Intrusion anomaly monitoring analysis device in vehicle environment that detects and responds to secure boot processing tampering
Provided is an analysis device that reduces false detection of an attack event to appropriately output an anomaly notification. The analysis device configured to be communicable with a plurality of monitoring-target devices collects monitoring results of each of the monitoring-target devices, determines whether an anomaly has occurred in each of the monitoring-target devices, based on the monitoring results, and determines whether to output an anomaly notification indicating the anomaly, based on a result of the determination and code verification results of each of the monitoring-target devices.
1. An analysis device configured to be communicable with a plurality of monitoring-target devices,
wherein the analysis device
collects monitoring results of each of the plurality of monitoring-target devices, the monitoring results comprising anomaly-related information associated with each of the plurality of monitoring-target devices,
determines whether an anomaly has occurred in each of the plurality of monitoring-target devices, based on the monitoring results,
executes secure boot processing on each of the plurality of monitoring-target devices,
determines, in response to executing the secure boot processing, code verification results indicative of whether programs executed by the plurality of monitoring-target devices have been tampered, at start of execution of the programs,
and
determines whether to output an anomaly notification indicating the anomaly, based on whether the anomaly has occurred in at least one of the plurality of monitoring-target devices and the code verification results indicates that the programs executed by any of the plurality of monitoring-target devices have been tampered.
2. The analysis device according to claim 1 ,
wherein each of the plurality of monitoring-target devices is mounted on a vehicle.
3. The analysis device according to claim 2 , wherein the analysis device determines to output the anomaly notification in a case where the determination is made that the anomaly has occurred and tampering has been performed in any of the plurality of monitoring-target devices within a predetermined period.
4. The analysis device according to claim 2 , wherein the analysis device determines not to output the anomaly notification in a case where the determination is made that no tampering has been performed in any of the plurality of monitoring-target devices.
5. The analysis device according to claim 1 , wherein the analysis device further determines whether to output the anomaly notification based on a number of occurrence times of anomaly or a number of occurrence times of identical anomaly in any of the plurality of monitoring-target devices within a predetermined period.
6. The analysis device according to claim 1 , wherein the analysis device further determines whether to output the anomaly notification based on a content of the anomaly that has occurred in any of the plurality of monitoring-target devices.
7. The analysis device according to claim 3 , wherein the predetermined period is an operation period of the vehicle on which the plurality of monitoring-target devices is mounted or an operation period of the analysis device.
8. The analysis device according to claim 1 ,
wherein the anomaly notification includes a cumulative notification related to a number of occurrence times of the anomaly and an immediate notification related to a content of the anomaly that has occurred, and
wherein the anomaly notification includes information indicating whether the anomaly notification is the cumulative notification or the immediate notification.