WO2023032279A1 - Information processing system - Google Patents
Information processing system Download PDFInfo
- Publication number
- WO2023032279A1 WO2023032279A1 PCT/JP2022/009964 JP2022009964W WO2023032279A1 WO 2023032279 A1 WO2023032279 A1 WO 2023032279A1 JP 2022009964 W JP2022009964 W JP 2022009964W WO 2023032279 A1 WO2023032279 A1 WO 2023032279A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- software
- information
- vulnerability
- vehicle
- Prior art date
Links
- 230000010365 information processing Effects 0.000 title claims abstract description 23
- 238000013480 data collection Methods 0.000 claims abstract description 9
- 238000007405 data analysis Methods 0.000 claims abstract description 6
- 238000004458 analytical method Methods 0.000 description 13
- 238000011156 evaluation Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 7
- 238000000034 method Methods 0.000 description 4
- 238000009825 accumulation Methods 0.000 description 3
- 238000013475 authorization Methods 0.000 description 3
- 238000004891 communication Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000012038 vulnerability analysis Methods 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000003044 adaptive effect Effects 0.000 description 1
- 230000001934 delay Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 208000015181 infectious disease Diseases 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000002250 progressing effect Effects 0.000 description 1
- 239000000725 suspension Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
Definitions
- the present invention relates to an information processing system.
- IoT in which all kinds of things are connected to the Internet, is progressing, ensuring the security of IoT devices has become an important social issue. Especially when IoT devices are automobiles such as connected cars and self-driving cars, security attacks on automobiles may threaten human safety. There is a need for a technique to suppress this.
- SOC Security Operation Center
- the SOC collects logs related to security events from vehicles, and SOC operators and analysts analyze the situation of the vehicle and the impact on other vehicles based on the logs, and formulate and implement countermeasures.
- the security event collected from the vehicle it is possible to use the detection result of the alert detection device mounted on the vehicle.
- the risk level and known threat information are defined as a combination of the autonomous driving function level (SAE level), the number of linked ECUs for each ECU, and the application, and created into a database, and the software installed in the ECU in the connected car is created.
- SAE level autonomous driving function level
- a technology is disclosed that shortens the time to deal with new cyberattacks by presenting past threat information related to functions added by updates to analysts.
- Patent Document 1 each time a function was added by software update, it was presented to the analyst and analyzed by the analyst. Therefore, it is necessary for analysts to deal with known alert information one by one, and there is a problem that it takes time to deal with new cyberattacks.
- the present invention has been made in view of the above points, and aims to provide an information processing system that can reduce the time taken to deal with a new cyber attack.
- An information processing system for analyzing vehicle data, comprising a data collection unit for collecting vehicle data and in-vehicle software that generated the vehicle data. It is characterized by comprising a software identification unit that identifies and a data analysis unit that analyzes vulnerability of vehicle data based on vulnerability information of the identified software.
- the vulnerability information of the data when an alert is detected, by associating the data that caused the alert with the software information in the vehicle, the vulnerability information of the data can be referred to the vulnerability information of the software. can be automatically identified by This eliminates the need for analysts to make judgments about known vulnerability information. Therefore, it is possible to provide an information processing system that greatly reduces the burden on analysts and shortens the time taken to deal with new cyberattacks. Further features related to the present invention will become apparent from the description of the specification and the accompanying drawings. Further, problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.
- FIG. 1 is a diagram showing the functional configuration of an information processing system according to the embodiment
- FIG. FIG. 4 is a diagram showing an example of a data dictionary used to identify software
- FIG. 4 is a diagram showing an example of a software BOM;
- the figure which shows an example of incident DB. 4 is a flowchart showing processing for determining vulnerability information of data in this embodiment.
- FIG. 1 is a diagram showing the overall configuration of an information processing system according to one embodiment of the present invention.
- the information processing system includes a data collection unit that collects various data from the vehicle, an analysis support function unit that identifies the software that generated the collected data, determines the vulnerability information of the software, and an alert from the identified software.
- An alert management unit that has an analysis engine that determines whether or not it corresponds to the above, an alert information storage unit (alert information DB) that stores alert information, an alert management unit that manages alert information, and an incident information storage unit that stores incident information (incident information DB), and has an incident management unit that manages incident information.
- the system according to the present invention is installed in a server or computer that can communicate with a vehicle via a wireless network, for example.
- an incident refers to a man-made event that actually poses a security threat to information management and system operation, among the events that caused an alert to be issued.
- it refers to any artificial event that threatens (dangerous) the confidentiality, integrity, or availability of the computer system operated by the organization or the information under its control, such as malware infection, unauthorized access, password leakage, web Site defacement, confidential information leakage, phishing, denial of service attacks (DoS attacks), etc.
- the data collection unit receives (collects) various data from the vehicle via the network and saves it.
- the data to be collected includes OTA (Over The Air) information sent and received via in-vehicle communication, telematics information sent from in-vehicle devices equipped with communication and GPS functions, and vehicle diagnostics for diagnosing vehicle problems.
- ACC related to ACC Adaptive Cruise Control
- ACC Adaptive Cruise Control
- a dedicated sensor and CPU computer installed in the car to perform both accelerator operation and brake operation.
- information, and lane keep information which is information for recognizing the driving lane by the in-vehicle radar and controlling so as not to deviate from the lane.
- the analysis support function part includes a software identification part, a software ID assignment part, and an alert analysis part.
- the data transmitted from the data collection unit to the analysis support function unit is first processed by the software identification unit for identifying the software that generated the data.
- the data has a plurality of parameters, and based on these parameters, the software identification unit identifies the software using a data dictionary, and the version information is stored in the system of the automobile manufacturer that manufactured the vehicle. Identify by referring to the vehicle software configuration list. The configuration of this data dictionary and the method of specifying the software will be described later.
- ID_1 is assigned to data for which software is specified by the software ID assigning unit (in this embodiment, ID_1 is assigned).
- Data with a software ID is sent to the analysis engine.
- the analysis engine determines whether the data corresponds to an alert, that is, whether the data value or the like is an abnormal value exceeding the normal range.
- Data determined to be alerts are sent as alerts to the alert analysis section of the analysis support function section.
- the alert analysis unit refers to the software BOM (Bill of Materials) possessed by the automobile manufacturer system to obtain a component list that constitutes the software that generated the alerted data. and referencing a vulnerability information database (DB) external to the system to determine whether there is vulnerability information for the identified software and/or components.
- BOM Bacill of Materials
- a vulnerability is a security problem area in a software product or web application. Attacking the problematic area by unauthorized access to a computer or a computer virus may cause the software product or web application to become vulnerable. Anything that may impair the original functions or performance of an application. It also includes situations where the security of web applications cannot be maintained due to inappropriate operations by website operators, such as when personal information is not managed under appropriate access controls. The configuration and the like of the vulnerability information database will be described later.
- Data determined to have vulnerabilities is stored in the alert DB, and if the severity of the vulnerability in the data is identified, it is also stored in the incident DB.
- the data dictionary used to identify the software that generated the data collected by the data collection unit will be explained using FIG.
- the data dictionary lists various types of software that the vehicle has, along with their versions and IDs. Data that can be generated by such software are stored in association with various parameters of the data.
- the software identification unit can identify from which software the data is generated by comparing the parameters of the data transmitted from the data collection unit with the parameters stored in the data dictionary. .
- FIG. 3 shows an example of the result of the analysis engine evaluating received data using CVSS.
- CVSS refers to a common vulnerability scoring system CVSS (Common Vulnerability Scoring System). This is an open and general-purpose evaluation method for information system vulnerabilities, and a common evaluation method that does not depend on vendors.
- CVSS Common Vulnerability Scoring System
- Attack source category is an evaluation of where a vulnerable system/component can be attacked from. indicates that attacks can be made only by physical means such as USB.
- Complexity of attack conditions is an evaluation of the complexity of the conditions necessary to attack a system/component with vulnerabilities. Prior information, etc., that depends on a person other than a third party is required.
- Principal level required for attack is an evaluation of the level of privilege required to attack a vulnerable system/component, and indicates the strength of authority, such as whether confidential information can be accessed. .
- User involvement level is an evaluation of the level of user involvement required when attacking a system/component with a vulnerability, and whether user operations such as clicking links, browsing files, and changing settings are required. Please, etc.
- the "assumed range of impact”, also called “scope”, is an evaluation of the range of impact of attacks on vulnerable systems/components. Indicates whether the sphere of influence remains the belonging authorization scope of the vulnerable system/component.
- Authorization scope is the concept of the scope of management authority for computer resources. If it was in scope, it would be “no scope change", while attacking a vulnerable component (software H or X) resulted in another component (software I or Y) in another authorization scope In that case, even within the same host, it will be "scope changed”.
- Constantiality impact is an evaluation of the possibility of information leakage within the scope of expected impact when a vulnerability is attacked, and the possibility of information leakage or removal of access restrictions. indicates
- Integrity impact is an evaluation of the possibility of falsification of information within the expected scope of impact when a vulnerability is attacked. Indicates the magnitude of the impact.
- Availability impact is an evaluation of the possibility of delays or suspension of operations within the expected range of impact when a vulnerability is attacked.
- Resources network bandwidth, processor processing, disk space, etc.
- Affected system indicates the system/component that generated the data.
- data with vulnerability ID_1 is data generated by OTA-ECU software version 2.0 or earlier
- data with vulnerability ID_2 is software component libxxxx_18.0. Indicates that the data is generated by
- the severity (0 is the lowest and 10 is the highest) is calculated based on the above evaluation items.
- the severity of the two data calculated in this embodiment is 7.8, which is "important", and 5.5, which is "warning". Since the details of the data with vulnerability ID_3 are unknown as described above, the severity is also unknown.
- FIG. 4 is a diagram showing the software configuration of each vehicle type.
- the OTA software of the device installed in the vehicle of vehicle type A is version 2.0, and can generate data given vulnerability ID_1 shown in FIG. That is, it is determined that the software has a vulnerability.
- Vehicle B also has the same software configuration as vehicle A, but the OTA software version is 3.0, and it is not determined to be vulnerable software.
- FIG. 5 is an example of a software BOM showing the components that make up each piece of software.
- version 1.0 of the OTA software has a vulnerable component libxxxx_18.0. From this also, it is determined that the OTA software has a vulnerability. In this way, by referring not only to the software itself but also to the vulnerabilities of the components that make up the software, it becomes possible to more accurately determine the vulnerabilities of the software.
- FIG. 6 is a diagram showing an example of the configuration of an alert database (DB) used in this embodiment
- FIG. 7 is a diagram similarly showing an example of the configuration of an incident database (DB).
- DB alert database
- FIG. 7 all alerted data (see FIG. 3) are registered in the alert DB.
- FIG. 7 the data for which the degree of severity has been determined is registered in the incident DB.
- the fact that the severity of the alert ID_1234569 data was not determined means that the various data necessary to determine the severity are not stored in the vulnerability DB. Therefore, it is sent to analysts for direct reference to various information contained in the data to determine severity. Analysts determine the severity of the data and then register it in the incident DB. At the same time, it is also possible to access the vulnerability DB and register vulnerability information related to the data.
- FIG. 8 is a flowchart showing a method of determining data vulnerability using the information processing system according to this embodiment.
- the system constantly monitors the alert reception status (S802), and when an alert is received, identifies the software that generated the alert data using the data dictionary, and assigns a software ID (S803).
- the software that generated the data for which the alert was issued is specified, and an ID corresponding to the software is given to the data. Then, based on this software ID, the vulnerability information registered in the vulnerability DB is referenced to determine the vulnerability of the alerted data. That is, when an alert is detected, software information in the vehicle is included in the data that is the cause of the alert, thereby automating the identification of vulnerability information of the software that caused the alert. This eliminates the need for analysts to judge known vulnerability information, making it possible to shorten the time to respond to functions and new attacks that are unrelated to past threat information.
- An information processing system for analyzing vehicle data comprising: a data collection unit that collects vehicle data; a software identification unit that identifies software in the vehicle that generated vehicle data; and a data analysis unit that analyzes vulnerabilities based on vulnerability information of the identified software.
- the vehicle further includes a data dictionary section in which parameters of software in the vehicle are recorded, and the software identification section identifies the software that generated the vehicle data by referring to the data dictionary section.
- the data analysis unit further analyzes the vulnerability of data based on the vulnerability information possessed by the components that make up the software. This makes it possible to analyze vulnerabilities in more detail even when vulnerabilities cannot be determined by software alone.
- an alert information storage unit that stores alert information indicating a threat, and when a vulnerability is detected from data and the software that generated the data is identified, the information on the data in which the vulnerability is detected is stored; Store in the alert information accumulation unit.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Provided is an information processing system for analyzing data pertaining to a vehicle, said information processing system comprising: a data collection unit that collects the data pertaining to the vehicle; a software identification unit that identifies software in the vehicle which has generated the data pertaining to the vehicle; and a data analysis unit that analyzes vulnerability of the data pertaining to the vehicle on the basis of vulnerability information which the identified software has.
Description
本発明は、情報処理システムに関する。
The present invention relates to an information processing system.
あらゆるモノがインターネットに繋がるＩｏＴ化が進む中、ＩｏＴ機器のセキュリティを担保することが重要な社会課題の一つとなっている。特にＩｏＴ機器がコネクテッドカーや自動運転車などの自動車である場合、自動車がセキュリティ上の攻撃を受けることで、人の安全性を脅かす場合があり、そのような安全性上の被害を最小限に抑える技術が求められている。
As the IoT, in which all kinds of things are connected to the Internet, is progressing, ensuring the security of IoT devices has become an important social issue. Especially when IoT devices are automobiles such as connected cars and self-driving cars, security attacks on automobiles may threaten human safety. There is a need for a technique to suppress this.
そのために近年では、車両の出荷後における運用中のセキュリティを管理するために、自動車向けＳＯＣ（Security Operation Center）が検討されている。ＳＯＣでは、車両からセキュリティイベントに関するログを収集し、ＳＯＣのオペレータや分析官が当該ログに基づいて、当該車両の状況や他車両への影響を分析し、対策方針の策定および実行を行う。車両から収集するセキュリティイベントとして、車両に搭載されたアラート検知装置の検知結果を利用することが考えられる。
For this reason, in recent years, a SOC (Security Operation Center) for automobiles has been considered to manage security during operation after the vehicle is shipped. The SOC collects logs related to security events from vehicles, and SOC operators and analysts analyze the situation of the vehicle and the impact on other vehicles based on the logs, and formulate and implement countermeasures. As the security event collected from the vehicle, it is possible to use the detection result of the alert detection device mounted on the vehicle.
コネクテッドカーは益々増加しており、ＳＯＣが監視する車両の台数は大規模になってくる。そして、自動車に対する攻撃方法も多岐に亘っていくことが考えられる。このような環境では、新たなアラートが検知された場合に、分析に時間を要し、オペレータや分析官の作業負荷が増大してしまう。
The number of connected cars is increasing more and more, and the number of vehicles monitored by the SOC is becoming larger. And it is conceivable that the methods of attacking automobiles will also diversify. In such an environment, when new alerts are detected, analysis takes time and increases the workload of operators and analysts.
特許文献１では、自動運転機能レベル（ＳＡＥレベル）、ＥＣＵごとの連携ＥＣＵ数、アプリの組み合わせでリスクレベルと既知の脅威情報を定義してデータベース化し、コネクテッドカー内のＥＣＵに実装されるソフトウェアの更新により追加された機能に関連する過去の脅威情報を分析官に提示することで、新たなサイバー攻撃への対処時間を短縮する技術が開示されている。
In Patent Document 1, the risk level and known threat information are defined as a combination of the autonomous driving function level (SAE level), the number of linked ECUs for each ECU, and the application, and created into a database, and the software installed in the ECU in the connected car is created. A technology is disclosed that shortens the time to deal with new cyberattacks by presenting past threat information related to functions added by updates to analysts.
しかしながら、特許文献１で開示されている技術では、ソフトウェア更新によって機能が追加される毎に分析官に提示され、分析官による分析が行われていた。そのため、既知のアラート情報についても逐次分析官が対処する必要があり、新たなサイバー攻撃を受けた場合に対処に時間を要するという問題がある。
However, with the technology disclosed in Patent Document 1, each time a function was added by software update, it was presented to the analyst and analyzed by the analyst. Therefore, it is necessary for analysts to deal with known alert information one by one, and there is a problem that it takes time to deal with new cyberattacks.
本発明は、上記の点を鑑みてなされたものであり、新たなサイバー攻撃を受けた場合であっても対処時間を短縮することが可能な情報処理システムを提供することを目的とする。
The present invention has been made in view of the above points, and aims to provide an information processing system that can reduce the time taken to deal with a new cyber attack.
上記目標を達成するため本発明に係る情報処理システムは、車両のデータを分析する情報処理システムであって、車両のデータを収集するデータ収集部と、車両のデータを生成した車両内のソフトウェアを特定するソフトウェア特定部と、車両のデータの脆弱性を、特定されたソフトウェアが有する脆弱性情報に基づいて分析するデータ分析部と、を備えることを特徴とする。
An information processing system according to the present invention for achieving the above object is an information processing system for analyzing vehicle data, comprising a data collection unit for collecting vehicle data and in-vehicle software that generated the vehicle data. It is characterized by comprising a software identification unit that identifies and a data analysis unit that analyzes vulnerability of vehicle data based on vulnerability information of the identified software.
本発明によれば、アラート検出時に、そのアラートの発生要因となったデータと車両内のソフトウェア情報とを紐づけることで、当該データの脆弱性情報を、当該ソフトウェアの脆弱性情報を参照することで自動的に特定できる。そのため、既知の脆弱性情報については、分析官が判断する必要がなくなる。従って、分析官の負担が大幅に減少し、新たなサイバー攻撃を受けた場合であっても対処時間を短縮することが可能な情報処理システムを提供することが可能になる。
本発明に関連する更なる特徴は、本明細書の記述、添付図面から明らかになるものである。また、上記した以外の、課題、構成及び効果は、以下の実施形態の説明により明らかにされる。 According to the present invention, when an alert is detected, by associating the data that caused the alert with the software information in the vehicle, the vulnerability information of the data can be referred to the vulnerability information of the software. can be automatically identified by This eliminates the need for analysts to make judgments about known vulnerability information. Therefore, it is possible to provide an information processing system that greatly reduces the burden on analysts and shortens the time taken to deal with new cyberattacks.
Further features related to the present invention will become apparent from the description of the specification and the accompanying drawings. Further, problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.
本発明に関連する更なる特徴は、本明細書の記述、添付図面から明らかになるものである。また、上記した以外の、課題、構成及び効果は、以下の実施形態の説明により明らかにされる。 According to the present invention, when an alert is detected, by associating the data that caused the alert with the software information in the vehicle, the vulnerability information of the data can be referred to the vulnerability information of the software. can be automatically identified by This eliminates the need for analysts to make judgments about known vulnerability information. Therefore, it is possible to provide an information processing system that greatly reduces the burden on analysts and shortens the time taken to deal with new cyberattacks.
Further features related to the present invention will become apparent from the description of the specification and the accompanying drawings. Further, problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.
以下、本発明の実施形態について図面を参照して説明する。
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
図１は、本発明の一実施形態に係る情報処理システムの全体構成を示す図である。情報処理システムは、車両からの種々のデータを収集するデータ収集部、収集したデータを生成したソフトウェアを特定し、当該ソフトウェアの脆弱性情報を判定するための分析支援機能部、特定したソフトウェアがアラートに該当するかどうかを判定する分析エンジン、アラート情報が格納されたアラート情報蓄積部（アラート情報ＤＢ）を有し、アラート情報を管理するアラート管理部、及びインシデント情報が格納されたインシデント情報蓄積部（インシデント情報ＤＢ）を有し、インシデント情報を管理するインシデント管理部を有する。なお、本発明に係るシステムは、例えば車両と無線ネットワークを介して通信可能なサーバやコンピュータに搭載される。
FIG. 1 is a diagram showing the overall configuration of an information processing system according to one embodiment of the present invention. The information processing system includes a data collection unit that collects various data from the vehicle, an analysis support function unit that identifies the software that generated the collected data, determines the vulnerability information of the software, and an alert from the identified software. An alert management unit that has an analysis engine that determines whether or not it corresponds to the above, an alert information storage unit (alert information DB) that stores alert information, an alert management unit that manages alert information, and an incident information storage unit that stores incident information (incident information DB), and has an incident management unit that manages incident information. The system according to the present invention is installed in a server or computer that can communicate with a vehicle via a wireless network, for example.
ここで、インシデントとは、アラートが発せられた原因となった事象のうち、実際に情報管理やシステム運用に関して保安上の脅威となる人為的な事象のことを言う。具体的には組織が運用するコンピュータシステムや管理下にある情報の機密性、完全性、可用性を脅かす（危険性のある）何らかの人為的な事象を指し、マルウェア感染や不正アクセス、パスワード漏洩、Webサイト改竄、機密情報流出、フィッシング、サービス拒否攻撃（DoS攻撃）などが含まれる
Here, an incident refers to a man-made event that actually poses a security threat to information management and system operation, among the events that caused an alert to be issued. Specifically, it refers to any artificial event that threatens (dangerous) the confidentiality, integrity, or availability of the computer system operated by the organization or the information under its control, such as malware infection, unauthorized access, password leakage, web Site defacement, confidential information leakage, phishing, denial of service attacks (DoS attacks), etc.
データ収集部は、ネットワークを介して車両から各種データを受信（収集）し、保存する。収集対象のデータには、車両内の通信を経由して送受信されるＯＴＡ（Ｏｖｅｒ Ｔｈｅ Ａｉｒ）情報、通信やＧＰＳ機能を備えた車載器から発信されるテレマティクス情報、車両の不具合を診断する車両診断情報、リモートキーなどによる遠隔操作情報、クルマに搭載した専用のセンサーとＣＰＵ（コンピューター）を用いたシステムが、アクセル操作とブレーキ操作の両方を行い、運転を支援するＡＣＣ（Ａｄａｐｔｉｖｅ Ｃｒｕｉｓｅ Ｃｏｎｔｒｏｌ）に関するＡＣＣ情報、車載レーダによって走行レーンを認識し、レーンから逸れないように制御するための情報であるレーンキープ情報等が含まれる。
The data collection unit receives (collects) various data from the vehicle via the network and saves it. The data to be collected includes OTA (Over The Air) information sent and received via in-vehicle communication, telematics information sent from in-vehicle devices equipped with communication and GPS functions, and vehicle diagnostics for diagnosing vehicle problems. ACC related to ACC (Adaptive Cruise Control), which assists driving by operating information, remote control information using a remote key, etc., and a system that uses a dedicated sensor and CPU (computer) installed in the car to perform both accelerator operation and brake operation. information, and lane keep information, which is information for recognizing the driving lane by the in-vehicle radar and controlling so as not to deviate from the lane.
分析支援機能部は、ソフトウェア特定部、ソフトウェアＩＤ付与部、及びアラート分析部を含む。データ収集部から分析支援機能部に送信されたデータは、まず当該データを生成したソフトウェアを特定するためのソフトウェア特定部によって処理される。データは複数のパラメータを有しており、ソフトウェア特定部では、このパラメータを基に、データ辞書を用いて当該ソフトウェアを特定するとともに、そのバージョン情報について、車両を製造した自動車メーカのシステムに保存された車両ソフトウェア構成リストを参照して特定する。このデータ辞書の構成及びソフトウェアを特定する方法については後述する。
The analysis support function part includes a software identification part, a software ID assignment part, and an alert analysis part. The data transmitted from the data collection unit to the analysis support function unit is first processed by the software identification unit for identifying the software that generated the data. The data has a plurality of parameters, and based on these parameters, the software identification unit identifies the software using a data dictionary, and the version information is stored in the system of the automobile manufacturer that manufactured the vehicle. Identify by referring to the vehicle software configuration list. The configuration of this data dictionary and the method of specifying the software will be described later.
ソフトウェアが特定されたデータには、ソフトウェアＩＤ付与部によってＩＤが付与される（本実施形態においてはＩＤ＿１が付与されている）。
An ID is assigned to data for which software is specified by the software ID assigning unit (in this embodiment, ID_1 is assigned).
ソフトウェアＩＤが付与されたデータは、分析エンジンへと送信される。分析エンジンでは、当該データがアラートに該当するかどうか、すなわちデータの値等が正常範囲を超えた異常な値であるかどうかを判定する。
Data with a software ID is sent to the analysis engine. The analysis engine determines whether the data corresponds to an alert, that is, whether the data value or the like is an abnormal value exceeding the normal range.
アラートに該当すると判定されたデータは、分析支援機能部のアラート分析部へアラートとして送信される。アラート分析部は、当該データに付与されたソフトウェアＩＤを基に、自動車メーカシステムが有するソフトウェアＢＯＭ（Ｂｉｌｌ ｏｆ Ｍａｔｅｒｉａｌｓ：部品表）を参照して当該アラートされたデータを生成したソフトウェアを構成するコンポーネントリストを取得するとともに、システム外部の脆弱性情報データベース（ＤＢ）を参照して、特定されたソフトウェア及び／またはコンポーネントに関する脆弱性情報があるかどうかを判定する。
Data determined to be alerts are sent as alerts to the alert analysis section of the analysis support function section. Based on the software ID assigned to the data, the alert analysis unit refers to the software BOM (Bill of Materials) possessed by the automobile manufacturer system to obtain a component list that constitutes the software that generated the alerted data. and referencing a vulnerability information database (DB) external to the system to determine whether there is vulnerability information for the identified software and/or components.
ここで、脆弱性とは、ソフトウェア製品やウェブアプリケーション等におけるセキュリティ上の問題箇所であり、コンピュータへの不正アクセスやコンピュータウイルス等により、この問題の箇所が攻撃されることで、そのソフトウェア製品やウェブアプリケーションの本来の機能や性能を損なう原因となり得るものをいう。また、個人情報等が適切なアクセス制御の下に管理されていないなど、ウェブサイト運営者の不適切な運用により、ウェブアプリケーションのセキュリティが維持できなくなっている状態も含む。脆弱性情報データベースの構成等については後述する。
Here, a vulnerability is a security problem area in a software product or web application. Attacking the problematic area by unauthorized access to a computer or a computer virus may cause the software product or web application to become vulnerable. Anything that may impair the original functions or performance of an application. It also includes situations where the security of web applications cannot be maintained due to inappropriate operations by website operators, such as when personal information is not managed under appropriate access controls. The configuration and the like of the vulnerability information database will be described later.
脆弱性を有すると判定されたデータは、アラートＤＢに格納され、さらに、当該データが有する脆弱性の深刻度が特定された場合にはインシデントＤＢにも格納される。
Data determined to have vulnerabilities is stored in the alert DB, and if the severity of the vulnerability in the data is identified, it is also stored in the incident DB.
次に、データ収集部が収集したデータを生成したソフトウェアを特定するために用いるデータ辞書について図２を用いて説明する。図２に示すように、データ辞書には、車両が有する種々のソフトウェアが、そのバージョンやＩＤと共に羅列されている。そして、それらのソフトウェアが生成し得るデータが、当該データの持つ種々のパラメータと関連付けられて記憶されている。
Next, the data dictionary used to identify the software that generated the data collected by the data collection unit will be explained using FIG. As shown in FIG. 2, the data dictionary lists various types of software that the vehicle has, along with their versions and IDs. Data that can be generated by such software are stored in association with various parameters of the data.
従って、ソフトウェア特定部は、データ収集部から送信されたデータのパラメータと、データ辞書に記憶されたパラメータとを照合することによって、当該データがどのソフトウェアから生成されたかを特定することが可能になる。
Therefore, the software identification unit can identify from which software the data is generated by comparing the parameters of the data transmitted from the data collection unit with the parameters stored in the data dictionary. .
なお、図２に示すデータ辞書に記載された各種パラメータは一つの例示であり、パラメータの種類や数は任意に設定可能である。
The various parameters described in the data dictionary shown in FIG. 2 are merely examples, and the types and number of parameters can be set arbitrarily.
次に、図３から図５を用いて、データがアラートに該当するか否か判定する方法、及びアラートに該当すると判定されたデータの取り扱いについて説明する。
Next, using FIGS. 3 to 5, we will explain how to determine whether data corresponds to an alert and how to handle data determined to correspond to an alert.
図３は、分析エンジンが、受信データをＣＶＳＳを用いて評価した結果の一例を示す。ＣＶＳＳとは、共通脆弱性評価システムCVSS(Common Vulnerability Scoring System)のことを指す。これは、情報システムの脆弱性に対するオープンで汎用的な評価手法であり、ベンダーに依存しない共通の評価方法である。
FIG. 3 shows an example of the result of the analysis engine evaluating received data using CVSS. CVSS refers to a common vulnerability scoring system CVSS (Common Vulnerability Scoring System). This is an open and general-purpose evaluation method for information system vulnerabilities, and a common evaluation method that does not depend on vendors.
本実施例においては、３つのデータが分析対象となっており、脆弱性ＩＤ＿１及びＩＤ＿２が付与されたデータについては、各種の情報が判明しており、脆弱性ＩＤ＿３が付与されたデータについては、その詳細が不明であることが示されている。
In this embodiment, three pieces of data are analyzed. Various types of information are known for the data assigned vulnerability ID_1 and ID_2, and for the data assigned vulnerability ID_3, It is shown that the details are unknown.
「タイトル」は、どのシステム／コンポーネントに脆弱性が存在するかを示す。
"Title" indicates which system/component has the vulnerability.
「攻撃元区分」は、脆弱性のあるシステム／コンポーネントをどこから攻撃可能であるかを評価したものであり、「ネットワーク」は、通信を介して外部から攻撃可能であることを示し、「ローカル」は、ＵＳＢ等物理的な手段でのみ攻撃可能であることを示す。
"Attack source category" is an evaluation of where a vulnerable system/component can be attacked from. indicates that attacks can be made only by physical means such as USB.
「攻撃条件の複雑さ」は、脆弱性のあるシステム／コンポーネントを攻撃する際に必要な条件の複雑さを評価したものであり、複雑さが高ければ高いほど、設定情報や共有鍵等、攻撃者以外に依存する事前情報等が必要になる。
"Complexity of attack conditions" is an evaluation of the complexity of the conditions necessary to attack a system/component with vulnerabilities. Prior information, etc., that depends on a person other than a third party is required.
「攻撃に必要な特権レベル」は、脆弱性のあるシステム／コンポーネントを攻撃する際に必要な特権のレベルを評価したものであり、秘密情報にアクセスできるかどうか、等の権限の強さを示す。
"Privilege level required for attack" is an evaluation of the level of privilege required to attack a vulnerable system/component, and indicates the strength of authority, such as whether confidential information can be accessed. .
「ユーザ関与レベル」とは、脆弱性のあるシステム／コンポーネントを攻撃する際に必要なユーザ関与レベルを評価したものであり、リンクのクリック、ファイル閲覧、設定の変更など、ユーザによる操作が必要かどうか、等を示す。
"User involvement level" is an evaluation of the level of user involvement required when attacking a system/component with a vulnerability, and whether user operations such as clicking links, browsing files, and changing settings are required. Please, etc.
「影響想定範囲」は、「スコープ」とも呼ばれ、脆弱性のあるシステム／コンポーネントへの攻撃による影響範囲を評価したものである。影響範囲が脆弱性のあるシステム／コンポーネントの帰属するオーソリゼーションスコープに留まるかどうかを示す。オーソリゼーションスコープとは、計算機資源に対する管理権限の範囲概念であり、例えば、脆弱性のあるコンポーネント(ソフトウェアA)を攻撃し、その影響が他のコンポーネント(ソフトウェアB)に及んだとしても、同じオーソリゼーションスコープ内にあれば、「スコープ変更なし」となり、一方、脆弱性のあるコンポーネント(ソフトウェアHやX)を攻撃した結果、他のオーソリゼーションスコープにある他のコンポーネント(ソフトウェアIやY)に及んだ場合には、同じホスト内であっても「スコープ変更あり」となる。
The "assumed range of impact", also called "scope", is an evaluation of the range of impact of attacks on vulnerable systems/components. Indicates whether the sphere of influence remains the belonging authorization scope of the vulnerable system/component. Authorization scope is the concept of the scope of management authority for computer resources. If it was in scope, it would be "no scope change", while attacking a vulnerable component (software H or X) resulted in another component (software I or Y) in another authorization scope In that case, even within the same host, it will be "scope changed".
「機密性影響」とは、脆弱性を攻撃された際に、対象とする影響想定範囲の情報が漏えいする可能性を評価したものであり、情報漏洩やアクセス制限の解除等が発生する可能性を示す。
"Confidentiality impact" is an evaluation of the possibility of information leakage within the scope of expected impact when a vulnerability is attacked, and the possibility of information leakage or removal of access restrictions. indicates
「完全性影響」とは、脆弱性を攻撃された際に、対象とする影響想定範囲の情報が改ざんされる可能性を評価したものであり、情報改ざんの可能性、及び当該改ざんがシステムに与える影響の大きさを示す。
"Integrity impact" is an evaluation of the possibility of falsification of information within the expected scope of impact when a vulnerability is attacked. Indicates the magnitude of the impact.
「可用性影響」とは、脆弱性を攻撃された際に、対象とする影響想定範囲の業務が遅延・停止する可能性を評価したものであり、リソース(ネットワーク帯域、プロセッサ処理、ディスクスペースなど)を枯渇、あるいは停止等させられるかどうかを示す。
"Availability impact" is an evaluation of the possibility of delays or suspension of operations within the expected range of impact when a vulnerability is attacked. Resources (network bandwidth, processor processing, disk space, etc.) can be depleted, stopped, etc.
「影響を受けるシステム」は、当該データを生成したシステム／コンポーネントを示す。図３においては、脆弱性ＩＤ＿１が付与されたデータは、ＯＴＡ－ＥＣＵソフトウェアのバージョン２．０以前のソフトウェアにより生成されたデータであり、脆弱性ＩＤ＿２が付与されたデータは、ソフトウェアコンポーネントlibxxxx＿18.0により生成されたデータであることを示す。
"Affected system" indicates the system/component that generated the data. In FIG. 3, data with vulnerability ID_1 is data generated by OTA-ECU software version 2.0 or earlier, and data with vulnerability ID_2 is software component libxxxx_18.0. Indicates that the data is generated by
そして、上記の評価項目を基に深刻度（０が最も低く、１０が最も高い）が算出される。本実施形態において算出されている２つのデータの深刻度７．８は「重要」であり、５．５は「警告」である。脆弱性ＩＤ＿３が付与されたデータについては、上記の通りその詳細が一切不明であるため、深刻度も不明となっている。
Then, the severity (0 is the lowest and 10 is the highest) is calculated based on the above evaluation items. The severity of the two data calculated in this embodiment is 7.8, which is "important", and 5.5, which is "warning". Since the details of the data with vulnerability ID_3 are unknown as described above, the severity is also unknown.
図４は、各車種が有するソフトウェア構成を示す図である。図４に示すように、車種Ａの車両に搭載された機器のＯＴＡソフトウェアはバージョン２．０であり、図３で示された脆弱性ＩＤ＿１が付与されたデータを生成し得る。即ち脆弱性を有するソフトウェアであると判定される。また、車両Ｂも車両Ａと同様のソフトウェア構成を有しているが、ＯＴＡソフトウェアのバージョンは３．０であり、脆弱性を有するソフトウェアであるとは判定されない。
FIG. 4 is a diagram showing the software configuration of each vehicle type. As shown in FIG. 4, the OTA software of the device installed in the vehicle of vehicle type A is version 2.0, and can generate data given vulnerability ID_1 shown in FIG. That is, it is determined that the software has a vulnerability. Vehicle B also has the same software configuration as vehicle A, but the OTA software version is 3.0, and it is not determined to be vulnerable software.
図５は、各ソフトウェアを構成するコンポーネントを示すソフトウェアＢＯＭの一例である。図５に示すように、ＯＴＡソフトウェアのバージョン１．０は、脆弱性を有するコンポーネントlibxxxx＿18.0を有している。このことからも、ＯＴＡソフトウェアが脆弱性を有していると判定される。このように、ソフトウェア自体に加え、ソフトウェアを構成するコンポーネントが有する脆弱性をも参照することで、ソフトウェアの有する脆弱性をより正確に判定することが可能になる。
FIG. 5 is an example of a software BOM showing the components that make up each piece of software. As shown in FIG. 5, version 1.0 of the OTA software has a vulnerable component libxxxx_18.0. From this also, it is determined that the OTA software has a vulnerability. In this way, by referring not only to the software itself but also to the vulnerabilities of the components that make up the software, it becomes possible to more accurately determine the vulnerabilities of the software.
図６は、本実施形態において用いられるアラートデータベース（ＤＢ）の構成の一例を示した図であり、図７は、同様にインシデントデータベース（ＤＢ）の構成の一例を示した図である。図６に示すように、アラートされたデータ（図３参照）は、全てアラートＤＢに登録される。そして、図７に示すように、そのうち深刻度が判定されたデータについてはインシデントＤＢに登録される。
FIG. 6 is a diagram showing an example of the configuration of an alert database (DB) used in this embodiment, and FIG. 7 is a diagram similarly showing an example of the configuration of an incident database (DB). As shown in FIG. 6, all alerted data (see FIG. 3) are registered in the alert DB. Then, as shown in FIG. 7, the data for which the degree of severity has been determined is registered in the incident DB.
本実施形態においては、図３で示した、脆弱性ＩＤ＿１及びＩＤ＿２が付与されたデータ、すなわちアラートＩＤ＿１２３４５６７及びＩＤ＿１２３４５６８が付与されたデータについては深刻度が判明しているため、アラートＤＢ及びインシデントＤＢの両方に登録される。しかし、アラートＩＤ＿１２３４５６９が付与されたデータについては、深刻度が不明であるため、アラートＤＢには登録されるが、インシデントＤＢには登録されない。
In this embodiment, since the severity of the data with vulnerability ID_1 and ID_2 shown in FIG. registered for both. However, since the severity of the data with alert ID_1234569 is unknown, it is registered in the alert DB but not registered in the incident DB.
アラートＩＤ＿１２３４５６９のデータの深刻度が判定されなかったことは、深刻度を判定するために必要な各種データが脆弱性ＤＢに記憶されていないことを意味する。従って、当該データが含む各種の情報を直接参照して深刻度を判定するために、分析官へと送信される。分析官は、当該データの深刻度を判定し、その後インシデントＤＢへと登録する。また、同時に脆弱性ＤＢへとアクセスし、当該データに関する脆弱性情報を登録することも可能である。
The fact that the severity of the alert ID_1234569 data was not determined means that the various data necessary to determine the severity are not stored in the vulnerability DB. Therefore, it is sent to analysts for direct reference to various information contained in the data to determine severity. Analysts determine the severity of the data and then register it in the incident DB. At the same time, it is also possible to access the vulnerability DB and register vulnerability information related to the data.
図８は、本実施形態に係る情報処理システムを用いて、データの脆弱性を判定する方法を示すフローチャートである。まず、システムは、アラートの受信状態を常に監視し（Ｓ８０２）、アラートを受信した場合、アラートされたデータを生成したソフトウェアを、データ辞書を用いて特定し、ソフトウェアＩＤを付与する（Ｓ８０３）。
FIG. 8 is a flowchart showing a method of determining data vulnerability using the information processing system according to this embodiment. First, the system constantly monitors the alert reception status (S802), and when an alert is received, identifies the software that generated the alert data using the data dictionary, and assigns a software ID (S803).
そして、ＣＶＳＳを用いて、特定されたソフトウェアに関する脆弱性情報があるかどうかを判定する（Ｓ８０４）。脆弱性情報がある場合には、当該アラートされたデータの深刻度も判明しているので、図６及び図７を用いて説明したように、脆弱性ＩＤ及び深刻度とともに、アラートＤＢ及びインシデントＤＢに格納する（Ｓ８０７）。
Then, using CVSS, it is determined whether there is vulnerability information regarding the identified software (S804). If there is vulnerability information, the severity of the alerted data is also known, so as described with reference to FIGS. (S807).
特定されたソフトウェアに関する脆弱性情報がない場合には、ソフトウェアＢＯＭにアクセスし、当該ソフトウェアを構成するコンポーネントリストを取得する（Ｓ８０５）。そして、コンポーネントに関する脆弱性があるかどうか、すなわち当該コンポーネントリストに、脆弱性を有するコンポーネントがあるかどうかを、再びＣＶＳＳを用いて判定する（Ｓ８０６）。脆弱性情報があると判定された場合には、図６及び図７を用いて説明したように、脆弱性ＩＤ及び深刻度とともに、アラートＤＢ及びインシデントＤＢに格納する（Ｓ８０７）。
If there is no vulnerability information regarding the specified software, access the software BOM and obtain a list of components that make up the software (S805). Then, it is determined using CVSS again whether or not there is a vulnerability related to the component, that is, whether or not the component list includes a component having a vulnerability (S806). If it is determined that there is vulnerability information, it is stored in the alert DB and the incident DB together with the vulnerability ID and severity as described with reference to FIGS. 6 and 7 (S807).
コンポーネントに関する脆弱性情報もなしと判定された場合には、上述の脆弱性ＩＤ＿１２３４５６９が付与されたデータと同様に、インシデントＤＢには格納せず、そのままアラートＤＢに格納するとともに分析官へと送信する（Ｓ８０８）。
If it is determined that there is no vulnerability information related to the component, it will not be stored in the incident DB, just like the data with the vulnerability ID_1234569 described above, but will be stored in the alert DB and sent to the analyst. (S808).
本実施形態によれば、アラートが発せられたデータを生成したソフトウェアを特定し、当該ソフトウェアに対応するＩＤを当該データに付与している。そして、このソフトウェアＩＤを基に、脆弱性ＤＢに登録された脆弱性情報を参照して、当該アラートされたデータの脆弱性を判定している。すなわち、アラート検出時に、その要因となるデータに車両内のソフトウェア情報を含むことで、アラートの要因となったソフトウェアの脆弱性情報の特定を自動化している。これにより、既知の脆弱性情報についても分析官が判断する必要がなくなり、過去の脅威情報との関連がない機能や新たな攻撃への対処時間を短縮することが可能になっている。
According to this embodiment, the software that generated the data for which the alert was issued is specified, and an ID corresponding to the software is given to the data. Then, based on this software ID, the vulnerability information registered in the vulnerability DB is referenced to determine the vulnerability of the alerted data. That is, when an alert is detected, software information in the vehicle is included in the data that is the cause of the alert, thereby automating the identification of vulnerability information of the software that caused the alert. This eliminates the need for analysts to judge known vulnerability information, making it possible to shorten the time to respond to functions and new attacks that are unrelated to past threat information.
以上で説明した本発明の実施例によれば、以下の作用効果を奏する。
（１）車両のデータを分析する情報処理システムであって、車両のデータを収集するデータ収集部と、車両のデータを生成した車両内のソフトウェアを特定するソフトウェア特定部と、車両のデータの脆弱性を、特定されたソフトウェアが有する脆弱性情報に基づいて分析するデータ分析部と、を備える。 According to the embodiments of the present invention described above, the following effects are obtained.
(1) An information processing system for analyzing vehicle data, comprising: a data collection unit that collects vehicle data; a software identification unit that identifies software in the vehicle that generated vehicle data; and a data analysis unit that analyzes vulnerabilities based on vulnerability information of the identified software.
（１）車両のデータを分析する情報処理システムであって、車両のデータを収集するデータ収集部と、車両のデータを生成した車両内のソフトウェアを特定するソフトウェア特定部と、車両のデータの脆弱性を、特定されたソフトウェアが有する脆弱性情報に基づいて分析するデータ分析部と、を備える。 According to the embodiments of the present invention described above, the following effects are obtained.
(1) An information processing system for analyzing vehicle data, comprising: a data collection unit that collects vehicle data; a software identification unit that identifies software in the vehicle that generated vehicle data; and a data analysis unit that analyzes vulnerabilities based on vulnerability information of the identified software.
これにより、脆弱性を有するソフトウェアが既に記録されている場合には、分析官による分析を要することなく自動的にデータの脆弱性を判定することが可能になる。従って、分析官の負担が大幅に軽減され、新たな脆弱性に対する対処に要する時間も短縮することが可能になる。
As a result, if vulnerable software is already recorded, it will be possible to automatically determine the vulnerability of the data without the need for analysis by analysts. Therefore, the burden on analysts is greatly reduced, and the time required to deal with new vulnerabilities can be shortened.
（２）車両内のソフトウェアが有するパラメータが記録されたデータ辞書部をさらに備え、ソフトウェア特定部は、データ辞書部を参照することで車両のデータを生成したソフトウェアを特定する。これにより、予めデータ辞書部を用意しておくことによって、ソフトウェアの特定を迅速に行うことが可能になっている。
(2) The vehicle further includes a data dictionary section in which parameters of software in the vehicle are recorded, and the software identification section identifies the software that generated the vehicle data by referring to the data dictionary section. As a result, by preparing the data dictionary section in advance, it is possible to quickly specify the software.
（３）データ分析部は、さらにソフトウェアを構成するコンポーネントが有する脆弱性情報に基づいてデータの脆弱性を分析する。これにより、ソフトウェアだけでは脆弱性が判定できない場合であっても、より詳細に脆弱性を分析することが可能になっている。
(3) The data analysis unit further analyzes the vulnerability of data based on the vulnerability information possessed by the components that make up the software. This makes it possible to analyze vulnerabilities in more detail even when vulnerabilities cannot be determined by software alone.
（４）脅威を示すアラート情報を格納するアラート情報蓄積部をさらに備え、データから脆弱性が検出され、かつ当該データを生成したソフトウェアが特定できた場合、脆弱性が検出されたデータに関する情報をアラート情報蓄積部に格納する。これにより、アラートが検出されたデータを逐次記憶しておくことが可能になり、脆弱性分析の精度・速度を向上させることが可能になる。
(4) further comprising an alert information storage unit that stores alert information indicating a threat, and when a vulnerability is detected from data and the software that generated the data is identified, the information on the data in which the vulnerability is detected is stored; Store in the alert information accumulation unit. As a result, it becomes possible to sequentially store the data in which alerts are detected, and it becomes possible to improve the accuracy and speed of vulnerability analysis.
（５）インシデント情報を格納するインシデント情報蓄積部をさらに備え、脆弱性が検出されたデータの深刻度が特定できた場合、当該深刻度が特定されたデータに関する情報をインシデント情報蓄積部に格納する。これにより、深刻度が特定されたデータを逐次記憶しておくことが可能になり、（４）と同様に、脆弱性分析の精度・速度を向上させることが可能になる。
(5) Further comprising an incident information accumulation unit for storing incident information, and when the severity of the data in which the vulnerability is detected can be identified, the information on the data for which the severity is identified is stored in the incident information accumulation unit. . As a result, it is possible to sequentially store the data whose severity has been specified, and it is possible to improve the accuracy and speed of vulnerability analysis as in (4).
なお、本発明は上記した実施例に限定されるものではなく、特許請求の範囲に記載された本発明の精神を逸脱しない範囲で、種々の設計変更を行うことができるものである。例えば、上記の実施例は本発明に対する理解を助けるために詳細に説明したものであり、必ずしも説明した全ての構成を備えるものに限定されるものではない。また、ある実施例の構成の一部を他の実施例の構成に置き換えることが可能であり、また、ある実施例の構成に他の実施例の構成を加えることも可能である。また、各実施例の構成の一部について、他の構成の追加・削除・置換をすることが可能である。
The present invention is not limited to the above-described embodiments, and various design changes can be made without departing from the spirit of the invention described in the claims. For example, the above embodiments have been described in detail to facilitate understanding of the present invention, and are not necessarily limited to those having all the described configurations. In addition, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Moreover, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.
Claims (5)
- 車両のデータを分析する情報処理システムであって、
前記車両のデータを収集するデータ収集部と、
前記車両のデータを生成した前記車両内のソフトウェアを特定するソフトウェア特定部と、
前記車両のデータの脆弱性を、前記特定されたソフトウェアが有する脆弱性情報に基づいて分析するデータ分析部と、を備えること、
を特徴とする情報処理システム。 An information processing system for analyzing vehicle data,
a data collection unit that collects data of the vehicle;
a software identification unit that identifies software in the vehicle that generated the vehicle data;
a data analysis unit that analyzes vulnerability of data of the vehicle based on vulnerability information of the identified software;
An information processing system characterized by - 請求項１に記載の情報処理システムにおいて、
前記車両内のソフトウェアが有するパラメータが記録されたデータ辞書部をさらに備え、
前記ソフトウェア特定部は、前記データ辞書部を参照することで前記車両のデータを生成したソフトウェアを特定すること、
を特徴とする情報処理システム。 In the information processing system according to claim 1,
further comprising a data dictionary section in which parameters possessed by software in the vehicle are recorded;
The software identification unit identifies software that generated the vehicle data by referring to the data dictionary unit;
An information processing system characterized by - 請求項１に記載の情報処理システムにおいて、
前記データ分析部は、さらに前記ソフトウェアを構成するコンポーネントが有する脆弱性情報に基づいて前記データの脆弱性を分析すること、
を特徴とする情報処理システム。 In the information processing system according to claim 1,
The data analysis unit further analyzes the vulnerability of the data based on vulnerability information possessed by the components that make up the software;
An information processing system characterized by - 請求項１に記載の情報処理システムにおいて、
脅威を示すアラート情報を格納するアラート情報蓄積部をさらに備え、
前記データから脆弱性が検出され、かつ当該データを生成したソフトウェアが特定できた場合、
脆弱性が検出された前記データに関する情報を前記アラート情報蓄積部に格納すること、
を特徴とする情報処理システム。 In the information processing system according to claim 1,
further comprising an alert information storage unit that stores alert information indicating a threat;
If a vulnerability is detected from the data and the software that generated the data is identified,
storing information about the data in which the vulnerability is detected in the alert information storage unit;
An information processing system characterized by - 請求項４に記載の情報処理システムにおいて、
インシデント情報を格納するインシデント情報蓄積部をさらに備え、
前記脆弱性が検出されたデータの深刻度が特定できた場合、
当該深刻度が特定された前記データに関する情報を前記インシデント情報蓄積部に格納すること、
を特徴とする情報処理システム。 In the information processing system according to claim 4,
further comprising an incident information storage unit for storing incident information,
If the severity of the data in which the vulnerability is detected can be identified,
storing information about the data for which the severity is specified in the incident information storage unit;
An information processing system characterized by
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| JP2021142113A JP2023035334A (en) | 2021-09-01 | 2021-09-01 | Information processing system |
| JP2021-142113 | 2021-09-01 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023032279A1 true WO2023032279A1 (en) | 2023-03-09 |
Family
ID=85412420
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/JP2022/009964 WO2023032279A1 (en) | 2021-09-01 | 2022-03-08 | Information processing system |
Country Status (2)
| Country | Link |
|---|---|
| JP (1) | JP2023035334A (en) |
| WO (1) | WO2023032279A1 (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2019129527A (en) * | 2018-01-22 | 2019-08-01 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ | Data analysis device and program |
| JP2019133599A (en) * | 2018-02-02 | 2019-08-08 | クラリオン株式会社 | On-vehicle device and incident monitoring method |
| JP2020021309A (en) * | 2018-08-01 | 2020-02-06 | 株式会社野村総合研究所 | Vulnerability management system and program |
-
2021
- 2021-09-01 JP JP2021142113A patent/JP2023035334A/en active Pending
-
2022
- 2022-03-08 WO PCT/JP2022/009964 patent/WO2023032279A1/en unknown
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2019129527A (en) * | 2018-01-22 | 2019-08-01 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ | Data analysis device and program |
| JP2019133599A (en) * | 2018-02-02 | 2019-08-08 | クラリオン株式会社 | On-vehicle device and incident monitoring method |
| JP2020021309A (en) * | 2018-08-01 | 2020-02-06 | 株式会社野村総合研究所 | Vulnerability management system and program |
Also Published As
| Publication number | Publication date |
|---|---|
| JP2023035334A (en) | 2023-03-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11363045B2 (en) | Vehicle anomaly detection server, vehicle anomaly detection system, and vehicle anomaly detection method | |
| EP3699794A1 (en) | System and method for detecting exploitation of a component connected to an in-vehicle network | |
| JP7194396B2 (en) | Specially programmed computing system with associated devices configured to implement secure lockdown and method of use | |
| US10270786B2 (en) | Automated security policy generation for controllers | |
| JP7194184B2 (en) | Systems and methods for connected vehicle cyber security | |
| US11636206B2 (en) | Deferred malware scanning | |
| CN113661693A (en) | Detecting sensitive data exposure via logs | |
| JP2020530624A5 (en) | ||
| US20070067623A1 (en) | Detection of system compromise by correlation of information objects | |
| WO2020261262A1 (en) | Systems and methods for assessing risk in networked vehicle components | |
| JP7253663B2 (en) | MONITORING DEVICE, MONITORING SYSTEM AND MONITORING METHOD | |
| CN109784055B (en) | Method and system for rapidly detecting and preventing malicious software | |
| JP2023515379A (en) | SYSTEM AND METHOD FOR INTRUSION DETECTION FOR IN-VEHICLE NETWORK | |
| WO2020075801A1 (en) | Information processing device, abnormality analyzing method, and program | |
| US20220019661A1 (en) | Log analysis device | |
| KR102338998B1 (en) | System and method for checking log integrity and proving forgery and alteration activity of log through the same | |
| WO2023032279A1 (en) | Information processing system | |
| CN110086812B (en) | Safe and controllable internal network safety patrol system and method | |
| WO2020075808A1 (en) | Information processing device, log analysis method, and program | |
| CN109684826B (en) | Application sandbox anti-escape method and electronic equipment | |
| CN115348052A (en) | Multi-dimensional blacklist protection method, device, equipment and readable storage medium | |
| Du et al. | A Multi-source Alarm Information Fusion Processing Method for Network Attack Situation | |
| WO2023048187A1 (en) | Vehicle security analysis device and method, and program therefor | |
| CN117056909A (en) | Intrusion detection in a computer system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22863869 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |