system ECU group 6, the information system ECU group 7, and the OBDII 4). 1 is a known attack extracted by analysis of vulnerabilities and threats of devices connected to the vehicle, other communication devices connected to the in-vehicle network 2, and the like. The threat analysis method for extracting these attacks is not particularly limited. For example, methods such as threat extraction using DFD (Date Flow Diagram), threat classification by STRIDE, threat tree, or threat evaluation by DREAD can be adopted. The attack set in the attack type column can be set to, for example, illegal use, illegal setting, illegal relay, illegal insertion, information leakage, Dos attack, message loss, or fake message.

A plurality of abnormality detection items include frame abnormalities F1 to F5 and bus abnormalities B1 to B5. Parameters relating to frame anomalies such as the reception cycle, payload, DLC, and RTR are set in the frame anomalies F1 to F5, respectively. Further, parameters relating to bus abnormality such as bus load factor, bus error, and appearance ID are set in the bus abnormality B1 to B5, respectively.

A pattern of combination data indicating whether or not detection is required for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5) is set for each type of attack. In FIG. 3, “AND” indicates that it is always detected, “NOT” indicates that it is never detected, and “−” indicates that it is detected or unknown. For example, in the attack A1, the frame abnormality F1 is always detected, the frame abnormality F3, F5 and the bus abnormality B1, B4, B5 are never detected, and the frame abnormality F2, F4 and the bus abnormality B2, B3 are detected. Or unknown (whether or not detected).

The attack identifying unit 30 responds to the detected abnormality based on the abnormality data held in the abnormal data holding unit 27 and the abnormality detection pattern for each type of attack held in the abnormality detection pattern holding unit 29. Perform processing to identify the type of attack. After performing the attack identifying process, the attack identifying unit 30 also gives an instruction to reset (clear) the abnormal data (detection data) temporarily stored in the abnormal data holding unit 27.

FIG. 4 is a diagram for explaining a case where the type of attack can be identified by the attack identifying process performed by the attack identifying unit 30.
The attack identifying unit 30 collates the abnormal data 27a held in the abnormal data holding unit 27 with the abnormal detection pattern 29a for each type of attack held in the abnormal detection pattern holding unit 29 to obtain the abnormal data. Processing for identifying the type of attack corresponding to the abnormality indicated by 27a is performed.

The abnormality data 27a includes data indicating the results of presence or absence of detection ("1" detected, "0" not detected) for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5). Has been. The abnormal data 27a illustrated in FIG. 4 includes data in which frame abnormalities F1 and F2 and bus abnormalities B1 to B5 are detected, and frame abnormalities F3 to F5 are not detected.

In the example shown in FIG. 4, as a result of the attack identifying unit 30 collating the abnormal data 27a and the abnormal detection pattern 29a for each type of attack, the abnormal data indicated by the abnormal data 27a detected this time is detected as abnormal. The case where the attack A3 in the pattern 29a is identified is shown. Next, a case where the type of attack cannot be specified by the attack specifying process performed by the attack specifying unit 30 will be described.

FIG. 5 is a diagram for explaining a case where the type of attack cannot be specified by the attack specifying process performed by the attack specifying unit 30. The abnormality data 27b illustrated in FIG. 5 includes data in which frame abnormalities F1 and F2 and bus abnormalities B2, B4, and B5 are detected, and frame abnormalities F3 to F5 and bus abnormalities B1 and B3 are not detected. It is configured.

In the example shown in FIG. 5, as a result of the attack identifying unit 30 collating the abnormal data 27b with the abnormal detection pattern 29a for each type of attack, the abnormal data indicated by the abnormal data 27b detected this time is detected as abnormal. The case where it is determined that none of the attacks in the pattern 29a are matched (does not match) is shown. As described above, when the attack identification process performed by the attack identification unit 30 fails to identify the type of attack (in other words, it is an unknown attack), the attack estimation process by the attack estimation unit 32 is performed next.

The attack estimation pattern holding unit 31 holds an attack estimation pattern for each type of attack in advance. The attack estimation pattern for each type of attack is configured to include combination data of weighting values for each of the plurality of abnormality detection items.

FIG. 6 is a diagram for explaining an example of the attack estimation pattern held by the attack estimated pattern holding unit 31 for each type of attack.
The data indicating the attack estimation pattern 31a for each attack type is configured to include an attack type item, a plurality of abnormality detection items, and a first total value item.

Similar to the abnormality detection pattern 29a illustrated in FIG. 3, the type of attack that can be assumed in the in-vehicle network 2 (attacks A11 to A15,...) Is set in the attack type item. Further, the plurality of abnormality detection items include parameters of the frame abnormalities F1 to F5 and the bus abnormalities B1 to B5, like the abnormality detection pattern 29a illustrated in FIG.

Then, for each type of attack, combination data (weighting value of 0.0 to 1.0) for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5) (Also referred to as a set) pattern is set. The closer the weighting value is to 1.0, the higher the probability that the abnormality will occur, and the closer the weighting value is to 0.0, the lower the probability that the abnormality will occur. The weighting value for each abnormality detection item of each attack may be set based on the result of the threat analysis performed in advance, or may be set based on the result of the machine learning performed in advance. The first total value indicates the sum (also referred to as the sum of sets) of the combination data (weight set) of the weight values for each of the plurality of abnormality detection items in each attack.

The attack estimation unit 32 holds the abnormal data held in the abnormal data holding unit 27 and the attack estimated pattern holding unit 31 when the attack specifying unit 30 cannot specify the type of attack. A process of estimating the type of attack corresponding to the detected abnormality is performed based on the attack estimation pattern 31a for each type of attack.

FIG. 7 is a diagram for explaining an example of attack estimation processing performed by the attack estimation unit 32.
The attack estimation unit 32, for each type of attack (attacks A11 to A15,...) Held in the attack estimation pattern holding unit 31, detects each abnormality detection item (frame abnormality F1 to F5, and bus) of the abnormality data 27b. A second total value (also called the sum of product sets) indicating the sum of products of the data (1 or 0) indicating whether or not the anomalies B1 to B5 are detected and the weighting values set for the respective anomaly detection items of the attack estimation pattern 31a ) Is calculated (that is, it functions as a first calculation unit).

FIG. 8 is a diagram showing an example of the calculation result of the second total value calculated by the first calculation unit included in the attack estimation unit 32.
As shown in FIG. 8, for each abnormality detection item (frame abnormality F1 to F5, and bus abnormality B1 to B5) of each attack, data indicating whether or not each abnormality data 27b is detected, and each estimated attack pattern 31a. The product value with the weighting value is calculated, and the sum of the calculated product values is calculated as the second total value.

Next, the attack estimation unit 32 calculates the matching rate between the first total value and the second total value for each type of attack (that is, functions as the second calculation unit).
FIG. 9 is a diagram showing an example of the matching rate calculated by the second calculation unit included in the attack estimation unit 32. As shown in FIG. 9, the matching rate here is represented by [second total value/first total value]×100 (%).

Next, the attack estimation unit 32 estimates the type of attack corresponding to the abnormality that could not be identified by the attack identification unit 30, based on the match rate for each attack calculated by the second calculation unit (that is, estimation). Functions as a department). The estimation unit included in the attack estimation unit 32 can estimate which existing attack type the abnormality that could not be identified by the attack identification unit 30 resembles, based on the matching rate. In the example shown in FIG. 9, the match rate of the attack A11 is the highest, and it is possible to estimate that the attack due to the abnormality detected this time is the most similar to the attack A11.

The incident handling unit 33 functions as a first incident handling unit that performs a handling process for the identified attack type when the attack identifying unit 30 identifies the type of attack corresponding to the abnormality. Further, the incident handling unit 33 functions as a second incident handling unit that performs a handling process for the estimated attack type when the attack estimating unit 32 estimates the attack type corresponding to the abnormality.

FIG. 10 shows an example of attack identification data output to the incident response unit 33 when the attack identification unit 30 identifies the type of attack corresponding to the abnormality.
As shown in FIG. 10, the attack identification data includes CH attacked by the gateway ECU 10, a frame in which an abnormality has occurred, and data related to the identified attack. The incident handling unit 33 executes a predetermined countermeasure process for the identified type of attack based on the attack identifying data acquired from the attack identifying unit 30.

FIG. 11 shows an example of attack estimation data output to the incident handling unit 33 when the attack estimation unit 32 estimates the type of attack corresponding to an abnormality.
As shown in FIG. 11, the attack estimation data includes CH attacked by the gateway ECU 10, a frame having an abnormality, and data regarding the estimated attack. The incident handling unit 33 executes a predetermined countermeasure process for the estimated attack type based on the attack estimation data acquired from the attack estimation unit 32. For example, the countermeasure process for the type of attack having the highest matching rate is executed.

[Operation example]
FIG. 12 is a schematic flowchart showing a processing operation performed by the security control unit 12 included in the gateway ECU 10 according to the embodiment (1). It should be noted that the present processing operation is premised on the case where an attacker performs some security attack on the in-vehicle network 2 and the defense function of the gateway ECU 10 is broken.

First, in step S1, the security control unit 12 determines whether or not an abnormality has occurred in the in-vehicle network 2 due to a security attack. If it is determined that the abnormality has not occurred, the processing is terminated, while the abnormality has occurred. If determined, the process proceeds to step S2.

In step S2, the security control unit 12 performs a process of detecting an abnormality that has occurred in the frame received from each ECU group or the bus 3 connected to each CH, and then advances the process to step S3.

In step S3, the security control unit 12 performs a process of collecting the data of the abnormality that has occurred in the received frame or the bus 3 (that is, the detection result of the abnormality), and then advances the process to step S4.

In step S4, the security control unit 12 performs a process of identifying the type of security attack using the collected abnormal data, and a process of estimating the type of attack when the type of attack cannot be identified. Then, the process proceeds to step S5. In step S5, the security control unit 12 performs a process of implementing an incident countermeasure corresponding to the identified type of attack or the estimated type of attack, and then ends the process.

FIG. 13 is a flowchart showing an abnormality detection processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1). This processing operation is an example of the abnormality detection processing operation performed in step S2 of FIG. 12, and is executed when a frame which is a CAN signal is received.

First, in step S11, the security control unit 12 performs a process of receiving a frame that is a CAN signal (frame received from each ECU group) from the gateway function unit 11, and proceeds to step S12. In step S12, the security control unit 12 determines whether or not an abnormality due to a security attack has been detected in the received frame or the bus 3 that has received the frame. If it is determined that no abnormality has been detected, the CAN signal is detected. If it is determined that an abnormality has been detected while the abnormality detection processing at the time of reception is completed, the processing proceeds to step S13.

In step S13, the security control unit 12 is currently in a state of collecting abnormal data due to a security attack (abnormality collection state) (in other words, whether the abnormal data collection unit 26 is operating or not). ), and if it is determined that abnormal data is currently being collected, the process proceeds to step S15. On the other hand, in step S13, if the security control unit 12 determines that the abnormal data is not currently collected, the process proceeds to step S14. In step S14, the security attack abnormal condition is collected. A process of transitioning (in other words, the abnormal data collecting unit 26 starts collecting abnormal data) is performed, and then the process proceeds to step S15.

In step S15, the security control unit 12 determines whether or not the abnormality detected in step S12 is an abnormality already detected after transition to the abnormality collection state, and determines that the abnormality is already detected. For example, the abnormality detection process when the CAN signal is received ends.

On the other hand, if the security control unit 12 determines in step S15 that the abnormality is not already detected (in other words, it is an undetected abnormality), the process proceeds to step S16, and in step S16, the detected abnormality is detected. The data is stored in the abnormal data holding unit 27, and then the abnormality detection process when the CAN signal is received ends.

In the above abnormality detection processing operation, after receiving the frame in step S11, it is determined whether or not the frame abnormality or the bus abnormality is detected in step S12, but the processing form is not limited to this. In another embodiment, the security control unit 12 may detect the frame abnormality and the bus abnormality in different processing flows. For example, the frame abnormality may be detected after the frame is received, and the bus abnormality may be detected by constantly monitoring the state of the bus 3 connected to CH1 to CH4.

FIG. 14 is a flowchart showing an abnormality collection processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1). This processing operation is an example of an operation of collecting abnormal data (abnormality detection result) performed in step S3 of FIG.

First, in step S21, the security control unit 12 starts counting the abnormality collection time by the timer 28, and then proceeds to step S22. In step S22, it is determined whether or not a predetermined time has elapsed since the count was started. to decide. The predetermined time is set to a time (for example, several seconds to several tens of seconds) that does not hinder safe traveling even when the vehicle 1 receives a security attack.

In step S22, if the security control unit 12 determines that the predetermined time has not elapsed, the timer 28 continues counting until the predetermined time has elapsed, and if it determines that the predetermined time has elapsed, the process proceeds to step S23. In step S23, the security control unit 12 ends the collection of abnormal data and advances the process to the next step S24. In step S24, the count of the timer 28 is cleared, and then the process ends.

FIG. 15 is a flowchart showing an attack identifying processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1). The processing operation is an example of the attack identifying processing operation performed in step S4 of FIG. 12, and includes the attack identifying processing operation and the attack estimating processing operation.

First, in step S31, the security control unit 12 reads out the abnormal data (abnormal data detected within a predetermined time) stored in the abnormal data holding unit 27, and advances the processing to step S32. The abnormality data has, for example, the data configuration shown in the abnormality data 27a illustrated in FIG. 4 (the data configuration including the results of the presence/absence of detection of a plurality of abnormality detection items).

In step S32, the security control unit 12 reads the abnormality detection pattern specified for each type of attack from the abnormality detection pattern holding unit 29, and advances the processing to the next step S33. The abnormality detection pattern has, for example, the data structure shown in the abnormality detection pattern 29a for each type of attack illustrated in FIG. 3 (combination data of detection necessity for a plurality of abnormality detection items is set for each type of attack). Data structure).

In step S33, the security control unit 12 performs a process (matching process) of matching the abnormality data read in step S31 with the abnormality detection pattern for each type of attack read in step S32, and then in step S34. Proceed with processing. In step S34, it is determined whether or not the same abnormality detection pattern as the abnormal data is detected as a result of the collation, and if it is determined that the same abnormality detection pattern as the abnormal data is detected, the process proceeds to step S35. ..

In step S35, the security control unit 12 identifies that the type of attack indicated by the abnormality data is an attack indicated by the same abnormality detection pattern determined in step S34, and then proceeds to step S36.

In step S36, the security control unit 12 performs a process of outputting information on the identified attack to the incident handling unit 33, and then advances the process to step S37.

On the other hand, if the security control unit 12 determines in step S34 that the same abnormality detection pattern as the abnormality data is not detected, the process proceeds to step S38.
In step S38, the security control unit 12 reads out the attack estimation pattern specified for each type of attack from the attack estimation pattern holding unit 31, and then advances the process to step S39. The attack estimation pattern is, for example, the data structure shown in the attack estimation pattern 31a for each type of attack illustrated in FIG. 6 (combined data of weighting values for each of a plurality of abnormality detection items and data of the sum of weighting values). The data structure is set for each type of attack).

In step S39, the security control unit 12 performs a process of calculating the sum (second total value) of the products of the abnormal data and the attack estimation pattern for each attack type, and advances the process to step S40. In step S40, the security control unit 12 compares the first total value (sum of sets) defined in the attack estimation pattern for each type of attack with the second total value (sum of intersections) ([second total sum]. Value/first total value]×100(%)) is calculated, and the process proceeds to step S41.

In step S41, the security control unit 12 estimates the type of attack based on the matching rate. For example, it is estimated that the abnormality detected this time is the most similar to the attack with the highest matching rate, and the process proceeds to step S42. In step S42, the security control unit 12 performs a process of outputting the estimated attack information to the incident handling unit 33, and then advances the process to step S37. In step S37, the security control unit 12 performs a reset process for clearing the data temporarily held in the abnormal data holding unit 27, and then ends the process.

[Action/effect]
Since the gateway ECU 10 according to the embodiment (1) includes the security control unit 12, the frame abnormality detection unit 22 detects a frame abnormality, and the bus abnormality detection unit 24 detects a bus abnormality. The detected abnormality is collected by the abnormality data collection unit 26, and the collected abnormality data is held in the abnormality data holding unit 27. Then, the attack identifying unit 30 identifies the type of attack corresponding to the abnormality.

Therefore, when the in-vehicle network 2 receives a security attack, the type of the attack can be specified by the vehicle 1 alone, that is, by the gateway ECU 10. In addition, the attack identification unit 30 collates (matches) the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items with the abnormality detection pattern for each type of attack, whereby the type of attack corresponding to the abnormality Is specified. Therefore, it is possible to quickly identify the type of attack and reduce the device cost by performing low-load processing with a reduced load, without performing anomaly analysis that requires a large amount of processing such as machine learning. It is also possible to realize a device that is advantageous in terms of cost.

Then, when the type of attack corresponding to the abnormality is specified, the incident handling unit 33 can promptly take measures against the identified type of attack. As a result, the driver of the vehicle 1 can drive with peace of mind against the threat of security.

Further, even if the attack identifying unit 30 cannot identify the type of attack, the attack estimating unit 32 can estimate the type of attack similar to the abnormality. In addition, an attack estimation pattern defined for each type of attack is used to estimate the type of attack, a second total value is calculated for each type of attack, and a first total value and a second total value for each type of attack are calculated. The match rate with the total value is calculated, and the type of attack corresponding to the abnormality is estimated based on the calculated match rate. Therefore, it is possible to quickly estimate which known attack is most similar to the known attack by performing low-load processing with a light load, without performing anomalous analysis with a large amount of processing such as machine learning. You can

Then, when the type of attack corresponding to the abnormality is estimated, the incident handling unit 33 can promptly take measures against the estimated type of attack. As a result, the driver of the vehicle 1 can drive with peace of mind against the threat of security.

[Configuration example 2]
FIG. 16 is a block diagram showing a functional configuration example of the gateway ECU 10A according to the embodiment (2). The components having the same functions as those of the gateway ECU 10 shown in FIG. 2 are designated by the same reference numerals, and the description thereof will be omitted here.
The gateway ECU 10 according to the embodiment (1) is configured to be able to detect a frame abnormality and a bus abnormality, whereas the gateway ECU 10A according to the embodiment (2) is configured to be able to detect an internal processing abnormality. There is a big difference.

The gateway ECU 10A includes a gateway function unit 11 and a security control unit 12A. The security control unit 12A is a part in which the functions of the security device according to the present embodiment are mounted.

The security control unit 12A monitors the internal processing in addition to the frame receiving unit 21, the frame abnormality detecting unit 22, the bus monitoring unit 23, the bus abnormality detecting unit 24, the frame normal value holding unit 25A, and the bus normal value holding unit 25B. It is configured to include a unit 34, an internal processing abnormality detection unit 35, and an internal processing normal value holding unit 36.
Further, the security control unit 12A includes the abnormal data collection unit 26A, the abnormal data holding unit 27A, the timer 28, the abnormality detection pattern holding unit 29A, the attack identifying unit 30A, the attack estimation pattern holding unit 31A, the attack estimation unit 32A, and the incident handling. It is configured to include the portion 33.

The internal processing monitoring unit 34 monitors the state of internal control processing in the gateway ECU 10A when each function of the gateway function unit 11 (for example, a frame reception function, a transfer function, a transmission function, etc.) is being executed.
The monitoring target of the internal processing includes at least one or more of the control processing time of the function, the function execution frequency, the function execution processing order, and the resource of the hardware configuring the gateway ECU 10A.

Regarding the control processing time, for example, whether or not the control processing of each function is executed within a preset time is monitored.
As for the function execution frequency, for example, it is monitored whether or not the function execution frequency of each function of the gateway function unit 11 is within a preset numerical range.
Regarding the function execution processing order, for example, it is monitored whether or not the processing execution order of each function of the gateway function unit 11 is executed in a preset order.

Hardware resources include, for example, CPU usage rate, RAM usage rate, code ROM (code storage memory) usage rate, or data ROM (data storage memory) usage rate. Regarding hardware resources, for example, it is monitored whether the average usage rate of each hardware is within a preset numerical range.

The internal processing abnormality detection unit 35 detects whether or not there is an abnormality (that is, internal processing abnormality) in the internal processing monitored by the internal processing monitoring unit 34 by checking a plurality of abnormality detection items (also referred to as parameters). To do. The plurality of abnormality detection items for detecting the internal processing abnormality include, for example, parameters such as the control processing time, the number of times of function execution, the order of function execution processing, and hardware resources. The frame abnormality detection unit 22, the bus abnormality detection unit 24, and the internal processing abnormality detection unit 35 are an example of an abnormality detection unit that detects an abnormality caused by an attack on the in-vehicle network 2.

The internal processing normal value holding unit 36 stores in advance internal processing normal values (also referred to as normal patterns) of a plurality of abnormality detection items, which are used by the internal processing abnormality detection unit 35 to determine whether there is an internal processing abnormality. Is held. The internal processing normal value is composed of a normal pattern of a plurality of items such as control processing time of each function, function execution frequency, function execution processing order, and average usage rate of hardware resources.

The abnormal data collection unit 26A collects frame abnormal data detected within a predetermined time after the frame abnormal detection unit 22 detects a frame abnormal, and sends the collected frame abnormal data to the abnormal data holding unit 27A. .. Further, the abnormal data collection unit 26A collects data of bus abnormalities detected within a predetermined time after the bus abnormalities are detected by the bus abnormality detection unit 24, and collects the collected data of bus abnormalities in the abnormal data holding unit 27A. Send to. Further, the abnormal data collection unit 26A collects the data of the internal processing abnormality detected within a predetermined time after the internal processing abnormality detection unit 35 detects the internal processing abnormality, and collects the collected data of the internal processing abnormality. It is sent to the data holding unit 27A.

The abnormal data holding unit 27A temporarily holds the frame abnormal data, the bus abnormal data, and the internal processing abnormal data collected by the abnormal data collecting unit 26A. The timer 28 counts a predetermined time for collecting abnormal data by the abnormal data collecting unit 26A. The predetermined time is set to a time that does not hinder safe traveling even if the vehicle 1 is subjected to a security attack, for example.

The abnormality detection pattern holding unit 29A holds an abnormality detection pattern for each type of attack in advance. The abnormality detection pattern for each type of attack is configured to include combination data of the necessity of detection for each of the plurality of abnormality detection items.

FIG. 17 is a diagram for explaining an example of the abnormality detection pattern held by the abnormality detection pattern holding unit 29A for each type of attack.
The data indicating the abnormality detection pattern 29b for each type of attack includes an item of attack type and a plurality of abnormality detection items. The difference from the abnormality detection pattern 29a shown in FIG. 3 is that a plurality of abnormality detection items further include an internal processing abnormality.

The types of attacks that can be assumed in the in-vehicle network 2 (attacks A21 to A25,...) Are set in the attack type item.
The plurality of abnormality detection items include frame abnormalities F1 to F4, bus abnormalities B1 to B4, and internal processing abnormalities C1 to C4. Parameters relating to frame anomalies such as the reception cycle, payload, DLC, and RTR are set in the frame anomalies F1 to F4. Further, parameters relating to bus abnormality such as bus load factor, bus error, and appearance ID are set in the bus abnormality B1 to B4, respectively. Further, in the internal processing abnormalities C1 to C4, parameters relating to internal processing abnormalities such as control processing time of each function, function execution frequency, function execution processing order, and hardware resources are set.

Then, a pattern of combination data indicating whether or not detection is necessary for each of a plurality of abnormality detection items (frame abnormality F1 to F4, bus abnormality B1 to B4, and internal processing abnormality C1 to C4) is set for each type of attack.
For example, in the attack A21, the frame abnormality F1 and the internal processing abnormality C4 are always detected, and the frame abnormality F3, the bus abnormalities B2 and B3, and the internal processing abnormalities C2 and C3 are never detected, and the frame abnormality F2, F4, and the bus abnormality are detected. The abnormalities B1 and B4 and the internal processing abnormality C1 are detected or unknown (may be detected or may not be detected).

The attack identifying unit 30A responds to the detected abnormality based on the abnormality data held in the abnormal data holding unit 27A and the abnormality detection pattern 29b for each type of attack held in the abnormality detection pattern holding unit 29A. Perform processing to identify the type of attack to be performed. After performing the attack identifying process, the attack identifying unit 30A instructs the abnormal data holding unit 27A to reset (clear) the abnormal data (detection data). The attack identifying unit 30A executes the same processing operation as the processing operation (the processing of identifying by collating) performed by the attack identifying unit 30 illustrated in FIG.

The attack estimation pattern holding unit 31A holds an attack estimation pattern for each type of attack in advance. The attack estimation pattern for each type of attack is configured to include combination data of weighting values for each of the plurality of abnormality detection items.

FIG. 18 is a diagram for explaining an example of the attack estimation pattern for each type of attack, which is held in the attack estimated pattern holding unit 31A.
Similar to the attack estimation pattern 31a shown in FIG. 6, the data indicating the attack estimation pattern 31b for each type of attack is configured to include an attack type item, a plurality of abnormality detection items, and a first total value item. ing.

Similar to the abnormality detection pattern 29b illustrated in FIG. 17, the types of attacks that can be assumed in the in-vehicle network 2 (attacks A31 to A35,...) Are set in the attack type item. Further, the plurality of abnormality detection items include parameters of frame abnormalities F1 to F4, bus abnormalities B1 to B4, and internal processing abnormalities C1 to C4, like the abnormality detection pattern 29b illustrated in FIG.

Then, a weighting value (any one of 0.0 to 1.0) for each of a plurality of abnormality detection items (frame abnormality F1 to F4, bus abnormality B1 to B4, and internal processing abnormality C1 to C4) is set for each type of attack. A pattern of combination data (also referred to as a weighted set) of values is set. The first total value indicates the sum (also referred to as the sum of sets) of the combination data (weight set) of the weight values for each of the plurality of abnormality detection items in each attack.

The attack estimation unit 32A holds the abnormal data held in the abnormal data holding unit 27A and the attack estimated pattern holding unit 31A when the attack specifying unit 30A cannot specify the type of attack. A process of estimating the type of attack corresponding to the detected abnormality is performed based on the attack estimation pattern 31b for each type of attack.

More specifically, the attack estimation unit 32A, for each type of attack (attacks A31 to A35,...) Stored in the attack estimation pattern storage unit 31A, each abnormality detection item (frame abnormality F1) of abnormal data. To F4, bus abnormalities B1 to B4, and internal processing abnormalities C1 to C4), the sum of products of data (1 or 0) regarding whether or not detection is performed and the weighting value set for each abnormality detection item of the attack estimation pattern 31b is calculated. The second total value shown (also referred to as the sum of product sets) is calculated (that is, it functions as the first calculator).

Next, the attack estimation unit 32A calculates the matching rate between the first total value and the second total value (for example, [second total value/first total value]×100(%)) for each type of attack. (That is, functions as the second calculation unit).

Next, the attack estimation unit 32A estimates the type of attack corresponding to the abnormality that could not be identified by the attack identification unit 30A based on the match rate for each attack calculated by the second calculation unit (that is, estimation). Functions as a department). The estimation unit that constitutes the attack estimation unit 32A can estimate which existing attack type is similar to the existing attack type based on the match rate.

The incident handling unit 33 functions as a first incident handling unit that performs a handling process for the identified attack type when the attack identifying unit 30A identifies the type of attack corresponding to the abnormality. Further, the incident handling unit 33 functions as a second incident handling unit that performs handling processing for the estimated attack type when the attack estimating unit 32A estimates the attack type corresponding to the abnormality.

When the attack identification unit 30A identifies the type of attack corresponding to the abnormality, the attack identification data output to the incident response unit 33 includes, for example, the CH attacked by the gateway ECU 10A, the frame having the abnormality, and the abnormality. Includes data about internal actions that were taken and the identified attacks. The incident handling unit 33 executes a predetermined countermeasure process for the identified type of attack based on the attack identifying data acquired from the attack identifying unit 30A.

Further, when the attack estimation unit 32A estimates the type of attack corresponding to the abnormality, the attack estimation data output to the incident response unit 33 includes, for example, the CH attacked by the gateway ECU 10A and the frame having the abnormality. , Internal processing with anomalies, and data on estimated attacks. The incident handling unit 33 executes a predetermined countermeasure process for the estimated attack type based on the attack estimation data acquired from the attack estimating unit 32A. For example, the countermeasure process for the type of attack having the highest matching rate is executed.

[Operation example]
Next, a processing operation performed by the security control unit 12A included in the gateway ECU 10A according to the embodiment (2) will be described. The processing operation performed by the security control unit 12A included in the gateway ECU 10A according to the embodiment (2) is basically performed by the security control unit 12 included in the gateway ECU 10 according to the embodiment (1). Since the operation is the same as that of the operation, the description of the same processing will be omitted.

The main difference from the embodiment (1) is that in the gateway ECU 10A according to the embodiment (2), in addition to the frame abnormality and the bus abnormality, an internal processing abnormality is further detected, and a combination of these abnormalities is detected. On the basis of this, processing for identifying the type of attack is performed, and if the type of attack cannot be identified, processing for estimating the type of attack is performed.

First, the processing operation performed by the security control unit 12A constituting the gateway ECU 10A according to the embodiment (2) will be described based on the schematic flow chart shown in FIG.

In step S1, the security control unit 12A determines whether or not an abnormality has occurred in the in-vehicle network 2 due to a security attack. If it is determined that the abnormality has not occurred, the processing is terminated while it is determined that an abnormality has occurred. If so, the process proceeds to step S2.

In step S2, the security control unit 12A performs a process of detecting an abnormality that has occurred in the frame received from each ECU group, the bus 3 connected to each CH, or the internal process of the gateway ECU 10A, and then the process proceeds to step S3. Proceed.

In step S3, the security control unit 12A performs a process of collecting the data of the abnormality that has occurred in the received frame, the bus 3, or the internal processing of the gateway ECU 10A (that is, the detection result of the abnormality), and then performs the processing in step S4. Proceed.

In step S4, the security control unit 12A performs a process of identifying the type of security attack using the collected abnormal data, and a process of estimating the type of attack when the type of attack cannot be identified. Then, the process proceeds to step S5. In step S5, the security control unit 12A performs a process of implementing an incident countermeasure corresponding to the identified type of attack or the estimated type of attack, and then ends the process.

Next, the abnormality detection processing operation performed by the security control unit 12A configuring the gateway ECU 10A according to the embodiment (2) will be described. The frame abnormality and bus abnormality detection processing operation performed by the security control unit 12A is substantially the same as the content described based on the flowchart shown in FIG. 13, and thus the description thereof is omitted here.

The internal processing abnormality detection processing operation performed by the security control unit 12A will be described based on the flowchart shown in FIG. This processing operation is executed during the operation of the gateway ECU 10A.

First, in step S51, the security control unit 12A performs a process of monitoring the state of the internal control process when each function of the gateway function unit 11 (for example, a frame receiving function, a transfer function, a transmitting function, etc.) is being executed. Then, the process proceeds to step S52.

In step S52, the security control unit 12A sets the state of the monitored internal processing to at least one of the control processing time of each function, the function execution count, the function execution processing order, and the hardware resource. Based on this, it is determined whether or not an internal processing abnormality has been detected.

If it is determined in step S52 that the security control unit 12A has not detected an internal process abnormality, the abnormality detection process at the time of executing the function of the gateway function unit 11 is terminated, while if it is determined that an abnormality is detected, the process proceeds to step S53. Proceed with processing.

In step S53, the security control unit 12A is currently in a state of collecting abnormal data due to a security attack (abnormal collection state) (in other words, whether the abnormal data collection unit 26 is operating or not). ), and if it is determined that abnormal data is currently being collected, the process proceeds to step S55. On the other hand, if it is determined in step S53 that the security control unit 12A is not currently collecting the abnormal data, the process proceeds to step S54, and in step S54, the security attacking abnormal state is collected. A process of transitioning (in other words, the abnormal data collecting unit 26A starts collecting abnormal data) is performed, and then the process proceeds to step S55.

In step S55, the security control unit 12A determines whether or not the internal processing abnormality detected in step S52 is an abnormality already detected after transition to the abnormality collection state, and the abnormality is already detected. If judged, the abnormality detection process of the internal process at the time of executing the function of the gateway function unit 11 is completed.

On the other hand, if it is determined in step S55 that the internal processing abnormality has not been detected (in other words, it is an undetected abnormality), the security control unit 12A advances the processing to step S56, and in step S56, it is detected. The abnormal data of the internal processing is stored in the abnormal data holding unit 27A, and then the abnormality detection processing of the internal processing when the function of the gateway function unit 11 is executed is completed.

Since the abnormality collection processing operation performed by the security control unit 12A configuring the gateway ECU 10A according to the embodiment (2) is substantially the same as the content described based on the flowchart shown in FIG. 14, the description thereof is omitted here. To do.

Further, the attack identifying processing operation performed by the security control unit 12A configuring the gateway ECU 10A according to the embodiment (2) is substantially the same as the content described based on the flowchart shown in FIG. 15 except the following differences. Therefore, the description thereof will be omitted.
One of the differences is that the abnormality detection pattern 29b including the internal processing abnormality as illustrated in FIG. 17 is read from the abnormality detection pattern holding unit 29A and a process of identifying the type of attack is performed.
Another difference is that when the type of attack cannot be specified (when the same abnormality detection pattern is not detected), the attack estimation pattern holding unit 31A includes an attack including an internal processing abnormality as illustrated in FIG. The point is that the estimated pattern 31b is read and the type of attack is estimated.

[Action/effect]
According to gateway ECU 10A of the second embodiment, it is possible to obtain the same effects as those of gateway ECU 10 of the first embodiment. Furthermore, since the security control unit 12A can detect an internal processing abnormality in addition to the frame abnormality and the bus abnormality, the type of attack is identified or the type of attack is estimated based on these internal processing abnormalities. It is possible to identify and estimate a wider variety of attacks.

[Modification]
Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in all respects. It goes without saying that various improvements and changes can be made without departing from the scope of the present invention.

For example, the

security control units

12 and 12A mounted on the

gateway ECUs

10 and 10A may be mounted on other ECUs, or the security ECUs equipped with the

security control units

12 and 12A may be connected to the in-vehicle network 2. Good.

In the gateway ECU according to another embodiment, the

security control units

12 and 12A may further include an abnormality log accumulation unit that accumulates abnormality data collected by the abnormality

data collection units

26 and 26A as an abnormality log. .. According to such a configuration, since the abnormal data is accumulated in the abnormal log accumulating unit as an abnormal log, it is possible to perform the post analysis using the abnormal log accumulated in the abnormal log accumulating unit.

Further, in the gateway ECU according to another embodiment, the

security control units

12 and 12A notify the passengers in the vehicle of an abnormality through the notification device included in the information system ECU group 7 connected to the vehicle-mounted network 2. You may further provide a part. A navigation device, an audio device, or the like may be applied to the notification device that functions as the notification unit. According to such a configuration, the notification processing unit can notify the occupant in the vehicle of the abnormality via the notification device, and thus the occupant can appropriately respond to the abnormality. ..

In the gateway ECU according to another embodiment, the

security control units

12 and 12A report an abnormality to the outside of the vehicle via a telematics device included in the information system ECU group 7 connected to the vehicle-mounted network 2 or an ITS-related device. You may further provide the notification process part which does. According to such a configuration, the notification processing unit can notify the abnormality to the outside of the vehicle through the telematics device functioning as the external notification unit or the ITS-related device. It is possible to notify a dealer, a maker, or a public institution that an abnormality has occurred, and it is possible to appropriately deal with the abnormality from outside the vehicle.

Further, in the above embodiment, an example in which the technology according to the present invention is applied to the

gateway ECUs

10 and 10A connected to the vehicle-mounted network 2 has been described. The vehicle-mounted network 2 is an example of a device network to which the technology according to the present invention is applied. The technology according to the present invention is applied to other device networks, for example, an industrial device network in which one or more industrial devices configuring an FA (Factory Automation) system are connected via a communication path, and household devices including home appliances. It is also applicable to a security device included in a connected home device network, an office device network to which office devices are connected, or the like. For example, the application example to the in-vehicle network 2 described based on FIGS. 1 to 19 can be applied to the industrial device network, the home device network, or the office device network. In that case, various improvements and modifications can be made without departing from the scope of the present invention so as to be compatible with each device network, and a specific configuration according to the embodiment can be appropriately adopted.

The FA system includes, for example, a transportation system for various items, an inspection system, an assembly system using a robot, and the like. Further, the control devices mounted on the industrial devices that configure these FA systems include, for example, programmable controllers (hereinafter referred to as PLCs), motion position control controllers, field network devices, wireless devices, sensors, actuators, robots, HMI devices. , And at least one of a data collection device. Further, the communication path connecting various control devices in the FA system may be wired or wireless. Further, the communication protocol in the device network is not limited to the CAN protocol, and a communication protocol suitable for the device network can be adopted.

FIG. 20 is a schematic block diagram showing an example in which the security device according to the modified example is applied to an FA system.
The FA system 100 includes a security device 110, one or more PLCs 104 connected to the security device 110, an input device 105 and an output device 106 connected to the PLC 104, and these are connected via a bus 103. Thus, the industrial equipment network 101 is constructed. The industrial equipment network 101 is a communication network that constitutes the FA system 100, and is a network that communicates according to a predetermined communication protocol such as CAN.

The PLC 104 is an example of a control device that constitutes the FA system 100.
A SCADA (Supervisory Control And Data Acquisition) 107 and a PC (Personal Computer) 108 are connected to the security device 110.

In the FA system 100, the technology according to the present invention is installed in the security device 110. The security device 110 may have the same hardware configuration and functional configuration as the security control unit 12 of the gateway ECU 10 according to the embodiment (1), or the security control unit of the gateway ECU 10A according to the embodiment (2). The hardware configuration and the functional configuration similar to 12A may be provided.

In this case, the attack type items (see FIGS. 3, 6, 17, and 18) held in the abnormality detection

pattern holding units

29 and 29A and the attack estimation

pattern holding units

31 and 31A include industrial equipment. The types of attacks that can be assumed in the network 101 are set, and the abnormality detection pattern and attack estimation pattern for each of these types of attacks are set.

The PLC 104 includes, for example, a control unit including a processor that executes a predetermined program, an input/output unit to which the input device 105 and the output device 106 are connected, and a communication unit to which the security device 110 and the like are connected. Has been done. The input device 105 includes, for example, devices such as various sensors or switches. The output device 106 includes control target devices such as various actuators, robots, relays, and valves. The input device 105 and the output device 106 may be directly connected to the PLC 104 or may be connected via a field network.

The PLC 104 receives data from the input device 105, executes arithmetic processing according to a predetermined program, and outputs an operation signal such as on/off to the output device 106 based on the obtained arithmetic result. To execute.
The SCADA 107 is a computer device that monitors the operating state of the FA system 100 and executes process control and the like. The PC 108 is a general-purpose computer device, and by operating the PC 108, maintenance operations such as setting of various devices included in the FA system 100 can be performed.

Since the security device 110 has the same configuration as the gateway ECU 10 according to the embodiment (1) or the gateway ECU 10A according to the embodiment (2), the same effect as the gateway ECU 10 or the gateway ECU 10A can be obtained. It can be obtained with the FA system 100.

That is, according to the security device 110, when an attack is performed on the industrial equipment network 101 that constitutes the FA system 100, the attack is performed in the FA system 100, that is, in the security device 110 by a process with a reduced load. It is determined that incident response processing is performed according to the determined attack. As a result, prompt incident response can be performed, and the operator of the FA system 100 can operate the FA system with more peace of mind without worrying about security threats.

FIG. 21 is a schematic block diagram showing an FA system according to another modification. However, components having the same functions as those of the FA system 100 shown in FIG. 20 are designated by the same reference numerals, and the description thereof will be omitted.

In the FA system 100 shown in FIG. 20, the security device 110 is equipped as a device different from the PLC 104, and the security device 110 is connected to the PLC 104. On the other hand, in the FA system 100A shown in FIG. 21, the PLC 104A is equipped with a security processing unit 1041 that functions as a security device according to the present invention. The security processing unit 1041 is composed of, for example, a software module that realizes a security function, and may be equipped with the function of each unit that forms the security control unit 12 of the gateway ECU 10 according to the embodiment (1). The function of each unit forming the security control unit 12A of the gateway ECU 10A according to the form (2) may be provided.

In this case, the security processing unit 1041 may be installed in each of the PLCs 104A included in the FA system 100A, or the security processing unit 1041 may be provided in any one or more of the PLCs 104A included in the FA system 100A. May be equipped.

According to the PLC 104A equipped with the security processing unit 1041, it is possible to obtain the same effect as the gateway ECU 10 or the gateway ECU 10A in the FA system 100A.

That is, according to the PLC 104A in which the security processing unit 1041 is installed, when an attack is performed on the industrial equipment network 101 that constitutes the FA system 100A, the processing in which the load is reduced in the FA system 100A, that is, in the PLC 104A. Then, the attack is determined, and the incident response processing is executed according to the determined attack. As a result, prompt incident response becomes possible, and the operator of the FA system 100A can operate the FA system with more peace of mind without fear of security threats.

Note that, in FIG. 21, the case where the PLC 104A configuring the FA system 100A is equipped with the security processing unit 1041 has been described, but in yet another modified example, security is provided to a control device different from the PLC included in the FA system. The function of the processing unit 1041 may be provided.

The present invention specifies or estimates the type of attack that has occurred in a device network in which one or more devices such as in-vehicle devices or industrial devices are connected via a communication path, and responds to the specified or estimated type of attack. It can be widely used in the industrial field related to security devices that execute processing.

[Appendix]
Embodiments of the present invention may be described as, but not limited to, the following supplementary notes.
(Appendix 1)
A security device (10) included in a device network (2) in which one or more control devices (5, 6, 7) are connected via a bus (3),
An abnormality detection unit (22, 24) for detecting an abnormality caused by an attack on the device network (2),
An abnormality data collection unit (26) for collecting data of the abnormality detected by the abnormality detection unit (22, 24);
An abnormal data holding unit (27) for holding the abnormal data collected by the abnormal data collecting unit (26);
An abnormality detection pattern holding unit (29) for holding an abnormality detection pattern for each type of attack, which includes combination data indicating whether or not detection is required for each of a plurality of abnormality detection items;
The abnormality is dealt with based on the abnormality data stored in the abnormality data storage unit (27) and the abnormality detection pattern for each type of attack stored in the abnormality detection pattern storage unit (29). A security device (10), comprising: an attack identification unit (30) that identifies the type of attack to be performed.

(Appendix 2)
An attack identification method executed by at least one or more computers (10) included in a device network (2) in which one or more control devices (5, 6, 7) are connected via a bus (3),
An abnormality detection step (S2) of detecting an abnormality caused by an attack on the device network (2),
An abnormality data collecting step (S3) for collecting the data of the abnormality detected by the abnormality detecting step (S2),
A holding step (S16) of holding the abnormal data collected by the abnormal data collecting step (S3) in an abnormal data holding unit (27);
The abnormality is dealt with based on the abnormality data held in the abnormality data holding unit (27) and the abnormality detection pattern for each type of attack held in the abnormality detection pattern holding unit (29). An attack identification step (S4) for identifying the type of attack,
An attack identification method, wherein the abnormality detection pattern for each type of attack is configured to include combination data of detection necessity for each of a plurality of abnormality detection items.

(Appendix 3)
A program to be executed by a computer (10) connected to a device network (2),
In the computer (10),
An abnormality detection step (S2) of detecting an abnormality caused by an attack on the device network (2),
An abnormal data collection step (S3) of collecting the data of the abnormality detected by the abnormality detection step;
A holding step (S16) of holding the abnormal data collected by the abnormal data collecting step (S3) in an abnormal data holding unit (27);
The abnormality is dealt with based on the abnormality data held in the abnormality data holding unit (27) and the abnormality detection pattern for each type of attack held in the abnormality detection pattern holding unit (29). A program for executing an attack identification step (S4) for identifying the type of attack,
A program characterized in that the abnormality detection pattern for each type of attack includes combination data indicating whether or not detection is required for each of a plurality of abnormality detection items.

1 Vehicle 2 In-vehicle network (device network)
3 Bus 4 OBDII
5 Travel system ECU group 6 Body system ECU group 7 Information

system ECU group

10, 10A Gateway ECU (security device)
11

gateway function unit

12, 12A security control unit 21 frame receiving unit 22 frame abnormality detecting unit 23 bus monitoring unit 24 bus abnormality detecting unit 25 normal value holding unit 25A frame normal value holding unit 25B bus normal

value holding unit

26, 26A abnormal

data Collection unit

27, 27A Abnormal data storage unit 28

Timer

29, 29A Abnormality detection

pattern storage unit

30, 30A

Attack identification unit

31, 31A Attack estimation

pattern storage unit

32, 32A Attack estimation unit 33

Incident response unit

100, 100A FA system 101 Industry Device network (device network)
103

Bus

104, 104A PLC
1041 Security processing unit 105 Input device 106 Output device 107 SCADA
108 PC
110 security device

Claims

A security device included in a device network in which one or more devices are connected via a communication path,
An anomaly detection unit that detects an anomaly caused by an attack on the device network,
An abnormality data collection unit that collects the data of the abnormality detected by the abnormality detection unit;
An abnormal data holding unit that holds the abnormal data collected by the abnormal data collecting unit;
An abnormality detection pattern holding unit that holds an abnormality detection pattern for each of the types of attacks, which is configured to include combination data of detection necessity for each of a plurality of abnormality detection items,
An attack identification unit that identifies the type of attack corresponding to the anomaly based on the anomaly data held in the anomaly data holding unit and the anomaly detection pattern held in the anomaly detection pattern holding unit A security device comprising:
An attack estimation pattern holding unit configured to include combination data of weighting values for each of the plurality of abnormality detection items, which holds an attack estimation pattern for each type of the attack,
When the type of attack cannot be specified by the attack specifying unit, the abnormal data held in the abnormal data holding unit and the attack estimation pattern held in the attack estimation pattern holding unit The security device according to claim 1, further comprising: an attack estimation unit that estimates the type of the attack corresponding to the abnormality based on the following.
The abnormality data stored in the abnormality data storage unit is
Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
The attack identification unit
2. The type of the attack corresponding to the abnormality is identified by collating the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items with the abnormality detection pattern. The described security device.
The abnormality data stored in the abnormality data storage unit is
Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
The attack estimation pattern is
A first total value indicating the sum of the combination data of the weighting values,
The attack estimation unit
A first calculation unit that calculates, for each type of the attack, a second total value that indicates a sum of products of the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items and the weighting value;
A second calculation unit that calculates the matching rate between the first total value and the second total value for each type of attack;
The security device according to claim 2, further comprising: an estimation unit that estimates the type of the attack corresponding to the abnormality based on the matching rate calculated by the second calculation unit.
In the case where the message received via the communication path is normal, a message normal value holding unit that holds a normal value for each of the plurality of abnormality detection items is provided,
The plurality of abnormality detection items include one or more items relating to the abnormality of the message,
The abnormality detection unit,
A message abnormality detection unit that detects a message abnormality due to the attack based on the normal value of each of the plurality of abnormality detection items held in the message normal value holding unit,
The abnormal data collection unit,
The security device according to any one of claims 1 to 4, wherein data of the message abnormality detected by the message abnormality detection unit is collected.
When the state of the communication path is normal, the communication path normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
The plurality of abnormality detection items include one or more items relating to the abnormality of the communication path,
The abnormality detection unit,
Based on the normal value of each of the plurality of abnormality detection items held in the communication path normal value holding unit, a communication path abnormality detection unit for detecting a communication path abnormality due to the attack,
The abnormal data collection unit,
The security device according to any one of claims 1 to 4, wherein data of the communication path abnormality detected by the communication path abnormality detection unit is collected.
When the internal processing of the security device is normal, the internal processing normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
The plurality of abnormality detection items include one or more items related to the abnormality of the internal processing,
The abnormality detection unit,
An internal processing abnormality detection unit that detects an abnormality in the internal processing, based on the normal value of each of the plurality of abnormality detection items held in the internal processing normal value holding unit,
The abnormal data collection unit,
The security device according to any one of claims 1 to 4, wherein data of an abnormality in the internal processing detected by the internal processing abnormality detection unit is collected.
The abnormal data collection unit,
5. The security device according to claim 1, wherein data of the abnormality detected within a predetermined time after the abnormality is detected by the abnormality detection unit is collected.
The security device according to any one of claims 1 to 4, further comprising an abnormal log storage unit that stores the abnormal data collected by the abnormal data collection unit as an abnormal log.
The first incident handling unit that performs a handling process for the identified attack type when the attack identifying unit identifies the type of the attack corresponding to the abnormality is provided. The security device according to claim 3.
When the attack estimation unit estimates the type of the attack corresponding to the abnormality, a second incident response unit that performs a response process to the estimated attack type is provided. The security device according to claim 4.
The security device according to any one of claims 1 to 4, further comprising a notification processing unit that operates the notification unit connected to the device network to notify the abnormality.
The security device according to any one of claims 1 to 4, further comprising a notification processing unit that operates an external notification unit connected to the device network to notify the abnormality to the outside.
The device is a control device mounted on a vehicle,
The security device according to any one of claims 1 to 4, wherein the equipment network is an in-vehicle network.
The device is a control device installed in an industrial device that constitutes an FA (Factory Automation) system,
The security device according to any one of claims 1 to 4, wherein the device network is an industrial device network that constitutes the FA system.
An attack identification method executed by at least one or more computers included in a device network in which one or more devices are connected via a communication path,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit Attack specific steps to
An attack identifying method, wherein the abnormality detection pattern is configured to include combination data of detection necessity for each of a plurality of abnormality detection items.
When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit An attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of
The attack identifying method according to claim 16, wherein the attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
A program for causing at least one computer included in a device network in which one or more devices are connected via a communication path,
The at least one or more computers,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit It is a program to execute the attack specific step
A program, wherein the abnormality detection pattern is configured to include combination data of whether or not detection is required for each of a plurality of abnormality detection items.
The at least one or more computers,
When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit A program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of
The program according to claim 18, wherein the attack estimation pattern includes combination data of weighting values for each of the plurality of abnormality detection items.
A computer-readable storage medium in which a program to be executed by at least one computer included in a device network in which one or more devices are connected via a communication path is stored,
The at least one or more computers,
An anomaly detection step of detecting an anomaly caused by an attack on the device network,
An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step;
A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit;
The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit The program for executing the attack specific step
The computer-readable storage medium, wherein the abnormality detection pattern is configured to include combination data of detection necessity for each of a plurality of abnormality detection items.
The at least one or more computers,
When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit And a program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of
21. The computer-readable storage medium according to claim 20, wherein the attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.