WO2020158118A1 - Appareil de sécurité, procédé d'identification des attaques, programme et support de stockage - Google Patents

Appareil de sécurité, procédé d'identification des attaques, programme et support de stockage Download PDF

Info

Publication number
WO2020158118A1
WO2020158118A1 PCT/JP2019/045105 JP2019045105W WO2020158118A1 WO 2020158118 A1 WO2020158118 A1 WO 2020158118A1 JP 2019045105 W JP2019045105 W JP 2019045105W WO 2020158118 A1 WO2020158118 A1 WO 2020158118A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack
abnormality
unit
data
abnormality detection
Prior art date
Application number
PCT/JP2019/045105
Other languages
English (en)
Japanese (ja)
Inventor
泰生 山本
直樹 廣部
泰久 渡辺
徹 小河原
Original Assignee
オムロン株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from JP2019136882A external-priority patent/JP2020123307A/ja
Application filed by オムロン株式会社 filed Critical オムロン株式会社
Publication of WO2020158118A1 publication Critical patent/WO2020158118A1/fr

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
    • B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Definitions

  • the present invention relates to a security device, an attack identification method, a program, and a storage medium.
  • an abnormality detection server on a cloud accumulates information about frames received from an on-vehicle network from each vehicle, adjusts a predetermined model by machine learning or the like, and a frame received on a certain in-vehicle network.
  • a system for calculating the degree of abnormality in the above-mentioned condition by a calculation process related to a comparison between the information about the frame and a predetermined model is disclosed.
  • the amount of processing executed by the abnormality detection server is enormous, and it is difficult to implement such an abnormality detection server function in a vehicle in terms of processing capacity and cost of a device installed in the vehicle. There was a problem that was.
  • the present invention has been made in view of the above problem, and when one or more devices are subjected to a security attack on a device network connected via a communication path, the type of the attack is reduced in processing. It is an object of the present invention to provide a security device, an attack identifying method, a program, and a storage medium that can be identified by the method described above and that enables swift incident response.
  • a security device (1) is a security device included in a device network in which one or more devices are connected via a communication path.
  • An anomaly detection unit that detects an anomaly caused by an attack on the device network
  • An abnormality data collection unit that collects the data of the abnormality detected by the abnormality detection unit
  • An abnormal data holding unit that holds the abnormal data collected by the abnormal data collecting unit
  • An abnormality detection pattern holding unit that holds an abnormality detection pattern for each of the types of attacks, which is configured to include combination data of detection necessity for each of a plurality of abnormality detection items
  • An attack identification unit that identifies the type of attack corresponding to the anomaly based on the anomaly data held in the anomaly data holding unit and the anomaly detection pattern held in the anomaly detection pattern holding unit It is characterized by having and.
  • the abnormality detecting unit detects the abnormality
  • the detected abnormality data is collected by the abnormality data collecting unit
  • the collected abnormality data is stored in the abnormal data holding unit. Retained by the department.
  • the attack identifying unit identifies the type of the attack corresponding to the abnormality. Therefore, when the device network receives the attack, the type of the attack can be specified by the security device alone. Further, since the abnormality detection pattern specified for each type of the attack is used to specify the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The type of the attack can be specified by the performed processing.
  • the communication path may be a wired communication path, a wireless communication path, or a communication path including both wired and wireless communication paths.
  • a security device (2) is the same as the security device (1), An attack estimation pattern holding unit configured to include combination data of weighting values for each of the plurality of abnormality detection items, which holds an attack estimation pattern for each type of the attack, When the type of attack cannot be specified by the attack specifying unit, the abnormal data held in the abnormal data holding unit and the attack estimation pattern held in the attack estimation pattern holding unit And an attack estimation unit that estimates the type of the attack corresponding to the abnormality based on the above.
  • the attack estimating unit estimates the attack type corresponding to the abnormality. can do. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The performed process makes it possible to deduce whether the attack is similar to any known attack.
  • a security device (3) is the same as the security device (1),
  • the abnormality data stored in the abnormality data storage unit is Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
  • the attack identification unit It is characterized in that the type of the attack corresponding to the abnormality is specified by collating the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items with the abnormality detection pattern.
  • the attack identifying unit collates (in other words, matches) the data indicating the result of detection of each of the plurality of abnormality detection items with the abnormality detection pattern. Identifies the type of attack corresponding to the abnormality. Therefore, the type of attack can be quickly identified by the low-load processing.
  • the security device (4) is the same as the security device (2),
  • the abnormality data stored in the abnormality data storage unit is Including data indicating the result of detection or not for each of the plurality of abnormality detection items,
  • the attack estimation pattern is A first total value indicating the sum of the combination data of the weighting values,
  • the attack estimation unit A first calculation unit that calculates, for each type of the attack, a second total value that indicates a sum of products of the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items and the weighting value;
  • a second calculation unit that calculates the matching rate between the first total value and the second total value for each type of attack;
  • An estimating unit that estimates the type of the attack corresponding to the abnormality based on the matching rate calculated by the second calculating unit.
  • the attack estimation unit calculates the second total value for each type of the attack, and calculates the first total value and the second total value for each type of the attack.
  • the match rate is calculated, and the type of the attack corresponding to the abnormality is estimated based on the calculated match rate. Therefore, the low-load processing makes it possible to quickly estimate which of the known attacks the attack is most similar to.
  • the security control unit (5) in any of the security devices (1) to (4), in any of the security devices (1) to (4), in the case where the message received via the communication path is normal, a message normal value holding unit that holds a normal value for each of the plurality of abnormality detection items is provided,
  • the plurality of abnormality detection items include one or more items relating to the abnormality of the message,
  • the abnormality detection unit A message abnormality detection unit that detects a message abnormality due to the attack based on the normal value of each of the plurality of abnormality detection items held in the message normal value holding unit,
  • the abnormal data collection unit Data of the message abnormality detected by the message abnormality detection unit is collected.
  • the message abnormality is detected based on the normal value of each of the plurality of abnormality detection items held in the message normal value holding unit. Even if the number is large, the message abnormality can be detected promptly by the processing with reduced load. Further, the attack identifying unit can quickly identify the type of the attack corresponding to the message abnormality, and the attack estimating unit can quickly estimate the type of attack corresponding to the message abnormality. Is possible.
  • the security control unit (6) in any of the security devices (1) to (5), the communication path normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
  • the plurality of abnormality detection items include one or more items relating to the abnormality of the communication path,
  • the abnormality detection unit Based on the normal value of each of the plurality of abnormality detection items held in the communication path normal value holding unit, a communication path abnormality detection unit for detecting a communication path abnormality due to the attack,
  • the abnormal data collection unit It is characterized in that data of the communication path abnormality detected by the communication path abnormality detection unit is collected.
  • the communication path abnormality is detected based on the normal value of each of the plurality of abnormality detection items held in the communication path normal value holding unit. Even if the number of items is large, the communication path abnormality can be detected promptly by the processing with reduced load. Further, the attack identifying unit can quickly identify the type of the attack corresponding to the communication path abnormality, and the attack estimating unit quickly estimates the type of attack corresponding to the communication path abnormality. It becomes possible to do.
  • the security control unit (7) in any of the security devices (1) to (6), the internal processing normal value holding unit for holding the normal value of each of the plurality of abnormality detection items,
  • the plurality of abnormality detection items include one or more items related to the abnormality of the internal processing,
  • the abnormality detection unit An internal processing abnormality detection unit that detects an abnormality in the internal processing, based on the normal value of each of the plurality of abnormality detection items held in the internal processing normal value holding unit,
  • the abnormal data collection unit Data of abnormality of the internal processing detected by the internal processing abnormality detection unit is collected.
  • an abnormality in the internal processing (hereinafter, also referred to as internal processing abnormality) Since it is detected, even if the number of the plurality of abnormality detection items is large, the internal processing abnormality can be detected promptly by the processing with reduced load. Further, the attack identification unit can quickly identify the type of the attack corresponding to the internal processing abnormality, and the attack estimation unit quickly estimates the type of the attack corresponding to the internal processing abnormality. It becomes possible to do. Therefore, it becomes possible to specify or estimate an abnormality due to the attack that cannot be detected from the communication channel or a message received via the communication channel based on the internal processing abnormality, and thus more various types can be obtained. It is possible to identify or estimate the attack of.
  • the security device (8) is the security device (1) to (7) according to any one of the above security devices.
  • the abnormal data collection unit Data of the abnormality detected within a predetermined time after the abnormality is detected by the abnormality detector is collected.
  • the abnormality data collection unit collects the abnormality data detected within a predetermined time after the abnormality is detected. Therefore, by using the data of the abnormality detected within the predetermined time, it is possible to improve the accuracy of identifying the type of attack by the attack identifying unit, and estimate the type of attack by the attack estimating unit. The accuracy can be increased.
  • a security device (9) is, in any one of the security devices (1) to (8), an abnormal log accumulation unit that accumulates the abnormal data collected by the abnormal data collection unit as an abnormal log. It is characterized by having.
  • the security device (9) since the abnormality data is accumulated in the abnormality log storage unit as an abnormality log, it is possible to perform a post analysis using the abnormality log stored in the abnormality log storage unit. It will be possible.
  • the attack identifying unit identifies the type of the attack corresponding to the abnormality, It is characterized by including a first incident handling unit that performs handling processing for types.
  • the security device (10) when the type of the attack corresponding to the abnormality is identified by the first incident response unit, it is possible to quickly take measures against the identified type of the attack.
  • the estimated attack It is characterized by including a second incident handling unit that performs handling processing for types.
  • the security device (11) when the type of the attack corresponding to the abnormality is estimated by the second incident response unit, it is possible to quickly take measures against the estimated type of the attack.
  • the security device (12) is, in any of the security devices (1) to (11), provided with a notification processing unit that operates the notification unit connected to the device network to notify the abnormality. It is characterized by
  • the notification processing unit can operate the notification unit to notify the abnormality, so that the user who receives the notification can appropriately respond to the abnormality. Can be carried out.
  • the security device (13) is, in any one of the security devices (1) to (12), a notification process for operating the external notification unit connected to the device network to notify the abnormality to the outside. It is characterized by having a section.
  • the notification processing unit it is possible for the notification processing unit to operate the external notification unit to report the abnormality to the outside, so that an appropriate countermeasure is taken from the outside. can do.
  • a security device (14) according to the present disclosure is the control device according to any one of the security devices (1) to (13), wherein the device is mounted in a vehicle,
  • the device network is an in-vehicle network.
  • the security device (14) when one or more of the control devices receives a security attack on the in-vehicle network connected via the communication path, the type of the attack is loaded on the vehicle alone. It can be specified by the reduced processing. In addition, prompt incident response can be achieved, and the safety of the vehicle can be enhanced.
  • a security device (15) according to the present disclosure is the control device according to any one of the security devices (1) to (13), wherein the device is installed in an industrial device forming an FA (Factory Automation) system.
  • the device network is an industrial device network that constitutes the FA system.
  • the security device when one or more of the control devices receives the attack on the industrial device network connected via the communication path, the type of the attack in the FA system. Can be specified by the processing with reduced load. In addition, quick incident response is possible, and the user (for example, operator) of the industrial device can use the industrial device with more peace of mind without worrying about security threats.
  • the attack identifying method (1) is an attack identifying method executed by at least one computer included in a device network in which one or more devices are connected via a communication path, An anomaly detection step of detecting an anomaly caused by an attack on the device network, An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step; A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit; The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit Attack specific steps to The abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.
  • the attack identification method (1) since the abnormality detection pattern is used to identify the type of the attack, when the device network receives the attack, the processing amount such as machine learning is enormous and the load is high.
  • the type of the attack can be specified by the processing with reduced load, without performing the abnormality analysis of 1.
  • the attack identifying method (2) is held in the abnormal data holding unit when the attack identifying step cannot identify the attack type in the attack identifying method (1).
  • an attack estimation step of estimating the type of the attack corresponding to the abnormality is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
  • the attack estimating step identifies the attack type corresponding to the abnormality. Can be estimated. Further, since the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, the load is reduced without performing a heavy load abnormality analysis with a large amount of processing such as machine learning. The performed process makes it possible to deduce whether the attack is similar to any known attack.
  • the program (1) is a program for causing at least one or more computers included in a device network in which one or more devices are connected via a communication path, The at least one or more computers, An anomaly detection step of detecting an anomaly caused by an attack on the device network, An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step; A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit; The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit It is a program to execute the attack specific step
  • the abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.
  • the program (1) when the attack on the device network is received, it is possible to cause the at least one or more computers to execute the process of identifying the type of the attack. Therefore, the type of the attack can be specified by the computer itself. Further, since the abnormality detection pattern is used to identify the type of the attack, it is possible to perform the processing in which the load is reduced without causing the computer to execute a heavy load abnormality analysis such as machine learning. It becomes possible to execute the processing for specifying the type of attack.
  • the program may be a program stored in a storage medium or a program that can be transferred via a communication network.
  • a program (2) according to the present disclosure is the same as the program (1) above.
  • the at least one or more computers When the type of the attack cannot be specified by the attack specifying step, the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit
  • a program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of The attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
  • the attack estimating step causes the computer to detect the attack corresponding to the abnormality.
  • a process of estimating the type can be executed.
  • the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, it is necessary to cause the computer to execute an abnormality analysis with a large amount of processing such as machine learning and a high load. Instead, it is possible to execute the process of estimating whether the attack is similar to any known attack by the process of reducing the load.
  • the computer-readable storage medium (1) is a computer in which a program for executing at least one computer included in a device network in which one or more devices are connected via a communication path is stored.
  • a readable storage medium The at least one or more computers, An anomaly detection step of detecting an anomaly caused by an attack on the device network, An abnormality data collecting step of collecting data of the abnormality detected by the abnormality detecting step; A holding step of holding the abnormal data collected by the abnormal data collecting step in an abnormal data holding unit; The type of the attack corresponding to the abnormality is identified based on the abnormality data held in the abnormal data holding unit and the abnormality detection pattern for each type of the attack held in the abnormality detection pattern holding unit.
  • the abnormality detection pattern is configured to include combination data of whether or not detection is required for each of the plurality of abnormality detection items.
  • the attack when the at least one or more computers read the program and execute the steps, the attack is made on the device network, It is possible to execute processing for specifying the type of attack. Therefore, the type of the attack can be specified by the computer itself. Further, since the abnormality detection pattern is used to identify the type of the attack, it is possible to perform the processing in which the load is reduced without causing the computer to execute a heavy load abnormality analysis such as machine learning. It becomes possible to execute the processing for specifying the type of attack.
  • a computer-readable storage medium (2) is provided in the at least one computer,
  • the abnormal data held in the abnormal data holding unit and the type of the attack held in the attack estimated pattern holding unit A program for further executing an attack estimation step of estimating the type of the attack corresponding to the abnormality based on the attack estimation pattern of The attack estimation pattern is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
  • the attack estimating step causes the computer to detect the abnormality.
  • a process of estimating the type of the corresponding attack can be executed.
  • the attack estimation pattern defined for each type of the attack is used for the estimation of the type of the attack, it is necessary to cause the computer to execute an abnormality analysis with a large amount of processing such as machine learning and a high load. Instead, it is possible to execute the process of estimating whether the attack is similar to any known attack by the process of reducing the load.
  • FIG. 3 is a block diagram showing a functional configuration example of a gateway ECU according to the embodiment (1).
  • FIG. 7 is a diagram for explaining an example of an abnormality detection pattern held by an abnormality detection pattern holding unit for each type of attack. It is a figure for demonstrating the case where the kind of attack was able to be specified by the attack specific process which an attack specific part performs. It is a figure for demonstrating the case where the kind of attack cannot be specified by the attack specific process which an attack specific part performs. It is a figure for demonstrating an example of the attack estimation pattern for every kind of attack currently hold
  • FIG. 6 is a configuration example of attack identification data output to the incident response unit when the attack identification unit identifies the type of attack corresponding to the abnormality. It is a structural example of the attack estimation data output to the incident response unit when the type of attack corresponding to the abnormality is specified by the attack estimation unit.
  • 7 is a schematic flowchart showing a processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1).
  • FIG. 7 is a flowchart showing an abnormality detection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1).
  • 7 is a flowchart showing an abnormality collection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1).
  • 7 is a flowchart showing an attack identifying processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (1).
  • It is a block diagram which shows the functional structural example of the gateway ECU which concerns on embodiment (2).
  • FIG. 7 is a diagram for explaining an example of an abnormality detection pattern held by an abnormality detection pattern holding unit for each type of attack. It is a figure for demonstrating an example of the attack estimation pattern for every kind of attack currently hold
  • FIG. 7 is a flowchart showing an abnormality detection processing operation performed by a security control unit that constitutes the gateway ECU according to the embodiment (2). It is a schematic block diagram of the FA system which concerns on a modification. It is a schematic block diagram of the FA system which concerns on another modification.
  • FIG. 1 is a schematic block diagram of an in-vehicle network system to which the security device according to the embodiment (1) is applied.
  • the in-vehicle network 2 is a communication network system mounted on the vehicle 1, and includes an OBDII (On-board diagnostics II) 4, a traveling system ECU (Electronic Control Unit) group 5, a body system ECU group 6, an information system ECU group 7, And a gateway ECU 10.
  • the vehicle-mounted network 2 in the present embodiment is a network that communicates according to the CAN (Controller Area Network) protocol. Note that communication standards other than CAN may be adopted for the in-vehicle network 2.
  • the OBDII 4, the traveling system ECU group 5, the body system ECU group 6, and the information system ECU group 7 are connected to CH1, CH2, CH3, and CH4 of the gateway ECU 10 via the bus 3 which is a communication path, respectively.
  • the number of communication CHs that the gateway ECU 10 has is not limited to four.
  • a central gateway system in which the ECU group is connected to the gateway ECU 10 for each functional system is adopted, but the connection system of the gateway ECU 10 is not limited to this system, and the ECU group is connected between the ECU groups.
  • the gateway ECU 10 may be provided in the system.
  • OBDII4 is equipped with a port to which a diagnostic device or scan tool for failure diagnosis or maintenance is connected.
  • the traveling system ECU group 5 includes a drive system ECU and a chassis system ECU.
  • the drive system ECU includes a control unit for "running" functions such as engine control, motor control, fuel cell control, EV (Electric Vehicle) control, and transmission control.
  • the chassis system ECU includes a control unit for "stop, bend” functions such as brake control or steering control.
  • the body system ECU group 6 includes a control unit related to the functions of the vehicle body such as a door lock, a power window, an air conditioner, a light, or a winker.
  • the information system ECU group 7 includes infotainment devices, telematics devices, or ITS (Intelligent Transport Systems) related devices.
  • the infotainment device includes a car navigation device or an audio device
  • the telematics device includes a communication unit for connecting to a mobile phone network or the like.
  • the ITS-related device includes an ETC (Electronic Toll Collection System), a road-to-vehicle communication with a roadside device such as an ITS spot, or a communication unit for performing inter-vehicle communication.
  • a safety function system ECU group may be connected to the gateway ECU 10.
  • the safety function system ECU group includes a control unit relating to functions such as automatic braking, lane keeping control, inter-vehicle distance control, etc. that automatically improve safety or realize comfortable driving in cooperation with the traveling system ECU group 5 and the like. It is included.
  • an external interface may be connected to the gateway ECU 10.
  • the external interface includes, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), USB (Universal Serial Bus) port, memory card slot, or the like.
  • the gateway ECU 10 has a function of exchanging frames with each ECU group included in the in-vehicle network 2 according to the CAN protocol, and further functions as a security device according to the present embodiment. That is, the security device according to the present embodiment is mounted on the gateway ECU 10 connected to the bus 3 of the vehicle-mounted network 2.
  • the gateway ECU 10 determines the attack by the vehicle 1 alone, that is, in the gateway ECU 10 by the process of reducing the load (ie, the attack). , Identify or presume the type of attack) and execute incident response processing according to the determined attack. As a result, the driver of the vehicle 1 can drive the vehicle 1 without anxiety about the threat of a security attack.
  • the traveling system ECU group 5, the body system ECU group 6, the information system ECU group 7, and the gateway ECU 10 are configured by a computer device including one or more processors, a memory, a communication module, and the like, and a processor mounted in each ECU. However, by reading the program stored in the memory, interpreting and executing the program, each ECU executes predetermined control.
  • FIG. 2 is a block diagram showing a functional configuration example of the gateway ECU 10 according to the embodiment (1).
  • the gateway ECU 10 includes a gateway function unit 11 and a security control unit 12.
  • the security control unit 12 is a part in which the functions of the security device according to the present embodiment are mounted.
  • the gateway ECU 10 includes, as hardware, a memory including a ROM (Read Only Memory) and a RAM (Random Access Memory) in which a control program is stored, a processor such as a CPU (Central Processing Unit) that reads and executes the program from the memory. , And a communication module for connecting to the vehicle-mounted network 2 and the like.
  • ROM Read Only Memory
  • RAM Random Access Memory
  • CPU Central Processing Unit
  • the gateway function unit 11 has a function of performing control to transfer a frame via each ECU group and the bus 3, and includes, for example, a frame transmission/reception unit, a frame interpretation unit, and a frame conversion unit (not shown) of the vehicle-mounted network 2.
  • the configuration required for mutual communication with each ECU group according to the CAN protocol is included.
  • the bus 3 is an example of a communication path and the frame is an example of a message.
  • the -Frames in the CAN protocol are configured to include data frames, remote frames, overload frames, and error frames.
  • the data frame includes SOF (Start of Frame), ID, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit, DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence, CRC delimiter (CRC delimiter).
  • DEL Data Length Code
  • CRC Cyclic Redundancy Check
  • CRC delimiter CRC delimiter
  • DEL ACK (Acknowledgement) slot
  • ACK delimiter (DEL) and EOF (End Of Frame) fields.
  • the security control unit 12 includes a frame reception unit 21, a frame abnormality detection unit 22, a bus monitoring unit 23, a bus abnormality detection unit 24, and a normal value holding unit 25.
  • the security control unit 12 further includes an abnormal data collection unit 26, an abnormal data holding unit 27, a timer 28, an abnormality detection pattern holding unit 29, an attack identifying unit 30, an attack estimation pattern holding unit 31, an attack estimation unit 32, and an incident response. It is configured to include the portion 33.
  • the security control unit 12 is configured to include, as hardware, a ROM in which a control program is stored, a memory including a RAM, a processor that reads a program from the memory and executes the program, and the functions of the above-described units are realized by the hardware. Is being realized.
  • the frame receiving unit 21 receives, for example, a frame (CAN frame) that is a CAN signal from the gateway function unit 11, and sends the received frame to the frame abnormality detection unit 22 and the bus monitoring unit 23.
  • a frame CAN frame
  • the frame receiving unit 21 receives, for example, a frame (CAN frame) that is a CAN signal from the gateway function unit 11, and sends the received frame to the frame abnormality detection unit 22 and the bus monitoring unit 23.
  • the frame abnormality detection unit 22 checks a plurality of abnormality detection items (also referred to as parameters) to determine whether the frame received by the frame reception unit 21 has an abnormality (that is, a frame abnormality) caused by an attack on the vehicle-mounted network 2. And detect.
  • the plurality of abnormality detection items for detecting the frame abnormality may include, for example, parameters such as RTR, DLC, payload, and reception cycle set for each frame ID.
  • the frame abnormality is an abnormality of the CAN signal alone.
  • the frame abnormality detection unit 22 is an example of a message abnormality detection unit.
  • the bus monitoring unit 23 monitors the respective states of the buses 3 connected to CH1 to CH4 of the gateway ECU 10 and sends the monitoring data to the bus abnormality detection unit 24.
  • the bus abnormality detection unit 24 is an example of a communication path abnormality detection unit.
  • the bus abnormality detection unit 24 determines whether or not the bus 3 connected to CH1 to CH4 has an abnormality (that is, a bus abnormality) caused by an attack on the vehicle-mounted network 2 by using a plurality of abnormality detection items (also referred to as parameters). Check and detect.
  • the plurality of abnormality detection items for detecting a bus abnormality include, for example, a bus load factor of each bus 3 connected to CH1 to CH4, a bus state (state such as presence or absence of bus error), and an ID appearing on the bus 3. Parameters may be included.
  • the bus abnormality indicates a situation abnormality of the CAN signal.
  • the frame abnormality detection unit 22 and the bus abnormality detection unit 24 are an example of an abnormality detection unit that detects an abnormality caused by an attack on the vehicle-mounted network 2.
  • the normal value holding unit 25 holds in advance frame normal values (also referred to as normal patterns) for each of the plurality of abnormality detection items used by the frame abnormality detection unit 22 to determine whether or not there is a frame abnormality. Further, the normal value holding unit 25 holds in advance bus normal values (also referred to as normal patterns) of the plurality of abnormality detection items, which are used by the bus abnormality detection unit 24 to determine whether there is a bus abnormality. There is.
  • the normal value holding unit 25 has functions as a frame normal value holding unit (message normal value holding unit) and a bus normal value holding unit (communication path normal value holding unit), but instead of the normal value holding unit 25
  • the frame normal value holding unit and the bus normal value holding unit may be separately provided.
  • the frame normal value is composed of a normal pattern of a plurality of items such as a reception cycle, DLC data length, and payload characteristics for each ID of a frame received on each CH.
  • the bus normal value is composed of a normal pattern of a plurality of items such as a bus load factor, presence or absence of a bus error, and an appearance ID for each bus 3 connected to each CH.
  • the abnormal data collection unit 26 collects frame abnormal data detected within a predetermined time after the frame abnormal detection unit 22 detects the frame abnormal, and sends the collected frame abnormal data to the abnormal data holding unit 27. .. Further, the abnormal data collection unit 26 collects data of other bus abnormalities detected within a predetermined time after the bus abnormal detection unit 24 detects a bus abnormal condition, and retains the collected bus abnormal data as abnormal data. Send to section 27.
  • the abnormal data holding unit 27 temporarily holds the frame abnormal data and the bus abnormal data collected by the abnormal data collecting unit 26.
  • the timer 28 counts a predetermined time for the abnormal data collecting unit 26 to collect abnormal data.
  • the predetermined time is set to a time that does not hinder safe traveling even if the vehicle 1 is subjected to a security attack, for example.
  • the abnormality detection pattern holding unit 29 holds in advance an abnormality detection pattern for each type of attack.
  • the abnormality detection pattern for each type of attack is configured to include combination data of the necessity of detection for each of the plurality of abnormality detection items.
  • FIG. 3 is a diagram for explaining an example of the abnormality detection pattern held by the abnormality detection pattern holding unit 29 for each type of attack.
  • the data indicating the abnormality detection pattern 29a for each type of attack includes an item of attack type and a plurality of abnormality detection items.
  • the types of attacks that can be assumed in the in-vehicle network 2 (attacks A1 to A5,%) are set in the attack type item.
  • the attack set in the attack type column is a threat analysis for the system of the in-vehicle network 2 (that is, the gateway ECU 10, the traveling system ECU group 5, the body system ECU group 6, the information system ECU group 7, and the OBDII 4).
  • 1 is a known attack extracted by analysis of vulnerabilities and threats of devices connected to the vehicle, other communication devices connected to the in-vehicle network 2, and the like.
  • the threat analysis method for extracting these attacks is not particularly limited. For example, methods such as threat extraction using DFD (Date Flow Diagram), threat classification by STRIDE, threat tree, or threat evaluation by DREAD can be adopted.
  • the attack set in the attack type column can be set to, for example, illegal use, illegal setting, illegal relay, illegal insertion, information leakage, Dos attack, message loss, or fake message.
  • a plurality of abnormality detection items include frame abnormalities F1 to F5 and bus abnormalities B1 to B5.
  • Parameters relating to frame anomalies such as the reception cycle, payload, DLC, and RTR are set in the frame anomalies F1 to F5, respectively.
  • parameters relating to bus abnormality such as bus load factor, bus error, and appearance ID are set in the bus abnormality B1 to B5, respectively.
  • a pattern of combination data indicating whether or not detection is required for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5) is set for each type of attack.
  • “AND” indicates that it is always detected
  • “NOT” indicates that it is never detected
  • “ ⁇ ” indicates that it is detected or unknown.
  • the attack A1 the frame abnormality F1 is always detected
  • the frame abnormality F3, F5 and the bus abnormality B1, B4, B5 are never detected
  • the frame abnormality F2, F4 and the bus abnormality B2, B3 are detected. Or unknown (whether or not detected).
  • the attack identifying unit 30 responds to the detected abnormality based on the abnormality data held in the abnormal data holding unit 27 and the abnormality detection pattern for each type of attack held in the abnormality detection pattern holding unit 29. Perform processing to identify the type of attack. After performing the attack identifying process, the attack identifying unit 30 also gives an instruction to reset (clear) the abnormal data (detection data) temporarily stored in the abnormal data holding unit 27.
  • FIG. 4 is a diagram for explaining a case where the type of attack can be identified by the attack identifying process performed by the attack identifying unit 30.
  • the attack identifying unit 30 collates the abnormal data 27a held in the abnormal data holding unit 27 with the abnormal detection pattern 29a for each type of attack held in the abnormal detection pattern holding unit 29 to obtain the abnormal data. Processing for identifying the type of attack corresponding to the abnormality indicated by 27a is performed.
  • the abnormality data 27a includes data indicating the results of presence or absence of detection ("1" detected, "0" not detected) for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5). Has been.
  • the abnormal data 27a illustrated in FIG. 4 includes data in which frame abnormalities F1 and F2 and bus abnormalities B1 to B5 are detected, and frame abnormalities F3 to F5 are not detected.
  • the attack identifying unit 30 collating the abnormal data 27a and the abnormal detection pattern 29a for each type of attack, the abnormal data indicated by the abnormal data 27a detected this time is detected as abnormal.
  • the case where the attack A3 in the pattern 29a is identified is shown.
  • the type of attack cannot be specified by the attack specifying process performed by the attack specifying unit 30 will be described.
  • FIG. 5 is a diagram for explaining a case where the type of attack cannot be specified by the attack specifying process performed by the attack specifying unit 30.
  • the abnormality data 27b illustrated in FIG. 5 includes data in which frame abnormalities F1 and F2 and bus abnormalities B2, B4, and B5 are detected, and frame abnormalities F3 to F5 and bus abnormalities B1 and B3 are not detected. It is configured.
  • the attack identifying unit 30 collating the abnormal data 27b with the abnormal detection pattern 29a for each type of attack, the abnormal data indicated by the abnormal data 27b detected this time is detected as abnormal.
  • the attack identification process performed by the attack identification unit 30 fails to identify the type of attack (in other words, it is an unknown attack)
  • the attack estimation process by the attack estimation unit 32 is performed next.
  • the attack estimation pattern holding unit 31 holds an attack estimation pattern for each type of attack in advance.
  • the attack estimation pattern for each type of attack is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
  • FIG. 6 is a diagram for explaining an example of the attack estimation pattern held by the attack estimated pattern holding unit 31 for each type of attack.
  • the data indicating the attack estimation pattern 31a for each attack type is configured to include an attack type item, a plurality of abnormality detection items, and a first total value item.
  • the type of attack that can be assumed in the in-vehicle network 2 (attacks A11 to A15,...) Is set in the attack type item.
  • the plurality of abnormality detection items include parameters of the frame abnormalities F1 to F5 and the bus abnormalities B1 to B5, like the abnormality detection pattern 29a illustrated in FIG.
  • combination data (weighting value of 0.0 to 1.0) for each of a plurality of abnormality detection items (frame abnormality F1 to F5 and bus abnormality B1 to B5) (Also referred to as a set) pattern is set.
  • the weighting value for each abnormality detection item of each attack may be set based on the result of the threat analysis performed in advance, or may be set based on the result of the machine learning performed in advance.
  • the first total value indicates the sum (also referred to as the sum of sets) of the combination data (weight set) of the weight values for each of the plurality of abnormality detection items in each attack.
  • the attack estimation unit 32 holds the abnormal data held in the abnormal data holding unit 27 and the attack estimated pattern holding unit 31 when the attack specifying unit 30 cannot specify the type of attack. A process of estimating the type of attack corresponding to the detected abnormality is performed based on the attack estimation pattern 31a for each type of attack.
  • FIG. 7 is a diagram for explaining an example of attack estimation processing performed by the attack estimation unit 32.
  • the attack estimation unit 32 for each type of attack (attacks A11 to A15,...) Held in the attack estimation pattern holding unit 31, detects each abnormality detection item (frame abnormality F1 to F5, and bus) of the abnormality data 27b.
  • a second total value also called the sum of product sets
  • Is calculated that is, it functions as a first calculation unit).
  • FIG. 8 is a diagram showing an example of the calculation result of the second total value calculated by the first calculation unit included in the attack estimation unit 32.
  • each abnormality detection item frame abnormality F1 to F5, and bus abnormality B1 to B5
  • data indicating whether or not each abnormality data 27b is detected and each estimated attack pattern 31a.
  • the product value with the weighting value is calculated, and the sum of the calculated product values is calculated as the second total value.
  • FIG. 9 is a diagram showing an example of the matching rate calculated by the second calculation unit included in the attack estimation unit 32. As shown in FIG. 9, the matching rate here is represented by [second total value/first total value] ⁇ 100 (%).
  • the attack estimation unit 32 estimates the type of attack corresponding to the abnormality that could not be identified by the attack identification unit 30, based on the match rate for each attack calculated by the second calculation unit (that is, estimation). Functions as a department).
  • the estimation unit included in the attack estimation unit 32 can estimate which existing attack type the abnormality that could not be identified by the attack identification unit 30 resembles, based on the matching rate.
  • the match rate of the attack A11 is the highest, and it is possible to estimate that the attack due to the abnormality detected this time is the most similar to the attack A11.
  • the incident handling unit 33 functions as a first incident handling unit that performs a handling process for the identified attack type when the attack identifying unit 30 identifies the type of attack corresponding to the abnormality. Further, the incident handling unit 33 functions as a second incident handling unit that performs a handling process for the estimated attack type when the attack estimating unit 32 estimates the attack type corresponding to the abnormality.
  • FIG. 10 shows an example of attack identification data output to the incident response unit 33 when the attack identification unit 30 identifies the type of attack corresponding to the abnormality.
  • the attack identification data includes CH attacked by the gateway ECU 10, a frame in which an abnormality has occurred, and data related to the identified attack.
  • the incident handling unit 33 executes a predetermined countermeasure process for the identified type of attack based on the attack identifying data acquired from the attack identifying unit 30.
  • FIG. 11 shows an example of attack estimation data output to the incident handling unit 33 when the attack estimation unit 32 estimates the type of attack corresponding to an abnormality.
  • the attack estimation data includes CH attacked by the gateway ECU 10, a frame having an abnormality, and data regarding the estimated attack.
  • the incident handling unit 33 executes a predetermined countermeasure process for the estimated attack type based on the attack estimation data acquired from the attack estimation unit 32. For example, the countermeasure process for the type of attack having the highest matching rate is executed.
  • FIG. 12 is a schematic flowchart showing a processing operation performed by the security control unit 12 included in the gateway ECU 10 according to the embodiment (1). It should be noted that the present processing operation is premised on the case where an attacker performs some security attack on the in-vehicle network 2 and the defense function of the gateway ECU 10 is broken.
  • step S1 the security control unit 12 determines whether or not an abnormality has occurred in the in-vehicle network 2 due to a security attack. If it is determined that the abnormality has not occurred, the processing is terminated, while the abnormality has occurred. If determined, the process proceeds to step S2.
  • step S2 the security control unit 12 performs a process of detecting an abnormality that has occurred in the frame received from each ECU group or the bus 3 connected to each CH, and then advances the process to step S3.
  • step S3 the security control unit 12 performs a process of collecting the data of the abnormality that has occurred in the received frame or the bus 3 (that is, the detection result of the abnormality), and then advances the process to step S4.
  • step S4 the security control unit 12 performs a process of identifying the type of security attack using the collected abnormal data, and a process of estimating the type of attack when the type of attack cannot be identified. Then, the process proceeds to step S5. In step S5, the security control unit 12 performs a process of implementing an incident countermeasure corresponding to the identified type of attack or the estimated type of attack, and then ends the process.
  • FIG. 13 is a flowchart showing an abnormality detection processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1).
  • This processing operation is an example of the abnormality detection processing operation performed in step S2 of FIG. 12, and is executed when a frame which is a CAN signal is received.
  • step S11 the security control unit 12 performs a process of receiving a frame that is a CAN signal (frame received from each ECU group) from the gateway function unit 11, and proceeds to step S12.
  • step S12 the security control unit 12 determines whether or not an abnormality due to a security attack has been detected in the received frame or the bus 3 that has received the frame. If it is determined that no abnormality has been detected, the CAN signal is detected. If it is determined that an abnormality has been detected while the abnormality detection processing at the time of reception is completed, the processing proceeds to step S13.
  • step S13 the security control unit 12 is currently in a state of collecting abnormal data due to a security attack (abnormality collection state) (in other words, whether the abnormal data collection unit 26 is operating or not). ), and if it is determined that abnormal data is currently being collected, the process proceeds to step S15.
  • step S13 if the security control unit 12 determines that the abnormal data is not currently collected, the process proceeds to step S14.
  • step S14 the security attack abnormal condition is collected. A process of transitioning (in other words, the abnormal data collecting unit 26 starts collecting abnormal data) is performed, and then the process proceeds to step S15.
  • step S15 the security control unit 12 determines whether or not the abnormality detected in step S12 is an abnormality already detected after transition to the abnormality collection state, and determines that the abnormality is already detected. For example, the abnormality detection process when the CAN signal is received ends.
  • step S15 determines in step S15 that the abnormality is not already detected (in other words, it is an undetected abnormality)
  • the process proceeds to step S16, and in step S16, the detected abnormality is detected.
  • the data is stored in the abnormal data holding unit 27, and then the abnormality detection process when the CAN signal is received ends.
  • the security control unit 12 may detect the frame abnormality and the bus abnormality in different processing flows.
  • the frame abnormality may be detected after the frame is received, and the bus abnormality may be detected by constantly monitoring the state of the bus 3 connected to CH1 to CH4.
  • FIG. 14 is a flowchart showing an abnormality collection processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1).
  • This processing operation is an example of an operation of collecting abnormal data (abnormality detection result) performed in step S3 of FIG.
  • step S21 the security control unit 12 starts counting the abnormality collection time by the timer 28, and then proceeds to step S22.
  • step S22 it is determined whether or not a predetermined time has elapsed since the count was started. to decide.
  • the predetermined time is set to a time (for example, several seconds to several tens of seconds) that does not hinder safe traveling even when the vehicle 1 receives a security attack.
  • step S22 if the security control unit 12 determines that the predetermined time has not elapsed, the timer 28 continues counting until the predetermined time has elapsed, and if it determines that the predetermined time has elapsed, the process proceeds to step S23.
  • step S23 the security control unit 12 ends the collection of abnormal data and advances the process to the next step S24.
  • step S24 the count of the timer 28 is cleared, and then the process ends.
  • FIG. 15 is a flowchart showing an attack identifying processing operation performed by the security control unit 12 configuring the gateway ECU 10 according to the embodiment (1).
  • the processing operation is an example of the attack identifying processing operation performed in step S4 of FIG. 12, and includes the attack identifying processing operation and the attack estimating processing operation.
  • the security control unit 12 reads out the abnormal data (abnormal data detected within a predetermined time) stored in the abnormal data holding unit 27, and advances the processing to step S32.
  • the abnormality data has, for example, the data configuration shown in the abnormality data 27a illustrated in FIG. 4 (the data configuration including the results of the presence/absence of detection of a plurality of abnormality detection items).
  • step S32 the security control unit 12 reads the abnormality detection pattern specified for each type of attack from the abnormality detection pattern holding unit 29, and advances the processing to the next step S33.
  • the abnormality detection pattern has, for example, the data structure shown in the abnormality detection pattern 29a for each type of attack illustrated in FIG. 3 (combination data of detection necessity for a plurality of abnormality detection items is set for each type of attack). Data structure).
  • step S33 the security control unit 12 performs a process (matching process) of matching the abnormality data read in step S31 with the abnormality detection pattern for each type of attack read in step S32, and then in step S34. Proceed with processing.
  • step S34 it is determined whether or not the same abnormality detection pattern as the abnormal data is detected as a result of the collation, and if it is determined that the same abnormality detection pattern as the abnormal data is detected, the process proceeds to step S35. ..
  • step S35 the security control unit 12 identifies that the type of attack indicated by the abnormality data is an attack indicated by the same abnormality detection pattern determined in step S34, and then proceeds to step S36.
  • step S36 the security control unit 12 performs a process of outputting information on the identified attack to the incident handling unit 33, and then advances the process to step S37.
  • step S34 the security control unit 12 determines in step S34 that the same abnormality detection pattern as the abnormality data is not detected, the process proceeds to step S38.
  • step S38 the security control unit 12 reads out the attack estimation pattern specified for each type of attack from the attack estimation pattern holding unit 31, and then advances the process to step S39.
  • the attack estimation pattern is, for example, the data structure shown in the attack estimation pattern 31a for each type of attack illustrated in FIG. 6 (combined data of weighting values for each of a plurality of abnormality detection items and data of the sum of weighting values).
  • the data structure is set for each type of attack).
  • step S39 the security control unit 12 performs a process of calculating the sum (second total value) of the products of the abnormal data and the attack estimation pattern for each attack type, and advances the process to step S40.
  • step S40 the security control unit 12 compares the first total value (sum of sets) defined in the attack estimation pattern for each type of attack with the second total value (sum of intersections) ([second total sum]. Value/first total value] ⁇ 100(%)) is calculated, and the process proceeds to step S41.
  • step S41 the security control unit 12 estimates the type of attack based on the matching rate. For example, it is estimated that the abnormality detected this time is the most similar to the attack with the highest matching rate, and the process proceeds to step S42.
  • step S42 the security control unit 12 performs a process of outputting the estimated attack information to the incident handling unit 33, and then advances the process to step S37.
  • step S37 the security control unit 12 performs a reset process for clearing the data temporarily held in the abnormal data holding unit 27, and then ends the process.
  • the gateway ECU 10 since the gateway ECU 10 according to the embodiment (1) includes the security control unit 12, the frame abnormality detection unit 22 detects a frame abnormality, and the bus abnormality detection unit 24 detects a bus abnormality.
  • the detected abnormality is collected by the abnormality data collection unit 26, and the collected abnormality data is held in the abnormality data holding unit 27.
  • the attack identifying unit 30 identifies the type of attack corresponding to the abnormality.
  • the type of the attack can be specified by the vehicle 1 alone, that is, by the gateway ECU 10.
  • the attack identification unit 30 collates (matches) the data indicating the result of detection/non-detection for each of the plurality of abnormality detection items with the abnormality detection pattern for each type of attack, whereby the type of attack corresponding to the abnormality Is specified. Therefore, it is possible to quickly identify the type of attack and reduce the device cost by performing low-load processing with a reduced load, without performing anomaly analysis that requires a large amount of processing such as machine learning. It is also possible to realize a device that is advantageous in terms of cost.
  • the incident handling unit 33 can promptly take measures against the identified type of attack. As a result, the driver of the vehicle 1 can drive with peace of mind against the threat of security.
  • the attack estimating unit 32 can estimate the type of attack similar to the abnormality.
  • an attack estimation pattern defined for each type of attack is used to estimate the type of attack, a second total value is calculated for each type of attack, and a first total value and a second total value for each type of attack are calculated.
  • the match rate with the total value is calculated, and the type of attack corresponding to the abnormality is estimated based on the calculated match rate. Therefore, it is possible to quickly estimate which known attack is most similar to the known attack by performing low-load processing with a light load, without performing anomalous analysis with a large amount of processing such as machine learning. You can
  • the incident handling unit 33 can promptly take measures against the estimated type of attack. As a result, the driver of the vehicle 1 can drive with peace of mind against the threat of security.
  • FIG. 16 is a block diagram showing a functional configuration example of the gateway ECU 10A according to the embodiment (2).
  • the components having the same functions as those of the gateway ECU 10 shown in FIG. 2 are designated by the same reference numerals, and the description thereof will be omitted here.
  • the gateway ECU 10 according to the embodiment (1) is configured to be able to detect a frame abnormality and a bus abnormality
  • the gateway ECU 10A according to the embodiment (2) is configured to be able to detect an internal processing abnormality. There is a big difference.
  • the gateway ECU 10A includes a gateway function unit 11 and a security control unit 12A.
  • the security control unit 12A is a part in which the functions of the security device according to the present embodiment are mounted.
  • the security control unit 12A monitors the internal processing in addition to the frame receiving unit 21, the frame abnormality detecting unit 22, the bus monitoring unit 23, the bus abnormality detecting unit 24, the frame normal value holding unit 25A, and the bus normal value holding unit 25B. It is configured to include a unit 34, an internal processing abnormality detection unit 35, and an internal processing normal value holding unit 36. Further, the security control unit 12A includes the abnormal data collection unit 26A, the abnormal data holding unit 27A, the timer 28, the abnormality detection pattern holding unit 29A, the attack identifying unit 30A, the attack estimation pattern holding unit 31A, the attack estimation unit 32A, and the incident handling. It is configured to include the portion 33.
  • the internal processing monitoring unit 34 monitors the state of internal control processing in the gateway ECU 10A when each function of the gateway function unit 11 (for example, a frame reception function, a transfer function, a transmission function, etc.) is being executed.
  • the monitoring target of the internal processing includes at least one or more of the control processing time of the function, the function execution frequency, the function execution processing order, and the resource of the hardware configuring the gateway ECU 10A.
  • control processing time for example, whether or not the control processing of each function is executed within a preset time is monitored.
  • function execution frequency for example, it is monitored whether or not the function execution frequency of each function of the gateway function unit 11 is within a preset numerical range.
  • function execution processing order for example, it is monitored whether or not the processing execution order of each function of the gateway function unit 11 is executed in a preset order.
  • Hardware resources include, for example, CPU usage rate, RAM usage rate, code ROM (code storage memory) usage rate, or data ROM (data storage memory) usage rate. Regarding hardware resources, for example, it is monitored whether the average usage rate of each hardware is within a preset numerical range.
  • the internal processing abnormality detection unit 35 detects whether or not there is an abnormality (that is, internal processing abnormality) in the internal processing monitored by the internal processing monitoring unit 34 by checking a plurality of abnormality detection items (also referred to as parameters). To do.
  • the plurality of abnormality detection items for detecting the internal processing abnormality include, for example, parameters such as the control processing time, the number of times of function execution, the order of function execution processing, and hardware resources.
  • the frame abnormality detection unit 22, the bus abnormality detection unit 24, and the internal processing abnormality detection unit 35 are an example of an abnormality detection unit that detects an abnormality caused by an attack on the in-vehicle network 2.
  • the internal processing normal value holding unit 36 stores in advance internal processing normal values (also referred to as normal patterns) of a plurality of abnormality detection items, which are used by the internal processing abnormality detection unit 35 to determine whether there is an internal processing abnormality. Is held.
  • the internal processing normal value is composed of a normal pattern of a plurality of items such as control processing time of each function, function execution frequency, function execution processing order, and average usage rate of hardware resources.
  • the abnormal data collection unit 26A collects frame abnormal data detected within a predetermined time after the frame abnormal detection unit 22 detects a frame abnormal, and sends the collected frame abnormal data to the abnormal data holding unit 27A. .. Further, the abnormal data collection unit 26A collects data of bus abnormalities detected within a predetermined time after the bus abnormalities are detected by the bus abnormality detection unit 24, and collects the collected data of bus abnormalities in the abnormal data holding unit 27A. Send to. Further, the abnormal data collection unit 26A collects the data of the internal processing abnormality detected within a predetermined time after the internal processing abnormality detection unit 35 detects the internal processing abnormality, and collects the collected data of the internal processing abnormality. It is sent to the data holding unit 27A.
  • the abnormal data holding unit 27A temporarily holds the frame abnormal data, the bus abnormal data, and the internal processing abnormal data collected by the abnormal data collecting unit 26A.
  • the timer 28 counts a predetermined time for collecting abnormal data by the abnormal data collecting unit 26A.
  • the predetermined time is set to a time that does not hinder safe traveling even if the vehicle 1 is subjected to a security attack, for example.
  • the abnormality detection pattern holding unit 29A holds an abnormality detection pattern for each type of attack in advance.
  • the abnormality detection pattern for each type of attack is configured to include combination data of the necessity of detection for each of the plurality of abnormality detection items.
  • FIG. 17 is a diagram for explaining an example of the abnormality detection pattern held by the abnormality detection pattern holding unit 29A for each type of attack.
  • the data indicating the abnormality detection pattern 29b for each type of attack includes an item of attack type and a plurality of abnormality detection items.
  • the difference from the abnormality detection pattern 29a shown in FIG. 3 is that a plurality of abnormality detection items further include an internal processing abnormality.
  • the types of attacks that can be assumed in the in-vehicle network 2 (attacks A21 to A25,...) are set in the attack type item.
  • the plurality of abnormality detection items include frame abnormalities F1 to F4, bus abnormalities B1 to B4, and internal processing abnormalities C1 to C4. Parameters relating to frame anomalies such as the reception cycle, payload, DLC, and RTR are set in the frame anomalies F1 to F4. Further, parameters relating to bus abnormality such as bus load factor, bus error, and appearance ID are set in the bus abnormality B1 to B4, respectively. Further, in the internal processing abnormalities C1 to C4, parameters relating to internal processing abnormalities such as control processing time of each function, function execution frequency, function execution processing order, and hardware resources are set.
  • a pattern of combination data indicating whether or not detection is necessary for each of a plurality of abnormality detection items (frame abnormality F1 to F4, bus abnormality B1 to B4, and internal processing abnormality C1 to C4) is set for each type of attack.
  • the frame abnormality F1 and the internal processing abnormality C4 are always detected, and the frame abnormality F3, the bus abnormalities B2 and B3, and the internal processing abnormalities C2 and C3 are never detected, and the frame abnormality F2, F4, and the bus abnormality are detected.
  • the abnormalities B1 and B4 and the internal processing abnormality C1 are detected or unknown (may be detected or may not be detected).
  • the attack identifying unit 30A responds to the detected abnormality based on the abnormality data held in the abnormal data holding unit 27A and the abnormality detection pattern 29b for each type of attack held in the abnormality detection pattern holding unit 29A. Perform processing to identify the type of attack to be performed. After performing the attack identifying process, the attack identifying unit 30A instructs the abnormal data holding unit 27A to reset (clear) the abnormal data (detection data). The attack identifying unit 30A executes the same processing operation as the processing operation (the processing of identifying by collating) performed by the attack identifying unit 30 illustrated in FIG.
  • the attack estimation pattern holding unit 31A holds an attack estimation pattern for each type of attack in advance.
  • the attack estimation pattern for each type of attack is configured to include combination data of weighting values for each of the plurality of abnormality detection items.
  • FIG. 18 is a diagram for explaining an example of the attack estimation pattern for each type of attack, which is held in the attack estimated pattern holding unit 31A. Similar to the attack estimation pattern 31a shown in FIG. 6, the data indicating the attack estimation pattern 31b for each type of attack is configured to include an attack type item, a plurality of abnormality detection items, and a first total value item. ing.
  • the types of attacks that can be assumed in the in-vehicle network 2 (attacks A31 to A35,...) are set in the attack type item.
  • the plurality of abnormality detection items include parameters of frame abnormalities F1 to F4, bus abnormalities B1 to B4, and internal processing abnormalities C1 to C4, like the abnormality detection pattern 29b illustrated in FIG.
  • a weighting value (any one of 0.0 to 1.0) for each of a plurality of abnormality detection items (frame abnormality F1 to F4, bus abnormality B1 to B4, and internal processing abnormality C1 to C4) is set for each type of attack.
  • a pattern of combination data (also referred to as a weighted set) of values is set.
  • the first total value indicates the sum (also referred to as the sum of sets) of the combination data (weight set) of the weight values for each of the plurality of abnormality detection items in each attack.
  • the attack estimation unit 32A holds the abnormal data held in the abnormal data holding unit 27A and the attack estimated pattern holding unit 31A when the attack specifying unit 30A cannot specify the type of attack.
  • a process of estimating the type of attack corresponding to the detected abnormality is performed based on the attack estimation pattern 31b for each type of attack.
  • each abnormality detection item (frame abnormality F1) of abnormal data.
  • frame abnormality F1 the sum of products of data (1 or 0) regarding whether or not detection is performed and the weighting value set for each abnormality detection item of the attack estimation pattern 31b is calculated.
  • the second total value shown (also referred to as the sum of product sets) is calculated (that is, it functions as the first calculator).
  • the attack estimation unit 32A calculates the matching rate between the first total value and the second total value (for example, [second total value/first total value] ⁇ 100(%)) for each type of attack. (That is, functions as the second calculation unit).
  • the attack estimation unit 32A estimates the type of attack corresponding to the abnormality that could not be identified by the attack identification unit 30A based on the match rate for each attack calculated by the second calculation unit (that is, estimation). Functions as a department).
  • the estimation unit that constitutes the attack estimation unit 32A can estimate which existing attack type is similar to the existing attack type based on the match rate.
  • the incident handling unit 33 functions as a first incident handling unit that performs a handling process for the identified attack type when the attack identifying unit 30A identifies the type of attack corresponding to the abnormality. Further, the incident handling unit 33 functions as a second incident handling unit that performs handling processing for the estimated attack type when the attack estimating unit 32A estimates the attack type corresponding to the abnormality.
  • the attack identification data output to the incident response unit 33 includes, for example, the CH attacked by the gateway ECU 10A, the frame having the abnormality, and the abnormality. Includes data about internal actions that were taken and the identified attacks.
  • the incident handling unit 33 executes a predetermined countermeasure process for the identified type of attack based on the attack identifying data acquired from the attack identifying unit 30A.
  • the attack estimation data output to the incident response unit 33 includes, for example, the CH attacked by the gateway ECU 10A and the frame having the abnormality. , Internal processing with anomalies, and data on estimated attacks.
  • the incident handling unit 33 executes a predetermined countermeasure process for the estimated attack type based on the attack estimation data acquired from the attack estimating unit 32A. For example, the countermeasure process for the type of attack having the highest matching rate is executed.
  • the processing operation performed by the security control unit 12A included in the gateway ECU 10A according to the embodiment (2) is basically performed by the security control unit 12 included in the gateway ECU 10 according to the embodiment (1). Since the operation is the same as that of the operation, the description of the same processing will be omitted.
  • the main difference from the embodiment (1) is that in the gateway ECU 10A according to the embodiment (2), in addition to the frame abnormality and the bus abnormality, an internal processing abnormality is further detected, and a combination of these abnormalities is detected. On the basis of this, processing for identifying the type of attack is performed, and if the type of attack cannot be identified, processing for estimating the type of attack is performed.
  • step S1 the security control unit 12A determines whether or not an abnormality has occurred in the in-vehicle network 2 due to a security attack. If it is determined that the abnormality has not occurred, the processing is terminated while it is determined that an abnormality has occurred. If so, the process proceeds to step S2.
  • step S2 the security control unit 12A performs a process of detecting an abnormality that has occurred in the frame received from each ECU group, the bus 3 connected to each CH, or the internal process of the gateway ECU 10A, and then the process proceeds to step S3. Proceed.
  • step S3 the security control unit 12A performs a process of collecting the data of the abnormality that has occurred in the received frame, the bus 3, or the internal processing of the gateway ECU 10A (that is, the detection result of the abnormality), and then performs the processing in step S4. Proceed.
  • step S4 the security control unit 12A performs a process of identifying the type of security attack using the collected abnormal data, and a process of estimating the type of attack when the type of attack cannot be identified. Then, the process proceeds to step S5. In step S5, the security control unit 12A performs a process of implementing an incident countermeasure corresponding to the identified type of attack or the estimated type of attack, and then ends the process.
  • the frame abnormality and bus abnormality detection processing operation performed by the security control unit 12A is substantially the same as the content described based on the flowchart shown in FIG. 13, and thus the description thereof is omitted here.
  • the internal processing abnormality detection processing operation performed by the security control unit 12A will be described based on the flowchart shown in FIG. This processing operation is executed during the operation of the gateway ECU 10A.
  • step S51 the security control unit 12A performs a process of monitoring the state of the internal control process when each function of the gateway function unit 11 (for example, a frame receiving function, a transfer function, a transmitting function, etc.) is being executed. Then, the process proceeds to step S52.
  • the gateway function unit 11 for example, a frame receiving function, a transfer function, a transmitting function, etc.
  • step S52 the security control unit 12A sets the state of the monitored internal processing to at least one of the control processing time of each function, the function execution count, the function execution processing order, and the hardware resource. Based on this, it is determined whether or not an internal processing abnormality has been detected.
  • step S52 If it is determined in step S52 that the security control unit 12A has not detected an internal process abnormality, the abnormality detection process at the time of executing the function of the gateway function unit 11 is terminated, while if it is determined that an abnormality is detected, the process proceeds to step S53. Proceed with processing.
  • step S53 the security control unit 12A is currently in a state of collecting abnormal data due to a security attack (abnormal collection state) (in other words, whether the abnormal data collection unit 26 is operating or not). ), and if it is determined that abnormal data is currently being collected, the process proceeds to step S55. On the other hand, if it is determined in step S53 that the security control unit 12A is not currently collecting the abnormal data, the process proceeds to step S54, and in step S54, the security attacking abnormal state is collected. A process of transitioning (in other words, the abnormal data collecting unit 26A starts collecting abnormal data) is performed, and then the process proceeds to step S55.
  • a security attack abnormal collection state
  • step S55 the security control unit 12A determines whether or not the internal processing abnormality detected in step S52 is an abnormality already detected after transition to the abnormality collection state, and the abnormality is already detected. If judged, the abnormality detection process of the internal process at the time of executing the function of the gateway function unit 11 is completed.
  • step S55 if it is determined in step S55 that the internal processing abnormality has not been detected (in other words, it is an undetected abnormality), the security control unit 12A advances the processing to step S56, and in step S56, it is detected.
  • the abnormal data of the internal processing is stored in the abnormal data holding unit 27A, and then the abnormality detection processing of the internal processing when the function of the gateway function unit 11 is executed is completed.
  • the attack identifying processing operation performed by the security control unit 12A configuring the gateway ECU 10A according to the embodiment (2) is substantially the same as the content described based on the flowchart shown in FIG. 15 except the following differences. Therefore, the description thereof will be omitted.
  • One of the differences is that the abnormality detection pattern 29b including the internal processing abnormality as illustrated in FIG. 17 is read from the abnormality detection pattern holding unit 29A and a process of identifying the type of attack is performed.
  • the attack estimation pattern holding unit 31A includes an attack including an internal processing abnormality as illustrated in FIG. The point is that the estimated pattern 31b is read and the type of attack is estimated.
  • gateway ECU 10A of the second embodiment it is possible to obtain the same effects as those of gateway ECU 10 of the first embodiment. Furthermore, since the security control unit 12A can detect an internal processing abnormality in addition to the frame abnormality and the bus abnormality, the type of attack is identified or the type of attack is estimated based on these internal processing abnormalities. It is possible to identify and estimate a wider variety of attacks.
  • the security control units 12 and 12A mounted on the gateway ECUs 10 and 10A may be mounted on other ECUs, or the security ECUs equipped with the security control units 12 and 12A may be connected to the in-vehicle network 2. Good.
  • the security control units 12 and 12A may further include an abnormality log accumulation unit that accumulates abnormality data collected by the abnormality data collection units 26 and 26A as an abnormality log. .. According to such a configuration, since the abnormal data is accumulated in the abnormal log accumulating unit as an abnormal log, it is possible to perform the post analysis using the abnormal log accumulated in the abnormal log accumulating unit.
  • the security control units 12 and 12A notify the passengers in the vehicle of an abnormality through the notification device included in the information system ECU group 7 connected to the vehicle-mounted network 2. You may further provide a part.
  • a navigation device, an audio device, or the like may be applied to the notification device that functions as the notification unit.
  • the notification processing unit can notify the occupant in the vehicle of the abnormality via the notification device, and thus the occupant can appropriately respond to the abnormality. ..
  • the security control units 12 and 12A report an abnormality to the outside of the vehicle via a telematics device included in the information system ECU group 7 connected to the vehicle-mounted network 2 or an ITS-related device. You may further provide the notification process part which does.
  • the notification processing unit can notify the abnormality to the outside of the vehicle through the telematics device functioning as the external notification unit or the ITS-related device. It is possible to notify a dealer, a maker, or a public institution that an abnormality has occurred, and it is possible to appropriately deal with the abnormality from outside the vehicle.
  • the vehicle-mounted network 2 is an example of a device network to which the technology according to the present invention is applied.
  • the technology according to the present invention is applied to other device networks, for example, an industrial device network in which one or more industrial devices configuring an FA (Factory Automation) system are connected via a communication path, and household devices including home appliances. It is also applicable to a security device included in a connected home device network, an office device network to which office devices are connected, or the like.
  • 1 to 19 can be applied to the industrial device network, the home device network, or the office device network. In that case, various improvements and modifications can be made without departing from the scope of the present invention so as to be compatible with each device network, and a specific configuration according to the embodiment can be appropriately adopted.
  • the FA system includes, for example, a transportation system for various items, an inspection system, an assembly system using a robot, and the like.
  • the control devices mounted on the industrial devices that configure these FA systems include, for example, programmable controllers (hereinafter referred to as PLCs), motion position control controllers, field network devices, wireless devices, sensors, actuators, robots, HMI devices. , And at least one of a data collection device.
  • PLCs programmable controllers
  • the communication path connecting various control devices in the FA system may be wired or wireless.
  • the communication protocol in the device network is not limited to the CAN protocol, and a communication protocol suitable for the device network can be adopted.
  • FIG. 20 is a schematic block diagram showing an example in which the security device according to the modified example is applied to an FA system.
  • the FA system 100 includes a security device 110, one or more PLCs 104 connected to the security device 110, an input device 105 and an output device 106 connected to the PLC 104, and these are connected via a bus 103.
  • the industrial equipment network 101 is constructed.
  • the industrial equipment network 101 is a communication network that constitutes the FA system 100, and is a network that communicates according to a predetermined communication protocol such as CAN.
  • the PLC 104 is an example of a control device that constitutes the FA system 100.
  • a SCADA (Supervisory Control And Data Acquisition) 107 and a PC (Personal Computer) 108 are connected to the security device 110.
  • the security device 110 may have the same hardware configuration and functional configuration as the security control unit 12 of the gateway ECU 10 according to the embodiment (1), or the security control unit of the gateway ECU 10A according to the embodiment (2).
  • the hardware configuration and the functional configuration similar to 12A may be provided.
  • the attack type items (see FIGS. 3, 6, 17, and 18) held in the abnormality detection pattern holding units 29 and 29A and the attack estimation pattern holding units 31 and 31A include industrial equipment.
  • the types of attacks that can be assumed in the network 101 are set, and the abnormality detection pattern and attack estimation pattern for each of these types of attacks are set.
  • the PLC 104 includes, for example, a control unit including a processor that executes a predetermined program, an input/output unit to which the input device 105 and the output device 106 are connected, and a communication unit to which the security device 110 and the like are connected. Has been done.
  • the input device 105 includes, for example, devices such as various sensors or switches.
  • the output device 106 includes control target devices such as various actuators, robots, relays, and valves.
  • the input device 105 and the output device 106 may be directly connected to the PLC 104 or may be connected via a field network.
  • the PLC 104 receives data from the input device 105, executes arithmetic processing according to a predetermined program, and outputs an operation signal such as on/off to the output device 106 based on the obtained arithmetic result.
  • the SCADA 107 is a computer device that monitors the operating state of the FA system 100 and executes process control and the like.
  • the PC 108 is a general-purpose computer device, and by operating the PC 108, maintenance operations such as setting of various devices included in the FA system 100 can be performed.
  • the security device 110 has the same configuration as the gateway ECU 10 according to the embodiment (1) or the gateway ECU 10A according to the embodiment (2), the same effect as the gateway ECU 10 or the gateway ECU 10A can be obtained. It can be obtained with the FA system 100.
  • the security device 110 when an attack is performed on the industrial equipment network 101 that constitutes the FA system 100, the attack is performed in the FA system 100, that is, in the security device 110 by a process with a reduced load. It is determined that incident response processing is performed according to the determined attack. As a result, prompt incident response can be performed, and the operator of the FA system 100 can operate the FA system with more peace of mind without worrying about security threats.
  • FIG. 21 is a schematic block diagram showing an FA system according to another modification.
  • components having the same functions as those of the FA system 100 shown in FIG. 20 are designated by the same reference numerals, and the description thereof will be omitted.
  • the security device 110 is equipped as a device different from the PLC 104, and the security device 110 is connected to the PLC 104.
  • the PLC 104A is equipped with a security processing unit 1041 that functions as a security device according to the present invention.
  • the security processing unit 1041 is composed of, for example, a software module that realizes a security function, and may be equipped with the function of each unit that forms the security control unit 12 of the gateway ECU 10 according to the embodiment (1).
  • the function of each unit forming the security control unit 12A of the gateway ECU 10A according to the form (2) may be provided.
  • the security processing unit 1041 may be installed in each of the PLCs 104A included in the FA system 100A, or the security processing unit 1041 may be provided in any one or more of the PLCs 104A included in the FA system 100A. May be equipped.
  • the PLC 104A equipped with the security processing unit 1041, it is possible to obtain the same effect as the gateway ECU 10 or the gateway ECU 10A in the FA system 100A.
  • the security processing unit 1041 when an attack is performed on the industrial equipment network 101 that constitutes the FA system 100A, the processing in which the load is reduced in the FA system 100A, that is, in the PLC 104A. Then, the attack is determined, and the incident response processing is executed according to the determined attack. As a result, prompt incident response becomes possible, and the operator of the FA system 100A can operate the FA system with more peace of mind without fear of security threats.
  • the present invention specifies or estimates the type of attack that has occurred in a device network in which one or more devices such as in-vehicle devices or industrial devices are connected via a communication path, and responds to the specified or estimated type of attack. It can be widely used in the industrial field related to security devices that execute processing.
  • a program for executing an attack identification step (S4) for identifying the type of attack A program characterized in that the abnormality detection pattern for each type of attack includes combination data indicating whether or not detection is required for each of a plurality of abnormality detection items.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mechanical Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'objectif de la présente invention est de fournir un appareil de sécurité capable d'identifier une attaque au moyen d'un traitement à charge réduite pour un cas où un réseau de dispositifs a été soumis à une attaque de sécurité, l'appareil de sécurité inclus dans le réseau de dispositifs étant fourni : une unité de détection d'anomalie qui détecte une anomalie générée par une attaque sur le réseau de dispositifs; une unité de collecte de données d'anomalie qui collecte des données sur l'anomalie détectée; une unité de conservation de données d'anomalie qui conserve les données d'anomalie collectées; une unité de conservation des modèles de détection d'anomalies qui conserve un modèle de détection d'anomalies pour chaque attaque, le modèle de détection d'anomalies étant configuré de manière à inclure des données combinées nécessitant ou non une détection pour chacun d'une pluralité d'éléments de détection d'anomalies; et une unité d'identification d'attaques qui identifie, sur la base des données d'anomalies et du modèle de détection d'anomalies, le type d'attaque correspondant à l'anomalie.
PCT/JP2019/045105 2019-01-29 2019-11-18 Appareil de sécurité, procédé d'identification des attaques, programme et support de stockage WO2020158118A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
JP2019-012956 2019-01-29
JP2019012956 2019-01-29
JP2019-136882 2019-07-25
JP2019136882A JP2020123307A (ja) 2019-01-29 2019-07-25 セキュリティ装置、攻撃特定方法、及びプログラム

Publications (1)

Publication Number Publication Date
WO2020158118A1 true WO2020158118A1 (fr) 2020-08-06

Family

ID=71842027

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/045105 WO2020158118A1 (fr) 2019-01-29 2019-11-18 Appareil de sécurité, procédé d'identification des attaques, programme et support de stockage

Country Status (1)

Country Link
WO (1) WO2020158118A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2013168763A (ja) * 2012-02-15 2013-08-29 Hitachi Ltd セキュリティ監視システムおよびセキュリティ監視方法
WO2018100783A1 (fr) * 2016-12-01 2018-06-07 住友電気工業株式会社 Détecteur, procédé de détection et programme de détection
WO2018186054A1 (fr) * 2017-04-07 2018-10-11 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Procédé de détermination d'une référence destiné à une détection de communication non autorisée, système de détermination d'une référence destiné à une détection de communication non autorisée, et programme associé
JP2019008618A (ja) * 2017-06-26 2019-01-17 パナソニックＩｐマネジメント株式会社 情報処理装置、情報処理方法及びプログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2013168763A (ja) * 2012-02-15 2013-08-29 Hitachi Ltd セキュリティ監視システムおよびセキュリティ監視方法
WO2018100783A1 (fr) * 2016-12-01 2018-06-07 住友電気工業株式会社 Détecteur, procédé de détection et programme de détection
WO2018186054A1 (fr) * 2017-04-07 2018-10-11 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Procédé de détermination d'une référence destiné à une détection de communication non autorisée, système de détermination d'une référence destiné à une détection de communication non autorisée, et programme associé
JP2019008618A (ja) * 2017-06-26 2019-01-17 パナソニックＩｐマネジメント株式会社 情報処理装置、情報処理方法及びプログラム

Similar Documents

Publication Publication Date Title
JP2020123307A (ja) セキュリティ装置、攻撃特定方法、及びプログラム
EP3744583B1 (fr) Dispositif et programme d'analyse de données
WO2020075800A1 (fr) Dispositif d'analyse, système d'analyse, procédé d'analyse et programme
CN106462702B (zh) 用于在分布式计算机基础设施中获取并且分析电子取证数据的方法和系统
US20210385244A1 (en) Electronic control device, fraud detection server, in-vehicle network system, in-vehicle network monitoring system, and in-vehicle network monitoring method
US10178094B2 (en) Communication system and information collection method executed in communication system
CN112639909B (zh) 设备、数据发送方法及记录介质
CN111431864A (zh) 车联网监控系统、方法、装置及可读存储介质
EP3744582B1 (fr) Dispositif et programme d'analyse de données
CN106919163B (zh) 通信系统和在通信系统中执行的信息收集方法
JP7149888B2 (ja) 情報処理装置、情報処理方法及びプログラム
KR101585342B1 (ko) 이상행위 탐지 장치 및 방법
WO2020075809A1 (fr) Dispositif de traitement d'informations, procédé d'analyse de données et programme
CN113364746A (zh) 设备识别方法、装置、设备及计算机存储介质
JP7346688B2 (ja) 情報処理装置、情報処理方法及びプログラム
CN106973034A (zh) 用于传输对象的数据的系统和方法
WO2020158118A1 (fr) Appareil de sécurité, procédé d'identification des attaques, programme et support de stockage
JP2014031077A (ja) 車両動作検証システム
JP7318710B2 (ja) セキュリティ装置、インシデント対応処理方法、プログラム、及び記憶媒体
CN110466450A (zh) 汽车安全检测系统
JP7259966B2 (ja) セキュリティ装置、設定変更方法、プログラム、及び記憶媒体
JP7160206B2 (ja) セキュリティ装置、攻撃対応処理方法、コンピュータプログラム、及び記憶媒体
US20230319085A1 (en) Attack path generation method and attack path generation device
Biswas Machine Learning Based Intrusion Detection in Controller Area Network
CN115858508A (zh) 车辆数据处理方法、装置及车辆

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19914013

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19914013

Country of ref document: EP

Kind code of ref document: A1