Abstract: An incident event cause identification system includes a device log information holding unit that holds log information of a target device, a causality graph holding unit that holds a causality graph in which a relationship between an incident event and a cause thereof is associated, and an incident detection processing unit that detects an incident in the target device. A necessary log information determination processing unit extracts a causality graph of an associated type for the detected incident event and determines device log information necessary for cause identification on the basis of the extracted causality graph. A necessary log information collection processing unit collects the device log information determined by the necessary log information determination processing unit, and a cause analysis processing unit identifies a cause of the incident event by using the device log information collected by the necessary log information collection processing unit and the causality graph.

Abstract: When occurrence of a security event related to a security abnormality is detected, a detection device transmits a countermeasure request message including detected content of the security event to a countermeasure reader device. When the countermeasure request message is received from the detection device, the countermeasure reader device specifies countermeasure content for the security event and transmits a pre-preparation message including the detected content and the countermeasure content to other countermeasure devices. When each of the countermeasure devices excluding the countermeasure reader device receives the pre-preparation message from the countermeasure reader device, the countermeasure device verifies consistency between the detected content included in the received pre-preparation message and the countermeasure content.

Abstract: An information processing device that can update software includes: a storage unit that stores control information for controlling whether or not the software can be updated; a communication unit that receives a communication message transmitted from another information processing device connected thereto via a communication line; an update control unit that updates the control information on the basis of the communication message received by the communication unit; and an update propriety determination unit that determines whether or not the software can be updated, on the basis of the control information.

Abstract: An arithmetic device includes a first core, a second core, and one or more other cores that perform arithmetic processing. The first core includes a first verification unit that performs a first verification process on a message received from outside of the arithmetic device. The second core includes a verification destination determination processing unit that determines whether or not the second core executes the second verification process on the message based on identification information included in the message.

Abstract: Provided is an information processing apparatus that allows a plurality of systems to efficiently share information regarding an alert. An information processing apparatus includes an ID assigning computer that assigns a log ID to collected log data of a device, a first processing computer that stores the log data and the log ID and detects an abnormality based on the log data, and a second processing computer that stores the log data and the log ID, detects an abnormality based on the log data, and transmits the log ID of the log data in which the abnormality is detected and a detection result of the abnormality to the first processing computer. The first processing computer stores the log data stored in the first processing computer and the received detection result in association with each other based on the log ID received from the second processing computer.

Abstract: An electronic control device 140 is mounted on an on-vehicle control system 10 that performs travel control of an automobile, and is communicatively connected to a plurality of control devices including a first control device (electronic control device 120) and a second control device (electronic control device 130). The electronic control device 140 includes an attack determination unit 145 that determines presence or absence of a security attack in each control device, and a redundant system execution determination unit 146 that determines whether to cause the second control device to execute a redundant function similar to or a part of the function performed by the first control device based on the result of determination by the attack determination unit 145.

Abstract: Provided is an electronic control system including: a security event analysis unit configured to read a log recording an operation of a device and to detect a security event that is an event related to information security; a safety feature execution unit created to execute a safety feature serving as a measure against a safety event that is an event related to functional safety; a security feature execution unit capable of executing a security feature serving as a measure against the security event; a storage unit that stores correspondence information indicating at least one of the safety feature and the security feature corresponding to the security event; and a determination unit configured to identify, based on the correspondence information, a feature corresponding to the security event detected by the security event analysis unit and to cause at least one of the safety feature execution unit and the security feature execution unit to execute the identified feature, wherein the correspondence informatio

Abstract: An information processing device which transmits and receives a message to which a communication ID indicating a class has been assigned, includes: a storage unit which stores, for each of the communication IDs, a communication counter for verifying a recency of a communication; a recency information management unit which updates the communication counter based on a predetermined condition; an abnormality monitoring unit which identifies an influence range of an abnormality that occurred; and a message generation unit which generates a synchronization request message including the communication ID indicating that it is a message requesting a synchronization of the communication counter, and a synchronization target identifier indicating the influence range identified by the abnormality monitoring unit.

Abstract: An information processing apparatus capable of aperiodic communication and periodic communication, provided with a communication determination unit that determines a type of a communication message; a first processing determination unit that determines relatedness between aperiodic communication and periodic communication by using a first communication message for which the type is determined to be aperiodic communication, and a prediction range for an amount of time for receiving a second communication message for which the type is determined to be periodic communication; and a second processing determination unit that determines that the second communication message is legitimate communication for periodic communication in a case where the periodic communication second communication message determined to have relatedness is in the prediction range a predetermined amount of time later.

Abstract: When a client certificate is required to connect to a client according to a predetermined communication protocol, a server receives a connection request that is a message associated with specific information from the client in a handshake for connection with the client. The server makes a client judgement as to whether or not a cache hit occurs, which is to find a summary client certificate in a cache area using the specific information associated with the connection request. When the result of the client judgement is true, the server returns to the client a connection response including hit information indicating that a cache hit occurs.

Abstract: A vehicular control apparatus is used in an onboard system provided with a plurality of information processors mutually connected via a communication bus, and includes a storage section for storing information, and an arithmetic section for executing a process based on the information stored in the storage section. The information contains first management information relating to a security abnormality as a communication data abnormality owing to security attack from outside the onboard system, and second management information relating to a safety abnormality as a communication data abnormality owing to an abnormality in the onboard system. The first management information contains first limit condition information indicating a first limit condition for executing a security coping with the security abnormality. The second management information contains second limit condition information indicating a second limit condition for executing a safety coping with the safety abnormality.

Abstract: An information processing apparatus capable of aperiodic communication and periodic communication, provided with a communication determination unit that determines a type of a communication message; a first processing determination unit that determines relatedness between aperiodic communication and periodic communication by using a first communication message for which the type is determined to be aperiodic communication, and a prediction range for an amount of time for receiving a second communication message for which the type is determined to be periodic communication; and a second processing determination unit that determines that the second communication message is legitimate communication for periodic communication in a case where the periodic communication second communication message determined to have relatedness is in the prediction range a predetermined amount of time later.

Abstract: An unauthorized access to a vehicle is accurately detected.

Abstract: An arithmetic device includes a first core, a second core, and one or more other cores that perform arithmetic processing. The first core includes a first verification unit that performs a first verification process on a message received from outside of the arithmetic device. The second core includes a verification destination determination processing unit that determines whether or not the second core executes the second verification process on the message based on identification information included in the message.

Abstract: A version checking apparatus that checks subject software version information, and easily decides whether or not the subject software version information matches version information of reference software having been found to have a vulnerability, e.g.

Abstract: A monitor for monitoring a monitored object comprises: a processor configured to execute a program; a storage device configured to store the program; and a communication interface capable of communicating with the monitored object, wherein the processor is configured to execute: acquisition processing for acquiring threat information indicating association of a plurality of events necessary for an occurrence of a threat; and determination processing for determining, as a collection scheme of a log from the monitored object according to a rule for detecting an attack on the monitored object, either a passive scheme for collecting the log transmitted from the monitored object or an active scheme for collecting from the monitored object the log requested from the monitor to the monitored object.

Abstract: A packet according to a secure protocol over a high-speed protocol has a small size header. A reception system estimates a packet number which is used in processing of a packet having a small size header on the basis of information indicating a packet number of a received packet. The header of each of one or more packets among N packets (where N is an integer of two or more) is a small size header, which is either a first header having one part of the packet number of the packet or a second header without the packet number of the packet. When the small size header is the first header, the header of each of the N packets is the first header. When the small size header is the second header, the header of each of the packets other than one packet among the N packets is the second header.

Abstract: An information processing device that can update software includes: a storage unit that stores control information for controlling whether or not the software can be updated; a communication unit that receives a communication message transmitted from another information processing device connected thereto via a communication line; an update control unit that updates the control information on the basis of the communication message received by the communication unit; and an update propriety determination unit that determines whether or not the software can be updated, on the basis of the control information.

Abstract: An information processing device which transmits and receives a message to which a communication ID indicating a class has been assigned, includes: a storage unit which stores, for each of the communication IDs, a communication counter for verifying a recency of a communication; a recency information management unit which updates the communication counter based on a predetermined condition; an abnormality monitoring unit which identifies an influence range of an abnormality that occurred; and a message generation unit which generates a synchronization request message including the communication ID indicating that it is a message requesting a synchronization of the communication counter, and a synchronization target identifier indicating the influence range identified by the abnormality monitoring unit.

Abstract: An information processing device included in an in-vehicle system of a vehicle includes an information acquisition unit that collects abnormality information relevant to an abnormality that has occurred in the vehicle, a determination unit that identifies a source of generation of the abnormality that has occurred on the basis of the abnormality information, and a spread prevention processing unit that executes a spread prevention process in which a predetermined function of a target identified by the determination unit is restricted.