WO2024089723A1

WO2024089723A1 - Cyber attack detection device and cyber attack detection method

Info

Publication number: WO2024089723A1
Application number: PCT/JP2022/039427
Authority: WO
Inventors: 俊樹池頭; 克久小笠原; 祐介瀬戸
Original assignee: 三菱電機株式会社
Priority date: 2022-10-24
Filing date: 2022-10-24
Publication date: 2024-05-02

Abstract

This cyber attack detection device comprises: a communication header monitoring unit that monitors a header of received communication data; a communication monitoring unit that monitors a payload of the communication data; an attack detection unit that detects, from the communication data, signs of a DoS attack which would lead to the function failure of the communication monitoring unit; an additional information request unit that identifies a transmission source from the communication data when the signs are detected, and requests the identified transmission source to add additional information to a header of communication data to be newly transmitted; and an update unit that, when the signs are detected, performs an update determination for adding the additional information as a monitored item. The communication header monitoring unit adds the additional information as a monitored item on the basis of the update determination, and determines that newly received communication data is abnormal when the additional information has not been added to the header of the newly received communication data, or when the information added to the header of the newly received communication data does not match the additional information.

Description

Cyber attack detection device and cyber attack detection method

This disclosure relates to cyber attack detection technology.

Patent Document 1 discloses, as an example of a cyber-attack detection technology, a technology relating to an in-vehicle network device that communicates data between multiple in-vehicle devices, which has a status acquisition unit that acquires the status of the vehicle itself and a communication monitoring unit that monitors the data, and which changes the method of monitoring the data based on the status of the vehicle itself.

JP 2017-47835 A

The device disclosed in Patent Document 1 only changes the monitoring method depending on the state, so there is a problem that the communication monitoring unit may stop functioning if it is attacked by sending a large amount of communication data, known as a DoS (Denial of Service) attack.

This disclosure has been made to solve these problems, and aims to provide cyber-attack detection technology that can deal with DoS attacks.

One aspect of the cyber attack detection device disclosed herein includes a communication header monitoring unit that monitors the header of received communication data, a communication monitoring unit that monitors the payload of the communication data, an attack detection unit that detects from the communication data a sign of a DoS attack that will cause the communication monitoring unit to malfunction, an additional information request unit that, when the sign is detected, identifies a sender from the communication data and requests the identified sender to add additional information to the header of newly sent communication data, and an update unit that makes an update decision to add the additional information as a monitoring item when the sign is detected, and the communication header monitoring unit adds the additional information as a monitoring item based on the update decision, and if the additional information has not been added to the header of the newly received communication data or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal.

The cyber attack detection technology disclosed herein can deal with DoS attacks.

FIG. 2 is a functional block diagram of a control device. 11 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. 11 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. 11 is an explanatory diagram for explaining an operation of a communication header monitoring unit for determining that communication data is abnormal; FIG. 11 is a flowchart showing an abnormality detection process when no DoS attack is occurring; 11 is a flowchart showing a sign determination process for determining a sign of a DoS attack. 11 is a flowchart showing an anomaly detection process when a sign of a DoS attack is detected.

Various embodiments of the present disclosure will be described in detail below with reference to the attached drawings. Note that components with the same or similar reference numerals in the drawings have the same or similar configurations or functions, and redundant descriptions of such components will be omitted.

Embodiment 1.
<Outline of configuration>
(Control device)
1 is a functional block diagram of an on-vehicle electronic control device (hereinafter, simply referred to as a "control device") when the cyber-attack detection device of the present disclosure is applied as the control device. The control device 10 is a device that controls a vehicle (not shown). The control device 10 is connected to another control device (not shown) inside the vehicle via a communication line (not shown), for example, Ethernet or a CAN (Controller Area Network). The control device 10 includes a VM (Virtual Machine) 20, a network switch 30, hardware 40, and a hypervisor 50.

(Network Switch)
The network switch 30 is a network switch that connects the control device 10 to another control device (not shown) inside the vehicle. The network switch 30 is, for example, an Ethernet switch equipped with a security function. As an example, as shown in Fig. 1, the network switch 30 may include a communication header monitoring unit 100 and monitor the header of communication data. The function or operation of the communication header monitoring unit 100 will be described in more detail later.

(VM)
The VM (Virtual Machine) 20 is a virtual machine that has a function of controlling a vehicle. For example, the VM 20 includes Linux (registered trademark) which is an operating system (OS). The VM 20 includes a communication monitoring unit 101, an attack detection unit 103, an additional information request unit 104, an update unit 105, and an encryption unit 109. Details of these functional units will be described later.

(hardware)
The hardware 40 is the hardware of the control device 10, and includes a processor 401 and a memory 402. The hardware 40 may include a function of routing communication data and a security function.

The processor 401 executes the programs stored in the memory 402 to perform the functions executed by each functional unit of the VM 20. The processor 401 also executes the programs stored in the memory 402 to perform the functions executed by the communication header monitoring unit 100. Examples of the memory 402 include non-volatile or volatile semiconductor memory such as RAM (random access memory), ROM (read-only memory), flash memory, EPROM (erasable programmable read-only memory), and EEPROM (electrically erasable programmable read-only memory), as well as magnetic disks, flexible disks, optical disks, compact disks, mini disks, and DVDs.

(Hypervisor)
The hypervisor 50 is a hypervisor for the control device 10, and is software for running one or more VMs 20 on the hardware 40. Generally, a hypervisor is software for running a plurality of different operating systems simultaneously on the hardware, so when the control device 10 includes a single VM 20, the hypervisor 50 may not be necessary. The hypervisor 50 may include a function for routing communication data and a security function.

<Details of configuration>
(Communication header monitoring unit)
As an example, the network switch 30 may include a communication header monitoring unit 100 that includes an abnormality determination unit 102A.

The communication header monitoring unit 100 is a functional unit that has a function of transmitting and receiving communication data to and from a control device (not shown) other than the control device 10, and inspecting the header of the communication data. The communication header monitoring unit 100 transmits and receives communication data, for example, of Ethernet communication, and inspects the header of the communication data.

The abnormality determination unit 102A holds a list of normal communication data as normal values, and has the function of comparing the monitoring results with the normal values using newly acquired communication data as the monitoring results. The list of normal communication data is created by a control unit (not shown) of the VM 20 when the control device 10 is operating normally, and is held in memory. The abnormality determination unit 102A acquires and holds this created list by referring to the memory.

Inspection of the header of communication data includes, for example, layer 2 inspection, layer 3 inspection, or layer 4 inspection for Ethernet communication data.

Layer 2 inspections include, for example, inspection of the source MAC (Media Access Control) address, the destination MAC address, and inspection of the VLAN (Virtual LAN) port.

Layer 3 inspections include, for example, inspection of the source IP (Internet Protocol) address and the destination IP address.

Layer 4 inspections include, for example, inspection of source port number, destination port number, and TCP (Transmission Control Protocol) flags.

In FIG. 1, the network switch 30 is shown equipped with a communication header monitoring unit 100, but the communication header monitoring unit 100 may be located in any of the hardware 40, the hypervisor 50, or the VM 20. A communication header monitoring unit may also be located for each layer. For example, the network switch 30 may be provided with a communication header monitoring unit that inspects layer 2, and the hardware 40 may be provided with a communication header monitoring unit that inspects layers 3 and 4.

(Communications Monitoring Department)
The communication monitoring unit 101 includes an abnormality determination unit 102B, and monitors the area other than the header of the communication data monitored by the communication header monitoring unit 100, i.e., the payload information. The payload information includes, for example, the data, reception cycle, and reception frequency of the communication data.

The communication monitoring unit 101 may monitor the headers of the communication data monitored by the communication header monitoring unit 100. By configuring the communication monitoring unit 101 to monitor the headers of the communication data in addition to the communication header monitoring unit 100, it is possible for the communication monitoring unit 101 to monitor the headers of the communication data even when the communication header monitoring unit 100 is not operating normally.

The abnormality determination unit 102B holds a list of normal communication data as normal values, and has the function of comparing the monitoring results with normal values using newly acquired communication data as monitoring results. The list of normal communication data is created by a control unit (not shown) of the VM 20 when the control device 10 is operating normally, and is stored in memory. The abnormality determination unit 102B acquires and stores this created list by referencing the memory. If the comparison result between the monitoring results and the normal values does not match, the abnormality determination unit 102B determines that the newly acquired communication data is abnormal.

If the abnormality determination unit 102B determines that the newly acquired communication data is abnormal, it can cut off communication as an abnormality response process. Other abnormality response processes may also be implemented. Other abnormality response processes include, for example, switching the communication line, switching the control device 10 to a standby control device, and degrading the functions of the control device 10. If it determines that the newly acquired communication data is normal, the normal control process of the control device 10 continues to be executed.

(Attack detection section)
The attack detection unit 103 is a functional unit that performs a sign determination function to determine whether or not there is a sign of a DoS attack as an incident. If a DoS attack occurs, the communication monitoring unit 101 will not function, so by detecting a sign of a DoS attack, the communication monitoring unit 101 is prevented from malfunctioning. Additionally, the attack detection unit 103 may perform an attack end determination function to determine that there is no attack when the DoS attack subsides. In order to perform the sign determination function and the additional attack end determination function, the attack detection unit 103 includes a communication bandwidth monitoring unit 106, a resource monitoring unit 107, a memory monitoring unit 108, and an attack determination unit 120.

(Communication Bandwidth Monitoring Unit)
The communication band monitoring unit 106 is a functional unit that monitors the communication band usage, which is the usage of the communication band used by the communication monitoring unit 101 when receiving communication data, and determines whether there is a margin in the communication band. For example, an upper limit is set from the normal communication band, and if the communication band exceeds the set upper limit, it is determined that there is an abnormality.

(Resource Monitoring Unit)
The resource monitoring unit 107 has a function of monitoring the processing load of the communication monitoring unit 101 and judging whether there is a margin for the processing load. For example, the resource monitoring unit 107 compares the normal processor usage rate with the current processor usage rate for the processor assigned to the resource monitoring unit 107 and judges whether there is an abnormality.

(Memory monitoring section)
The memory monitoring unit 108 has a function of monitoring the memory usage of the communication monitoring unit 101 and determining whether there is sufficient memory space. For example, the memory monitoring unit 108 compares the normal memory usage with the current memory usage of the memory allocated to the memory monitoring unit 108 and determines whether there is an abnormality.

(Attack determination section)
The attack determination unit 120 determines whether there is a sign of an incident due to a DoS attack based on the monitoring results of the communication band monitoring unit 106, the resource monitoring unit 107, and the memory monitoring unit 108. The attack determination unit 120 may determine that there is a sign when all of the monitoring results of the communication band monitoring unit 106, the resource monitoring unit 107, and the memory monitoring unit 108 are abnormal, or may determine that there is a sign when any one of the monitoring results is abnormal. Furthermore, the state of the vehicle may also be taken into consideration to determine whether there is a sign of an incident. For example, a strict upper limit on the processing load may be set while the vehicle is traveling.

The attack detection unit 103 may operate based on the abnormality result of the communication monitoring unit 101. For example, it may be configured to operate when the abnormality result of the communication monitoring unit 101 is a periodic abnormality.

When the attack detection unit 103 detects a sign of an incident, it transmits the detection result indicating the presence of the sign to the additional information request unit 104 and the update unit 105.

(Additional Information Request Department)
The additional information requesting unit 104 is a functional unit that, when the attack detection unit 103 determines that there is a sign of an incident, identifies a sender from a large amount of received communication data and requests the sender to add additional information to the header of communication data to be newly sent. For example, in the case of an attack in which the IP address of a legitimate device is spoofed, a large amount of communication data of the spoofed legitimate device is received, so the additional information requesting unit 104 requests the sender to add additional information to the header, with the spoofed legitimate device as the sender.

In addition, identifying the sender includes not only uniquely identifying the sender's address, but also narrowing it down to a certain extent.

The additional information is dynamic information that changes with each transmission or over time, or encrypted information in which dynamic information is encrypted. Examples of dynamic information include counter values and timestamps.

The additional information requesting unit 104 may select a random value or a random item as the additional information. As one example, the additional information requesting unit 104 selects a counter value that counts up from a random number as the additional information. As one example, the additional information requesting unit 104 randomly selects a counter value and a timestamp as the additional information. In other words, rather than selecting a counter value every time, sometimes the counter value is selected and sometimes the timestamp is selected.

The additional information request unit 104 may request that information encrypted using a specific encryption key, which will be described later, be added as additional information.

In addition, if the attack detection unit 103 no longer detects any signs of an incident after requesting that additional information be added, the additional information requesting unit 104 may issue a removal request to the sender to remove the additional information that it has requested the sender to add.

The additional information requested by the additional information request unit 104 is sent to the sender and also transmitted to the update unit 105. In one embodiment, the additional information may also be transmitted to the encryption unit 109.

(Encryption section)
The encryption unit 109 is a functional unit that encrypts the additional information requested by the additional information request unit 104. The encryption unit 109 encrypts, for example, a counter value or a timestamp. For encryption, for example, a Message Authentication Code (MAC), a common key encryption, or a public key encryption is used.

The encryption key used by the encryption unit 109 is assumed to be held in advance by the legitimate sender. In other words, the control device 10 and the legitimate sender hold the same common key.

The encryption process is performed by the VM 20 or the hardware 40. For example, the encryption is performed using a high-speed HSM (Hardware Security Module).

(Update Department)
The update unit 105 is a functional unit that makes an update judgment to add additional information to the monitoring items of the communication data when the additional information request unit 104 requests the sender to add additional information to the header of the communication data. Based on this update judgment, the monitoring items by the communication header monitoring unit 100 are updated. The updating of the monitoring items may be performed by the update unit 105 or the communication header monitoring unit 100. When the communication header monitoring unit 100 updates the monitoring items, the updating unit 105 transmits an instruction to the communication header monitoring unit 100 to update the monitoring items based on the update judgment. A part of the communication data may be monitored as binary.

In addition, when a removal request is made by the additional information requesting unit 104 to remove the additional information, the updating unit 105 may make a removal update judgment to remove the additional information from the monitoring items of the communication data. Based on this update judgment, the monitoring items by the communication header monitoring unit 100 are updated. In other words, the additional information is removed from the monitoring items by the communication header monitoring unit 100.

(Details of the abnormality detection method)
Hereinafter, a detailed procedure of an anomaly determination method in which the communication header monitoring unit 100 determines that communication data is abnormal will be described with reference to FIG. 2 to FIG.

Figure 2 shows a method in which additional information is added to the monitoring items of the communication header monitoring unit 100, and a case in which no additional information is present in the header of the communication data is determined to be an abnormality. The newly connected unauthorized device B is attempting to launch a DoS attack on the control device 10 by spoofing the IP address in the header of legitimate device A.

In the control device 10, the attack detection unit 103 detects signs of an incident (DoS attack). If a sign is detected, the additional information request unit 104 identifies the sender from the large amount of communication data received and requests the sender to add additional information. Also, if a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

The control device 10 (additional information request unit 104) requests the legitimate device A, which is the sender, to add additional information. On the other hand, since the fraudulent device B is merely masquerading as legitimate device A, the communication data requesting additional information does not reach the fraudulent device B.

After requesting to add the additional information, regular device A sends communication data with the additional information added to the header to the control device 10. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from regular device A is normal based on the monitoring results of the communication header monitoring unit 100.

On the other hand, the unauthorized device B transmits communication data to the control device 10 without adding any additional information to the header. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from the unauthorized device B is abnormal based on the monitoring results of the communication header monitoring unit 100. If an abnormality is determined, the communication header monitoring unit 100 may block communication with the unauthorized device B.

In this way, it is possible to detect abnormalities in communication data when an attack using a spoofed IP address is made. In addition, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

Figure 3 shows a method in which additional information is added to the monitoring items of the communication header monitoring unit 100, and if the additional information added to the header of the communication data is incorrect, it is determined to be an anomaly. The newly connected fraudulent device B is eavesdropping on the communication of legitimate device A, spoofing the IP address in the header of legitimate device A, and adding mimicking additional information, in an attempt to perform a DoS attack on the control device 10.

In the control device 10, the attack detection unit 103 detects signs of an incident. If a sign is detected, the additional information request unit 104 identifies the sender from the large amount of communication data received and requests the sender to add additional information. In the example of Figure 3, the additional information is a counter value. Furthermore, if a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

The control device 10 (additional information request unit 104) requests the legitimate device A, which is the sender, to add additional information. On the other hand, since the unauthorized device B is merely masquerading as legitimate device A, the communication data requesting additional information does not reach unauthorized device B. However, unauthorized device B eavesdrops on the communication of legitimate device A and confirms that additional information has been added.

After requesting to add the additional information, regular device A sends communication data to the control device 10 with the correct additional information counter value of 1 added to the header. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from regular device A is normal based on the monitoring results of the communication header monitoring unit 100.

On the other hand, unauthorized device B eavesdrops on legitimate device A's communications, spoofs the IP address in the header of legitimate device A, and sends communication data to the control device 10 with the intercepted additional information of a counter value of 1. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from unauthorized device B is abnormal based on the monitoring results of the communication header monitoring unit 100, since the counter value has not been counted up. If an abnormality is determined, the communication header monitoring unit 100 may block communication with unauthorized device B.

In this way, it is possible to detect abnormalities in communication data when a replay attack is launched by spoofing an IP address. In addition, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

FIG. 4 shows a method in which additional information is added to the monitoring items of the communication header monitoring unit 100, and an abnormality is determined if the encrypted additional information added to the header of the communication data is incorrect. The newly connected fraudulent device B is eavesdropping on the communication of legitimate device A, spoofing the MAC address in the header of legitimate device A, and impersonating legitimate device A to add imitation additional information to the control device 10, in an attempt to launch a DoS attack.

In the control device 10, the attack detection unit 103 detects signs of an incident. If a sign is detected, the additional information request unit 104 identifies the sender from the large amount of communication data received, and requests the sender to add additional information in which specified information is encrypted. In the example of Figure 4, the additional information is an encrypted counter value. Furthermore, if a sign is detected, the update unit 105 makes an update decision to add the additional information as a monitoring item in the communication header monitoring unit 100, and the additional information is added as a monitoring item in the communication header monitoring unit 100 based on this update decision.

The control device 10 (additional information request unit 104) requests the legitimate device A, which is the sender, to add additional information in which the counter value is encrypted. On the other hand, since the unauthorized device B has spoofed the MAC address of the legitimate device A, the communication data requesting additional information also reaches the unauthorized device B.

After requesting to add the additional information, regular device A sends additional information 0110, which is an encrypted counter value, to the header of the control device 10. In the control device 10 that receives this communication data, the abnormality determination unit 102A determines that the communication data from regular device A is normal based on the monitoring results of the communication header monitoring unit 100.

On the other hand, unauthorized device B eavesdrops on legitimate device A's communications with the control device 10, spoofs the header of legitimate device A, and sends the eavesdropped additional information 0110 to the control device 10. In the control device 10 that receives this communication data, the abnormality determination unit 102 determines that the communication data from unauthorized device B is abnormal because the counted-up counter value is not encrypted additional information, based on the monitoring results of the communication header monitoring unit 100. If an abnormality is determined, the communication header monitoring unit 100 may block communication with unauthorized device B.

In this way, it is possible to detect abnormalities in communication data when a replay attack is launched by spoofing a MAC address. In addition, since abnormal communication is blocked based on the signs of a DoS attack, it is possible to deal with a DoS attack.

<Operation>
Hereinafter, the operation of the control device 10 in relation to the cyber-attack detection method will be described with reference to FIGS.

(Abnormality detection process when no DoS attack is occurring)
First, the abnormality detection process performed by the control device 10 when it is not under a DoS attack will be described in detail with reference to Fig. 5. Fig. 5 is a flowchart showing the flow of a series of processes from the communication data reception process, through the abnormality determination process, to the execution of the determination result process.

In step S201, the communication header monitoring unit 100 receives communication data. After the processing in step S201 ends, the processing proceeds to step S202.

In step S202, the communication header monitoring unit 100 inspects the header of the communication data. The abnormality determination unit 102A compares the monitoring result of the communication header monitoring unit 100 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S202, processing proceeds to step S204. If no abnormality (normality) is determined in step S202, processing proceeds to step S203.

In step S203, the communication monitoring unit 101 inspects the data in the areas other than the header of the communication data. The abnormality determination unit 102B compares the monitoring results of the communication monitoring unit 101 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S203, the process proceeds to step S204. If a normality is determined in step S203, the process proceeds to step S205.

If the abnormality determination unit 102A or the abnormality determination unit 102B determines that an abnormality exists, in step S204, the abnormality determination unit 102A or the abnormality determination unit 102B performs abnormality processing. For example, the abnormality determination unit 102A or the abnormality determination unit 102B cuts off communication that has been determined to be abnormal. After step S204 ends, the abnormality detection processing ends.

If abnormality determination unit 102A and abnormality determination unit 102B determine that the system is normal in step S205, abnormality determination unit 102A and abnormality determination unit 102B perform normal processing. Normal processing refers to normal control processing. After step S205 ends, the abnormality detection processing ends.

(Process for determining a DoS attack sign)
Next, the sign determination process in which the control device 10 determines whether there is a sign of a DoS attack will be described in detail with reference to Fig. 6. Fig. 6 is a flow chart showing the flow of a series of processes from determining whether there is a sign of an incident (DoS attack), identifying the source of transmission, requesting the source of transmission to add additional information, and updating the header monitoring items to add the additional information.

In step S301, the communication bandwidth monitoring unit 106 monitors the communication bandwidth of the communication monitoring unit 101. If the communication bandwidth exceeds a predetermined threshold, it is determined that an abnormality has occurred. If an abnormality has been determined in step S301, the process proceeds to step S302.

In step S302, the resource monitoring unit 107 monitors the processing load of the communication monitoring unit 101. If the processing load exceeds a predetermined threshold, it is determined that an abnormality exists. If an abnormality is determined in step S302, the process proceeds to step S303.

In step S303, the memory monitoring unit 108 monitors the memory usage of the communication monitoring unit 101. If the memory usage exceeds a predetermined threshold, it is determined to be an abnormality. After step S303 is completed, if an abnormality is determined, the process proceeds to step S304. Note that steps S301, S302, and S303 may be performed in any order.

In step S304, the attack determination unit 120 determines whether there are signs of an incident caused by a DoS attack based on the abnormality result of the communication bandwidth monitoring unit 106, the abnormality result of the resource monitoring unit 107, and the abnormality determination result of the memory monitoring unit 108. The attack determination unit 120 may determine that there are signs of an incident when any of the abnormality determination results indicate an abnormality. If it is determined in step S304 that there are signs of an incident, the process proceeds to step S305.

In step S305, the additional information request unit 104 identifies the sender from the large amount of received data. After the process in step S305 ends, the process proceeds to step S306.

In step S306, the additional information requesting unit 104 requests the identified sender to add additional information. The additional information requesting unit 104 may request encrypted information as additional information. In this case, the encryption unit 109 encrypts the expected value of the monitored item (e.g., a counter value) and sets the encrypted data as additional information. After the processing in step S306 is completed, the process proceeds to step S307.

In step S307, the update unit 105 makes an update decision to add the additional information requested by the additional information request unit 104 to the sender as a monitoring item of the communication data. Based on this update decision, as one example, the update unit 105 adds the requested additional information to the monitoring items of the communication header monitoring unit 100. As another example, the communication header monitoring unit 100 may add the requested additional information to the monitoring items. After the processing in step S307 ends, the incident sign determination processing ends.

(Abnormality detection process when a DoS attack sign is detected)
Next, the abnormality detection process when the control device 10 detects a sign of a DoS attack will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing the flow of a series of processes from the communication data reception process, through the abnormality detection process, to the execution of the determination result process.

In step S401, the communication header monitoring unit 100 receives communication data. After the processing in step S401 ends, the processing proceeds to step S402.

In step S402, the communication header monitoring unit 100 inspects the header of the communication data. The abnormality determination unit 102A compares the monitoring result of the communication header monitoring unit 100 with a list of normal communication data to which additional information has been added, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S402, processing proceeds to step S404. If no abnormality (normality) is determined in step S402, processing proceeds to step S403.

In step S403, the communication monitoring unit 101 inspects the data in the areas other than the header of the communication data. The abnormality determination unit 102B compares the monitoring results of the communication monitoring unit 101 with a list of normal communication data, and determines whether the abnormality is due to invalid data. If an abnormality is determined in step S403, the process proceeds to step S404. If a normality is determined in step S403, the process proceeds to step S405.

If the abnormality determination unit 102A or the abnormality determination unit 102B determines that there is an abnormality, in step S404, the abnormality determination unit 102A or the abnormality determination unit 102B performs abnormality processing. For example, the abnormality determination unit 102A or the abnormality determination unit 102B cuts off communication that has been determined to be abnormal. After step 404 ends, the abnormality detection processing ends.

If abnormality determination unit 102A and abnormality determination unit 102B determine that the system is normal in step S405, abnormality determination unit 102A and abnormality determination unit 102B perform normal processing. Normal processing refers to normal control processing. After step 405 ends, the abnormality detection processing ends.

In the above-described first embodiment, an example has been described in which the cyber-attack detection device according to the present disclosure is used as an in-vehicle electronic control device. However, the cyber-attack detection device according to the present disclosure is not limited to this example. For example, it can also be used as a device connected to a communication line that has high security strength and requires a mechanism for early detection of abnormalities.

The above-described embodiment 1 provides the following advantages:

One aspect of the control device (cyber attack detection device) of the present disclosure includes a communication header monitoring unit (100) that monitors the header of received communication data, a communication monitoring unit (101) that monitors the payload of the communication data, an attack detection unit (103) that detects from the communication data a sign of a DoS attack that will cause the communication monitoring unit to malfunction, an additional information request unit (104) that identifies a source from the communication data when the sign is detected and requests the identified source to add additional information to the header of communication data to be newly sent, and an update unit (105) that makes an update decision to add the additional information as a monitoring item when the sign is detected, and the communication header monitoring unit (100) adds the additional information as a monitoring item based on the update decision, and if the additional information has not been added to the header of the newly received communication data or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal.

In this way, a sign of a DoS attack is detected, a request is made to the sender to add additional information to the header of the transmitted data, and monitoring is performed to see whether the requested additional information has been added. Therefore, since a DoS attack is dealt with in advance before it is carried out, the control device (cyber attack detection device) disclosed herein can deal with DoS attacks.

In addition, according to one aspect of the control device (cyber attack detection device) disclosed herein, if the communication header monitoring unit determines that the newly received communication data is abnormal, it blocks communication with the sender. Therefore, since there is no need for the communication monitoring unit, which monitors the payload, to process a large amount of received data, the processing load on the communication monitoring unit can be reduced.

Furthermore, according to one aspect of the control device (cyber attack detection device) of the present disclosure, if no signs of a DoS attack are detected after a request to add additional information is made, a request is made to remove the additional information for which the request to add was made. In this way, by dynamically adding additional information, it is possible to increase the possibility of preventing eavesdropping and spoofing attacks carried out through guesswork.

Furthermore, according to one aspect of the control device (cyber attack detection device) disclosed herein, the additional information is dynamic information that changes with each transmission or over time. In this way, by adding additional information whose value changes dynamically, it is possible to prevent attacks even if the data is intercepted and a replay attack is carried out.

Furthermore, according to one aspect of the control device (cyberattack detection device) of the present disclosure, the dynamic information is a timestamp or a counter value, and the additional information request unit randomly selects the timestamp or counter value as the additional information, and when the counter value is selected, the counter value is counted up from a random value. Therefore, it is possible to increase the possibility of preventing eavesdropping and spoofing attacks carried out by guessing.

In addition, one aspect of the control device (cyber attack detection device) disclosed herein further includes an encryption unit (109) that encrypts the dynamic information into encrypted information using a predetermined encryption key, and the additional information request unit requests the sender to add information obtained by encrypting the dynamic information using the encryption key as the additional information, and the update unit makes a further update decision to add the encrypted information as a monitoring item when the symptom is detected, and the communication header monitoring unit adds the encrypted information as a monitoring item based on the further update decision, and when the encrypted information has not been added to the header of the newly received communication data or when the information added to the header of the newly received communication data does not match the encrypted information, the newly received communication data is determined to be abnormal.

This configuration makes it possible to deal with DoS attacks that involve spoofing MAC addresses.

In addition, it is possible to combine the embodiments, and modify or omit each embodiment as appropriate.

The cyberattack detection device disclosed herein can be used, for example, as an electronic control device mounted on a vehicle.

10 Control device (cyber attack detection device), 30 Network switch, 40 Hardware, 50 Hypervisor, 100 Communication header monitoring unit, 101 Communication monitoring unit, 102 (102A, 102B) Anomaly determination unit, 103 Attack detection unit, 104 Additional information request unit, 105 Update unit, 106 Communication bandwidth monitoring unit, 107 Resource monitoring unit, 108 Memory monitoring unit, 109 Encryption unit, 120 Attack determination unit, 401 Processor, 402 Memory.

Claims

a communication header monitoring unit that monitors the header of received communication data;
a communication monitoring unit that monitors a payload of the communication data;
an attack detection unit that detects a sign of a DoS attack that may cause a malfunction of the communication monitoring unit from the communication data;
an additional information request unit that, when the sign is detected, identifies a source from the communication data and requests the identified source to add additional information to a header of communication data to be newly transmitted;
an update unit that determines whether to add the additional information as a monitoring item when the symptom is detected;
Equipped with
the communication header monitoring unit adds the additional information as a monitoring item based on the update determination, and if the additional information has not been added to a header of the newly received communication data, or if the information added to the header of the newly received communication data does not match the additional information, determines that the newly received communication data is abnormal.
Cyber attack detection device.
When the communication header monitoring unit determines that the newly received communication data is abnormal, the communication header monitoring unit cuts off communication with the transmission source.
The cyber attack detection device according to claim 1.
The attack detection unit is
a communication band monitoring unit that monitors a communication band usage amount of the communication band used by the communication monitoring unit;
a resource monitoring unit that monitors a processing load of the communication monitoring unit;
a memory monitoring unit that monitors the memory usage of the communication monitoring unit;
an attack determination unit that determines the presence of the warning sign based on all or a part of the communication bandwidth usage, the processing load, and the memory usage;
Equipped with
A cyber attack detection device according to claim 1 or 2.
If the sign is not detected after the request is made,
the additional information request unit issues a removal request to the identified transmission source to remove the additional information for which addition has been requested;
the update unit makes a removal/update decision to remove the additional information from the monitoring items,
the communication header monitoring unit removes the additional information that has been added as a monitoring item based on the removal/update determination.
A cyber attack detection device according to any one of claims 1 to 3.
The cyber attack detection device according to any one of claims 1 to 4, wherein the additional information is dynamic information that changes with each transmission or over time.
the communication header monitoring unit determines that the newly received communication data is abnormal if the value of the dynamic information does not increase or exceeds a predetermined upper limit value;
A cyber attack detection device according to claim 5.
the dynamic information is a timestamp or a counter value;
the additional information request unit randomly selects the time stamp or the counter value as the additional information, and when the counter value is selected, the counter value is counted up from a random value;
A cyber attack detection device according to claim 5 or 6.
An encryption unit that encrypts the dynamic information into encrypted information using a predetermined encryption key,
the additional information request unit requests the transmission source to add information obtained by encrypting the dynamic information using the encryption key as the additional information;
the update unit, when the symptom is detected, makes a further update decision to add the encryption information as a monitoring item;
the communication header monitoring unit adds the encryption information as a monitoring item based on the further update determination, and if the encryption information has not been added to a header of the newly received communication data, or if the information added to the header of the newly received communication data does not match the encryption information, determines that the newly received communication data is abnormal.
A cyber attack detection device according to claim 5.
The cyber attack detection device according to claim 8, wherein the dynamic information is a timestamp or a counter value.
A cyber-attack detection method performed by a cyber-attack detection device including a communication header monitoring unit, a communication monitoring unit, an attack detection unit, an additional information request unit, and an update unit,
a step of the communication header monitoring unit monitoring a header of the communication data to be received;
a step of the communication monitoring unit monitoring a payload of the communication data;
a step of the attack detection unit detecting, from the communication data, a sign of a DoS attack that may cause a malfunction of the communication monitoring unit;
a step of the additional information request unit, when the sign is detected, identifying a source from the communication data and requesting the identified source to add additional information to a header of communication data to be newly transmitted;
a step of the update unit making an update decision to add the additional information as a monitoring item when the symptom is detected;
Equipped with
a step of the communication header monitoring unit adding the additional information as a monitoring item based on the update determination, and determining that the newly received communication data is abnormal if the additional information has not been added to the header of the newly received communication data or if the information added to the header of the newly received communication data does not match the additional information;
Further comprising:
Methods for detecting cyber attacks.