Log analysis device
A log analysis device is provided. The log analysis device receives a log indicating status of an electronic control system mounted in a movable object from the electronic control system, analyzes an abnormality in the electronic control system by using the log received. Depending on a result of the analyzing, the log analysis device determines, on a log-by-log basis, priority for the electronic control system to transmit the log to the log analysis device. Based on the priority determined, the log analysis device generates instruction information that gives an instruction for controlling transmission of the log, and transmits the instruction information to the electronic control system.
1. A log analysis device comprising:
a receiver unit that receives a plurality of logs from an electronic control system mounted in a movable object, each log indicating status of the electronic control system mounted in the movable object;
a log analyzer unit that analyzes an abnormality in the electronic control system by using the plurality of logs received by the receiver unit;
a priority determiner unit that, depending on a result of the analyzing of the plurality of logs by the log analyzer unit, determines, on a log-by-log basis, a priority of each subsequent log of a plurality of subsequent logs for the electronic control system to transmit to the log analysis device;
an instruction generator unit that generates instruction information that provides an instruction for, based on the result of the analyzing of the plurality of logs by the log analyzer unit and based on the priority determined by the priority determiner unit, controlling transmission of each subsequent log; and
a transmitter unit that transmits the instruction information generated by the instruction generator unit to the electronic control system;
wherein:
the log analysis device is provided outside of the movable object and wirelessly communicates with the electronic control system of the movable object;
the plurality of logs and the plurality of subsequent logs each include a log recording a dynamic status that is constantly changing in relation to the electronic control system and a log recording a static status that is unchanging in relation to the electronic control system;
the log analyzer unit, the priority determiner unit, and the instruction generator unit are implemented by a processor and memory storing instructions that are executable by the processor;
the priority determiner unit determines a power supply status of the movable object as one of: the power supply status of the movable object is in an OFF state; an accessory power supply of the movable object is in an ON state; and an ignition power supply of the movable object is in an ON state; and
the priority determiner unit determines the priority of each subsequent log of the plurality of subsequent logs according to a change in the determined power supply status of the movable object.
2. The log analysis device according to claim 1 , wherein
by analyzing the log, the log analyzer unit executes:
a first analysis to detect occurrence of an abnormality in the electronic control system;
a second analysis to make analytics of details of the abnormality detected in the first analysis; and
upon measures against the abnormality being executed, a third analysis to check for status of the electronic control system after the measures.
3. The log analysis device according to claim 2 , wherein
the priority determiner unit
determines first priority depending on a result of the first analysis, and
determines second priority depending on a result of the second analysis, and
the log analyzer unit
executes the second analysis by analyzing a first subsequent log of the plurality of subsequent logs, which is the log that is transmitted from the electronic control system based on the first priority, and
executes the third analysis by analyzing a second subsequent log of the plurality of subsequent logs, which is the log that is transmitted from the electronic control system based on the second priority.
4. The log analysis device according to claim 1 , wherein
the priority determiner unit determines the priority of each subsequent log according to a detection function of a security sensor of the log analyzer unit.
5. The log analysis device according to claim 1 , wherein
the priority determiner unit determines the priority of each subsequent log depending on details of the abnormality detected by the log analyzer unit.
6. The log analysis device according to claim 1 , wherein
the priority determiner unit determines the priority of each subsequent log depending on a type of information protected by an electronic control device included in the electronic control system.
7. The log analysis device according to claim 1 , wherein
the priority determiner unit determines the priority of each subsequent log depending on a power supply status of the electronic control system and a power supply status of an electronic control device included in the electronic control system.
8. The log analysis device according to claim 1 , wherein:
the log analyzer unit analyzes the plurality of logs received by the receiver unit to detect, as the abnormality, a cyber attack on the electronic control system.
9. The log analysis device according to claim 1 , further comprising:
a measures determiner unit, implemented by the processor and memory, configured to determine a measure against a cyber attack;
wherein the measure determiner unit determines the measure against the cyber attack in response to the log analyzer unit detecting the cyber attack on the electronic control system as the abnormality, and determines at least one of: restarting an attacked electronic control unit of the electronic control system, isolating the attacked electronic control unit from other electronic control units of the electronic control system, and executing reprogramming with a wireless communication network as the measure against the cyber attack.
10. A method performed by a log analysis device, comprising:
receiving a plurality of logs from an electronic control system mounted in a movable object, each log indicating status of the electronic control system mounted in the movable object;
analyzing an abnormality in the electronic control system by using the plurality of logs received;
determining a power supply status of the movable object as one of: the power supply status of the movable object is in an OFF state; an accessory power supply of the movable object is in an ON state; and an ignition power supply of the movable object is in an ON state;
depending on a result of the analyzing of the plurality of logs, determining, on a log-by-log basis, a priority of each subsequent log of a plurality of subsequent logs for the electronic control system to transmit, the priority of each subsequent log of the plurality of subsequent logs being determined according to a change in the determined power supply status of the movable object;
generating instruction information that provides an instruction for, based on the result of the analyzing of the plurality of logs and based on the determined priority, controlling transmission of each subsequent log; and
transmitting the instruction information to the electronic control system;
wherein:
the log analysis device is provided outside of the movable object and wirelessly communicates with the electronic control system of the movable object; and
the plurality of logs and the plurality of subsequent logs each include a log recording a dynamic status that is changing constantly in relation to the electronic control system and a log recording a static status that is unchanging in relation to the electronic control system.
11. A non-transitory storage medium storing a program that causes a log analysis device to perform:
receiving a plurality of logs from an electronic control system mounted in a movable object, each log indicating status of the electronic control system mounted in the movable object;
analyzing an abnormality in the electronic control system by using the plurality of logs received;
determining a power supply status of the movable object as one of: the power supply status of the movable object is in an OFF state; an accessory power supply of the movable object is in an ON state; and an ignition power supply of the movable object is in an ON state;
depending on a result of the analyzing of the plurality of logs, determining, on a log-by-log basis, a priority of each subsequent log of a plurality of subsequent logs for the electronic control system to transmit, the priority of each subsequent log of the plurality of subsequent logs being determined according to a change in the determined power supply status of the movable object;
generating instruction information that provides an instruction for, based on the result of the analyzing of the plurality of logs and based on the determined priority, controlling transmission of each subsequent log; and
transmitting the instruction information to the electronic control system;
wherein:
the log analysis device is provided outside the movable object and wirelessly communicates with the electronic control systems of the movable object; and
the plurality of logs and the plurality of subsequent logs each include a log recording a dynamic status that is constantly changing in relation to the electronic control system and a log recording a static status that is unchanging in relation to the electronic control system.
12. A log analysis device comprising:
a receiver unit that receives a plurality of logs from an electronic control system mounted in a movable object, each log indicating status of the electronic control system mounted in the movable object;
a log analyzer unit that analyzes an abnormality in the electronic control system by using the plurality of logs received by the receiver unit;
a priority determiner unit that, depending on a result of the analyzing of the plurality of logs by the log analyzer unit, determines, on a log-by-log basis, a priority of each subsequent log of a plurality of subsequent logs for the electronic control system to transmit to the log analysis device;
an instruction generator unit that generates instruction information that provides an instruction for, based on the result of the analyzing of the plurality of logs by the log analyzer unit and based on the priority determined by the priority determiner unit, controlling transmission of each subsequent log; and
a transmitter unit that transmits the instruction information generated by the instruction generator unit to the electronic control system;
wherein:
the log analysis device is provided outside of the movable object and wirelessly communicates with the electronic control system of the movable object;
the plurality of logs and the plurality of subsequent logs each include a log recording a dynamic status that is constantly changing in relation to the electronic control system and a log recording a static status that is unchanging in relation to the electronic control system;
the log analyzer unit, the priority determiner unit, and the instruction generator unit are implemented by a processor and memory storing instructions that are executable by the processor;
the priority determiner unit determines a power supply status of the movable object as one of: the power supply status of the movable object is in an OFF state; an accessory power supply of the movable object is in an ON state; and an ignition power supply of the movable object is in an ON state; and
the priority determiner unit determines the priority of each subsequent log of the plurality of subsequent logs according to a power supply status of an electronic control unit changing in accordance with a change in the determined power supply status of the movable object.