Attack estimation verification device, attack estimation verification method, and storage medium storing attack estimation verification program
By an attack estimation verification device, an attack estimation verification method, and a computer-readable non-transitory storage medium storing an attack estimation verification program, an attack-abnormality relation table is stored, a security log is acquired, an attack received by an electronic control system is estimated, it is determined whether grouping or an assumption feature of an abnormal electronic control unit is appropriate, and a notification indicating a verification result is provided.
1 . An attack estimation verification device comprising:
a processor and memory configured to:
acquire a security log including:
identification information indicating an abnormal electronic control unit that is an electronic control unit in which an abnormality is detected among a plurality of electronic control units configuring an electronic control system;
abnormality information indicating the abnormality detected in the abnormal electronic control unit; and
group information indicating a group
which is obtained by grouping at least one electronic control unit among the plurality of electronic control units according to an actual feature of each of the plurality of electronic control units and an assumption feature assumed to be a function of each of the plurality of electronic control units, and
to which the abnormal electronic control unit belongs;
store an attack-abnormality relation table indicating a relation among attack information indicating a type of an attack,
prediction abnormality information indicating an abnormality predicted to occur due to the attack, and
prediction group information indicating a group in which the predicted abnormality occurs;
estimate an attack received by the electronic control system based on a prediction combination of the prediction abnormality information and the prediction group information, the prediction combination corresponding to a combination of the abnormality information and the group information;
determine that grouping of the group or an assumption feature, which is assumed to be a feature of the abnormal electronic control unit indicated by the identification information, is not appropriate when the attack estimated by the attack estimation unit is an attack related to the assumption feature indicated by the identification information; and
provide a notification indicating a verification result.
2 . The attack estimation verification device according to claim 1 , wherein
the feature is a network that is actually connected to or assumed to be connected to each of the plurality of electronic control units, and
the processor and memory are further configured to determine that the grouping of the group or a network assumed to be connected to the abnormal electronic control unit is not appropriate when the estimated attack is an attack via the network assumed to be connected to the abnormal electronic control unit.
3 . The attack estimation verification device according to claim 2 , wherein
the feature is also a layer to which each of the plurality of electronic control units belongs among a plurality of layers that are divided according to a security level of the electronic control system.
4 . The attack estimation verification device according to claim 1 , wherein
the feature is an actual function or an assumption function of each of the plurality of electronic control units, and
the processor and memory are further configured to determine that the grouping of the group or an assumption function assumed to be a function of the abnormal electronic control unit is not appropriate when the estimated attack is an attack on the assumption function.
5 . The attack estimation verification device according to claim 4 , wherein
the feature is also a layer to which each of the plurality of electronic control units belongs among a plurality of layers that are divided according to a security level of the electronic control system.
6 . The attack estimation verification device according to claim 1 , further comprising
a feature table storage that stores a feature table indicating a correspondence relation between the identification information and a feature that is the actual feature or the assumption feature of the abnormal electronic control unit,
wherein
the processor and memory are further configured to specify the feature of the abnormal electronic control unit by using the feature table.
7 . The attack estimation verification device according to claim 1 , wherein
the security log further includes information indicating the assumption feature of the abnormal electronic control unit.
8 . The attack estimation verification device according to claim 1 , wherein the processor and memory are further configured to:
acquire an individual security log including the identification information and the abnormality information;
determine a group to which the abnormal electronic control unit belongs based on the identification information; and
output the security log including the identification information, the abnormality information, and the group information indicating the determined group.
9 . The attack estimation verification device according to claim 8 , wherein the processor and memory are further configured to:
acquire feature number information indicating a maximum number of a feature of each of the plurality of electronic control units, and
determine the assumption feature of the abnormal electronic control unit based on the feature number information.
10 . The attack estimation verification device according to claim 1 , wherein
the attack estimation verification device and the electronic control system are mounted in a mobile object.
11 . The attack estimation verification device according to claim 1 , wherein
the electronic control system is an electronic control system mounted in a mobile object, and
the attack estimation verification device is a server device placed outside the mobile object.
12 . An attack estimation verification method executed by an attack estimation verification device including an attack-abnormality relation table storage that stores an attack-abnormality relation table indicating a relation among
attack information indicating a type of an attack,
prediction abnormality information indicating an abnormality predicted to occur due to the attack, and
prediction group information indicating a group in which the predicted abnormality occurs,
the method comprising:
acquiring a security log including:
identification information indicating an abnormal electronic control unit that is an electronic control unit in which an abnormality is detected among a plurality of electronic control units configuring an electronic control system, each of the plurality of electronic control units having a processor and memory;
abnormality information indicating an abnormality detected in the abnormal electronic control unit; and
group information indicating a group
which is obtained by grouping at least one electronic control unit among the plurality of electronic control units according to an actual feature of each of the plurality of electronic control units and an assumption feature of each of the plurality of electronic control units, and
to which the abnormal electronic control unit belongs;
estimating an attack received by the electronic control system based on a prediction combination of the prediction abnormality information and the prediction group information, the prediction combination corresponding to a combination of the abnormality information and the group information;
determining that grouping of the group or an assumption feature of the abnormal electronic control unit indicated by the identification information is not appropriate when the estimated attack is an attack related to the assumption feature of the abnormal electronic control unit indicated by the identification information; and
providing a notification indicating a verification result.
13 . A computer-readable non-transitory storage medium storing an attack estimation verification program executed by an attack estimation verification device including an attack-abnormality relation table storage that stores an attack-abnormality relation table indicating a relation among
attack information indicating a type of an attack,
prediction abnormality information indicating an abnormality predicted to occur due to the attack, and
prediction group information indicating a group in which the predicted abnormality occurs,
wherein the program is configured to cause a processor to:
acquire a security log including:
identification information indicating an abnormal electronic control unit that is an electronic control unit in which an abnormality is detected among a plurality of electronic control units configuring an electronic control system, each of the plurality of electronic control units having a processor and memory;
abnormality information indicating an abnormality detected in the abnormal electronic control unit; and
group information indicating a group
which is obtained by grouping at least one electronic control unit among the plurality of electronic control units according to an actual feature of each of the plurality of electronic control units and an assumption feature of each of the plurality of electronic control units and
to which the abnormal electronic control unit belongs;
estimate an attack received by the electronic control system based on a prediction combination of the prediction abnormality information and the prediction group information, the prediction combination corresponding to a combination of the abnormality information and the group information;
determine that grouping of the group or an assumption feature of the abnormal electronic control unit indicated by the identification information is not appropriate when the estimated attack is an attack related to the assumption feature of the abnormal electronic control unit indicated by the identification information; and
provide a notification indicating a verification result.