Abstract: By an attack estimation verification device, an attack estimation verification method, and a computer-readable non-transitory storage medium storing an attack estimation verification program, an attack-abnormality relation table is stored, a security log is acquired, an attack received by an electronic control system is estimated, it is determined whether grouping or an assumption feature of an abnormal electronic control unit is appropriate, and a notification indicating a verification result is provided.

Abstract: An attack analysis device includes attack abnormality relationship information indicating a relationship among (i) attack information indicating an attack possible to be received by an electronic control system, (ii) an estimation abnormality information indicating an abnormality estimated to be occurred when the attack is received, and (iii) commonized estimation abnormality location information indicating a commonized estimation abnormality location, which is a location of the abnormality estimated to be occurred when the electronic control system receives the attack and commonized between the electronic control system and a different electronic control system. The attack analysis device estimates an attack received by the electronic control system with reference to the attack abnormality relationship information.

Abstract: An attack analysis device acquires a security log generated by a security sensor mounted on each of a plurality of electronic control units configuring an electronic control system, sets a log package in which a plurality of the security logs are packaged, estimates an attack received by the electronic control system based on the log package, and outputs attack information indicating the estimated attack.

Abstract: A log management device includes a storage unit in which main device information indicating a main log management device is stored. The log management device is configured to: acquire logs from an electronic control unit; determine whether the ego log management device is the main log management device based on the main device information stored in the storage unit of the ego log management device; in response to determining that the ego log management device is the main log management device, transmit the acquired logs to a device located outside of the mobile object; and in response to determining that the ego log management device is not the main log management device, not transmit the acquired logs to the device located outside of the mobile object.

Abstract: A log analysis device includes a storage unit in which false positive confirmation rules and false positive estimation rules are stored. The log analysis device is configured to: acquire a security event log indicating an abnormality detected by a security sensor of an electronic control device mounted on a vehicle; acquire vehicle state information indicating an internal state or an external state of the vehicle; determine whether the security event logs is a confirmed false positive log using the false positive confirmation rule or an estimated false positive log using the false positive estimation rule; and output the estimated false positive log together with flag information with the confirmed false positive log being not output.

Abstract: An attack analysis device configured to analyze an attack against an electronic control system constructed in a vehicle, the attack being against the electronic control system via a network is provided. The attack analysis device includes a determination section configured to determine whether correspondence information matches a preset type of the attack, the correspondence information being obtained by associating a system log that is a log of the electronic control system with a communication log that is a log of communication between the electronic control system and an outside of the vehicle, and determine whether a target element representing at least one of the electronic control system or a component of the electronic control system has been violated.

Abstract: A center device is provided that receives a log from vehicle-mounted equipment transmitting the log based on an external transmission rule and analyzes the log to detect a cyber attack. Based on a result of the detecting, the center device determines update of the external transmission rule. The center devices transmits an external transmission rule update instruction. As attack depth of the cyber attack is deeper, the center device sets an external transmission target to the log that is generated in a deeper layer among layers in which constituent elements of the vehicle-mounted equipment are defined.

Abstract: An information processing device is configured to: acquire a security log indicating an anomaly occurred in a vehicle; determine whether to instruct a verification unit of the vehicle to execute an integrity verification for verifying an integrity of an in-vehicle unit based on the acquired security log; in response to determining to instruct the verification unit to execute the integrity verification, instruct the verification unit to execute the integrity verification; determine whether the in-vehicle unit is intruded based on a result of the integrity verification executed by the verification unit; and perform an estimation of an attack, which is a cause of intrusion, based on the security log and a result of intrusion determination that determines whether the in-vehicle unit is intruded.

Abstract: An attack analysis device includes a storage device storing attack anomaly relation information indicating a relation among (i) predicted attack information indicating an attack predicted to be received by an electronic control system, (ii) predicted anomaly information indicating an anomaly predicted to occur when the electronic control system receives the predicted attack, and (iii) predicted anomaly location information indicating a location within the electronic control system where the predicted anomaly occurs. The attack analysis device is configured to: acquire a security log indicating (i) an anomaly detected in the electronic control system and (ii) a location where the anomaly is detected; acquire an indicator indicating an internal state and/or external state of the mobile object when the anomaly occurs; estimate the received attack based on (i) the security log, (ii) the attack anomaly relation information, and (iii) the indicator; and output the attack information indicating the estimated attack.

Abstract: An attack analyzer includes: a common log acquisition unit acquiring a common security log including abnormality information indicating abnormality detected by an electronic control system, and a common abnormality position indicating an abnormality position of the abnormality converted to be common among the electronic control system and other electronic control systems; an attack/abnormality relationship table storage unit storing an attack/abnormality relationship table; an estimation unit; and an output unit outputting attack information including the attack type.

Abstract: An attack analysis device stores attack abnormality relationship information indicating a relationship among (i) predicted attack information indicating an attack predicted to be received by an electronic control system, (ii) predicted abnormality information indicating an abnormality predicted to occur in response to the predicted attack, and (iii) predicted abnormality location information indicating a location within the electronic control system where the predicted abnormality occurs.

Abstract: A log analysis device is provided. The log analysis device receives a log indicating status of an electronic control system mounted in a movable object from the electronic control system, analyzes an abnormality in the electronic control system by using the log received. Depending on a result of the analyzing, the log analysis device determines, on a log-by-log basis, priority for the electronic control system to transmit the log to the log analysis device. Based on the priority determined, the log analysis device generates instruction information that gives an instruction for controlling transmission of the log, and transmits the instruction information to the electronic control system.

Abstract: An attack analysis device acquires a security log generated by a security sensor mounted on each of a plurality of electronic control units configuring an electronic control system, sets a log package in which a plurality of the security logs are packaged, estimates an attack received by the electronic control system based on the log package, and outputs attack information indicating the estimated attack.

Abstract: An attack analysis device includes attack abnormality relationship information indicating a relationship among (i) attack information indicating an attack possible to be received by an electronic control system, (ii) an estimation abnormality information indicating an abnormality estimated to be occurred when the attack is received, and (iii) commonized estimation abnormality location information indicating a commonized estimation abnormality location, which is a location of the abnormality estimated to be occurred when the electronic control system receives the attack and commonized between the electronic control system and a different electronic control system. The attack analysis device estimates an attack received by the electronic control system with reference to the attack abnormality relationship information.

Abstract: A log transmission controller includes a log acquirer, a priority storage, an update instruction acquirer, a priority updater and a transmitter. The log acquirer acquires a log indicating respective states of electronic control units connected to the log transmission controller equipped in a moving object. The priority storage stores priority information indicating a priority for transmitting the log to a server. The update instruction acquirer acquires a first update instruction generated by an update instructor for updating the priority information, and second and third update instructions generated by the server for updating the priority information. The priority updater updates the priority information based on the update instruction. The transmitter transmits the log based on the priority. The first and second update instructions are for updating the priority to be higher than a predetermined priority, and the third update instruction is for updating the priority to the predetermined priority.

Abstract: By an attack estimation verification device, an attack estimation verification method, and a computer-readable non-transitory storage medium storing an attack estimation verification program, an attack-abnormality relation table is stored, a security log is acquired, an attack received by an electronic control system is estimated, it is determined whether grouping or an assumption feature of an abnormal electronic control unit is appropriate, and a notification indicating a verification result is provided.

Abstract: A log transmission controller includes a log acquirer, a priority storage, an update instruction acquirer, a priority updater and a transmitter. The log acquirer acquires a log indicating respective states of electronic control units connected to the log transmission controller, which is equipped in a moving object. The priority storage stores priority information indicating a priority for transmitting the log to a server, which is disposed at exterior of the moving object. The update instruction acquirer acquires an update instruction, which is generated by an update instructor equipped in the moving object, for instructing to update the priority information stored in the priority storage. The priority updater updates the priority information based on the update instruction. The transmitter transmits the log to the server based on the priority indicated by the updated priority information.

Abstract: An attack analyzer includes: a common log acquisition unit acquiring a common security log including abnormality information indicating abnormality detected by an electronic control system, and a common abnormality position indicating an abnormality position of the abnormality converted to be common among the electronic control system and other electronic control systems; an attack/abnormality relationship table storage unit storing an attack/abnormality relationship table; an estimation unit; and an output unit outputting attack information including the attack type.

Abstract: A log analysis device is provided. The log analysis device receives a log indicating status of an electronic control system mounted in a movable object from the electronic control system, analyzes an abnormality in the electronic control system by using the log received. Depending on a result of the analyzing, the log analysis device determines, on a log-by-log basis, priority for the electronic control system to transmit the log to the log analysis device. Based on the priority determined, the log analysis device generates instruction information that gives an instruction for controlling transmission of the log, and transmits the instruction information to the electronic control system.

Abstract: A center device is provided that receives a log from vehicle-mounted equipment transmitting the log based on an external transmission rule and analyzes the log to detect a cyber attack. Based on a result of the detecting, the center device determines update of the external transmission rule. The center devices transmits an external transmission rule update instruction. As attack depth of the cyber attack is deeper, the center device sets an external transmission target to the log that is generated in a deeper layer among layers in which constituent elements of the vehicle-mounted equipment are defined.