WO2022176131A1

WO2022176131A1 - Communication monitoring device, communication monitoring method, and program

Info

Publication number: WO2022176131A1
Application number: PCT/JP2021/006205
Authority: WO
Inventors: 勝松林; 卓麻小山; 靖岡野; 政志田中
Original assignee: 日本電信電話株式会社
Priority date: 2021-02-18
Filing date: 2021-02-18
Publication date: 2022-08-25
Also published as: JPWO2022176131A1

Abstract

The present invention is a communication monitoring device comprising: a communication source state update unit that monitors communication from a communication source to a communication destination, and that updates information indicating the state of the communication source, including the number of requests to the communication destination relating to lock release; a surveillance detection unit that, on the basis of the information indicating the state of the communication source, detects surveillance by the communication source of a lock release state with respect to the communication destination; and an attack detection unit that detects an attack on the communication destination from the communication source in which the surveillance was detected.

Description

COMMUNICATION MONITORING DEVICE, COMMUNICATION MONITORING METHOD AND PROGRAM

The present invention relates to a communication monitoring device, a communication monitoring method and a program.

Technology has been developed to detect abnormal communications using UDS (Unified Diagnostic Services), which is used for fault diagnosis and reprogramming of ECUs (Electronic Control Units) installed in automobiles.

For example, Non-Patent Document 1 discloses a method of detecting anomalies by learning a language model of normal diagnostic communication using natural language processing.

In cyberattacks, as the first stage of an attack, it is common to reconnoiter whether an attack is possible against the attack target by sending a certain request to the attack target and getting a response from the attack target. Therefore, by detecting such reconnaissance behavior, there is a demand to take measures such as notifying the occurrence of an abnormality and blocking communication from the communication source that performed the reconnaissance behavior. However, even in normal diagnostic communication, the diagnostic machine may transmit a request similar to such reconnaissance action and receive a response from the target device to perform diagnosis. is mistakenly determined as a reconnaissance act.

The disclosed technology aims to provide a device that performs highly accurate anomaly detection by reducing the probability of erroneous detection of normal diagnostic communication.

The disclosed technology includes a communication source state update unit that monitors communication from a communication source to a communication destination and updates information indicating the state of the communication source including the number of requests for unlocking to the communication destination; A reconnaissance detection unit that detects reconnaissance of the unlocked state of the communication destination by the communication source based on information indicating the state of the communication source; and an attack detection unit that detects an attack.

It is possible to provide a device that performs highly accurate anomaly detection by suppressing the probability of erroneous detection of normal diagnostic communication.

FIG. 4 is a diagram for explaining an example of a communication method involving unlocking; FIG. FIG. 11 is a sequence diagram illustrating an example of a SecurityAccess evasion attack; 3 is a functional configuration diagram of a communication monitoring device; FIG. FIG. 4 is a diagram showing an example of communication source state information; It is a figure which shows an example of attack determination rule information. 9 is a flowchart showing an example of the flow of communication monitoring processing; FIG. 11 is a flowchart showing an example of the flow of communication source status update processing; FIG. 9 is a flowchart showing an example of reconnaissance detection processing flow; It is a flowchart which shows an example of the flow of reconnaissance completion detection processing. 6 is a flowchart showing an example of the flow of attack detection processing; FIG. 4 is a first diagram for explaining normal diagnostic communication; FIG. 10 is a second diagram for explaining normal diagnostic communication; FIG. 11 is a third diagram for explaining normal diagnostic communication; It is a figure which shows the hardware structural example of a communication monitoring apparatus. 1 is a diagram illustrating an example hardware configuration of an automobile according to Embodiment 1; FIG. FIG. 10 is a diagram showing an outline of a communication monitoring system according to a second embodiment; FIG. FIG. 11 is a functional configuration diagram of a communication monitoring device according to the third embodiment; FIG. 12 is a diagram showing an outline of a communication monitoring system according to a fourth embodiment; FIG.

An embodiment (this embodiment) of the present invention will be described below with reference to the drawings. The embodiments described below are merely examples, and embodiments to which the present invention is applied are not limited to the following embodiments.

(Regarding the prerequisite communication method)
First, the communication method that is the premise of this embodiment will be described. Ethernet (registered trademark), CAN (Controller Area Network), etc. are known as typical communication protocols used for in-vehicle communication of automobiles. For example, an automobile or the like that performs CAN communication includes a plurality of electronic control units (ECUs). Each ECU communicates with each other by broadcasting message data using CAN. Also, message data transmitted and received in CAN contains a payload indicating the data body and an ID (called CAN-ID) used to identify the contents of the payload. Note that the CAN message data does not include information about the source and destination addresses.

In addition, UDS (Unified Diagnostic Services) is known as a protocol for performing fault diagnosis and reprogramming of ECUs using the above-mentioned Ethernet and CAN. UDS is a protocol that defines layer 7 of the OSI (Open Systems Interconnection) reference model. The UDS defines a communication method, a message format, a diagnostic service method (such as a service for rewriting a memory), and the like when the diagnostic machine performs fault diagnosis, reprogramming, and the like of an ECU.

In addition, UDS defines an access control mechanism to ensure that only authorized users can use the service. Specifically, with UDS, when using a service that could cause serious damage if misused by an unauthorized user (e.g., a service that reprograms the ECU), it is necessary to use the "Security Access Service" for the ECU. Unlocking is required. "Security Access Service" is an access control mechanism defined in UDS to prevent unauthorized users from misusing UDS services. Diagnostic communication by "SecurityAccessService" is an example of a communication method involving unlocking.

FIG. 1 is a diagram for explaining an example of a communication method involving unlocking. A communication source (for example, a diagnostic device) requests "Seed" necessary for unlocking (requestSeed). SID=0x27 is an identifier for identifying "SecurityAccessService".

Next, the communication destination (e.g. ECU) sends "Seed" to the communication source. Then, the communication source calculates a key from the received "Seed" and transmits it to the communication destination (sendKey). This sendKey is an example of communication requesting unlocking. The communication destination unlocks and transmits an unlock notification to the communication source (positive response).

For the unlocking method described above, reconnaissance of the unlocked state using "requestSeed" and SecurityAccess evasion attack using reconnaissance results can be realized. In particular, depending on the implementation method, when the communication destination unlocks, not only the communication source that requested unlocking, but all locks will be unlocked.

In particular, in the case of communication to the ECU using CAN, it is difficult to identify and manage the source of unlock request due to the specifications of the CAN protocol. Therefore, if an attacking device (hereinafter referred to as an attacking device) can identify an ECU that has been unlocked by a request from another device without requesting unlocking, it can use the UDS service. can be done.

In normal operation, the ECU is unlocked for a short period of time, so if the attacking equipment makes a UDS service request to any ECU without performing unlocked reconnaissance, that ECU will be locked. It is extremely likely that Therefore, it is extremely likely that the attacking device will receive a "negative response" to the service request, which means refusal.

By the way, a "negative response" corresponds to a system error or alert, and is a trace of an attack that is easily discovered by security administrators and systems. Therefore, it is assumed that the attacking device identifies an already unlocked ECU by a method that does not generate a "negative response" in order to execute a SecurityAccess evasion attack.

Next, I will explain the method in detail. As a premise, the UDS is defined as follows. That is, the unlocked ECU transmits "Seed" with all byte values of 0x00 in response to "requestSeed". Also, when the ECU receives an incorrect "Key" in "sendKey", it sends a "negative response". Furthermore, even if the communication source repeatedly performs only the act of acquiring "Seed" without receiving "sendKey", the ECU does not transmit "negative response".

Based on the above specifications, the attacking device can execute the following SecurityAccess evasion attack. That is, the attacking device transmits "requestSeed" to any ECU at any timing and acquires "Seed". Then, the attacking device determines whether or not all the byte values of the obtained "Seed" are 0x00, and if it determines that all the byte values are 0x00, it determines that the ECU is in the unlocked state, perform access.

FIG. 2 is a sequence diagram showing an example of a SecurityAccess evasion attack. A communication source, which is an attacking device, transmits "requestSeed" to the first communication destination, the second communication destination, etc., and acquires "Seed". Then, the communication source determines whether or not all the byte values of the obtained "Seed" are 0x00, and if it determines that all the byte values are not 0x00, does nothing and further performs the first communication destination, the second communication destination, etc. , and determines whether or not all byte values of the obtained "Seed" are 0x00. When the source determines that all bytes of "Seed" are 0x00, it completes reconnaissance and performs unauthorized access.

(Communication monitoring device according to this embodiment)
Next, a communication monitoring apparatus according to the present embodiment will be described assuming detection of the SecurityAccess evasion attack described above.

FIG. 3 is a functional configuration diagram of the communication monitoring device. The communication monitoring device 10 includes a storage unit 11 , a communication source state update unit 12 , a reconnaissance detection unit 13 , a reconnaissance completion detection unit 14 , an attack detection unit 15 , and a communication blocking unit 16 .

The storage unit 11 stores various types of information, specifically, source state information 901 and attack determination rule information 902 .

The communication source status information 901 is information indicating the status of the communication source, including the number of requests for unlocking to the communication destination. The attack determination rule information 902 is information that defines rules for determining whether or not target communication is an attack.

The communication source status update unit 12 monitors communication from the communication source to the communication destination and updates the communication source status information 901 .

Based on the communication source status information 901, the reconnaissance detection unit 13 detects reconnaissance by the communication source that the communication destination is unlocked.

The reconnaissance completion detection unit 14 detects that the reconnaissance of the unlocked state from the communication source whose reconnaissance has been detected to the communication destination has been completed.

Based on the attack determination rule information 902, the attack detection unit 15 detects whether or not there is an attack on the communication destination from the communication source whose reconnaissance has been detected.

The communication blocking unit 16 blocks communication from the source of the detected attack to the destination of communication.

Next, the information handled by the communication monitoring device 10 will be explained. FIG. 4 is a diagram showing an example of communication source state information.

The communication source state information 901 includes, as items, a communication source address, a difference, a state, and a communication destination address.

The value of the item "communication source address" is a value for identifying the communication source, and is, for example, a MAC (Media Access Control) address, IP (Internet Protocol) address, or the like. If the communication source address is unknown, the value of the item "communication source address" is set to "unknown". Therefore, in the processing to be described later, the state information about the communication source whose communication source address is unknown can be obtained by referring to the record in which the value of the item "communication source address" is "unknown". For example, when the communication protocol is Ethernet, the communication monitoring device 10 can extract the communication source address from the communication data. On the other hand, when the communication protocol is CAN, it is difficult for the communication monitoring device 10 to extract the communication source address from the communication data.

The value of the item "difference" is the "requestSeed" from the same communication source to each communication destination.
is the difference between the number of transmissions of "" and the number of transmissions of "sendKey". The greater the difference value, the greater the number of transmissions of "requestSeed" than the number of transmissions of "sendKey". This indicates that there is a high possibility that the communication source is performing the aforementioned SecurityAccess avoidance attack. The number of transmissions of “requestSeed” is an example of the number of times of requesting data for unlocking to the communication destination. Also, the number of transmissions of "sendKey" is an example of the number of times of requesting unlocking based on data for unlocking to the communication destination.

The value of the item "Status" is a value that indicates the status of each communication source, and is one of "Normal", "Reconnaissance in progress", "Reconnaissance completed", or "Blocked".

The value of the item "communication destination address" is a value for identifying the communication destination, and is, for example, a MAC address, IP address, CAN-ID, or the like.

As described above, the communication source state information 901 is information including "difference" and "state" for each combination of communication source and communication destination.

Note that the communication monitoring device 10 may initialize the communication source status information 901 periodically. For example, if neither the "difference" nor the "status" value changes for a predetermined time, the record is deleted (or the "difference" value is "0", the status value is "normal", and the communication destination change each address value to empty).

FIG. 5 is a diagram showing an example of attack determination rule information. The attack determination rule information 902 includes communication destination addresses and determination rules as items.

The value of the item "communication destination address" is a value for identifying the communication destination, such as a MAC address or IP address.

The value of the item "judgment rule" is a value that indicates the rule for judging an attack. For example, all messages addressed to the communication destination address are judged as an attack, all messages with no destination specified are judged as an attack, messages with an arbitrary value in the payload are judged as an attack, etc. , the item "judgment rule" defines a rule for judging an attack.

Next, the operation of the communication monitoring device 10 according to this embodiment will be described. FIG. 6 is a flowchart showing an example of the flow of communication monitoring processing.

The communication monitoring device 10 executes communication monitoring processing in response to a user's operation or periodically. Specifically, the communication source status update unit 12 of the communication monitoring device 10 executes communication source status update processing for updating the communication source status information 901 (step S1). Next, the reconnaissance detection unit 13 executes reconnaissance detection processing for detecting reconnaissance by each communication source (step S2).

Subsequently, the reconnaissance completion detection unit 14 executes reconnaissance completion detection processing for detecting that reconnaissance by the communication source whose reconnaissance has been detected has been completed (step S3). Then, the attack detection unit 15 executes attack detection processing for detecting an attack by the communication source whose reconnaissance has been completed (step S4).

Next, the communication blocking unit 16 blocks the attack-detected communication (step S5). Then, the communication blocking unit 16 updates the value of the item "state" of the communication source state information 901 related to the blocked communication to "blocked" (step S6).

Next, the details of each process from step S1 to step S4 will be described. FIG. 7 is a flowchart illustrating an example of the flow of communication source status update processing. The communication source status update unit 12 determines whether or not the application layer protocol of the communication to be monitored is UDS (step S11). Then, when the communication source state update unit 12 determines that the protocol is not UDS (step S11: No), the communication source state update process ends.

When the communication source status update unit 12 determines that the protocol is UDS (step S11: Yes), it determines whether or not SID=0x27 specified in the communication (step S12). When the communication source state update unit 12 determines that SID is not 0x27 (step S12: No), the communication source state update process ends.

When the communication source state update unit 12 determines that SID=0x27 (step S12: Yes), it determines whether sub-function=requestSeed (step S13). Then, when determining that sub-function=requestSeed (step S13: Yes), the communication source state update unit 12 adds 1 to the value of the item "difference" of the communication source state information 901 (step S15).

Also, when the communication source state updating unit 12 determines that sub-function=requestSeed is not true (step S13: No), it further determines whether sub-function=sendKey (step S14). If the communication source state update unit 12 determines that sub-function=sendKey is not true (step S14: No), it ends the communication source state update process.

When the communication source state update unit 12 determines that sub-function=sendKey (step S14: Yes), it subtracts 1 from the value of the item "difference" of the communication source state information 901 (step S16).

In this way, the communication source state update unit 12 adds 1 to the value of the item "difference" if the communication to be monitored is "requestSeed", and if the communication to be monitored is "sendKey", the value of the item "difference" is , subtract 1 from the value of

FIG. 8 is a flowchart showing an example of the flow of reconnaissance detection processing. The reconnaissance detection unit 13 determines whether or not the value of the item "difference" of the communication source state information 901 exceeds a preset threshold (step S21). Note that the threshold value may be set by the user as an arbitrary value of 2 or more, for example.

When the reconnaissance detection unit 13 determines that the value of the item "difference" exceeds the threshold (step S21: Yes), it updates the value of the item "state" of the communication source state information 901 to "reconnaissance in progress" (step S22). . Further, when the reconnaissance detection unit 13 determines that the value of the item "difference" does not exceed the threshold (step S21: No), it updates the value of the item "state" of the communication source state information 901 to "normal" ( step S23).

FIG. 9 is a flowchart showing an example of the flow of reconnaissance completion detection processing. The reconnaissance completion detection unit 14 determines whether or not the application layer protocol of the communication to be monitored is UDS (step S31). When the reconnaissance completion detection unit 14 determines that the protocol is not UDS (step S31: No), the reconnaissance completion detection process ends.

When the reconnaissance completion detection unit 14 determines that the protocol is UDS (step S31: Yes), it determines whether SID=0x67 specified in the communication (step S32). When the reconnaissance completion detection unit 14 determines that SID is not 0x67 (step S32: No), the reconnaissance completion detection process ends.

When the reconnaissance completion detection unit 14 determines that SID=0x67 (step S32: Yes), it determines whether sub-function=requestSeed (step S33). When the reconnaissance completion detection unit 14 determines that sub-function=requestSeed is not true (step S33: No), the reconnaissance completion detection process ends.

When the reconnaissance completion detection unit 14 determines that sub-function=requestSeed (step S33: Yes), it determines whether all byte values of "Seed" are "0x00" (step S34). When the reconnaissance completion detection unit 14 determines that any byte value of "Seed" is not "0x00" (step S34: No), the reconnaissance completion detection process ends.

When the reconnaissance completion detection unit 14 determines that all byte values of "Seed" are "0x00" (step S34: Yes), it determines whether the value of the item "state" of the communication source state information 901 is "reconnaissance in progress". It is determined whether or not (step S35). When the reconnaissance completion detection unit 14 determines that the value of the item "state" is not "reconnaissance in progress" (step S35: No), the reconnaissance completion detection process ends.

When the reconnaissance completion detecting unit 14 determines that the value of the item "status" is "reconnaissance in progress" (step S35: Yes), the value of the item "status" of the communication source status information 901 is set to "reconnaissance completed", and the item The value of "communication destination address" is updated to the detected communication destination address (step S36).

FIG. 10 is a flowchart showing an example of the flow of attack detection processing. The attack detection unit 15 determines whether or not the application layer protocol of the communication to be monitored is UDS (step S41). When the attack detection unit 15 determines that the protocol is not UDS (step S41: No), the attack detection process ends.

When the attack detection unit 15 determines that the protocol is UDS (step S41: Yes), the attack detection unit 15 determines whether the value of the item "state" of the communication source state information 901 is "reconnaissance completed" or "blocked". (Step S42). When the attack detection unit 15 determines that the value of the item "state" of the communication source state information 901 is neither "reconnaissance completed" nor "blocked" (step S42: No), it ends the attack detection process.

When the attack detection unit 15 determines that the value of the item "state" is "reconnaissance completed" or "blocked" (step S42: Yes), it determines whether the determination rule defined in the attack determination rule information 902 is satisfied. Determine (step S43). When the attack detection unit 15 determines that the determination rule is not satisfied (step S43: No), it ends the attack detection process.

When the attack detection unit 15 determines that the determination rule is satisfied (step S43: Yes), it determines that the target communication is an attack (step S44).

(Operation of communication monitoring device 10 according to the present embodiment for normal diagnostic communication)
Next, the operation of the communication monitoring device 10 according to the present embodiment for normal diagnostic communication will be described.

FIG. 11 is a first diagram for explaining normal diagnostic communication. The case in FIG. 11 occurs when the diagnostic device, which is the source of communication, fails to receive "Seed" for some reason after requesting "Seed", and re-requests "Seed". This is the case for diagnostic communication.

In this case, for example, when judging whether or not there is an abnormality by machine learning as in the conventional case, it is rare that the reception of "Seed" fails for some reason, so the probability of occurrence is low. and is considered to be detected as abnormal.

On the other hand, according to the communication monitoring apparatus 10 according to the present embodiment, the number of transmissions of "requestSeed" is set by appropriately setting the threshold without immediately judging that there is an abnormality with only one abnormal communication. and the number of transmissions of "sendKey" can be determined by the accumulated value. Therefore, the communication monitoring apparatus 10 according to the present embodiment can judge the case of FIG. 11 as normal communication. Further, even if the threshold value is set to 1 and the reconnaissance detection unit 13 detects reconnaissance, the communication monitoring device 10, depending on the result of determination by the reconnaissance completion detection unit 14 or the attack detection unit 15, The case of FIG. 11 can be judged as normal communication.

FIG. 12 is a second diagram for explaining normal diagnostic communication. The case of FIG. 12 is a case of normal diagnostic communication because it occurs when the diagnostic device, which is the source of communication, evaluates the ECU of each communication destination in, for example, security evaluation at the time of model certification of an automobile.

Even in this case, for example, when judging whether or not there is an abnormality by machine learning, as in the conventional case, it is rare to repeatedly send "requestSeed" to multiple communication destinations, so the probability of occurrence is low. It is considered that it is determined to be and is detected as an anomaly.

On the other hand, according to the communication monitoring device 10 according to the present embodiment, even if the reconnaissance detection unit 13 detects reconnaissance, depending on the result of determination by the reconnaissance completion detection unit 14 or the

attack detection unit

15, 12 cases can be judged as normal communication.

FIG. 13 is a third diagram for explaining normal diagnostic communication. The case of FIG. 13 is a case in which another diagnostic device, which is the second source of communication, accidentally sends "requestSeed" to the communication destination ECU unlocked by the diagnostic device, which is the first source of communication. This is the case for normal diagnostic communication.

Also in this case, for example, when judging whether or not there is an abnormality by machine learning as in the conventional art, the second communication source transmits "requestSeed", and as a response "Seed" whose all byte value is "0x00". Since reprogramming is executed after the is returned, it is considered that the probability of occurrence is low and an abnormality is detected.

On the other hand, according to the communication monitoring device 10 according to the present embodiment, since reconnaissance such as repeatedly executing "requestSeed" is not performed in the communication from the second communication source, 13 would not detect reconnaissance. Therefore, the communication monitoring device 10 can judge the case of FIG. 13 as normal communication.

(Hardware configuration example of communication monitoring device)
The communication monitoring device 10 can be implemented, for example, by causing a computer to execute a program describing the processing details described in this embodiment. Note that this "computer" may be a physical machine or a virtual machine on the cloud. When using a virtual machine, the "hardware" described here is virtual hardware.

The above program can be recorded on a computer-readable recording medium (portable memory, etc.), saved, or distributed. It is also possible to provide the above program through a network such as the Internet or e-mail.

FIG. 14 is a diagram showing a hardware configuration example of the computer. The computer of FIG. 14 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are connected to each other via a bus B.

A program that implements the processing in the computer is provided by a recording medium 1001 such as a CD-ROM or memory card, for example. When the recording medium 1001 storing the program is set in the drive device 1000 , the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000 . However, the program does not necessarily need to be installed from the recording medium 1001, and may be downloaded from another computer via the network. The auxiliary storage device 1002 stores installed programs, as well as necessary files and data.

The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when a program activation instruction is received. The CPU 1004 implements functions related to the device according to programs stored in the memory device 1003 . The interface device 1005 is used as an interface for connecting to the network. A display device 1006 displays a GUI (Graphical User Interface) or the like by a program. An input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used to input various operational instructions. The output device 1008 outputs the calculation result.

Next, Example 1, Example 2, Example 3, and Example 4 will be described as specific examples of the present embodiment.

(Example 1)
Embodiment 1 is an example in which the communication monitoring device 10 is installed on an in-vehicle network of an automobile.

FIG. 15 is a diagram showing a hardware configuration example of an automobile according to the first embodiment. The automobile 1 includes a communication monitoring device 10, an ECU 20, and an interface 30 for external communication. In this configuration, the communication monitoring device 10 can monitor communication via the external communication interface 30, identify the communication source and the communication destination ECU 20, and block communication detected as an attack. .

(Example 2)
Embodiment 2 is an example in which the communication device 40 provided in the vehicle 1 has a function of executing communication monitoring in a device different from the vehicle 1 (which may be implemented by a cloud server or the like) and blocking communication.

FIG. 16 is a diagram showing an overview of the communication monitoring system according to the second embodiment. A communication monitoring system includes a vehicle 1 and a communication monitoring device 10 . The vehicle 1 and the communication monitoring device 10 are communicably connected to each other by wireless communication or the like.

The automobile 1 includes an ECU 20, an external communication interface 30, and a communication device 40. The communication device 40 includes a communication section 41 and a communication blocking section 42 .

The communication monitoring device 10 includes a communication unit 17 instead of the communication blocking unit 16 of the communication monitoring device 10 shown in FIG.

The communication device 40 transmits data indicating the content of communication between the ECU 20 and the external device via the external communication interface 30 to the communication monitoring device 10 via the communication unit 41 . Based on the data received via the communication unit 17, the communication monitoring device 10 executes each process except for the communication blocking unit 16 according to the present embodiment described above. The communication monitoring device 10 then transmits information about the communication for which the attack was detected to the communication device 40 . The communication blocking unit 42 of the communication device 40 blocks the attack-detected communication based on the information received from the communication monitoring device 10 .

(Example 3)
A third embodiment is an example in which the detection result is transmitted to a predesignated destination instead of blocking communication. FIG. 17 is a functional configuration diagram of a communication monitoring apparatus according to the third embodiment; The communication monitoring device 10 according to the third embodiment includes a detection result transmitting unit 18 instead of the communication blocking unit 16 of the communication monitoring device 10 shown in FIG.

The detection result transmission unit 18 transmits information about communications in which an attack has been detected by e-mail, message, SNS, etc. to a pre-designated destination.

The hardware configuration of the automobile according to Example 3 is the same as in FIG. The detection result transmission unit 18 of the communication monitoring device 10 transmits the detection result to an external device via the external communication interface 30 . Moreover, the detection result transmitting unit 18 may display the detection result on a display device or the like provided in the automobile 1 .

(Example 4)
A fourth embodiment is an example in which communication is monitored by a device (which may be implemented by a cloud server or the like) different from the vehicle 1, and the device transmits the detection result.

FIG. 18 is a diagram showing an overview of the communication monitoring system according to the fourth embodiment. A communication monitoring system includes a vehicle 1 and a communication monitoring device 10 . The vehicle 1 and the communication monitoring device 10 are communicably connected to each other by wireless communication or the like.

The automobile 1 includes an ECU 20, an external communication interface 30, and a communication device 40. The communication device 40 includes a communication section 41 .

The communication monitoring device 10 has the same functional configuration as the communication monitoring device 10 shown in FIG. The detection result transmission unit 18 of the communication monitoring apparatus 10 according to the fourth embodiment transmits information on communications in which an attack has been detected by e-mail, message, SNS, etc., to a predetermined destination.

According to the communication monitoring device 10 according to the present embodiment, the communication from the communication source to the communication destination is monitored, and the communication source status information 901 including the number of requests for unlocking to the communication destination is updated. Based on the state information 901, the reconnaissance of the unlock state to the communication destination by the communication source is detected. As a result, it is possible to perform detection according to the state of the communication source, and it is possible to reduce the probability of erroneous detection of normal diagnostic communication. Also, by detecting an attack from a communication source whose reconnaissance has been detected to a communication destination, it is possible to block communication from the communication source to the communication destination, or to transmit the detection results to a specified destination.

Instead of the attack determination rule information 902, the attack detection unit 15 described above uses the results of various machine learning methods (detects communication in which the result of anomaly detection of diagnostic communication is abnormal), a rule using time (For example, a diagnostic communication sent within 1 second after the observation of "Seed" with all byte values of "0x00" is detected) may be used to detect an attack.

(Summary of embodiment)
This specification describes at least a communication monitoring device, a communication monitoring method, and a program described in each of the following items.
(Section 1)
a communication source status updating unit that monitors communication from a communication source to a communication destination and updates information indicating the status of the communication source including the number of requests for unlocking to the communication destination;
a reconnaissance detection unit that detects reconnaissance of the unlocked state of the communication destination by the communication source based on information indicating the state of the communication source;
An attack detection unit that detects an attack from the communication source whose reconnaissance has been detected to the communication destination,
Communication monitoring equipment.
(Section 2)
The information indicating the state of the communication source is information indicating a difference between the number of transmissions of data requests for unlocking to the communication destination and the number of transmissions of request data for unlocking based on the data,
The reconnaissance detection unit detects, based on the difference, reconnaissance of the unlocked state of the communication destination by the communication source.
A communication monitoring device according to claim 1.
(Section 3)
further comprising a communication blocking unit that blocks communication from the communication source in which the attack has been detected to the communication destination;
3. A communication monitoring device according to claim 1 or 2.
(Section 4)
Further comprising a detection result transmission unit that transmits information indicating the detection result,
The communication monitoring device according to any one of items 1 to 3.
(Section 5)
further comprising a reconnaissance completion detection unit that detects completion of reconnaissance from the communication source for which reconnaissance has been detected to the communication destination;
5. The communication monitoring device according to any one of items 1 to 4, wherein the attack detection unit detects an attack from the communication source whose completion of reconnaissance has been detected to the communication destination.
(Section 6)
the communication destination is an ECU, and the communication is communication for diagnosing the ECU;
The communication monitoring device according to any one of items 1 to 5.
(Section 7)
A computer implemented method comprising:
monitoring communication from a communication source to a communication destination and updating information indicating the status of the communication source, including the number of requests for unlocking to the communication destination;
Detecting reconnaissance of the unlocked state of the communication destination by the communication source based on the information indicating the state of the communication source;
detecting an attack from the communication source for which the reconnaissance has been detected to the communication destination;
Communication monitoring method.
(Section 8)
A program for causing a computer to function as each unit in the communication monitoring device according to any one of items 1 to 6.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

1 automobile 10 communication monitoring device 11 storage unit 12 communication source state update unit 13 reconnaissance detection unit 14 reconnaissance completion detection unit 15 attack detection unit 16 communication cutoff unit 17 communication unit 18 detection result transmission unit 20 ECU
30 external communication interface 40 communication device 41 communication unit 42 communication blocking unit 901 communication source status information 902 attack determination rule information 1000 drive device 1001 recording medium 1002 auxiliary storage device 1003 memory device 1004 CPU
1005 interface device 1006 display device 1007 input device 1008 output device

Claims

a communication source status updating unit that monitors communication from a communication source to a communication destination and updates information indicating the status of the communication source including the number of requests for unlocking to the communication destination;
a reconnaissance detection unit that detects reconnaissance of the unlocked state of the communication destination by the communication source based on information indicating the state of the communication source;
An attack detection unit that detects an attack from the communication source whose reconnaissance has been detected to the communication destination,
Communication monitoring equipment.
The information indicating the state of the communication source is information indicating a difference between the number of times data for unlocking is requested from the communication destination and the number of times unlocking is requested based on the data,
The reconnaissance detection unit detects, based on the difference, reconnaissance of the unlocked state of the communication destination by the communication source.
The communication monitoring device according to claim 1.
further comprising a communication blocking unit that blocks communication from the communication source in which the attack has been detected to the communication destination;
3. The communication monitoring device according to claim 1 or 2.
Further comprising a detection result transmission unit that transmits information indicating the detection result,
The communication monitoring device according to any one of claims 1 to 3.
further comprising a reconnaissance completion detection unit that detects completion of reconnaissance from the communication source for which reconnaissance has been detected to the communication destination;
The communication monitoring device according to any one of claims 1 to 4, wherein the attack detection unit detects an attack from the communication source whose completion of reconnaissance has been detected to the communication destination.
the communication destination is an ECU, and the communication is communication for diagnosing the ECU;
The communication monitoring device according to any one of claims 1 to 5.
A computer implemented method comprising:
monitoring communication from a communication source to a communication destination and updating information indicating the status of the communication source, including the number of requests for unlocking to the communication destination;
Detecting reconnaissance of the unlocked state of the communication destination by the communication source based on the information indicating the state of the communication source;
detecting an attack from the communication source for which the reconnaissance has been detected to the communication destination;
Communication monitoring method.
A program for causing a computer to function as each unit in the communication monitoring device according to any one of claims 1 to 6.