WO2023223515A1

WO2023223515A1 - Attack path estimation system, attack path estimation device, attack path estimation method, and program

Info

Publication number: WO2023223515A1
Application number: PCT/JP2022/020883
Authority: WO
Inventors: 靖岡野; 勝松林; 政志田中; 卓麻小山
Original assignee: 日本電信電話株式会社
Priority date: 2022-05-19
Filing date: 2022-05-19
Publication date: 2023-11-23
Also published as: JPWO2023223668A1; WO2023223668A1

Abstract

An attack path estimation system according to one embodiment of the present disclosure estimates an attack path in a subject system, and has: a configuration information creation unit configured so as to use at least one of an operation history log and design information about the subject system to create configuration information representing the configuration of the subject system; a predicted path information creation unit configured so as to use the configuration information and an attack pattern postulated by the subject system to create predicted path information representing predicted paths for an attack on the subject system; a weighted predicted path information creation unit configured so as to use a log obtained from the subject system and a prescribed weighting rule to create weighted predicted path information in which the predicted path information has been weighted, when an attack on the subject system has been detected; and a path retrieval unit configured so as to estimate an attack path representing the path from the source of the attack to the attack destination by means of a path search with respect to the weighted predicted path information.

Description

Attack route estimation system, attack route estimation device, attack route estimation method and program

The present disclosure relates to an attack route estimation system, an attack route estimation device, an attack route estimation method, and a program.

In recent years, vehicles equipped with the function of constantly connecting to external networks (so-called connected cars) are expected to become popular. Connected cars are expected to offer improved convenience, such as obtaining the latest traffic information, remote control of door locks and air conditioners, and software updates for electronic control units (ECUs).

On the other hand, there are concerns that by connecting vehicles and their electronic control devices to external networks, they could become targets of cyberattacks from malicious attackers, just like conventional IT devices. Research has also reported that it was possible to hijack vehicle control by illegally tampering with the controller installed in a vehicle through access from an external network and sending false commands from the controller to the ECU. Therefore, in order to detect cyber-attacks on vehicles, research is also being conducted on IDS (Intrusion Detection Systems) that detect abnormalities in CAN (Controller Area Network), which is a vehicle control information network.

By the way, when a cyber attack is detected, the attack is analyzed, and one of the important purposes of cyber attack analysis is to identify the device that is the source of the attack and the malware process/program within that device, and to identify the attack source. It is to clarify the route. Note that in intranets and server systems to which a plurality of devices are connected, a method of analyzing logs obtained by monitoring networks and devices, such as SIEM (Security Information Event Management), is often used. For example, in Non-Patent Document 1, in an intranet, a monitor that monitors the startup of processes and communications sent and received by processes is installed on PCs, and by analyzing the logs output by the monitor, it is possible to detect attack communications and malicious files. A method is disclosed that, when a process is detected, traces the communications and processes related to it and identifies the attack route and source of the attack. Note that, in general, the starting point of an attack route is the source of the attack, so in the following, identifying the attack route includes identifying the source of the attack.

Even in vehicle control systems in which multiple ECUs are connected via CAN, Ethernet, etc., it seems effective to use log analysis to identify attack paths. However, since EUCs are cheaper and have lower performance than PCs, servers, etc., it may be difficult to introduce a monitor into the ECU. Additionally, the network bandwidth for collecting logs is limited due to cost considerations, so the logs to be collected are often carefully selected. In addition, since CAN is a protocol that does not have a source address or a destination address, it is difficult to identify the source ECU and destination ECU using a CAN-IDS or CAN communication monitor that monitors the CAN bus. In this way, in a vehicle control system, the number of logs and types thereof that can be obtained may be smaller than in a general IT system.

In addition, logs may be missing due to vehicle malfunctions, deterioration of communication conditions due to the driving environment (for example, deterioration of communication conditions due to driving in a tunnel), or due to monitoring interference due to attacks. Some logs may become unobtainable. These deficiencies (including the inability to obtain logs) make log analysis even more difficult.

For example, in the method disclosed in Non-Patent Document 1, when an attack communication or a malicious file/process is detected, the process of the communication partner, its parent process, the previous communication, etc. are tracked one after another. By doing so, you can identify the attack route. For this reason, missing logs make tracking them extremely difficult and greatly impede identification of attack routes.

Note that the above-mentioned problems are considered to be common not only to vehicle control systems but also to various devices connected via a network. For example, with regard to IoT (Internet of Things) equipment, it is difficult to introduce a new monitor to an existing product, so there is a risk that logs necessary for log analysis to identify attack routes may not be obtained.

The present disclosure has been made in view of the above points, and provides a technique for estimating an attack route.

An attack path estimation system according to an aspect of the present disclosure is an attack path estimation system that estimates an attack path in a target system, and the attack path estimation system estimates a configuration of the target system using at least one of design information and operation history log of the target system. a configuration information creation unit configured to create configuration information representing a configuration information, and an expected route representing an expected path of an attack on the target system using the configuration information and an attack pattern assumed on the target system. an expected route information creation unit configured to create information; and when an attack on the target system is detected, the expected route information is created using a log acquired from the target system and a predetermined weighting condition. A weighted predicted route information creation unit configured to create weighted predicted route information weighted for the target route information, and a route search based on the weighted predicted route information, are used to perform a route search from the source of the attack to the attack destination. and a route search unit configured to estimate an attack route representing the route.

A technique for estimating attack routes is provided.

1 is a diagram illustrating an example of a hardware configuration of an attack path estimation device according to an embodiment. FIG. 1 is a diagram illustrating an example of a functional configuration of an attack route estimating device according to an embodiment. 7 is a flowchart illustrating an example of predicted route information creation processing according to the present embodiment. 7 is a flowchart illustrating an example of attack route estimation processing according to the present embodiment. 1 is a diagram showing a vehicle control system in Example 1. FIG. 3 is a diagram showing an example of an attack in Example 1. FIG. FIG. 3 is a diagram showing an example of attack detection in the first embodiment. 3 is a diagram showing vehicle configuration information in Example 1. FIG. 3 is a diagram showing a predicted route in Example 1. FIG. 3 is a diagram showing predicted route information in Example 1. FIG. 3 is a diagram showing observation information in Example 1. FIG. 3 is a diagram showing a weighted predicted route in Example 1. FIG. 3 is a diagram showing weighted predicted route information in Example 1. FIG. FIG. 2 is a diagram (part 1) showing an estimated attack route in Example 1; FIG. 3 is a diagram (Part 2) showing an estimated attack route in Example 1; 3 is a diagram showing an estimated attack route, its score, and cost in Example 1. FIG. 7 is a diagram showing an assumed attack pattern in Example 2. FIG. FIG. 7 is a diagram showing a weighted predicted route in Example 2; FIG. 7 is a diagram showing weighted predicted route information in Example 2; FIG. 7 is a diagram showing a weighted predicted route in Example 3; FIG. 7 is a diagram showing a predicted route in Example 4. FIG. 7 is a diagram showing a weighted predicted route in Example 4. FIG. 7 is a diagram showing weighted predicted route information in Example 4; FIG. 7 is a diagram (part 1) showing estimated attack routes, their scores, and costs in Example 4; FIG. 7 is a diagram (Part 2) showing estimated attack routes, their scores, and costs in Example 4;

An embodiment of the present invention will be described below. In the following embodiments, the attack route can be estimated even if the log is missing (data missing) when some kind of attack is detected, mainly targeting the vehicle control system. The attack route estimation device 10 will be explained. The attack path is a path from the attack source (attack source malicious process, malicious ECU, etc.) to the attack target (attack destination). By estimating the attack route, for example, when an attack on a vehicle control system is detected, it becomes possible to efficiently analyze the range of its influence.

Note that the vehicle control system is a system that includes an electronic control unit (ECU), CAN, etc., and controls various functions of a vehicle (for example, a car, a special vehicle, a motorcycle, a bicycle, etc.). However, this embodiment is not limited to vehicle control systems, but is applicable to machines installed in machinery (e.g., machine tools, construction machinery, agricultural machinery, industrial machinery, etc.) and configured with an electronic control unit (ECU), CAN, etc. It is similarly applicable to control systems. Furthermore, the present invention can be similarly applied to IoT systems configured with IoT devices and arbitrary communication networks.

<Hardware configuration of attack route estimation device 10>
FIG. 1 shows an example of the hardware configuration of an attack path estimation device 10 according to this embodiment. As shown in FIG. 1, the attack path estimation device 10 according to the present embodiment includes an input device 101, a display device 102, an external I/F 103, a communication I/F 104, and a RAM (Random Access Memory) 105. It has a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is communicably connected via a bus 109.

The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, or the like. The display device 102 is, for example, a display, a display panel, or the like. Note that the attack route estimation device 10 may not include at least one of the input device 101 and the display device 102, for example.

The external I/F 103 is an interface with an external device such as the recording medium 103a. The attack route estimation device 10 can read and write data on the recording medium 103a via the external I/F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

The communication I/F 104 is an interface for connecting the attack path estimation device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 106 is a nonvolatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 107 is, for example, a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is, for example, an arithmetic device such as a CPU (Central Processing Unit).

By having the hardware configuration shown in FIG. 1, the attack route estimation device 10 according to the present embodiment can realize expected route information creation processing and attack route estimation processing, which will be described later. Note that the hardware configuration shown in FIG. 1 is an example, and the hardware configuration of the attack route estimation device 10 is not limited to this. For example, the attack path estimation device 10 may include multiple auxiliary storage devices 107 and multiple processors 108, may not include a part of the illustrated hardware, or may include the illustrated hardware. It may also include various other hardware.

<Functional configuration of attack route estimation device 10>
FIG. 2 shows an example of the functional configuration of the attack route estimation device 10 according to this embodiment. As shown in FIG. 2, the attack route estimation device 10 according to this embodiment includes an expected route configuration section 110 and an attack route estimation section 120. Each of these units is realized, for example, by one or more programs installed in the attack path estimation device 10 causing the processor 108 to execute the process. Furthermore, the attack route estimation device 10 according to the present embodiment includes an expected route information storage unit 130. The predicted route information storage unit 130 is realized by, for example, the auxiliary storage device 107. Note that the expected route information storage unit 130 may be realized, for example, by a storage device such as a database that is connected to the attack route estimation device 10 via a communication network.

The predicted route configuration unit 110 uses information obtained in advance to create predicted route information representing the predicted route of the attack. As a result, even if there is data missing in the log when an attack was detected (hereinafter also referred to as attack detection log), the attack route can be estimated by filling in the missing part with the predicted route. becomes. In the following, in this embodiment, the information obtained in advance includes design information such as the ECUs installed in the vehicle, the processes executed by those ECUs, communication, network connections, etc., and the processes and information of each EUC obtained in advance. It is assumed that an operation history log representing a communication log and an assumed attack pattern representing a previously assumed attack path of a malicious EUC or a malicious process are used.

Here, the expected route configuration section 110 includes a vehicle configuration information creation section 111 and an expected route information creation section 112.

The vehicle configuration information creation unit 111 creates vehicle configuration information using design information and operation history logs. Vehicle configuration information refers to the processes executed in the EUC, the ECU itself, the communications and network connections sent and received by them, objects related to those processes and ECUs (e.g. data, files, etc.), and the associations between nodes. This is information expressed in a graph structure with edges.

The expected route information creation unit 112 creates expected route information using the vehicle configuration information and the assumed attack pattern. Further, the predicted route information creation unit 112 stores the generated predicted route information in the predicted route information storage unit 130. The assumed attack pattern refers to the malicious processes and ECUs that are assumed in advance, the malicious communications and network connections that they send and receive, and the objects (e.g., data, files, etc.) related to these malicious processes and ECUs that are connected to nodes, This is information expressed in a graph structure with edges representing associations between nodes. Further, the expected route information is obtained by adding a graph represented by an assumed attack pattern to the graph represented by the vehicle structure information. In other words, the expected route information is information expressed in a graph structure in which nodes and edges of the assumed attack pattern are added to the nodes and edges of the vehicle structure information.

In this way, expected route information is created by adding the graph represented by the assumed attack pattern to the graph represented by vehicle configuration information. This is because, in general, an attack route first passes through a normal route, that is, a route in the graph represented by the vehicle configuration information, and then, at the time of the attack, nodes (malicious processes, malicious communications, malicious files, etc.) that are not in the graph represented by the vehicle configuration information. This is because a malicious object (such as a malicious object) appears, and the route passes through such a malicious node.

The attack route estimation unit 120 estimates an attack route using the expected route information, the attack detection log, and the weighting rule, and creates attack route information representing the attack route. The attack detection log is a log collected when an IDS or the like of a vehicle control system detects an attack. The attack detection log may be collected by the vehicle control system and sent to the attack route estimation device 10 when the IDS or the like of the vehicle control system detects an attack, or the attack detection log may be collected by the attack route estimation device 10 from the vehicle control system. You may. The weighting rule is information representing weighting conditions (rules) used when creating weighted predicted route information, which will be described later.

Here, the attack route estimation unit 120 includes a weighted expected route information creation unit 121 and a route search unit 122.

The weighted expected route information creation unit 121 acquires attack detection logs, creates attack observation information using these attack detection logs, and adds/overwrites the observed information to the expected route information. Further, the weighted predicted route information creation unit 121 weights the edges of the predicted route information after addition/overwriting using a weighting rule, and creates weighted predicted route information. Observation information includes processes and ECUs that appear in attack detection logs (including malicious processes and malicious ECUs), communications and network connections sent and received by them, objects related to those processes and ECUs (e.g., data, files, etc.) It is information expressed in a graph structure with nodes as nodes and edges as associations between nodes. In other words, the observation information is graph information representing the route of an attack observed as an attack detection log.

As a result, even if there is data loss in the attack detection log and the graph represented by the observation information obtained from the attack detection log is incomplete, the missing portion can be supplemented with predicted route information. On the other hand, multiple attack paths can be estimated in the complementary part, but by weighting the edges, it is possible to estimate a more likely path as the attack path. Note that the weight represents the strength of association between nodes. The weight may be, for example, a cost that is assigned a smaller value as the association between nodes is stronger, or a transition probability that represents the probability that the edge can be used. Further, for example, some of the weights may be given in advance by the predicted route configuration unit 110 (in particular, the vehicle configuration information creation unit 111).

The route search unit 122 starts from a node representing a malicious process or malicious communication detected by an IDS or the like of a vehicle control system (hereinafter also referred to as a detection node), and searches backward from the detection node using weighted predicted route information. Perform route search and estimate attack route (including attack source). The route search unit 122 also outputs attack route information representing the estimated attack route to a predetermined output destination (for example, the display device 102 such as a display, the auxiliary storage device 107, another terminal connected via a communication network, etc.). Output to. As the route search method, for example, a shortest route search method such as Dijkstra's method can be used.

A plurality of attack routes estimated by the route search unit 122 can be estimated as routes from different attack source nodes to the same detection node. For this reason, the route search unit 122 may output the most probable attack route information among the plurality of pieces of attack route information to a predetermined output destination, for example, using a predetermined score. Alternatively, the route search unit 122 may output a plurality of pieces of attack route information and their scores to a predetermined output destination. Here, the score is, for example, the sum of costs given to edges on the attack route, this sum divided by the number of nodes on the attack route, and the score from the start point to the end point (detected node) of the attack route. The transition probability of , etc. can be used.

The predicted route information storage unit 130 stores predicted route information. Note that the predicted route information storage unit 130 may store predicted route information corresponding to each type or type of vehicle, for example. In this case, the attack route estimation unit 120 uses predicted route information corresponding to the type and type of vehicle in which the attack was detected.

<Expected route information creation process>
The predicted route information creation process according to this embodiment will be described with reference to FIG. 3. Note that the expected route information creation process is executed before the attack route estimation process, which will be described later, is executed.

The vehicle configuration information creation unit 111 of the predicted route configuration unit 110 creates vehicle configuration information using the design information and the operation history log (step S101). Note that the vehicle configuration information creation unit 111 may use both the design information and the operation history log, or may use only one of them.

The predicted route information creation unit 112 of the predicted route configuration unit 110 creates predicted route information using the vehicle configuration information and the assumed attack pattern, and stores this predicted route information in the predicted route information storage unit 130 (step S102). .

<Attack route estimation processing>
Attack route estimation processing according to this embodiment will be described with reference to FIG. 4. Note that the attack route estimation process is executed every time an attack is detected by the vehicle control system.

The weighted predicted route information creation unit 121 of the attack route estimation unit 120 acquires attack detection logs, creates attack observation information using those attack detection logs, and adds/overwrites the observation information to the expected route information. After that, weighted predicted route information is created using a weighting rule (step S201).

The route search unit 122 of the attack route estimation unit 120 estimates an attack route by searching the weighted expected route information from the detection node back, and then outputs attack route information representing the estimated attack route as a predetermined output. It is output first (step S202). Note that at this time, the route search unit 122 may output the most probable attack route information among the plurality of attack route information using a predetermined score, or may output the most probable attack route information among the plurality of attack route information and their scores. You can also output it.

<Example>
Examples of this embodiment will be described below.

・Example 1
Example 1 will be described below. In this embodiment, an attack route is estimated using a comprehensive assumed attack pattern. That is, in this embodiment, a case will be described in which a variety of attacks are comprehensively assumed without assuming a specific attack, and the attack route can be estimated even for an unknown attack.

FIG. 5 shows the configuration of the vehicle control system in this embodiment. The vehicle control system in this embodiment uses a smartphone or the like to perform remote operations such as locking/unlocking the doors of the target vehicle and turning on/off the air conditioner. For example, an OEM site accepts instructions from a smartphone. The TCUctrl process on the TCU, which is the telematics control unit, periodically makes HTTPS access (URLOEM) to the OEM site to receive commands. The command is communicated via Ethernet (IPCGW), converted into CAN communication (CAN6AA) by the central gateway CGW, and executed by the ECU 1 corresponding to the CAN communication. The OEM site and TCU are connected by NWEXT, which is an external wireless IP network, and the TCU and CGW are connected by NWINT, which is an in-vehicle Ethernet network. Further, the CGW and each ECU are connected by CANBUS, which is an in-vehicle CAN network. Furthermore, the TCU and each ECU are also connected via CANBUS for purposes such as remote diagnosis and measurement.

Note that NWEXT may include, for example, devices such as a router and an HTTPS proxy, but a description thereof will be omitted. Similarly, NWINT may include, for example, equipment such as an Ethernet switch, but a description thereof will be omitted. Similarly, CANBUS may include devices such as a CAN gateway, but a description thereof will be omitted. Moreover, below, ECU1 will be mainly explained among the ECUs, and the explanation of the other ECUs will be omitted.

In the vehicle control system in this embodiment, monitors and detectors are installed at NWEXT, TCU, NWINT, and CANBUS, and each outputs a log. For NWEXT, URL access log, for TCU, process startup log (startup process and its parent process), for NWINT, attack communication detection alert log by Ethernet-IDS, and for CANBUS, attack communication detection alert log for CAN-IDS. It shall be output.

An example of an attack on the vehicle control system in this embodiment is shown in FIG. The attack example shown in FIG. 6 is a Drive by Download attack in which an illegal command is executed. First, fraudulent information that attacks the TCUctrl vulnerability is embedded on the OEM site. When TCUctrl accesses (URLOEM) the unauthorized information on the TCU, a mal1 process, which is an unauthorized process, is generated and activated on the TCU due to the vulnerability. The mal1 process accesses the attacker's site (URLmal), downloads an attack program to the TCU, and uses the attack program to generate and start a mal2 process, which is an unauthorized process. The mal2 process sends an unauthorized CAN message CAN6AA' to CANBUS (CAN message insertion attack) and causes the ECU 1 to execute an unauthorized command.

Figure 7 shows a graphical representation of the log output during the above attack. NWEXT outputs URL access logs to URLOEM and URLmal, TCU outputs mal1 boot logs of TCUctrl and mal2 boot logs of mal1, and CANBUS outputs attack communication detection alert logs related to CAN6AA'. However, from the NWEXT URL access log, it is known that the access was made from the TCU, but it is not possible to specify from which process of the TCU the access was made. Further, from the CANBUS attack communication detection alert log, it is known that CAN6AA' was used in the attack, but the device and process that was the source of the attack cannot be identified. Note that since there is no attack communication in NWINT, no log is output.

Under the above circumstances, the attack route is estimated by tracing back from CANBUS CAN6AA' where the attack was detected.

First, predicted route information is created in advance by the predicted route configuration unit 110. In this embodiment, the vehicle configuration information shown in FIG. 8 is created by the vehicle configuration information creation section 111, and then the expected route information creation section 112 creates expected route information from the vehicle configuration information and the assumed attack pattern. The vehicle configuration information shown in FIG. 8 is a graph structure related to each device or process and communication in the vehicle control system shown in FIG. 5 expressed as an adjacency matrix. The source node (Src.) is assigned to the row, and the destination node (Dst.) is assigned to the column. Elements between nodes that have a relationship (edge) are expressed as 1, and elements between nodes that are not related are expressed as 0. do. Hereinafter, a node representing a process is also referred to as a process node, and a node representing communication is also referred to as a communication node.

The assumed attack pattern in this example was set as follows, allowing a comprehensive assumption of attack routes. First, for each device/network for which logs are output (i.e., NWEXT, TCU, NWINT, CANBUS), represent processes/communications that are not expected in the vehicle configuration information (i.e., suspected to have been used in the attack). Set a wildcard node that is a node. Next, edges to wildcard nodes are set along each device/network connection. A wildcard node for a process has an edge that means a startup relationship with all other process nodes in the device where the process is executed, and also communicates with all communication nodes on the network connected to the device. Give it an edge that signifies a relationship. A communication wildcard node has an edge indicating a communication relationship with all process nodes on a device connected to the network where the communication is performed. FIG. 9 shows a graph representing a predicted route incorporating such a comprehensive assumed attack pattern. Further, information (expected route information) expressing the graph structure as an adjacency matrix is shown in FIG. The nodes NWEXT ^* , TCU*, NWINT ^* , and CANBUS ^* added on NWEXT, TCU, NWINT ^, and CANBUS, respectively, are wildcard nodes. For example, the wildcard node TCU ^* has a bidirectional edge representing a startup relationship with the process TCUctrl on the TCU, and since the TCU is also connected to NWEXT, NWINT, and CANBUS, the communication nodes URLOEM, NWEXT ^* , and IPCGW of those networks are connected to the wildcard node TCU*. , NWINT ^* , CAN6AA, and CANBUS ^* are all set to have bidirectional edges representing communication relationships.

Note that depending on the characteristics of the system, the wildcard node of a certain device or network may be omitted, a wildcard node may be added, or the number of edges connected to the wildcard node may be reduced or increased. For example, it is not necessary to set a process wildcard node in a device that performs very strict forced access control and is certain that unauthorized process startup cannot occur. Furthermore, if network communication is restricted and controlled by a firewall with strong security, the edges connected to wildcard nodes may be reduced or made unidirectional edges according to the restrictions and controls.

With the above method, it is possible to create expected route information assuming a comprehensive attack pattern.

Next, the attack route estimation unit 120 estimates the attack route using the expected route information.

The weighted expected route information creation unit 121 acquires attack detection logs, creates observation information from these attack detection logs, adds and overwrites the observed information to the expected route information, and then sets weights using weighting rules. Create predicted route information. FIG. 11 shows observation information created from the attack detection log when the attack example shown in FIG. 6 was detected. URLs mal, mal1, mal2, and CAN6AA' are nodes that are not in the vehicle configuration information, and are replaced as wild card nodes NWEXT ^* , TCU ^* , and CANBUS ^* , respectively. Note that both TCUs mal1 and mal2 are substituted as TCU ^* . Therefore, the process activation relationship TCUctrl→mal1→mal2 is replaced by TCUctrl→TCU ^* .

The following rules 1 to 5 are used as weighting rules for edges of predicted route information.

Rule 1: Edges that exist in observation information (start-up related, communication related, etc.) have a low cost Rule 2: Edges of wildcard nodes that are not observed are deleted Rule 3: Edges that exist in vehicle configuration information have a medium cost Rule 4: The advantageous time between wildcard nodes is medium in cost. Rule 5: Other edges are costly. FIG. 12 shows a graph in which predicted route information is weighted using the above weighting rule. Further, information (weighted predicted route information) representing this graph as an adjacency matrix is shown in FIG. In FIG. 12, edges with high cost are represented by broken lines, edges with medium cost are represented by solid lines, and edges with low cost are represented by solid thick lines. Further, in FIG. 13, large cost is set as 100, medium cost as 10, and small cost as 1.

Note that the weighting rules may be changed, added, or deleted depending on the characteristics of the system. For example, rules such as uniformly reducing the cost of all edges connected to nodes that exist in observation information, reducing the cost of edges with wildcard nodes for process nodes that communicate with each other that are susceptible to threats, etc. May be added. Furthermore, if there are a plurality of CAN buses and attacks can be detected for each CAN bus, a rule may be added that particularly reduces the cost of an edge connected to the CAN bus where an attack has been detected. Further, in a system where there is a high possibility of failure in detecting an attack, the above rule 2 may be deleted. Furthermore, an appropriate value may be set as appropriate regarding the actual value of cost. In addition, some of the weighting may be performed in advance by the predicted route configuration unit 110. For example, the weighting according to the above rules 3 to 5 is performed in advance in the expected route configuration unit 110, and only the above rules 1 to 2 are performed in the attack route estimation unit 120 (the weighted expected route information creation unit 121). You may go.

Next, the route search unit 122 uses the weighted expected route information to estimate an attack route tracing back from the CANBUS network where the CAN-IDS attack communication detection alert has occurred. That is, the wild card node CANBUS ^* corresponding to the attack communication detection alert is set as a target, and a route to reach the target from other nodes and a score of the route are determined. The score is the sum of the costs of edges in the route divided by the number of edges in the route. Note that for the route search, for example, a shortest route search method such as Dijkstra's method can be used. An example of the route searched in this example is shown in FIGS. 14 and 15. In the example shown in FIG. 14, the attack path URLOEM→TCLctrl→TCU ^* →CANBUS ^* is searched. On the other hand, in the example shown in FIG. 15, the attack route NWEXT ^* →TCU ^* →CANBUS ^* is searched. These are the estimated attack routes.

FIG. 16 shows a list of attack routes estimated in this example, their scores, and costs. For example, the route search unit 122 selects an appropriate attack route from among these attack routes, and outputs attack route information representing the selected attack route to a predetermined output destination. Various methods can be considered to select an appropriate attack route, such as an attack route whose score is within a certain predetermined range, an attack route whose score is greater than or equal to a certain predetermined threshold, etc.

Note that an appropriate score is used depending on the characteristics of the system. For example, the score may be the sum of the costs of edges on the route divided by the number of nodes on the route, or the transition probability from the start point to the end point (detection node, target) of the attack route may be used as the score.

In this way, in this embodiment, vehicle configuration information and a comprehensive assumed attack pattern are created in advance as expected route information, and then weighted expected route information is created from this expected route information, attack detection log, and weighting rule. . This allows the attack route to be estimated even if the attack detection log is incomplete.

Note that in this embodiment, the processes and communications that are the targets of log output are used as nodes, but if the target of log output changes, the nodes and edges may be changed accordingly. Examples of nodes include files, system calls, signals, and the like. Further, the representation of the graph is not limited to an adjacency matrix, and may be represented in other formats such as a connection matrix, a Laplacian matrix, a list representation, and the like. Furthermore, it may be expressed as a bipartite graph instead of a one-part bluff.

・Example 2
Example 2 will be described below. In this embodiment, an attack route is estimated using a known assumed attack pattern.

In this embodiment, it is assumed that the configuration of the vehicle control system, the monitor/detector and its output log, and the attack example are the same as in the first embodiment.

Similarly to the first embodiment, vehicle configuration information is created by the vehicle configuration information creation unit 111. Next, the predicted route information creation unit 112 creates predicted route information from the vehicle configuration information and the assumed attack pattern. Assumed attack patterns may be given, for example, as a graph model representing the relationship between threats and vulnerabilities (also called an attack graph), or as indicators of compromise information (IoC). May be given. Below, a case will be described in which the assumed attack pattern is given by IoC.

FIG. 17 shows an example of IoC and its representation as an attack graph. In the example shown in FIG. 17, the attack graph is expressed as an adjacency matrix, all processes and communications that appear during IoC are described as nodes, and edges between associated nodes are set. This IoC and attack graph are stored together with vehicle configuration information in the expected route information storage unit 130 as expected route information. Note that in the IoC in this embodiment, an example is given in which TCUctrl, which is vulnerable to URLEM, is not described. This is because, for example, if a library has a vulnerability, all programs that use the library will be affected, so the program/process name may not be written in the IoC.

The weighted predicted route information creation unit 121 acquires attack detection logs and creates observation information from these attack detection logs. Furthermore, the weighted predicted route information creation unit 121 obtains from the predicted route information storage unit 130 an attack graph representing the IoC that most matches those attack detection logs. Then, the weighted predicted route information creation unit 121 adds and overwrites the observation information and the attack graph to the vehicle configuration information, and then creates weighted predicted route information using the weighting rule. Here, the following rules 1 to 4 are used as weighting rules for the edges of the predicted route information. Note that, as in the embodiment, the weighting rules may be changed, added, or deleted depending on the characteristics of the system.

Rule 1: Edges that exist in observation information (start-up related, communication related, etc.) have a low cost. Rule 2: Among edges in the attack graph, unobserved edges have a medium cost. Rule 3: Edges that exist in vehicle configuration information have a low cost. Medium Rule 4: Other edges are costly FIG. 18 shows a graph in which predicted route information is weighted using the above weighting rule. Further, information (weighted predicted route information) representing this graph as an adjacency matrix is shown in FIG. In FIG. 18, edges with high cost are represented by broken lines, edges with medium cost are represented by solid lines, and edges with low cost are represented by solid thick lines. Further, in FIG. 19, large cost is set as 100, medium cost as 10, and small cost as 1. Note that there are no edges with large costs in FIGS. 18 and 19.

Thereafter, similarly to the first embodiment, the route search unit 122 may use this weighted expected route information to estimate the attack route going back from the CANBUS network where the CAN-IDS attack communication detection alert has occurred.

・Example 3
Example 3 will be described below. As a third embodiment, the comprehensive assumed attack pattern of the first embodiment and the known assumed attack pattern of the second embodiment may be combined. For example, in Example 2, if mal2 and CAN6AA' are not included in the known expected attack pattern (in FIG. 17, if the IoC matches that of No. 2), then wildcard nodes TCU ^* and CAN6AA' are used instead, respectively. It may also be comprehensively expressed as CANBUS ^* . FIG. 20 shows an example of a graph represented by weighted expected route information when a comprehensive assumed attack pattern and a known assumed attack pattern are used. Thereafter, similarly to the first and second embodiments, the route search unit 122 may estimate an attack route using this weighted expected route information.

・Example 4
Example 4 will be described below. In this embodiment, a case will be described in which an attack route is estimated only by network monitoring without performing process monitoring. It is assumed that the configuration of the vehicle control system, attack examples, and attack detection conditions are the same as in the first embodiment.

FIG. 21 shows a graph of the predicted route information created by the predicted route information creation unit 112. Unlike the first embodiment, since process monitoring is not performed, there are no processes TCUctrl and TCU ^* nodes, and instead the TCU itself becomes a node, and the node TCU is the node URLOEM, NWEXT ^* , IPCGW, NWINT ^* , CAN6AA, CANBUS ^* and has an edge.

FIG. 22 shows a graph in which predicted route information is weighted using the same weighting rules as in Example 1 when an attack is detected. Further, information (weighted predicted route information) representing this graph as an adjacency matrix is shown in FIG. Further, FIG. 24 shows the route searched back from the detection node CANBUS ^* (estimated attack route) using the shortest route search method, and its score and cost.

Here, since process monitoring is not performed, it is possible that the attack route may not be estimated. Therefore, when searching for (estimating) a route going back from the detection node CANBUS ^* , a multiple route search method is used, which is an application of the shortest route search method. FIG. 25 shows attack routes (estimated attack routes) searched by the multiple route search method, their scores, and costs. In the multiple route search method in this embodiment, the shortest route search is performed from each node one edge back from the target node. In FIG. 22, the target node is the detection node CANBUS ^* , and the shortest route search is performed from each of the nodes TCU and CGW that are one edge back from that node.

In FIG. 25, among routes with the same starting and ending points, the route that goes through the CGW has a lower score, but the cost of the route that goes through the TCU is lower. In such a case, both are considered as attack route candidates, and additional investigation such as digital forensics is conducted to determine the route. This allows for thorough investigation and estimation of attack routes.

・Example 5
Example 5 will be described below. Logs that have been observed for a long time may contain multiple attack communication detection alerts. Therefore, if such a log is acquired as an attack detection log, it may be difficult to estimate the attack route. Therefore, when a log that has been observed for a long time is acquired as an attack detection log, the attack detection log may be appropriately divided and the present embodiment may be applied to each of the divided logs.

As a method for dividing the attack detection log, for example, methods such as extracting a portion of a specific period before and after the attack communication detection alert, dividing using a clustering method, etc. can be used. In addition, when the same alert occurs continuously, in order to further improve the accuracy of estimating the attack path, for example, the same alerts may be grouped together into one representative, or the start and end of the period in which the same alert occurs continuously. Alerts other than these two points may be deleted and then divided.

<Summary>
As described above, the attack route estimation device 10 according to the present embodiment creates expected route information expressed in a discrete graph from vehicle configuration information and an assumed attack pattern in advance, and then uses the attack detection information obtained at the time of attack detection. The attack route is estimated by creating weighted expected route information from logs and weighting rules, and performing a route search using the weighted expected route information from the attack detection node. This makes it possible to estimate the attack route even if there is data loss in the log obtained at the time of attack detection (attack detection log). Therefore, for example, when an attack on a vehicle control system is detected, it becomes possible to efficiently analyze the range of its influence.

In the above embodiment, the vehicle control system has been described as an example, but the present embodiment is not limited to this, and can be applied to other communication systems with communication functions such as machine control systems. Forms may also be applied. For example, communications consisting of industrial control equipment such as robots in factories, sensors placed in various places, audio equipment, home appliances, information processing terminals (smartphones, tablets, etc.), equipment generally called IoT equipment, etc. This embodiment may be applied to a system.

In addition, attack detection logs include, for example, alert logs of network attack detection functions such as CAN-IDS and in-vehicle Ethernet IDS, communication rejection logs and communication statistics logs of CAN communication gateways and IP firewalls, and communication statistics logs of ECUs and terminals. System logs from OS (Operating System) security audits, malware scan reports from anti-virus software, application logs such as proxy server access logs, etc. can be used.

The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications and changes, combinations with known techniques, etc. are possible without departing from the scope of the claims. .

10 Attack route estimation device 101 Input device 102 Display device 103 External I/F
103a Recording medium 104 Communication I/F
105 RAM
106 ROM
107 Auxiliary storage device 108 Processor 109 Bus 110 Expected route configuration unit 111 Vehicle configuration information creation unit 112 Expected route information creation unit 120 Attack route estimation unit 121 Weighted expected route information creation unit 122 Route search unit 130 Expected route information storage unit

Claims

An attack path estimation system that estimates an attack path in a target system,
a configuration information creation unit configured to create configuration information representing a configuration of the target system using at least one of design information and operation history log of the target system;
an expected route information creation unit configured to create expected route information representing an expected route of an attack on the target system using the configuration information and an attack pattern assumed on the target system;
When an attack on the target system is detected, weighted predicted route information is created by weighting the predicted route information using a log acquired from the target system and a predetermined weighting condition. A weighted predicted route information creation unit that is
a route search unit configured to estimate an attack route representing a route from the attack source to the attack destination by searching the weighted expected route information;
An attack route estimation system with
The weighted predicted route information creation unit includes:
When an attack on the target system is detected, creating observation information representing an observation route of the attack using logs obtained from the target system,
After adding and overwriting the observed information to the predicted route information, weighted predicted route information is created in which the predicted route information after the addition and overwriting is weighted using the weighting condition. The attack path estimation system according to claim 1, wherein the attack path estimation system is configured.
The configuration information creation unit includes:
The configuration information is configured to create the configuration information expressing the configuration of the target system in a graph structure using at least one of the design information and the operation history log,
The predicted route information creation unit includes:
The configuration information is configured to create the expected route information expressed in a graph structure by adding the attack pattern expressed in a graph structure to the configuration information,
The weighted predicted route information creation unit includes:
3. The weighted predicted route information is configured to create the weighted predicted route information in which an edge of a graph represented by the predicted route information is weighted using the log and the weighting condition. attack path estimation system.
The route search unit includes:
4. The attack route according to claim 3, wherein the attack route is estimated by the route search tracing back from the attack target, with a node representing a process, device, or communication in which the attack has been detected as the attack target. Attack route estimation system.
The route search unit includes:
calculating a score for the attack route using weights given to edges included in the attack route;
5. The attack route estimation system according to claim 4, wherein when a plurality of attack routes are estimated, one or more attack routes from among the plurality of attack routes are output to a predetermined output destination using the score.
An attack path estimation device for estimating an attack path in a target system,
a configuration information creation unit configured to create configuration information representing a configuration of the target system using at least one of design information and operation history log of the target system;
an expected route information creation unit configured to create expected route information representing an expected route of an attack on the target system using the configuration information and an attack pattern assumed on the target system;
When an attack on the target system is detected, weighted predicted route information is created by weighting the predicted route information using a log acquired from the target system and a predetermined weighting condition. A weighted predicted route information creation unit that is
a route search unit configured to estimate an attack route representing a route from the attack source to the attack destination by searching the weighted expected route information;
An attack route estimation device having
An attack route estimation method for estimating an attack route in a target system, the method comprising:
a configuration information creation step of creating configuration information representing a configuration of the target system using at least one of design information and operation history log of the target system;
an expected route information creation step of creating expected route information representing a expected route of an attack on the target system using the configuration information and an attack pattern assumed on the target system;
When an attack on the target system is detected, weighted prediction creates weighted predicted route information in which the predicted route information is weighted using a log obtained from the target system and a predetermined weighting condition. Route information creation procedure,
a route search procedure for estimating an attack route representing a route from the attack source to the attack destination by searching the weighted expected route information;
An attack route estimation method that is executed by a computer.
A program that estimates an attack route in a target system,
a configuration information creation step of creating configuration information representing a configuration of the target system using at least one of design information and operation history log of the target system;
an expected route information creation step of creating expected route information representing a expected route of an attack on the target system using the configuration information and an attack pattern assumed on the target system;
When an attack on the target system is detected, weighted prediction creates weighted predicted route information in which the predicted route information is weighted using a log obtained from the target system and a predetermined weighting condition. Route information creation procedure,
a route search procedure for estimating an attack route representing a route from the attack source to the attack destination by searching the weighted expected route information;
A program that causes a computer to execute.