Log determination device, log determination method, log determination program, and log determination system

A log determination method executable by a log determination device, comprising:

• acquiring a set of security logs each generated upon detecting an abnormality in an electronic control system, the abnormality having a type of a plurality of types, the electronic control system being mounted on a vehicle and configured to detect the abnormality, wherein a respective security log includes abnormality type information indicating the type among the plurality of types of the detected abnormality and detection time information indicating when the detected abnormality was detected;
• specifying a specific security log from among the acquired set of security logs based on the abnormality type information, the specific security log indicating that the abnormality of a given type among the plurality of types is detected;
• specifying a frequency of generation of the specific security log based on the detection time information;
• determining, based on the frequency of generation of the specific security log indicating the abnormality of the given type is detected in the electronic control system, whether or not the specific security log is a false positive log, the false positive log being the security log generated by detecting the abnormality caused not by the electronic control system being attacked;
• generating false positive log information indicative of the security log that is determined as the false positive log among the acquired set of security logs;
• and
• outputting the generated false positive log information to analyze an attack on the electronic control system mounted on the vehicle and to take a countermeasure against the attack based on the analyzing.

A non-transitory computer-readable storage medium storing a log determination program executable by a log determination device having a computer including a processor, the program comprising instructions that cause the processor to perform:

• acquiring a set of security logs each generated upon detecting an abnormality in an electronic control system the abnormality having a type of a plurality of types, the electronic control system being mounted on a vehicle and configured to detect the abnormality, wherein a respective security log includes abnormality type information indicating the type among the plurality of types of the detected abnormality and detection time information indicating when the detected abnormality was detected;
• specifying a specific security log from among the acquired set of security logs based on the abnormality type information, the specific security log indicating that the abnormality of a given type among the plurality of types is detected;
• specifying a frequency of generation of the specific security log based on the detection time information;
• determining, based on the frequency of generation of the specific security log indicating the abnormality of the given type is detected in the electronic control system, whether or not the specific security log is a false positive log, the false positive log being the security log generated by detecting the abnormality caused not by the electronic control system being attacked;
• generating false positive log information indicative of the security log that is determined as the false positive log among the acquired set of security logs;
• and
• outputting the generated false positive log information to analyze an attack on the electronic control system mounted on the vehicle and to take a countermeasure against the attack based on the analyzing.

A log determination system comprising:

• an electronic control system having a first computer including a first processor and a first memory storing a first program;
• and
• a log determination device having a second computer including a second processor and a second memory storing a second program;
• wherein:
• the first program causes the first processor to:
• generate a set of security logs each generated upon detecting an abnormality in the electronic control system, the abnormality having a type of a plurality of types, the electronic control system being mounted on a vehicle and configured to detect the abnormality, wherein a respective security log includes abnormality type information indicating the type among the plurality of types of the detected abnormality and detection time information indicating when the detected abnormality was detected;
• and
• transmit the set of security logs to the log determination device;
• and
• the second program causes the second processor to:
• acquire the set of security logs transmitted from the first processor;
• specify a specific security log from among the acquired set of security logs based on the abnormality type information, the specific security log indicating that the abnormality of a given type among the plurality of types is detected;
• specify a frequency of generation of the specific security log based on the detection time information;
• determine, based on the frequency of generation of the specific security log indicating the abnormality of the given type is detected in the electronic control system, whether or not the specific security log is a false positive log, wherein the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked;
• generate false positive log information indicative of the security log that is determined as the false positive log among the acquired set of security logs;
• and
• output the generated false positive log information to analyze an attack on the electronic control system mounted on the vehicle and to take a countermeasure against the attack based on the analyzing.