Specification of Intrusion Detection System Manager for Adaptive Platform, No.978, AUTOSAR R21-11(318) AP

Specification of Intrusion Detection System Manager for Adaptive Platform, No.978, 2021-11

https://www.autosar.org/fileadmin/standards/adaptive/21-11/AUTOSAR_SWS_AdaptiveIntrusionDetectionSystemManager.pdf

AUTOSAR R21-11記事一覧はこちら。

AUTOSAR 21-11,318文書読んだ。2022年6月初めにFO, AP, CP 全部到達。

https://qiita.com/kaizen_nagoya/items/4043e8414f850ce266a4

AUTOSAR R21-11(0) 仕様ダウンロード一覧。単語帳。参考文献資料作成

https://qiita.com/kaizen_nagoya/items/9b3a1b9b8d1e8d7e288e

# 用語(terms)
|Term|Description|
|:--|:--|
|Filter Chain| A set of consecutive filters which is applied to Security Events
|Intrusion Detection System| An Intrusion Detection System is a security control which detects and processes security events.
|Intrusion Detection System Manager| The Intrusion Detection System Manager handles security events reported by security sensors.
|Intrusion Detection System Reporter| The Intrusion Detection System Reporter handles qualified security events received from Idsm instances.
|Security Extract| The Security Extract specifies which security events are handled by IdsM instances and their configuration parameters.
|Security Event Type |A security event type can be identified by its security event type ID. Instances of security event types are called security events and share the same security event type ID.
|Security Events |Onboard Security Events are instances of security event types which are reported by BSW or SWC to the IdsM.
|Security Event Memory |A user defined diagnostic event memory which is independent from the primary diagnostic event memory.
|Security Sensors| BSW or SWC which report security events to the Idsm.
|Qualified Security Events |Security events which pass their filter chain are regarded as Qualified Security Events.
|Security Event Memory| User defined diagnostic event memory which is separated from the main diagnostic event memory.
|Security Incident and Event Management|Process for handling a confirmed security incident
|Security Operation Centre |Organization of security and domain experts who are analyzing security events and contributing to mitigation of threats.
|DID| Data Identifier according to Unified Diagnostic Services
|DTC |Diagnostics Trouble Code
|FC |Functional Cluster
|IDS |Intrusion Detection System
|IdsM |Intrusion Detection System Manager
|IdsR| Intrusion Detection System Reporter
|SecXT |Security Extract
|SEv |Security Event
|QSEv |Qualified Security Event
|Sem |Security Event Memory
|SIEM |Security Incident and Event Management
|SOC |Security Operation Centre
|SWCL |Software Cluster

## 英日
日本語は仮訳

T.B.D.

# 参考(reference)
Glossary も　参考に入れましょう。
https://www.autosar.org/fileadmin/standards/foundation/21-11/AUTOSAR_TR_Glossary.pdf

[1] Requirements on Intrusion Detection System
AUTOSAR_RS_IntrusionDetectionSystem
[2] Specification of Intrusion Detection System Protocol
AUTOSAR_PRS_IntrusionDetectionSystem
[3] Security Extract Template
AUTOSAR_TPS_SecurityExtractTemplate
[4] Specification of Adaptive Platform Core
AUTOSAR_SWS_AdaptivePlatformCore
[5] Specification of Cryptography
AUTOSAR_SWS_Cryptography

 ＜この記事は個人の過去の経験に基づく個人の感想です。現在所属する組織、業務とは関係がありません。＞

# 関連文書(Related document)
Specification of Intrusion Detection System Manager for Adaptive Platform, AUTOSAR R22-11, AP, No.978

https://qiita.com/kaizen_nagoya/items/b448aac54102f2189761
# 文書履歴(document history)
ver. 0.01 初稿 20220606
ver. 0.02 URL追記　20221229