Attack source identifying system, attack source identifying apparatus, attack source identifying method and program

An attack source identifying apparatus comprising:

• a plurality of electronic control devices;
• a gateway device communicably connected to the plurality of electronic control devices;
• an analysis device communicably connected to the plurality of electronic control devices;
• a processor;
• and
• a memory that includes instructions, which when executed, cause the processor to execute:
• creating, by each of the plurality of electronic control devices, history information of messages transmitted from a process executed by the electronic control device;
• transmitting, by each of the plurality of electronic control devices, at least a part of the history information to the analysis device;
• detecting, by the gateway device, an attack message from messages transmitted and received by the plurality of electronic control devices;
• and
• identifying, by the analysis device, a transmission source of the attack message by using detection information related to the attack message and information received from the plurality of electronic control devices in a case where the attack message is detected.

An attack source identifying method used in an attack source identifying system including:

• a plurality of electronic control devices;
• a gateway device communicably connected to the plurality of electronic control devices;
• and an analysis device communicably connected to the plurality of electronic control devices, wherein
• each of the electronic control devices executes:
• creating history information of messages transmitted from a process executed by the electronic control device;
• and
• transmitting at least a part of the history information to the analysis device,
• the gateway device executes
• detecting an attack message from messages transmitted and received by the plurality of electronic control devices, and
• the analysis device executes
• identifying a transmission source of the attack message by using detection information related to the attack message and information received from the plurality of electronic control devices in a case where the attack message is detected.