Patent Description:
Techniques are known which analyze cyber attacks (also called simply "attacks" hereinafter) on in-vehicle networks installed in vehicles (see PTL <NUM>, for example).

[PTL <NUM>] <CIT>. <NPL>), <CIT> and <CIT> are also relevant pieces of prior art which have been used to draw up the European search report and examine the European patent application.

When an attack has been carried out on an in-vehicle network, it is desirable to estimate the attack path of that attack, which includes an entry point, which is the point of intrusion into the in-vehicle network in the attack, and an attack target, which is the target of the attack.

Accordingly, an object of the present disclosure is to provide an attack analysis device and the like capable of estimating an attack path, including an entry point and an attack target, in an attack on an in-vehicle network.

An attack analysis device according to one aspect of the present disclosure includes: an obtainer that obtains in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control Electronic Control Units (ECUs), and anomaly detection information indicating a result of detecting an anomaly in at least one node in the in-vehicle network; an attack path estimator that, based on the in-vehicle network information and the anomaly detection information, estimates an attack path in an attack on the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of intrusion into the in-vehicle network in the attack and an attack target indicating a control ECU that is a target of the attack; and an outputter that outputs the attack path.

An attack analysis method according to one aspect of the present disclosure is an attack analysis method executed by a computer, the attack analysis method including: obtaining in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating a result of detecting an anomaly in at least one node in the in-vehicle network; estimating, based on the in-vehicle network information and the anomaly detection information, an attack path in an attack on the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of intrusion into the in-vehicle network in the attack and an attack target indicating a control ECU that is a target of the attack; and outputting the attack path.

A program according to one aspect of the present disclosure is a program for causing a computer to execute attack analysis processing, the attack analysis processing including: obtaining in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating a result of detecting an anomaly in at least one node in the in-vehicle network; estimating, based on the in-vehicle network information and the anomaly detection information, an attack path in an attack on the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of intrusion into the in-vehicle network in the attack and an attack target indicating a control ECU that is a target of the attack; and outputting the attack path.

According to the attack analysis device and the like according to one aspect of the present disclosure, an attack analysis device and the like capable of estimating an attack path, including an entry point and an attack target, in an attack on an in-vehicle network are provided.

The described embodiments are to be considered only as illustrative and not restrictive. The scope of the invention is defined by the appended claims, the dependent claims define further embodiments of the invention.

The inventors thought that to analyze an attack on an in-vehicle network installed in a vehicle, such as by analyzing the attack, verifying the attack against past cases, and the like, it is important to estimate the attack path of the attack, including the entry point, which refers to an external communication interface used as the point of intrusion into the in-vehicle network, and the attack target, which indicates the control ECU that is the target of the attack. This is because the costs of the analysis work can be reduced if the attack path can be estimated.

On the other hand, anomaly detection results detected at each node of the in-vehicle network may include undetected anomalies, false detections of anomalies, and the like, and there are therefore cases where it is difficult to estimate the attack path only from anomaly detection information indicating the anomaly detection results detected at each node of the in-vehicle network.

The inventors therefore diligently studied and experimented with methods for estimating attack paths with relatively high accuracy.

As a result, the inventors discovered that an attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network and anomaly detection information.

Based on this knowledge, the inventors made further studies and experiments, and arrived at the attack analysis device, attack analysis method, and program according to the present disclosure as described below.

According to the attack analysis device configured as described above, when an attack is carried out on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network, indicated by the in-vehicle network information, and the anomaly detection information. Thus, according to the attack analysis device configured as described above, an attack path including the entry point and the attack target of the attack on the in-vehicle network can be estimated.

Additionally, the obtainer may further obtain an external communication event history indicating a history of communication events between the in-vehicle network and outside the in-vehicle network, and a vehicle control event history indicating a history of vehicle control events by a vehicle in which the in-vehicle network is installed. The attack analysis device may further include: an entry point estimator that estimates the entry point based on the in-vehicle network information, the anomaly detection information, and the external communication event history; and an attack target estimator that estimates the attack target based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history. The attack path estimator may estimate the attack path based on the entry point estimated by the entry point estimator and the attack target estimated by the attack target estimator.

The attack analysis device configured as described above can estimate the entry point more accurately based on the in-vehicle network information, the anomaly detection information, and the external communication event history, and can estimate the attack target more accurately based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history. Thus, according to the attack analysis device, the attack path can be estimated more accurately.

Additionally, for each of the plurality of external communication interfaces, the entry point estimator may calculate an entry point risk indicating a confidence level of each of the plurality of external communication interfaces being the entry point, and estimate the entry point based on each entry point risk calculated; and for each of the plurality of control ECUs, the attack target estimator may calculate an attack target risk indicating a confidence level of each of the plurality of control ECUs being the attack target, and estimates the attack target based on each attack target risk calculated.

Accordingly, the confidence level as an entry point, calculated for each of the plurality of external communication interfaces, can be reflected in the estimation of the entry point, and the confidence level as an attack target, calculated for each of the plurality of control ECUs, can be reflected in the estimation of the attack target.

Additionally, the attack analysis device may further include an attack path confidence level calculator that, based on the entry point risk of the entry point calculated by the entry point estimator and the attack target risk of the attack target calculated by the attack target estimator, calculates an attack path confidence level indicating a confidence level of the attack path estimated by the attack path estimator being the attack path, and the outputter may further output the attack path confidence level.

Through this, information indicating the confidence level as the attack path can be output for the attack path which is output.

Additionally, the outputter may include a display controller that outputs, to a display device, a display control signal including the attack path, the display control signal controlling the display device to display a configuration diagram indicating the configuration of the in-vehicle network and display the attack path using a different method from a method used to display another part of the configuration diagram.

Accordingly, a user using the attack analysis device can visually recognize the attack path.

According to the attack analysis method, when an attack is carried out on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network, indicated by the in-vehicle network information, and the anomaly detection information. Thus, according to the attack analysis method, an attack path including the entry point and the attack target of the attack on the in-vehicle network can be estimated.

According to the program, when an attack is carried out on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network, indicated by the in-vehicle network information, and the anomaly detection information. Thus, according to the program, an attack path including the entry point and the attack target of the attack on the in-vehicle network can be estimated.

A specific example of the attack analysis device according to one aspect of the present disclosure will be described hereinafter with reference to the drawings. Each of the following embodiments describes a specific example of the present disclosure. As such, the numerical values, shapes, constituent elements, arrangements and connection states of constituent elements, steps, orders of steps, and the like in the following embodiments are merely examples, and are not intended to limit the present disclosure. Additionally, the drawings are schematic diagrams, and are not necessarily exact illustrations. Configurations that are substantially the same are given the same reference signs in the drawings, and redundant descriptions will be omitted or simplified.

An attack analysis device according to an embodiment will be described hereinafter. This attack analysis device is a device that estimates an attack path in an attack on an in-vehicle network installed in a vehicle.

<FIG> is a block diagram illustrating an example of the configuration of attack monitoring system <NUM> which uses attack analysis device <NUM> according to an embodiment to monitor attacks on in-vehicle network <NUM> installed in vehicle <NUM>.

As illustrated in <FIG>, attack monitoring system <NUM> is configured including monitoring server <NUM>, vehicle <NUM>, in-vehicle network <NUM>, and external network <NUM>.

Monitoring server <NUM> is what is known as a computer device, and includes a processor (not shown), a memory (not shown), a communication interface (not shown), a storage device (not shown), and a display (not shown).

Monitoring server <NUM> realizes attack analysis device <NUM> and display device <NUM> by the processor executing programs stored in the memory.

Vehicle <NUM> has a communication function, and is provided with in-vehicle network <NUM>. Vehicle <NUM> is an automobile, for example.

External network <NUM> is a wide-area network such as the Internet, and includes attack analysis device <NUM> and in-vehicle network <NUM> as connection destinations.

<FIG> is a block diagram illustrating an example of the configuration of in-vehicle network <NUM>.

As illustrated in <FIG>, in-vehicle network <NUM> is configured including a plurality of external communication interfaces, a plurality of control Electronic Control Units (ECUs), and integrated ECU <NUM>.

Here, in <FIG>, the plurality of external communication interfaces correspond to external communication IF_A 21A, external communication IF_B 21B, external communication IF_C 21C, and external communication IF_D 21D. Each of the plurality of external communication interfaces may also be referred to simply as "external communication IF <NUM>" hereinafter. Furthermore, in <FIG>, the plurality of control ECUs correspond to ECU_A 22A, ECU_B 22B, ECU_C 22C, and ECU_D 22D. Each of the plurality of control ECUs may also be referred to simply as "ECU <NUM>" hereinafter.

The plurality of external communication IFs <NUM> may include, for example, a telematics communication unit (TCU; Telematic Control Unit), an in-vehicle infotainment system, an external application execution device, a communication device that communicates with a charging stand, an On-Board Diagnostics (OBD) port, and the like.

Each of the plurality of external communication IFs <NUM> includes an Intrusion Detection System (IDS) that detects an anomaly in that external communication IF <NUM>. Here, external communication IF_A 21A includes IDS_A 23A, external communication IF_B 21B includes IDS_B 23B, external communication IF_C 21C includes IDS_C 23C, and external communication IF_D 21D includes IDS_D 23D.

The plurality of external communication IFs <NUM> are connected to integrated ECU <NUM> through Controller Area Network (CAN) <NUM> or Ethernet (registered trademark) <NUM>.

The plurality of ECUs <NUM> may include, for example, a control ECU that controls the travel of vehicle <NUM>, an Advanced Driver Assistance System (ADAS) control ECU that controls an ADAS, an air conditioner control ECU that controls an air conditioner, and the like.

Each ECU <NUM> includes an IDS that detects an anomaly in that ECU <NUM>. Here, ECU_A 22A includes IDS_E 23E, ECU_B 22B includes IDS_F 23F, ECU_C 22C includes IDS_G <NUM>, and ECU_D 22D includes IDS_H <NUM>.

The plurality of ECUs <NUM> are connected to integrated ECU <NUM> through CAN <NUM> or Ethernet (registered trademark) <NUM>.

<FIG> is a block diagram illustrating an example of the configuration of integrated ECU <NUM>.

As illustrated in <FIG>, integrated ECU <NUM> includes gateway <NUM>, security master <NUM>, vehicle control event manager <NUM>, IDS_I 23I, and IDS_J 23J.

Integrated ECU <NUM> is what is known as a computer device, and includes a processor (not shown), a memory (not shown), and a communication interface (not shown).

Integrated ECU <NUM> realizes gateway <NUM>, security master <NUM>, and vehicle control event manager <NUM>, as well as IDS_I 23I and IDS_J 23J which detect anomalies in integrated ECU <NUM>, by using the processor to execute programs stored in the memory.

Gateway <NUM> includes IDS_K <NUM> and IDS_L <NUM>, which detect anomalies in gateway <NUM>.

Each of the plurality of IDSs included in in-vehicle network <NUM> may also be referred to simply as "IDS <NUM>" hereinafter.

Security master <NUM> generates anomaly detection information indicating an anomaly detection result detected in at least one node in in-vehicle network <NUM> when IDS <NUM> included in in-vehicle network <NUM> has detected an anomaly. Once the anomaly detection information is detected, security master <NUM> transmits the generated anomaly detection information to attack analysis device <NUM> along with in-vehicle network information indicating the configuration of in-vehicle network <NUM>, a vehicle control event history (described later), and an external communication event history (described later).

Here, "node" refers to the plurality of external communication IFs <NUM>, gateway <NUM>, and the plurality of ECUs <NUM>.

<FIG> is a schematic diagram illustrating an example of an anomaly detection list, which itself is an example of the anomaly detection information generated by security master <NUM>.

As illustrated in <FIG>, the anomaly detection list is a table which, for each node included in in-vehicle network <NUM>, associates a classification of the node, a timestamp indicating the date and time at which an anomaly was detected by the IDS which detects anomalies for that node, whether or not an anomaly has been detected by the IDS which detects anomalies for that node, and an anomaly detection score output from the IDS which detects anomalies for that node. Here, the "anomaly detection score" is a score which indicates a degree of anomaly for the anomaly detected by the IDS, and is a score which increases in value as the degree of anomaly increases. The embodiment will be described assuming external communication IF <NUM> is classified as an entry node and ECU <NUM> is classified as a target node.

When one IDS <NUM> detects an anomaly, security master <NUM> generates the anomaly detection list for anomalies detected by IDSs <NUM> included in in-vehicle network <NUM> within predetermined period T1 (e.g., two minutes) starting from the detection.

When the same IDS <NUM> detects an anomaly multiple times within predetermined period T1, security master <NUM> may generate the anomaly detection list only for the first of those multiple anomalies, for example. This is because a series of successive attacks are to be handled as a single attack.

It can be seen, from the anomaly detection list illustrated in <FIG>, that, for example, the IDS of external communication IF_B, which is classified as an entry node, detected an anomaly at <NUM>:<NUM>:<NUM> on August <NUM>, <NUM>, and that the anomaly detection score of the detected anomaly is <NUM>.

Returning to <FIG>, descriptions of integrated ECU <NUM> will be resumed.

Vehicle control event manager <NUM> stores a predefined external communication event list, a predefined vehicle control event list, and based on the stored external communication event list and vehicle control event list, generates, updates, and manages an external communication event history, which indicates a history of communication events between in-vehicle network <NUM> and the exterior, and a vehicle control event history, which indicates a history of vehicle control events performed by vehicle <NUM>.

<FIG> is a schematic diagram illustrating an example of the external communication event list stored by vehicle control event manager <NUM>.

As illustrated in <FIG>, the external communication event list is a table which, for each of external communication events indicating communication events between in-vehicle network <NUM> and the exterior, associates a classification of the external communication event, a risk and a sub-risk indicating a degree of risk of a cyber attack stemming from that external communication event, and a prioritized path, which is a comment regarding that external communication event. Here, the "risk" and "sub-risk" are both scores which increase in value as the degree of risk of a cyber attack increases.

It can be seen, from the external communication event list illustrated in <FIG>, that, for example, the external communication event "connected to new IP address", which is classified as "establishment of external communication", has a risk of <NUM> and a sub-risk of <NUM>.

<FIG> is a schematic diagram illustrating an example of the external communication event history generated, updated, and managed by vehicle control event manager <NUM>.

As illustrated in <FIG>, the external communication event history is a table which, for each external communication event that occurs, associates the date and time when the external communication event occurred, an external communication event ID identifying that external communication event, an external communication IF ID identifying external communication IF <NUM> which communicated with the exterior in that external communication event, and an external communication event risk indicating the risk of that external communication event. Here, the external communication event risk is expressed as a combination of the risk and the sub-risk in the external communication event list.

It can be seen, from the external communication event history illustrated in <FIG>, that, for example, the external communication event "external device connected to OBD port" is an event which occurred at <NUM>:<NUM>:<NUM> on August <NUM>, <NUM>, was communicated with the exterior over external communication IF <NUM> identified by an external communication IF ID of "IF01", and which has an external communication event risk of <NUM>-<NUM>.

<FIG> is a schematic diagram illustrating an example of the vehicle control event list stored by vehicle control event manager <NUM>.

As illustrated in <FIG>, the vehicle control event list is a table which, for each vehicle control event indicating a vehicle control event performed by vehicle <NUM>, associates the classification of that vehicle control event, the risk and sub-risk indicating the severity of the threat to the safety of vehicle <NUM> if that vehicle control event is the result of a cyber attack, and the "prioritized path", which is a comment regarding that vehicle control event. Here, the "risk" and "sub-risk" are both scores which increase in value as the severity of the threat to the safety increases.

It can be seen, from the vehicle control event list illustrated in <FIG>, that, for example, the vehicle control event "acceleration/steering/deceleration instruction issued", which is classified as a "control instruction", has a risk of <NUM> and a sub-risk of <NUM>.

<FIG> is a schematic diagram illustrating an example of the vehicle control event history generated, updated, and managed by vehicle control event manager <NUM>.

As illustrated in <FIG>, the vehicle control event history is a table which, for each vehicle control event that has occurred, associates the date and time when that vehicle control event occurred, a vehicle control event ID identifying that vehicle control event, an ECU ID identifying ECU <NUM> which caused that vehicle control event to occur, and a vehicle control event risk indicating the risk of that vehicle control event. Here, the vehicle control event risk is expressed as a combination of the risk and the sub-risk in the vehicle control event list.

It can be seen, from the vehicle control event history illustrated in <FIG>, that, for example, the vehicle control event "air conditioner operation changed" is an event which occurred at <NUM>:<NUM>:<NUM> on August <NUM>, <NUM>, occurred in ECU <NUM> identified by an ECU ID of "ECU02", and which has a vehicle control event risk of <NUM>-<NUM>.

As described earlier, when IDS <NUM> included in in-vehicle network <NUM> detects an anomaly, security master <NUM> generates the anomaly detection information and transmits the generated anomaly detection information to attack analysis device <NUM> along with the in-vehicle network information, the vehicle control event history, and the external communication event history.

At this time, security master <NUM> does not absolutely have to transmit the entire external communication event history managed by vehicle control event manager <NUM> to attack analysis device <NUM>. The descriptions here will assume that security master <NUM> transmits, to attack analysis device <NUM>, an external communication event history of communication events between in-vehicle network <NUM> and the exterior in predetermined period T2 before and after the anomaly was detected (e.g., five minutes before the detection and five minutes after the detection, for a total of ten minutes). Additionally, at this time, security master <NUM> does not absolutely have to transmit the entire vehicle control event history managed by vehicle control event manager <NUM> to attack analysis device <NUM>. The descriptions here will assume that security master <NUM> transmits, to attack analysis device <NUM>, a vehicle control event history of vehicle control events performed by vehicle <NUM> in predetermined period T2 before and after the anomaly was detected.

<FIG> is a block diagram illustrating an example of the configuration of attack analysis device <NUM>.

As illustrated in <FIG>, attack analysis device <NUM> includes obtainer <NUM>, entry point estimator <NUM>, attack target estimator <NUM>, attack path estimator <NUM>, attack path estimation result table manager <NUM>, attack path confidence level calculator <NUM>, and outputter <NUM>.

Obtainer <NUM> obtains the in-vehicle network information, the anomaly detection information, the external communication event history, and the vehicle control event history transmitted from security master <NUM>.

Based on the in-vehicle network information, the anomaly detection information, and the external communication event history obtained by obtainer <NUM>, entry point estimator <NUM> estimates an entry point indicating external communication IF <NUM> that is the point of intrusion into in-vehicle network <NUM> in the attack on in-vehicle network <NUM>. At this time, for each of the plurality of external communication IFs <NUM>, entry point estimator <NUM> calculates an entry point risk, which indicates a confidence level of that external communication IF <NUM> being an entry point, and estimates the entry point based on each of the calculated entry point risks.

The estimation of the entry point by entry point estimator <NUM> will be described in detail later with reference to flowcharts and the like.

Based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history obtained by obtainer <NUM>, attack target estimator <NUM> estimates an attack target indicating ECU <NUM> which is the target of the attack on in-vehicle network <NUM>. At this time, for each of the plurality of ECUs <NUM>, attack target estimator <NUM> calculates an attack target risk, which indicates a confidence level that that ECU <NUM> is the attack target, and estimates the attack target based on each of the calculated attack target risks.

The estimation of the attack target by attack target estimator <NUM> will be described in detail later with reference to flowcharts and the like.

Based on the in-vehicle network information and the anomaly detection information obtained by obtainer <NUM>, attack path estimator <NUM> estimates an attack path, including the entry point and the attack target, in the attack on in-vehicle network <NUM>. The descriptions in the embodiment assume that attack path estimator <NUM> estimates the attack path based on the entry point estimated by entry point estimator <NUM>, the attack target estimated by attack target estimator <NUM>, the in-vehicle network information obtained by obtainer <NUM>, and the anomaly detection information obtained by obtainer <NUM>.

The estimation of the attack path by attack path estimator <NUM> will be described in detail later with reference to flowcharts and the like.

Based on the entry point risk of the entry point calculated by entry point estimator <NUM> and the attack target risk of the attack target calculated by attack target estimator <NUM>, attack path confidence level calculator <NUM> calculates an attack path confidence level indicating a confidence level for the attack path estimated by attack path estimator <NUM>.

The calculation of the attack path confidence level by attack path confidence level calculator <NUM> will be described in detail later with reference to flowcharts and the like.

Upon obtainer <NUM> obtaining the anomaly detection information, attack path estimation result table manager <NUM> generates the attack path estimation result table based on the anomaly detection information obtained by obtainer <NUM>. Then, attack path estimation result table manager <NUM> successively updates and manages the generated attack path estimation result table based on the various types of signals output from entry point estimator <NUM>, attack target estimator <NUM>, attack path estimator <NUM>, or attack path confidence level calculator <NUM>.

<FIG> is a schematic diagram illustrating an example of the attack path estimation result table generated by attack path estimation result table manager <NUM>. Here, <FIG> is a schematic diagram of the attack path estimation result table which is the attack path estimation result table in an initial state, generated by attack path estimation result table manager <NUM>, as a result of obtainer <NUM> obtaining the anomaly detection information, and which has not yet been updated.

As illustrated in <FIG>, the attack path estimation result table is a table which, for each node included in in-vehicle network <NUM>, associates the following: the classification of the node; a timestamp indicating the date and time when an anomaly has been detected by the IDS which detects anomalies for that node; whether or not an anomaly has been detected by the IDS which detects anomalies for that node; the anomaly detection score output from the IDS which detects anomalies for that node; an estimation result indicating an anomaly state of that node, estimated by entry point estimator <NUM> when that node is external communication IF <NUM>, or an estimation result indicating an anomaly state of that node, estimated by attack target estimator <NUM> when that node is ECU <NUM>; a risk indicating the entry point risk of that node, calculated by entry point estimator <NUM> when that node is communication IF <NUM>, or the attack target risk of that node, calculated by attack target estimator <NUM> when that node is ECU <NUM>; an attack path indicating whether that node corresponds to the attack path estimated by attack path estimator <NUM>; and the attack path confidence level of that attack path, calculated by attack path confidence level calculator <NUM>. The method for estimating the estimation result and risk value estimated by attack target estimator <NUM> or entry point estimator <NUM>, and the attack path estimated by attack path estimator <NUM>, will be described later.

As illustrated in <FIG>, the attack path estimation result table in the initial state has no information recorded for the estimation results, risks, attack paths, and attack path confidence levels.

The attack path estimation result table updated successively by attack path estimation result table manager <NUM> will be described later.

Returning to <FIG>, descriptions of attack analysis device <NUM> will be resumed.

Attack path estimation result table manager <NUM> generates and manages an attack path history, which indicates a history of the attack paths estimated by attack path estimator <NUM>.

<FIG> is a schematic diagram illustrating an example of the attack path history managed by attack path estimation result table manager <NUM>.

As illustrated in <FIG>, the attack path history is a table which, for each attack path estimated by attack path estimator <NUM>, associates an anomaly notification ID identifying the anomaly detection corresponding to that attack path, the attack path confidence level calculated by attack path confidence level calculator <NUM> for that attack path, the entry point of that attack path, the entry point risk calculated by entry point estimator <NUM> for that entry point, the attack target of that attack path, and the attack target risk calculated by attack target estimator <NUM> for that attack target.

Outputter <NUM> outputs the attack path estimated by attack path estimator <NUM>. This embodiment will describe outputter <NUM> as including display controller <NUM>, which outputs a display control signal including the attack path to display device <NUM>.

When attack path estimator <NUM> has estimated the attack path, display controller <NUM> outputs a display control signal including the attack path to display device <NUM>, the display control signal controlling display device <NUM> to display a configuration diagram indicating the configuration of the in-vehicle network, and display the attack path using a different method from the other parts in that configuration diagram. At this time, display controller <NUM> may output the display control signal as a display control signal which controls display device <NUM> to display, in table format, information pertaining to the estimation result from attack path estimator <NUM>, the estimation result from entry point estimator <NUM>, the estimation result from attack target estimator <NUM>, and/or the calculation result from attack path confidence level calculator <NUM>, for example. The descriptions here will assume that display controller <NUM> further implements the display control signal as a display control signal that controls display device <NUM> to display, in table format, the attack path history managed by attack path estimation result table manager <NUM>.

A specific example of a screen displayed by display device <NUM> under the control of the display control signal output by display controller <NUM> will be described later.

Operations performed by attack monitoring system <NUM> having the aforementioned configuration will be described hereinafter with reference to the drawings.

<FIG> is a sequence chart illustrating attack monitoring processing performed by attack monitoring system <NUM>. <FIG> is a flowchart illustrating attack analysis processing performed by attack analysis device <NUM> in the attack monitoring processing performed by attack monitoring system <NUM>.

As illustrated in <FIG>, in the attack monitoring processing, when IDS <NUM> included in in-vehicle network <NUM> detects an anomaly, that IDS <NUM> notifies security master <NUM> that an anomaly has been detected.

Upon being notified of the anomaly detection by IDS <NUM>, security master <NUM> generates the anomaly detection information (here, the anomaly detection list), and makes a request to vehicle control event manager <NUM> for the vehicle control event history and the external communication event history within predetermined period T2 before and after the detection of the anomaly by IDS <NUM>.

Upon doing so, vehicle control event manager <NUM> transmits the requested vehicle control event history and external communication event history to security master <NUM>.

Security master <NUM> obtains the vehicle control event history and the external communication event history. Security master <NUM> then transmits the generated anomaly detection information to attack analysis device <NUM> along with the in-vehicle network information, the obtained vehicle control event history, and the obtained external communication event history.

When the anomaly detection information is transmitted from security master <NUM>, attack analysis device <NUM> starts attack analysis processing.

As illustrated in <FIG> and <FIG>, in the attack analysis processing, obtainer <NUM> obtains the anomaly detection information, the in-vehicle network information, the vehicle control event history, and the external communication event history transmitted from security master <NUM> (step S10).

Next, based on the in-vehicle network information, the anomaly detection information, and the external communication event history obtained by obtainer <NUM>, entry point estimator <NUM> estimates the entry point (step S20). At this time, entry point estimator <NUM> calculates the entry point risk for each of the plurality of external communication IFs <NUM> in the process of estimating the entry point. This entry point estimation is implemented by entry point estimator <NUM> performing entry point estimation processing, which will be described later.

Next, based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history obtained by obtainer <NUM>, attack target estimator <NUM> estimates the attack target (step S30). At this time, attack target estimator <NUM> calculates the attack target risk for each of the plurality of ECUs <NUM> in the process of estimating the attack target. This attack target estimation is implemented by attack target estimator <NUM> performing attack target estimation processing, which will be described later.

Next, attack path estimator <NUM> estimates the attack path based on the entry point estimated by entry point estimator <NUM>, the attack target estimated by attack target estimator <NUM>, the in-vehicle network information obtained by obtainer <NUM>, and the anomaly detection information obtained by obtainer <NUM> (step S40). This attack path estimation is implemented by attack path estimator <NUM> performing attack path estimation processing, which will be described later.

Next, based on the entry point risk of the entry point calculated by entry point estimator <NUM> and the attack target risk of the attack target calculated by attack target estimator <NUM>, attack path confidence level calculator <NUM> calculates an attack path confidence level for the attack path estimated by attack path estimator <NUM> (step S50). This attack path confidence level calculation is implemented by attack path confidence level calculator <NUM> performing attack path confidence level calculation processing, which will be described later.

Next, outputter <NUM> outputs, to display device <NUM>, a display control signal including the attack path estimated by attack path estimator <NUM> (step S60).

Once outputter <NUM> outputs the display control signal, attack analysis device <NUM> ends the attack analysis processing.

Once outputter <NUM> outputs the display control signal, display device <NUM> displays an image based on that display control signal.

Once display device <NUM> displays the image based on the display control signal, attack monitoring system <NUM> ends the attack monitoring processing.

<FIG> and <FIG> are flowcharts illustrating the entry point estimation processing performed by entry point estimator <NUM>.

As illustrated in <FIG> and <FIG>, when the entry point estimation processing is started, entry point estimator <NUM> obtains the in-vehicle network information, the anomaly detection information, and the external communication event history obtained by obtainer <NUM>, and referring to the in-vehicle network information, selects one external communication IF <NUM> among the plurality of external communication IFs <NUM> included in in-vehicle network <NUM> (step S80).

Then, referring to anomaly detection information, entry point estimator <NUM> checks whether IDS <NUM> included in the selected external communication IF <NUM> has detected an anomaly (step S100).

If IDS <NUM> included in the selected external communication IF <NUM> has detected an anomaly in the processing of step S100 (step S100: Yes), entry point estimator <NUM> refers to the external communication event history, and checks whether the selected external communication IF <NUM> has produced an external communication event by communicating with the exterior (step S101).

If the selected external communication IF <NUM> has produced an external communication event by communicating with the exterior in the processing of step S101 (step S101: Yes), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "anomaly detected (attack risk: high)", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S102).

If the selected external communication IF <NUM> has not produced an external communication event by communicating with the exterior in the processing of step S101 (step S101: No), entry point estimator <NUM> refers to the anomaly detection information and the external communication event history, and checks whether IDS <NUM> immediately following the selected external communication IF <NUM> has detected an anomaly (step S103).

If IDS <NUM> immediately following the selected external communication IF <NUM> has detected an anomaly in the processing of step S103 (step S103: Yes), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "anomaly detected", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S104).

If IDS <NUM> immediately following the selected external communication IF <NUM> has not detected an anomaly in the processing of step S103 (step S103: No), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "false detection", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S105).

If IDS <NUM> included in the selected external communication IF <NUM> has not detected an anomaly in the processing of step S100 (step S100: No), entry point estimator <NUM> refers to the external communication event history, and checks whether the selected external communication IF <NUM> has produced an external communication event by communicating with the exterior (step S106).

If the selected external communication IF <NUM> has produced an external communication event by communicating with the exterior in the processing of step S106 (step S106: Yes), entry point estimator <NUM> refers to the anomaly notification information and the external communication event history, and checks whether IDS <NUM> immediately following the selected external communication IF <NUM> has detected an anomaly (step S107).

If IDS <NUM> immediately following the selected external communication IF <NUM> has detected an anomaly in the processing of step S107 (step S107: Yes), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "undetected", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S108).

If IDS <NUM> immediately following the selected external communication IF <NUM> has not detected an anomaly in the processing of step S107 (step S107: No), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "no attack (event present)", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S109).

If the selected external communication IF <NUM> has not produced an external communication event by communicating with the exterior in the processing of step S106 (step S106: No), entry point estimator <NUM> estimates the anomaly state of the selected external communication IF <NUM> to be "no attack", and calculates the entry point risk for that external communication IF <NUM> as "<NUM>" (step S110).

When the processing of step S102, the processing of step S104, the processing of step S105, the processing of step S108, the processing of step S109, or the processing of step S110 ends, entry point estimator <NUM> refers to the in-vehicle network information and checks whether there are unselected external communication IFs <NUM>, among the plurality of external communication IFs <NUM> included in in-vehicle network <NUM>, which have not yet been selected in the entry point estimation processing (step S111).

If there are unselected external communication IFs <NUM> in the processing of step S111 (step S111: Yes), entry point estimator <NUM> selects one external communication IF <NUM> among the unselected external communication IFs <NUM> (step S81), and moves to the processing of step S100.

If there are no unselected external communication IFs <NUM> in the processing of step S111 (step S111: No), entry point estimator <NUM> selects external communication IF <NUM> having the highest calculated entry point risk (step S112).

If there are a plurality of external communication IFs <NUM> selected in the processing of step S112 (step S113: Yes), entry point estimator <NUM> checks whether the entry point risks of those external communication IFs <NUM> are <NUM>, <NUM>, or <NUM> (step S114).

If the entry point risks are <NUM>, <NUM>, or <NUM> in the processing of step S114 (step S114: Yes), entry point estimator <NUM> refers to the external communication event history and estimates external communication IF <NUM>, among those external communication IFs <NUM>, which has the highest score for the associated external communication event risk, i.e., the highest degree of risk of a cyber attack due to the associated external communication event, as the entry point (step S115).

If the entry point risks are not <NUM>, <NUM>, or <NUM> in the processing of step S114 (step S114: No), entry point estimator <NUM> checks whether the entry point risks of those external communication IFs <NUM> are <NUM> or <NUM> (step S116).

If the entry point risks are <NUM> or <NUM> in the processing of step S116 (step S116: Yes), entry point estimator <NUM> refers to the anomaly detection information and estimates external communication IF <NUM>, among those external communication IFs <NUM>, which has the highest associated anomaly detection score, as the entry point (step S117).

If the entry point risks are not <NUM> or <NUM> in the processing of step S116 (step S116: No), entry point estimator <NUM> refers to the anomaly detection information and the in-vehicle network information, and estimates external communication IF <NUM> which can make the shortest connection to an intermediate node which detected the anomaly as the entry point (step S118).

If there are not a plurality of external communication IFs <NUM> selected in the processing of step S112 (step S113: No), i.e., if there is only one selected external communication IF <NUM>, entry point estimator <NUM> estimates that external communication IF <NUM> as the entry point (step S119).

When the processing of step S115, the processing of step S117, the processing of step S118, or the processing of step S119 ends, entry point estimator <NUM> outputs the estimated entry point as an estimation result of that entry point estimation processing (step S120).

When the processing of step S120 ends, entry point estimator <NUM> ends that entry point estimation processing.

<FIG> and <FIG> are flowcharts illustrating the attack target estimation processing performed by attack target estimator <NUM>.

As illustrated in <FIG> and <FIG>, when the attack target estimation processing is started, attack target estimator <NUM> obtains the in-vehicle network information, the anomaly detection information, and the vehicle control event history obtained by obtainer <NUM>, and referring to the in-vehicle network information, selects one ECU <NUM> among the plurality of ECUs <NUM> included in in-vehicle network <NUM> (step S90).

Then, referring to the anomaly detection information, attack target estimator <NUM> checks whether IDS <NUM> included in the selected ECU <NUM> has detected an anomaly (step S200).

If IDS <NUM> included in the selected ECU <NUM> has detected an anomaly in the processing of step S200 (step S200: Yes), attack target estimator <NUM> refers to the vehicle control event history and checks whether a vehicle control event has been produced by the selected ECU <NUM> (step S201).

If the selected ECU <NUM> has produced a vehicle control event in the processing of step S201 (step S201: Yes), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "anomaly detected (attack risk: high)", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S202).

If the selected ECU <NUM> has not produced a vehicle control event in the processing of step S201 (step S201: No), attack target estimator <NUM> refers to the anomaly detection information and the vehicle control event history, and checks whether IDS <NUM> immediately before the selected ECU <NUM> has detected an anomaly (step S203).

If IDS <NUM> immediately before the selected ECU <NUM> has detected an anomaly in the processing of step S203 (step S203: Yes), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "anomaly detected", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S204).

If IDS <NUM> immediately before the selected ECU <NUM> has not detected an anomaly in the processing of step S203 (step S203: No), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "false detection", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S205).

If IDS <NUM> included in the selected ECU <NUM> has not detected an anomaly in the processing of step S200 (step S200: No), attack target estimator <NUM> refers to the vehicle control event history and checks whether a vehicle control event has been produced by the selected ECU <NUM> (step S206).

If the selected ECU <NUM> has produced a vehicle control event in the processing of step S206 (step S206: Yes), attack target estimator <NUM> refers to the anomaly notification information and the vehicle control event history, and checks whether IDS <NUM> immediately before the selected ECU <NUM> has detected an anomaly (step S207).

If IDS <NUM> immediately before the selected ECU <NUM> has detected an anomaly in the processing of step S207 (step S207: Yes), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "undetected", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S208).

If IDS <NUM> immediately before the selected ECU <NUM> has not detected an anomaly in the processing of step S207 (step S207: No), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "no attack (event present)", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S209).

If the selected ECU <NUM> has not produced a vehicle control event in the processing of step S206 (step S206: No), attack target estimator <NUM> estimates the anomaly state of the selected ECU <NUM> to be "no attack", and calculates the attack target risk for that ECU <NUM> as "<NUM>" (step S210).

When the processing of step S202, the processing of step S204, the processing of step S205, the processing of step S208, the processing of step S209, or the processing of step S210 ends, attack target estimator <NUM> refers to the in-vehicle network information and checks whether there are unselected ECUs <NUM>, among the plurality of ECUs <NUM> included in in-vehicle network <NUM>, which have not yet been selected in the attack target estimation processing (step S211).

If there are unselected ECUs <NUM> in the processing of step S211 (step S211: Yes), attack target estimator <NUM> selects one ECU <NUM> among the unselected ECUs <NUM> (step S91), and moves to the processing of step S200.

If there are no unselected ECUs <NUM> in the processing of step S211 (step S211: No), attack target estimator <NUM> selects ECU <NUM> having the highest calculated attack target risk (step S212).

If there are a plurality of ECUs <NUM> selected in the processing of step S212 (step S213: Yes), attack target estimator <NUM> checks whether the attack target risks of those ECUs <NUM> are <NUM>, <NUM>, or <NUM> (step S214).

If the attack target risks are <NUM>, <NUM>, or <NUM> in the processing of step S214 (step S214: Yes), attack target estimator <NUM> refers to the vehicle control event history and estimates ECU <NUM>, among those ECUs <NUM>, which has the highest score for the associated vehicle control event risk, i.e., the highest severity of the associated vehicle control event threatening the safety of vehicle <NUM>, as the attack target (step S215).

If the attack target risks are not <NUM>, <NUM>, or <NUM> in the processing of step S214 (step S214: No), attack target estimator <NUM> checks whether the attack target risks of those ECUs <NUM> are <NUM> or <NUM> (step S216).

If the attack target risks are <NUM> or <NUM> in the processing of step S216 (step S216: Yes), attack target estimator <NUM> refers to the anomaly detection information and estimates ECU <NUM>, among those ECUs <NUM>, which has the highest associated anomaly detection score, as the attack target (step S217).

If the attack target risks are not <NUM> or <NUM> in the processing of step S216 (step S216: No), attack target estimator <NUM> refers to the anomaly detection information and the in-vehicle network information, and estimates ECU <NUM> which can make the shortest connection to an intermediate node which detected the anomaly as the attack target (step S218).

If there are not a plurality of ECUs <NUM> selected in the processing of step S212 (step S213: No), i.e., if there is only one selected ECU <NUM>, attack target estimator <NUM> estimates that ECU <NUM> as the attack target (step S219).

When the processing of step S215, the processing of step S217, the processing of step S218, or the processing of step S219 ends, attack target estimator <NUM> outputs the estimated attack target as an estimation result of that attack target estimation processing (step S220).

When the processing of step S220 ends, attack target estimator <NUM> ends that attack target estimation processing.

<FIG> is a schematic diagram illustrating an example of the attack path estimation result table updated by attack path estimation result table manager <NUM> after the entry point estimation processing has been executed by entry point estimator <NUM> and the attack target estimation processing has been executed by attack target estimator <NUM>.

As illustrated in <FIG>, when the entry point estimation processing is executed by entry point estimator <NUM> and the attack target estimation processing is executed by attack target estimator <NUM>, attack path estimation result table manager <NUM> updates the attack path estimation result table by recording the anomaly state of each external communication IF <NUM> estimated by entry point estimator <NUM>, or the anomaly state of each ECU <NUM> estimated by attack target estimator <NUM>, as the estimation result, as well as the entry point risk of each external communication IF <NUM> calculated by entry point estimator <NUM>, or the attack target risk of each ECU <NUM> calculated by attack target estimator <NUM>, as the risk, in the attack path estimation result table.

<FIG> is a flowchart illustrating the attack path estimation processing performed by attack path estimator <NUM>.

As illustrated in <FIG>, when the attack path estimation processing is started, attack path estimator <NUM> obtains the in-vehicle network information and the anomaly detection information obtained by obtainer <NUM>, the entry point estimated by entry point estimator <NUM>, and the attack target estimated by attack target estimator <NUM> (step S300).

Then, referring to the configuration of in-vehicle network <NUM> indicated by the in-vehicle network information, attack path estimator <NUM> calculates each of at least one path connecting the entry point with the attack target as an attack path candidate (step S310).

Once at least one attack path candidate is calculated, attack path estimator <NUM> refers to the anomaly detection information, and estimates the attack path candidate, among the at least one attack path candidate, which has the highest number of IDSs <NUM> that detected an anomaly, as the attack path (step S320). Here, if there are a plurality of attack path candidates having the highest number of IDSs <NUM> that detected an anomaly, attack path estimator <NUM> estimates each of the plurality of attack path candidates as an attack path.

When the processing of step S320 ends, attack path estimator <NUM> ends that attack path estimation processing.

<FIG> is a flowchart illustrating the attack path confidence level calculation processing performed by attack path confidence level calculator <NUM>.

As illustrated in <FIG>, when the attack path confidence level calculation processing is started, attack path confidence level calculator <NUM> obtains the entry point risk of the entry point calculated by entry point estimator <NUM> and the attack target risk of the attack target calculated by attack target estimator <NUM> (step S400).

Then, attack path confidence level calculator <NUM> calculates an average of the obtained entry point risk of the entry point and attack target risk of the attack target as the attack path confidence level (step S410).

Once the attack path confidence level is calculated, attack path confidence level calculator <NUM> checks whether there are a plurality of attack paths estimated by attack path estimator <NUM> (step S420).

If there are a plurality of attack paths estimated by attack path estimator <NUM> in the processing of step S420 (step S420: Yes), attack path confidence level calculator <NUM> corrects the attack path confidence level using the number of attack paths (step S430). Attack path confidence level calculator <NUM> will be described here as correcting the attack path confidence level by dividing the attack path confidence level by the number of attack paths. However, as long as attack path confidence level calculator <NUM> can correct the attack path confidence level using the number of attack paths, it is not absolutely necessary to employ a configuration in which the attack path confidence level is corrected by dividing the attack path confidence level by the number of attack paths.

When the processing of step S430 ends, attack path confidence level calculator <NUM> ends that attack path confidence level calculation processing.

Attack path confidence level calculator <NUM> has been described as calculating an average of the obtained entry point risk of the entry point and attack target risk of the attack target as the attack path confidence level in the processing of step S410. However, attack path confidence level calculator <NUM> may calculate the attack path confidence level using another method. For example, attack path confidence level calculator <NUM> may refer to the configuration of in-vehicle network <NUM> indicated by the in-vehicle network information obtained by obtainer <NUM> and the anomaly detection information obtained by obtainer <NUM> and calculate, as the attack path confidence level, a numerical value between <NUM> and <NUM> obtained by dividing the number of IDSs <NUM> that detected an anomaly in the attack path by the total number of IDSs <NUM> in the attack path.

<FIG> and <FIG> are schematic diagrams illustrating an example of the attack path estimation result table updated by attack path estimation result table manager <NUM> after the attack path estimation processing has been executed by attack path estimator <NUM> and the attack path confidence level calculation processing has been executed. Here, <FIG> is a schematic diagram illustrating an example of the attack path estimation result table when attack path estimator <NUM> has estimated a single attack path, and <FIG> is a schematic diagram illustrating an example of the attack path estimation result table when attack path estimator <NUM> has estimated a plurality of (two, here) attack paths.

As illustrated in <FIG> and <FIG>, when the attack path estimation processing is executed by attack path estimator <NUM> and the attack path confidence level calculation processing is executed, attack path estimation result table manager <NUM> updates the attack path estimation result table by recording a mark for the nodes corresponding to the attack path, for each attack path estimated by attack path estimator <NUM>, and the attack path confidence level calculated by attack path confidence level calculator <NUM>, in the attack path estimation result table.

<FIG> is a flowchart illustrating first display control processing performed by display controller <NUM>.

As illustrated in <FIG>, when the first display control processing is started, display controller <NUM> obtains the in-vehicle network information obtained by obtainer <NUM>, the attack path estimated by attack path estimator <NUM>, and the attack path history managed by attack path estimation result table manager <NUM> (step S500).

Then, referring to the configuration of in-vehicle network <NUM> indicated by the in-vehicle network information, display controller <NUM> calculates a display control signal such that an in-vehicle network configuration diagram indicating the configuration of the in-vehicle network is displayed in display device <NUM> (step S510).

Furthermore, referring to the attack path, display controller <NUM> calculates the display control signal such that the attack path is displayed in display device <NUM> using a different method from the other parts (step S520).

Furthermore, display controller <NUM> calculates the display control signal such that the attack path history is displayed in display device <NUM> in table format (step S530).

Then, display controller <NUM> outputs the calculated display control signal to display device <NUM> (step S540).

When the processing of step S540 ends, display controller <NUM> ends that first display control processing.

<FIG> is a schematic diagram illustrating an example of a screen displayed by display device <NUM> under the control of the display control signal output as a result of display controller <NUM> executing the first display processing.

As illustrated in <FIG>, by being controlled by the display control signal output from display controller <NUM>, display device <NUM> displays (<NUM>) the in-vehicle network configuration diagram in which the attack path estimated by attack path estimator <NUM> is displayed using a display method different from other paths, and (<NUM>) a list of, for each of at least one attack path estimated by attack path estimator <NUM> in the past, the anomaly notification ID identifying an anomaly notification corresponding to that attack path, the attack path confidence level of that attack path, the entry point of that attack path, the entry point risk of that entry point, the attack target of that attack path, and the attack target risk of that attack target, which are associated with each other in table format.

Note that display controller <NUM> may perform second display control processing instead of the first display control processing.

<FIG> is a flowchart illustrating the second display control processing performed by display controller <NUM>.

As illustrated in <FIG>, the second display control processing is processing realized by changing the first display control processing such that the processing of step S505 is performed instead of the processing of step S500, and the processing of step S531 and the processing of step S532 are executed between the processing of step S530 and the processing of step S540.

Accordingly, the following descriptions will focus on the processing of step S505, the processing of step S531, and the processing of step S532.

As illustrated in <FIG>, when the second display control processing is started, display controller <NUM> obtains the in-vehicle network information and the anomaly detection information obtained by obtainer <NUM>, the attack path estimated by attack path estimator <NUM>, and the attack path history managed by attack path estimation result table manager <NUM> (step S505), after which the processing moves to step S510.

When the processing of step S530 ends, display controller <NUM> refers to the anomaly detection information, and checks whether there is IDS <NUM> which is not included in the attack path but which has detected an anomaly (step S531).

If there is IDS <NUM> which is not included in the attack path but which has detected an anomaly in the processing of step S530 (step S531: Yes), display controller <NUM> calculates the display control signal such that the node including the corresponding IDS is displayed in display device <NUM> using a display method different from both the attack path and other parts (step S532).

If there is no IDS <NUM> which is not included in the attack path but which has detected an anomaly in the processing of step S530 (step S531: No), or if the processing of step S532 has ended, the processing moves to step S540.

When the processing of step S540 ends, display controller <NUM> ends that second display control processing.

<FIG> is a schematic diagram illustrating an example of a screen displayed by display device <NUM> under the control of the display control signal output as a result of display controller <NUM> executing the second display processing.

As illustrated in <FIG>, by being controlled by the display control signal output from display controller <NUM>, display device <NUM> displays (<NUM>) the in-vehicle network configuration diagram in which the attack path estimated by attack path estimator <NUM> is displayed using a display method different from other paths, and the node including IDS <NUM> which is not included in the attack path but which has detected an anomaly is displayed using a display method different from both the attack path and other parts, and (<NUM>) a list of, for each of at least one attack path estimated by attack path estimator <NUM> in the past, the anomaly notification ID identifying an anomaly notification corresponding to that attack path, the attack path confidence level of that attack path, the entry point of that attack path, the entry point risk of that entry point, the attack target of that attack path, and the attack target risk of that attack target, which are associated with each other in table format.

As described above, according to attack analysis device <NUM>, when an attack is carried out on in-vehicle network <NUM>, an attack path including the entry point and the attack target in that attack can be estimated. Accordingly, when an attack is carried out on in-vehicle network <NUM>, the cost of analyzing the attack, including analyzing the attack, verifying the attack against other cases from the past, and the like, can be reduced for the user of attack analysis device <NUM>.

Additionally, as described above, according to attack analysis device <NUM>, an in-vehicle network configuration diagram in which the estimated attack path is displayed using a display method different from other paths can be displayed in display device <NUM>. The user using attack analysis device <NUM> can therefore visually recognize the estimated attack path.

An example of the technique disclosed in the present application has been described based on an embodiment. However, the present disclosure is not intended to be limited to this embodiment. Variations on the present embodiment conceived by one skilled in the art, embodiments implemented by combining constituent elements from different other embodiments, and the like may be included in the scope of one or more aspects of the present disclosure as well, as long as they do not depart from the scope of the appended claims.

<FIG> is a block diagram illustrating an example of the configuration of integrated ECU 24A according to a variation. Integrated ECU 24A is, for example, what is known as a computer device, which includes a processor (not shown) and a memory (not shown), and which realizes attack analysis device <NUM> by the processor executing a program stored in the memory.

(<NUM>) Some or all of the constituent elements included in attack analysis device <NUM> may be realized by dedicated or general-purpose circuitry.

Some or all of the constituent elements included in attack analysis device <NUM> may be implemented by a single integrated circuit through system LSI (Large-Scale Integration), for example. "System LSI" refers to very-large-scale integration in which multiple constituent elements are integrated on a single chip, and specifically, refers to a computer system configured including a microprocessor, read-only memory (ROM), random access memory (RAM), and the like. A computer program is stored in the ROM. The system LSI circuit realizes the functions of the devices by the microprocessor operating in accordance with the computer program.

Note that although the term "system LSI" is used here, other names, such as IC, LSI, super LSI, ultra LSI, and so on may be used, depending on the level of integration. Furthermore, the manner in which the circuit integration is achieved is not limited to LSI, and it is also possible to use a dedicated circuit or a generic processor. It is also possible to employ a Field Programmable Gate Array (FPGA) which is programmable after the LSI circuit has been manufactured, or a reconfigurable processor in which the connections and settings of the circuit cells within the LSI circuit can be reconfigured.

Furthermore, if other technologies that improve upon or are derived from semiconductor technology enable integration technology to replace LSI circuits, then naturally it is also possible to integrate the function blocks using that technology. Biotechnology applications are one such foreseeable example.

(<NUM>) Rather than attack analysis device <NUM>, one aspect of the present disclosure may be an attack analysis method that implements the characteristic constituent elements included in attack analysis device <NUM> as steps. Additionally, aspects of the present disclosure may be realized as a computer program that causes a computer to execute the characteristic steps included in the attack analysis method. Furthermore, aspects of the present disclosure may be realized as a computer-readable non-transitory recording medium in which such a computer program is recorded.

Claim 1:
An attack analysis device comprising:
an obtainer that obtains in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control Electronic Control Units (ECUs), and anomaly detection information indicating a result of detecting an anomaly in at least one node in the in-vehicle network;
an attack path estimator that, based on the in-vehicle network information and the anomaly detection information, estimates an attack path in an attack on the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of intrusion into the in-vehicle network in the attack and an attack target indicating a control ECU that is a target of the attack; and
an outputter that outputs the attack path.