In-vehicle device, program, and information processing method

Abstract

This vehicle-mounted device is connected to a vehicle-mounted network mounted on a vehicle, and is provided with a processing unit that performs a process relating to a determination of whether or not data flowing through the vehicle-mounted network is normal, receives periodic data periodically transmitted through the vehicle-mounted network, and transmits the periodic data to the vehicle-mounted network. When event data of the same type as the periodic data is received between the reception time points of two pieces of continuously received periodic data, a determination is made as to whether or not the event data is normal on the basis of the value of the payload of the event data and the value of the payload of at least one of the two pieces of periodic data.

Description

Technical Field

[0001] This disclosure relates to vehicle-mounted devices, programs, and information processing methods.

[0002] This application claims priority based on Japanese Application No. 2023-44682, filed on March 20, 2023, and incorporates all the contents of the aforementioned Japanese application. Background Technology

[0003] Previously, communication between multiple on-board ECUs (Electronic Control Units) in vehicles widely adopted the CAN communication protocol. With the increasing multi-functionality and high functionality of vehicles, the number of on-board ECUs has tended to increase. However, these on-board ECUs are divided into groups (segments) to form a vehicle network. Multiple on-board ECUs in the same group are connected by a shared communication line to send and receive data with each other, and the data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (e.g., Patent Document 1).

[0004] In the vehicle network of Patent Document 1, in addition to the vehicle relay device (gateway), there is also a vehicle network monitoring device that is connected to each segment of the vehicle network and detects abnormal data (messages) flowing in the vehicle network. When the vehicle network monitoring device detects abnormal data (messages), it sends a warning message (message code) to the vehicle control unit (vehicle ECU).

[0005] Existing technical documents Patent documents Patent Document 1: Japanese Patent Application Publication No. 2013-131907 Summary of the Invention

[0006] One aspect of this disclosure relates to an in-vehicle device connected to an in-vehicle network mounted in a vehicle. The in-vehicle device includes a processing unit that performs processing related to determining whether data flowing in the in-vehicle network is normal. The processing unit receives periodic data transmitted periodically through the in-vehicle network. If, between the reception time points of two consecutively received periodic data sets, the processing unit receives event data of the same type as the periodic data, it determines whether the event data is normal based on the payload value of the event data and the payload value of at least one of the two periodic data sets. Attached Figure Description

[0007] Figure 1 This is a schematic diagram illustrating the structure of a vehicle-mounted system including the vehicle-mounted device of Embodiment 1. Figure 2 This is a block diagram illustrating the physical structure of an onboard device. Figure 3 This is an explanatory diagram related to the data category table. Figure 4 This is an explanatory diagram related to the data receiving list. Figure 5 This is an explanatory diagram related to the determination of whether event data is normal (during the period when event data transmission is prohibited). Figure 6 This is an explanatory diagram related to the determination of whether event data is normal (normal cycle range). Figure 7 This is an explanatory diagram related to the determination of whether event data is normal (normal value range). Figure 8 This is an explanatory diagram related to the determination (prediction) of whether event data is normal. Figure 9 This is an explanatory diagram related to the determination of whether event data is normal (payload change). Figure 10 This is an explanatory diagram related to the determination (reverse reasoning) of whether event data is normal. Figure 11 This is an explanatory diagram (matrix table) related to the method (determination table) by which the processing unit of the vehicle-mounted device determines event data. Figure 12 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device. Detailed Implementation

[0008] [The problem this disclosure aims to solve]

[0009] The vehicle network monitoring device in Patent Document 1 has the following problem: in a communication method that periodically sends data, it does not consider the ability to effectively detect abnormal (abnormal) messages based on their correlation with the sending period.

[0010] The purpose of this disclosure is to provide a vehicle-mounted device, etc., that can effectively detect abnormal data in a communication method that periodically transmits data.

[0011] [The Effects of This Disclosure]

[0012] According to one aspect of this disclosure, an in-vehicle device, etc., can be provided to effectively detect abnormal data in a communication method that periodically transmits data.

[0013] [Description of embodiments of this disclosure]

[0014] First, embodiments of this disclosure will be described by way of example. Additionally, at least a portion of the embodiments described below may be combined in any way.

[0015] (1) One aspect of this disclosure relates to an in-vehicle device connected to an in-vehicle network mounted on a vehicle, wherein the in-vehicle device includes a processing unit that performs processing related to determining whether data flowing in the in-vehicle network is normal, the processing unit receives periodic data that is periodically transmitted through the in-vehicle network, and when the processing unit receives event data of the same type as the periodic data between the reception time points of two consecutively received periodic data, it determines whether the event data is normal based on the value of the payload of the event data and the value of the payload of at least one of the two periodic data.

[0016] In this method, the processing unit of the vehicle-mounted device receives (acquires) multiple data (frames), such as CAN messages or IP data packets, sent from the vehicle-mounted ECU connected to the vehicle network. The data transmitted and received between the vehicle-mounted ECUs via the vehicle network includes periodic data (periodic messages) sent periodically and event data (event messages) sent when a predetermined event occurs due to a deviation from the period. The processing or processing content related to this periodic data can, for example, be the same as the processing related to determining whether the data (equivalent to periodic data) is normal as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566). That is, in this embodiment, by appropriately applying or referencing the contents described in International Publication No. 2022 / 185566, the processing unit of the vehicle-mounted device can also perform the same processing related to determining whether the data is normal as described in International Publication No. 2022 / 185566 regarding the processing of periodic data. This data is classified into multiple categories (types) in each communication protocol. For example, when the communication protocol is TCP / IP, the similarity or difference of data categories can be determined based on the similarity of port numbers (TCP port number, UDP port number), source address, destination address, or combinations thereof contained in the IP data packets. When the communication protocol is CAN (Controller Area Network) or CAN / FD, the similarity or difference of data categories can also be determined based on the similarity of the CAN message ID (CAN-ID). That is, data (CAN messages) with the same message ID (CAN-ID) are equivalent to data of the same category (same type of data). When the processing unit of the vehicle-mounted device receives two consecutive cycles of data of the same type, it determines whether event data (event messages) of the same type was received between the reception times of the two consecutively received cycles. If the processing unit of the vehicle-mounted device determines that event data was received, it determines whether the event data is normal based on the value of the event data's payload and the payload value of one of the two consecutively received cycles, i.e., the value of the payload of the earlier or later received cycle. Therefore, in a communication method that sends both periodic data and event data, it is possible to effectively determine whether the event data is normal or abnormal based on the periodic data. Furthermore, the processing unit of the vehicle-mounted device performs a normality determination on one or more event data received between the reception times of these periodic data points after receiving two consecutive periodic data points. Therefore, compared to processing (detection logic) that determines the normality of event data each time it is received, processing time can be shortened.In particular, when multiple event data are received between the receiving times of periodic data, by separately processing the reception of these event data and determining the normality of the received multiple event data by using the reception of subsequent periodic data as a trigger, the overhead caused by performing determination processing every time event data is received can be eliminated, thereby shortening the processing time or reducing the processing load of the processing unit. In this embodiment, the determination of whether the data is normal by the processing unit of the vehicle-mounted device refers to performing determination processing to determine whether the data (event data, periodic data) is normal or abnormal. Based on this, as the result of the determination processing, the processing unit of the vehicle-mounted device determines whether the data is abnormal or normal, and stores or outputs the determination result (abnormal determination or normal determination) to the storage unit.

[0017] (2) In the vehicle-mounted device according to one aspect of the present disclosure, if the difference between the payload value of the first received periodic data and the payload value of the event data in two consecutively received periodic data is less than a predetermined value, the processing unit determines that the event data is abnormal; if the difference between the payload value of the first received periodic data and the payload value of the event data exceeds a predetermined value, the processing unit determines that the event data is normal.

[0018] In this method, the processing unit of the vehicle-mounted device determines whether the event data is normal by comparing the payload value of the earlier received periodic data (the earlier periodic data) with the payload value of the event data (payload value) in two consecutively received periodic data sets (predictive processing). Alternatively, the payload may contain (store) multiple signals, and the processing unit of the vehicle-mounted device compares the value of each signal (signal value). In this case, even if only one signal value in the payload differs, it can be determined that the payload values ​​are different. That is, equal (substantially identical) payload values ​​mean that all signal values ​​in the payload of the periodic data are equal (substantially identical) to all signal values ​​in the payload of the event data. The processing unit of the vehicle-mounted device determines that the event data is abnormal if the difference (absolute value of the difference or deviation, etc.) between the payload value (signal value) of the earlier periodic data and the payload value (signal value) of the event data is below a specified value, and determines that the event data is normal if the difference exceeds the specified value. For example, if the specified value is 0, and the difference between the payload value (signal value) of the preceding periodic data and the payload value (signal value) of the event data is 0 or less, i.e., these payload values ​​are the same (completely identical), the processing unit of the vehicle-mounted device can also determine that the event data is abnormal. In this case, if these payload values ​​are not the same, i.e., different, the processing unit of the vehicle-mounted device determines that the event data is normal. The specified value (difference determination threshold) used to determine the difference in payload values ​​can be set to 0 or a relatively small value close to 0, determining the substantial similarity between the payload value of the previously received data and the payload value of the event data. When a phenomenon (event) occurs where the payload value of the preceding periodic data is changed, the event data is transmitted before the periodic data transmitted in the next transmission cycle. Therefore, the product specifications assume that the payload value of normal event data is different from the payload value of the preceding periodic data (the preceding periodic data). The processing unit of the vehicle-mounted device determines whether the event data is normal based on whether the difference between these payload values ​​is less than the specified value, i.e., whether these payload values ​​are substantially the same. By performing this processing, it is possible to effectively determine whether the event data is normal based on the transmission characteristics of sending event data that deviates from the transmission cycle when a specified phenomenon (event) occurs.

[0019] (3) In the vehicle-mounted device according to one aspect of the present disclosure, if the difference between the payload value of the later received periodic data in two consecutively received periodic data and the payload value of the event data is less than a predetermined value, the processing unit determines that the event data is normal; if the difference between the payload value of the earlier received data in two consecutively received periodic data and the payload value of the event data is greater than a predetermined value, the processing unit determines that the event data is abnormal.

[0020] In this method, the event data has the following transmission characteristics: when an event occurs where the payload value of a previously transmitted periodic data is changed, it is transmitted before the periodic data to be transmitted in the next transmission cycle. In this case, the product specification assumes that the payload value (signal value) of the periodic data received immediately after the event data reception time (the later received periodic data out of two consecutively received periodic data) is substantially the same as the payload value (signal value) of the event data. The processing unit of the vehicle-mounted device can also set the predetermined value (difference determination threshold) used to determine the substantial similarity of payload values ​​to 0 or a relatively small value close to 0 when determining the substantial similarity of payload values. Therefore, the processing unit of the vehicle-mounted device determines that the event data is normal when the difference between the event data and these payload values ​​(signal values) is 0 or less, i.e., the payload values ​​are the same (completely identical). The processing unit of the vehicle-mounted device determines that the event data is abnormal when the difference between the event data and these payload values ​​(signal values) exceeds 0, i.e., the payload values ​​are different. By performing this processing, the normality of event data can be effectively determined based on the transmission characteristics of event data transmitted outside the transmission cycle when a specified phenomenon (event) occurs. Furthermore, the processing unit of the vehicle-mounted device can simultaneously perform comparison processing (reverse calculation) with the payload value of the subsequently received periodic data and comparison processing (predictive processing) with the payload value of the periodic data received earlier. At this time, the processing unit of the vehicle-mounted device can also utilize multi-core or multi-CPU hardware resources to perform parallel computation (parallel processing) of the reverse calculation and predictive processing. By parallelizing multiple processes for event data in this way, the processing time (runtime) required for determining the normality of the event data can be reduced.

[0021] (4) In the vehicle-mounted device according to one aspect of the present disclosure, when the processing unit receives multiple event data between the receiving time points of two consecutively received periodic data, it determines whether the multiple event data are normal based on the change in the effective payload value of each of the multiple event data.

[0022] In this method, when the processing unit of the vehicle-mounted device transmits event data of the same type as the received periodic data between the reception time points of two consecutively received periodic data, it receives all the transmitted event data, associates the reception time points of each event data, and stores them in the storage unit of the vehicle-mounted device. Alternatively, for two consecutively received periodic data, they can also be associated with their respective reception time points and stored in the storage unit. When the processing unit of the vehicle-mounted device receives multiple event data between the reception time points of two consecutively received periodic data, these multiple event data are arranged in chronological order according to their reception time points. Among the multiple event data arranged in chronological order at the reception time points, the processing unit of the vehicle-mounted device determines whether the multiple event data are normal based on the changes in the values ​​of the payloads of each of these multiple event data. If the values ​​of the payloads of these multiple event data change, the processing unit of the vehicle-mounted device determines that the event data is normal; otherwise, it determines that the event data is abnormal. The processing unit of the vehicle-mounted device determines whether the event data is normal based on whether the values ​​of the payloads in two adjacent event data at the reception time points change, or the degree of change (degree of change). Therefore, based on the transmission characteristics of such event data that deviate from the transmission cycle when a specified phenomenon (event) occurs, it is possible to effectively determine whether the event data is normal.

[0023] (5) In the vehicle-mounted device according to one aspect of the present disclosure, if the value of the payload of two consecutive event data received in the plurality of event data does not change, the processing unit determines that at least one of the two consecutive event data is abnormal.

[0024] In this method, event data has the following transmission characteristics: when an event occurs such as a change in the payload value of a preceding transmitted (received) periodic data, it is transmitted before the periodic data to be transmitted in the next transmission cycle. Therefore, when multiple event data are received between the reception times of two consecutively received periodic data, the product specification assumes that the payload values ​​of each of these multiple event data are different (change) in the time series of two adjacent event data at the reception times. If the payload values ​​of two consecutively received event data do not change, i.e., the payload values ​​are the same, the processing unit of the vehicle-mounted device determines that at least one of the two consecutive event data is abnormal. Therefore, it can effectively determine whether the event data is normal based on the transmission characteristics of the event data. Furthermore, if the processing unit of the vehicle-mounted device determines that at least one of the two consecutive event data is abnormal, it can also determine a specific event data by comparing it with the payload value of a certain periodic data in the two consecutively received periodic data. The processing unit of the vehicle-mounted device can also store the received multiple event data in a storage unit, for example, in the form of a list (data reception list). When the processing unit of the vehicle-mounted device performs various calculations, such as determining whether the payload value of multiple received event data has changed, it can perform these calculations by simply calculating the difference or comparing the data received in the data receiving list. Therefore, it can suppress the increase in the demand for computing resources (hardware resources) such as the processing capacity (operation frequency) of the processing unit or the storage area of ​​the storage unit.

[0025] (6) In the vehicle-mounted device according to one aspect of the present disclosure, if the receiving time of the later received periodic data in the continuously received periodic data is within the normal periodic range based on the receiving time of the earlier received periodic data, the processing unit determines that the later received periodic data in the continuously received periodic data is normal. The processing unit only determines whether the event data based on the payload value is normal when it determines that the later received periodic data is normal.

[0026] In this method, when the processing unit of the vehicle-mounted device continuously receives periodic data of the same type, it derives a reception interval, which is the interval between the reception time of the first received periodic data and the reception time of the second received periodic data. Based on this reception interval and a normal period range with the reception time of the first received periodic data as a reference, the processing unit determines the success or failure of the second received periodic data (periodic data of the same type as the first received periodic data). Therefore, for periodically transmitted periodic data (messages), abnormal (abnormal) data (messages) can be effectively detected based on the transmission cycle. By setting a normal period range with the reception time of the first received periodic data as a reference in two consecutively received periodic data, the processing unit of the vehicle-mounted device can determine the data received from the reception time of the first received periodic data to the start time point (limit-low) of the normal period range as event data.

[0027] (7) In the vehicle-mounted device according to one aspect of the present disclosure, the normal cycle range is a range in which the upper and lower limits are set with the transmission cycle determined based on the category of the data as a reference value.

[0028] In this method, the processing unit of the vehicle-mounted device sets the normal cycle range based on the reception time of the previously received periodic data, using the transmission cycle determined by the type of that periodic data as a reference value. The range is defined by upper and lower limits (from the lower limit time point (limit-low) to the upper limit time point (limit-upp)). The lower limit time point (limit-low) corresponds to the start time point of the normal cycle range. The upper limit time point (limit-upp) corresponds to the end time point of the normal cycle range. The processing unit of the vehicle-mounted device can also determine whether the next periodic data in two consecutively received periodic data sets has been received, based on whether periodic data of the same type as the previously received periodic data has been received, during the period corresponding to this normal cycle range. Alternatively, if only a single periodic data set is received during the period corresponding to this normal cycle range, the processing unit can set the next normal cycle range based on the reception time of that single periodic data set. That is, the normal cycle range can be set solely based on the reception time point of the periodic data determined to be normal, regardless of whether event data is received. In this way, even in communication methods that set a normal period range based on the reception time of periodic data (communication methods without periodic transmission interval reset), it is possible to effectively determine whether event data sent outside the period is normal.

[0029] (8) In the vehicle-mounted device according to one aspect of the present disclosure, if the processing unit fails to receive periodic data within the normal periodic range or receives multiple periodic data, it does not perform determination processing related to the value of the payload of the event data, but determines that the event data is abnormal.

[0030] In this method, the processing unit of the vehicle-mounted device calculates the number of received periodic data points within a normal period range set based on the reception time of the previously received periodic data. If only one periodic data point is received (a single periodic data point is received), the processing unit determines that the single periodic data point is normal. If two periodic data points are received within the normal period range (multiple periodic data points are received), the processing unit determines that the multiple periodic data points are abnormal. In this case, the processing unit may also determine that at least one of the multiple periodic data points is abnormal, which corresponds to the range anomaly detection "anomaly detection (range)". If the processing unit fails to receive periodic data within the normal period range or receives multiple periodic data points, even if more than one event data point is received between the reception time of the previously received periodic data point and the start time point of the normal period range (the "limit-low"), it does not perform any determination processing related to the payload value of the event data, but instead determines that the event data is abnormal. When determining whether event data is normal, the premise is that two consecutively received data cycles are both considered normal. If no data cycles are received within the normal cycle range, or if multiple data cycles are received, this premise cannot be met. Therefore, if this premise cannot be met, no determination processing related to the payload value of the event data is performed, and the event data is determined to be abnormal. Thus, excessive or redundant determination processing for event data is unnecessary, and the processing load of the on-board unit can be suppressed unnecessarily.

[0031] (9) In the vehicle-mounted device according to one aspect of the present disclosure, the processing unit determines whether the value of the payload of the event data is within a normal value range predetermined according to the category of periodic data. If the processing unit determines that the value of the payload of the event data is within the normal value range, it performs a determination of whether the event data is normal based on a comparison with the value of the payload of the periodic data. If the processing unit determines that the value of the payload of the event data is not within the normal value range, it does not perform a comparison with the value of the payload of the periodic data, but determines that the event data is abnormal.

[0032] In this method, the normal range of the payload value (signal value) contained in the event data and periodic data is predetermined, for example, based on the data category determined by message ID or port number, i.e., the range of values ​​that the payload value (signal value) can obtain. The normal value range corresponding to these data categories can also be stored in the storage unit in table form (data category table). The processing unit of the vehicle-mounted device, for example, refers to this data category table to determine whether the payload value (signal value) of the received event data is within the normal value range. If the processing unit determines that it is within the normal value range, it determines whether the event data is normal by comparing the payload value (signal value) of the event data with the payload value (signal value) of at least one of two consecutively received periodic data. If the processing unit determines that it is not within the normal value range, it does not compare the payload value of the event data with that of the periodic data and determines that the event data is abnormal. In this case, the processing unit of the vehicle-mounted device may also determine that the event data corresponds to a specific anomaly detection "anomaly detection (specific)". In other words, since it is highly likely that event data whose payload value (signal value) deviates from the normal range is abnormal (abnormal) data caused by an attack, the processing load in the processing unit can be reduced or the processing time shortened by eliminating the need for post-processing such as comparison with periodic data for the event data.

[0033] (10) In the vehicle-mounted device according to one aspect of the present disclosure, the processing unit determines whether the reception time of the received event data is within an event data transmission prohibition period based on the reception time of the first received periodic data in the continuously received periodic data. If the processing unit determines that the reception time of the event data is not within the event data transmission prohibition period, it performs determination processing related to the value of the payload of the event data. If the processing unit determines that the reception time of the event data is within the event data transmission prohibition period, it does not perform determination processing related to the value of the payload of the event data, but determines that the event data is abnormal.

[0034] In this method, event data and periodic data are classified according to data categories determined by message IDs or port numbers, and the reception time of the previously received periodic data is used as a reference to pre-determine an event data transmission prohibition period for which transmission of the event data is prohibited. The transmission prohibition periods corresponding to these data categories can also be stored in the storage unit in table form (data category table). The processing unit of the vehicle-mounted device, for example, refers to this data category table to determine whether the reception time of the received event data falls within the event data transmission prohibition period. If the processing unit determines that the event data is not within the event data transmission prohibition period, it performs a determination process related to the value of the event data's payload. This determination process related to the event data's payload value includes, for example, determining whether the event data's payload value (signal value) is within the normal range, comparing the payload values ​​(signal values) of the event data and periodic data, or determining whether there is a change in the payload values ​​(signal values) of two consecutively received event data. If the processing unit determines that the event data is within the event data transmission prohibition period, it does not perform any determination process related to the event data's payload value and determines that the event data is abnormal. That is, assuming that the event data received during the event data transmission prohibition period is likely to be abnormal (abnormal) data caused by an attack, etc., it is possible to reduce the processing load or shorten the processing time in the processing unit by post-processing such as determination processing that does not require the value of the event data payload.

[0035] (11) The procedure involved in one aspect of this disclosure causes a computer connected to a vehicle network to perform the following processing: receiving periodic data that is periodically transmitted through the vehicle network, and in the case that event data of the same kind as the periodic data is received between the receiving time points of two consecutively received periodic data, determining whether the event data is normal based on the value of the payload of the event data and the value of the payload of at least one of the two periodic data.

[0036] In this approach, a program can be provided that enables a computer to execute as an in-vehicle device capable of effectively detecting abnormal data in a communication method that periodically transmits data.

[0037] (12) The information processing method involved in one aspect of this disclosure causes a computer connected to a vehicle network to perform the following processing: receiving periodic data that is periodically sent through the vehicle network, and in the case that event data of the same type as the periodic data is received between the receiving time points of two consecutively received periodic data, determining whether the event data is normal based on the value of the payload of the event data and the value of the payload of at least one of the two periodic data.

[0038] In this approach, an information processing method is provided that enables a computer to effectively detect abnormal data in a communication mode that periodically transmits data.

[0039] [Details of the embodiments disclosed herein]

[0040] This disclosure will be specifically described based on the accompanying drawings illustrating embodiments thereof. Hereinafter, the vehicle-mounted device 2 according to embodiments of this disclosure will be described with reference to the accompanying drawings. It should be noted that this disclosure is not limited to these examples, but is intended to include all modifications within the meaning and scope equivalent to the claims, as shown in the claims.

[0041] (Implementation Method 1)

[0042] The embodiments will now be described with reference to the accompanying drawings. Figure 1 This is a schematic diagram illustrating the structure of a vehicle system S including the vehicle-mounted device 2 of embodiment 1. Figure 2 This is a block diagram illustrating the physical structure of the vehicle-mounted device 2.

[0043] The vehicle system S is primarily composed of an on-board unit 2 mounted on vehicle C. The on-board unit 2 is communicatively connected to an external communication device 1 and multiple on-board ECUs 3. The on-board unit 2 relays communication between the multiple on-board ECUs 3 mounted on vehicle C. The on-board unit 2 can also communicate via the external communication device 1 with an external server 100 connected to an external network N, relaying communication between the external server 100 and the on-board ECUs 3 mounted on vehicle C.

[0044] The external server 100 is, for example, a computer such as a server connected to an external network N, such as the Internet or a public transportation network, and has a storage unit 21 or storage device based on RAM (Random Access Memory), ROM (Read Only Memory), or a hard disk. The storage unit 21 of the external server 100 is contained in a storage area that can be accessed from the vehicle-mounted device 2.

[0045] Vehicle C is equipped with an external communication device 1, an in-vehicle device 2, a display device 5, and multiple in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the external communication device 1 are connected in a communicable manner, for example, via a wiring harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECUs 3 are connected in a communicable manner via communication lines 41 corresponding to communication protocols such as CAN (Control Area Network), CAN / FD, or Ethernet (Ethernet), and the in-vehicle network 4. The communication protocols in the in-vehicle device 2 and the in-vehicle ECUs 3 can also be based on LIN, MOST, FlexRay, etc.

[0046] The external communication device 1 includes an external communication unit (not shown) and an input / output (I / F) (not shown) for communicating with the vehicle-mounted device 2. The external communication unit is a communication device for wireless communication using mobile communication protocols such as 3G, LTE, 4G, 5G, and WiFi, and transmits and receives data with an external server 100 via an antenna 11 connected to the external communication unit. Communication between the external communication device 1 and the external server 100 is, for example, via an external network N such as a public landline network or the Internet. The input / output (I / F) is a communication interface for, for example, serial communication with the vehicle-mounted device 2. The external communication device 1 and the vehicle-mounted device 2 communicate with each other via the input / output (I / F) and wiring harnesses such as serial cables connected to the input / output (I / F). In this embodiment, the external communication device 1 is a different device from the vehicle-mounted device 2, and these devices are connected in a communicative manner via the input / output (I / F), but this is not a limitation. The external communication device 1 may also be a component of the vehicle-mounted device 2 and built into it.

[0047] The vehicle-mounted device 2 includes a processing unit 20, a storage unit 21, an input / output (I / O) unit 22, and an in-vehicle communication unit 23. The vehicle-mounted device 2 can be, for example, a gateway (CAN gateway) that summarizes segments of a system based on multiple communication lines 41, such as the vehicle-mounted ECU 3 of the cognitive system, the vehicle-mounted ECU 3 of the judgment system, and the vehicle-mounted ECU 3 of the operating system, and relays communication between these segments of the vehicle-mounted ECU 3. The multiple communication lines 41 correspond to buses (CAN bus, Ethernet cable) in each segment. The vehicle-mounted device 2 can also be a vehicle-mounted relay device such as a layer 2 or layer 3 Ethernet switch, a PLB (Power Lanbox) that has power distribution functions in addition to data communication relay functions, or an integrated ECU that has relay functions and centrally controls the entire vehicle C. Alternatively, the vehicle-mounted device 2 can also be a functional unit of a vehicle-mounted ECU 3, such as a body ECU that controls the body system actuators of the vehicle C.

[0048] The processing unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), etc., and performs various control and calculation processes by reading and executing the control program (program product) and data pre-stored in the storage unit 21. The processing unit 20 can also function as a control unit to determine whether the data (CAN messages, IP data packets) obtained (received) via the in-vehicle communication unit 23 is normal and to perform overall control of the vehicle-mounted device 2.

[0049] The storage unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and pre-stores the program P (program product) and data referenced during processing. The program P (program product) stored in the storage unit 21 can also store a program P (program product) that can be read from the recording medium M of the vehicle-mounted device 2. In addition, the program P (program product) can be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0050] The storage unit 21 stores relay path information (routing table) used for relay processing during communication between vehicle ECUs 3 or between vehicle ECUs 3 and external server 100. The format of this relay path information is determined according to the communication protocol. In the case of a communication protocol such as CAN, the CAN relay path information includes the message identifier (CAN-ID, message ID) contained in the CAN message and the relay destination (I / O port number of the in-vehicle communication unit 23) associated with that CAN-ID.

[0051] The input / output I / F22 is the same as the input / output I / F of the external communication device 1, for example, it is a communication interface for serial communication. For example, the vehicle-mounted device 2 is connected to the external communication device 1, the display device 5 (HMI device) and the IG switch 6 (or power switch) for starting and stopping the vehicle C via the input / output I / F22 in a communicative manner.

[0052] The in-vehicle communication unit 23 is, for example, an input / output interface (CAN driver, Ethernet PHY unit) that uses communication protocols such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark). The processing unit 20 communicates with in-vehicle equipment such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0053] Multiple in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to various communication lines 41 (CAN bus, etc.) that constitute the vehicle network 4. By setting up multiple in-vehicle communication units 23 in this way, the vehicle network 4 can also be divided into multiple segments. The topology of the vehicle network 4 is not limited to the bus type shown in the figure of this embodiment. For example, the topology can also be a star topology centered on the vehicle device 2, a ring topology based on multiple vehicle devices 2, or a cascaded topology with the vehicle device 2 as the top-level device.

[0054] The processing unit 20 of the vehicle-mounted device 2 configured in this way transitions through multiple states during the determination process of received data (periodic data, event data) described later. These multiple states include, for example, a reference data receiving state (reference message acquisition state) for receiving data (periodic data) that serves as a reference when a normal period range is determined, and a determination execution state (periodic detection execution state) for determining whether the received data (periodic data) is normal based on the determined normal period range. The processing of the processing unit 20 related to state transitions during these determination processes can, for example, use the state transition-related processing described in International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0055] Like the vehicle-mounted device 2, the vehicle-mounted ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown). The storage unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores the program or data of the vehicle-mounted ECU 3. The vehicle-mounted ECU 3 communicates with the vehicle-mounted device 2, for example, by periodically sending CAN messages or IP data packets. The vehicle-mounted ECU 3 can also be a separate ECU subordinate to an integrated ECU, connected to sensors or actuators.

[0056] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a car navigation display. The display device 5 is connected to the input / output I / O 22 of the vehicle-mounted device 2 in a communicative manner via a wiring harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the vehicle-mounted device 2 via the input / output I / O 22.

[0057] Figure 3 This is an explanatory diagram related to the data category table. Various data stored by the processing unit 20 during decision processing are stored in designated storage areas accessible from the processing unit 20, such as the storage unit 21 of the vehicle-mounted device 2, or storage devices connected to the vehicle-mounted ECU 3 or external server 100. Data categories that are monitored during decision processing by the processing unit 20 are stored in the storage unit 21, for example, as a data category table. Management items (fields) defined in the data category table include, for example, message ID (data category), design cycle, upper and lower limit ratio, normal cycle range, decision execution object flag, event data transmission prohibition time, and payload normal value range.

[0058] The message ID (data category) management field stores, for example, the message ID (CAN-ID) representing the category of a CAN message. Based on this message ID, the category of the received data is determined. When the data to be determined is, for example, a CAN message, CAN messages with the same message ID are processed as data of the same category. That is, the message ID is set as a management field used to classify or define data categories. The management field used to determine the data category is not limited to the message ID in a CAN message; for example, in a TCP / IP packet, it can be based on the source IP address, destination IP address, TCP port number, UDP port number, or a combination thereof contained in the packet.

[0059] The design cycle refers to the predetermined transmission cycle when sending data (messages) from a certain vehicle ECU3, etc., that is, the transmission cycle based on the design specifications of the application installed on that vehicle ECU3, etc. The design cycle (e.g., x[ms]) of each data item is stored in the design cycle management item (field).

[0060] The upper and lower limit ratio represents the upper and lower limits used to determine the normal cycle range based on the design cycle. The upper and lower limit ratio can be defined, for example, as a ratio relative to the design cycle (e.g., a%, where a>0), or it can be expressed as actual time (±x×a×0.01[ms]). Alternatively, the upper and lower limit ratio can also be a ratio where the upper and lower limits are different.

[0061] The normal cycle range is a range calculated based on the design cycle and the ratio of upper and lower limits, and is used to determine whether the received data is normal. For example, with a design cycle of x [ms] and an upper and lower limit ratio of a% (±x×a×0.01 [ms]), the normal cycle range changes from xx×a×0.01 [ms] to x+x×a×0.01 [ms]. When the reception time of the baseline data used to determine the normal cycle range is set to (Kms), the center value of the normal cycle range is (K+x)ms, the lower limit time point (limit-low) is {(K+x)-(x×a×0.01)}ms, and the upper limit time point (limit-upp) is {(K+x)+(x×a×0.01)}ms. In this embodiment, the data category table includes both the design cycle and the upper and lower limit ratios, as well as the normal cycle range, but it is not limited to these; it may also include only one of them.

[0062] The execution target flag is stored with a flag value (1: monitored object, 0: non-monitored object). This flag value determines which category of data in the data transmitted and received by the vehicle network 4 is used as the execution target (monitored object) for normal determination. In this way, by using data of the category with the execution target flag set as the execution target (monitored object) for normal determination in the data transmitted and received by the vehicle network 4, only data with higher importance can be used as the monitoring target, reducing the processing load of the vehicle device 2 (processing unit 20).

[0063] Regarding the event data transmission prohibition time, the message ID (data category) stored in the same record contains baseline data (baseline message) used to determine the normal cycle range. This is the value of the time (period) during which event data transmission is prohibited from being sent, starting from the reception time of the first received cycle data. In other words, the start time of the event data transmission prohibition period (event data transmission prohibition period) is the reception time of the first received cycle data, and the end time of the event data transmission prohibition period is the time elapsed since that reception time. The event data transmission prohibition period is a time shorter than the design cycle (smaller value) (event data transmission prohibition period < design cycle). The event data transmission prohibition period can also be set relative to the design cycle using a coefficient (K) less than 1, such as 0.4 (event data transmission prohibition period = design cycle × K: for example, K = 0.4). Details will be discussed later. Data received during the event data transmission prohibition period (event data) is considered abnormal (abnormality detection (specific)).

[0064] The normal payload value range is the range of obtainable signal values ​​or control values, etc., contained in the payload area of ​​the message ID (data category) stored in the same record. The obtainable range of signal values ​​or control values, etc., is predetermined based on product specifications such as the various applications that detect or calculate these values. Details will be described later, but if the value stored in the payload area of ​​the received event data exceeds the normal payload value range, the event data is determined to be abnormal (abnormality detection (specific)).

[0065] The values ​​stored within the normal range of the payload can also be defined (stored) in multiple ways depending on the signals contained in the payload area. In this embodiment, the payload area may also contain two signals (signal A and signal B), and normal ranges (normal range of signal A and normal range of signal B) may be defined for each of these signals.

[0066] The processing unit 20 of the vehicle-mounted device 2 can also determine whether each signal value contained in the payload area is within the normal range when performing a normal determination based on the payload value of the received event data. At this time, even if only one of the multiple signal values ​​contained in the payload area exceeds the normal range, the processing unit 20 of the vehicle-mounted device 2 can determine that the received event data is abnormal (abnormality detection (specific)).

[0067] Figure 4 This is an explanatory diagram related to the data reception list. When the processing unit 20 of the vehicle-mounted device 2 receives data that is subject to a conditional determination, it stores information related to that data in a list format (data reception list) or a table format in a designated storage area accessible by the storage unit 21. In addition to storing information related to the received data in the data reception list, the processing unit 20 of the vehicle-mounted device 2 can also store it in different lists according to the data category. The data reception list generated and stored according to the data category is thus saved and managed as log information (reception log) of the received data.

[0068] The data receiving list is stored and managed as a list (table) for each data category. As management items (fields), each data receiving list for each data category includes, for example, a sequence number (number), receiving time point (timestamp), receiving period, normal value range determination, payload value, prediction result, reverse calculation result, and result determination.

[0069] The sequence number (serial number) is stored in the sequence number (number) management item to indicate the order in which the data was received. In this embodiment, the sequence number of the reference data (reference message) used to determine the normal cycle range, i.e., the first cycle data received, is set (saved) to 0. After the earlier cycle data is received, whenever data of the same type as that cycle data is received, the value of the sequence number is incremented (added by one) and set (saved).

[0070] The management project for receiving timestamps stores the receiving timestamp, which indicates the moment when data with a serial number (number) stored in the same record was received. The processing unit 20 of the vehicle-mounted device 2 calculates the difference (time difference) between the receiving timestamp of the data with the serial number set to 0 (the first received periodic data) and the receiving timestamp of each data, and can determine whether the data was received during the event data transmission prohibition period, the event transmission permission period (event data transmission permission period), or the normal periodic range.

[0071] The period during which data is received is the period that stores the receiving time of data containing the sequence number (number) stored in the same record. Within this period, after the normal period range containing the baseline data (baseline message) included in the previous normal period range—that is, the normal period range at the receiving time of the previously received period data (the previous normal period range)—the event data transmission prohibition period, the event transmission permission period, and the current normal period range are arranged chronologically in this order. The event data transmission prohibition period and the current normal period range are based on the receiving time of the previously received period data, for example, determined according to the normal period range and event data transmission prohibition time defined by the data category table. The event transmission permission period (event data transmission permission period) is the period between the event data transmission prohibition period and the current normal period range.

[0072] The processing unit 20 of the vehicle-mounted device 2 determines whether the received data is event data or periodic data based on the period to which the data reception time belongs. Data received during an event data transmission prohibited period or an event data transmission permitted period is determined to be event data. Data received within the normal periodic range is determined to be periodic data.

[0073] In management projects that determine the normal value range, the payload value of the data stored in the same record with the serial number (number) is considered, i.e., whether each signal value is within (within or outside) the normal payload value range defined by the data category table. Furthermore, event data received during an event data transmission prohibition period may not undergo any processing related to that payload value.

[0074] In the payload value management project, the payload value of data with a sequence number (number) stored in the same record is the individual signal value. Furthermore, event data received during an event data transmission prohibition period may not undergo any processing related to that payload value.

[0075] The prediction results management project stores the judgment results of the prediction processing for the data (event data) received during the event sending period. Details related to this prediction processing will be described later.

[0076] The reverse engineering results management project stores the determination results of the reverse engineering processing of data (event data) received during the event sending period. Details related to this reverse engineering processing will be described later.

[0077] The result determination management project stores the predicted results for data (event data) received during the event transmission permission period, or the final result determination corresponding to a combination of the predicted results and the reverse calculation results. This result determination is, for example, normal or abnormal. The abnormality includes an anomaly detection (range) "Abnormal (Range)" indicating a state where an anomaly is detected within a certain range of received data, and an anomaly detection (specific) "Abnormal (Specific)" indicating a state that can determine which data (message) is abnormal. Details regarding this result determination are described later.

[0078] Figure 5 This is an explanatory diagram related to the determination of whether event data is normal (during the event data transmission prohibition period). In the illustration of this embodiment, the determination process related to data (CAN messages, etc.) of a specific data category is explained. In this illustration, the horizontal axis represents time (elapsed time). For example, the processing unit 20 of the vehicle-mounted device 2 calculates the reception interval of the same type of data (same message ID) for each data (monitored object message) determined by the data category table stored in the storage unit 21. If the reception interval is within the normal period range, it is determined (specifically) that the data is periodic data (periodic message) that is transmitted periodically. The determination of whether these periodic data are normal and the determination of the normal period range can, for example, be the same as the data (equivalent to periodic data) related processing described in International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0079] In the illustration of this embodiment, the prior periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and normal value range are determined based on the reception time of the prior periodic data (reference Msg). The event data transmission prohibition period is the period from the reception time of the prior periodic data (reference Msg) to the end of the event data transmission prohibition period. The processing unit 20 of the vehicle-mounted device 2 takes the time point obtained by adding the design period (T) to the reception time of the prior periodic data (reference Msg) as the center value, and calculates (specifically) the period with the lower limit time point (limit-low) and the upper limit time point (limit-upp) as the upper and lower limits relative to the center value as the normal period range (the normal period range of this time). Data (Msg2) received within this normal period range (the normal period range of this time) is processed as subsequent periodic data (Msg2). In the illustration of this embodiment, the number of data received within the normal cycle range is only one based on the subsequent cycle data (Msg2), and the payload value (all signal values) of the cycle data (Msg2) is within the normal range, so the subsequent cycle data (Msg2) is determined to be normal.

[0080] The reception time of the data (Msg1) received from the previous periodic data (reference Msg) to the lower limit of the current normal periodic range is included in the event data transmission prohibition period. Therefore, the processing unit 20 of the vehicle-mounted device 2 determines that the data (Msg1) received during the event data transmission prohibition period is abnormal event data. At this time, the processing unit 20 of the vehicle-mounted device 2 can also determine that the event data (Msg1) is equivalent to the abnormality detection (specific) "abnormal (specific)".

[0081] Figure 6 This is an explanatory diagram related to the determination of whether event data is normal (normal cycle range). In the illustration of this embodiment, multiple data (Msg6, Msg7) are received as cycle data within the current normal cycle range. Based on this, two event data (Msg1, Msg2) are received during the event data transmission prohibition period, and three event data (Msg3, Msg4, Msg5) are received during the event transmission permission period. All multiple cycle data (Msg6, Msg7) received within the normal cycle range (the current normal cycle range) are determined to be abnormal. The processing unit 20 of the vehicle-mounted device 2 can also determine multiple cycle data (Msg6, Msg7) received within the same normal cycle range as equivalent to the abnormality detection (range) "abnormal (range)".

[0082] When determining whether event data is normal, it is predicated on the assumption that both consecutively received periodic data (the earlier periodic data and the later periodic data) are normal. Conversely, if periodic data (the later periodic data) is not received within the normal periodic range (the current normal periodic range), or if multiple periodic data (the later periodic data) are received, this precondition cannot be met. In this case, the processing unit 20 of the vehicle-mounted device 2, upon determining the subsequent normal periodic range, switches to a reference data receiving state (reference message acquisition state) for receiving periodic data that serves as the reference. After switching to the reference data receiving state, the processing unit 20 of the vehicle-mounted device 2, upon initially receiving data, sets the data as periodic data and switches to a determination execution state (periodic detection execution state). In this case, the processing unit 20 of the vehicle-mounted device 2 determines that the data received from the previous periodic data (reference Msg) up to the lower limit of the current normal periodic range and the event data (Msg1, Msg2) received during the event data transmission prohibition period are equivalent to the anomaly detection (specific) "anomaly (specific)".

[0083] Based on this, the processing unit 20 of the vehicle-mounted device 2 can also perform the following processing method (mode A): For event data (Msg3, Msg4, Msg5) received during the event transmission permission period, the normality of these event data (Msg3, Msg4, Msg5) is determined by comparing them with the payload values ​​of previously normal periodic data. The comparison processing of this payload value will be described later. By using this processing method (mode A), the accuracy of anomaly detection for each of the event data (Msg3, Msg4, Msg5) can be improved. That is, the anomaly detection (range) "anomaly (range)" which indicates that an anomaly is detected in a certain range of received data can be reduced, and the anomaly detection (specific) "anomaly (specific)" which indicates that a certain data (message) can be determined to be abnormal can be increased.

[0084] Alternatively, the processing unit 20 of the vehicle-mounted device 2 may determine that the event data (Msg3, Msg4, Msg5) received during the event transmission permission period is equivalent to the anomaly detection (range) "abnormal (range)". In this case, the multiple periodic data (Msg6, Msg7) determined to be "abnormal (range)" and the event data (Msg3, Msg4, Msg5) determined to be "abnormal (range)" can also be processed as separate anomaly determination results and stored (logged) in the log information (mode B). By using this processing method (mode B), anomaly detection (range) "abnormal (range)" outside the normal periodic range and anomaly detection (range) "abnormal (range)" within the normal periodic range can be logged separately.

[0085] Alternatively, the processing unit 20 of the vehicle-mounted device 2 determines that the event data (Msg3, Msg4, Msg5) received during the event transmission permission period is equivalent to the anomaly detection (range) "abnormal (range)". In this case, it is also possible to perform a processing method (mode C) that stores (log saves) multiple periodic data (Msg6, Msg7) determined to be "abnormal (range)" and event data (Msg3, Msg4, Msg5) determined to be "abnormal (range)" as a series of (identical) anomaly determination results in the log information. By using this processing method (mode C), the processing time can be shortened. In addition, compared with mode B, the capacity of the common header portion allocated when saving the log can be reduced, which can alleviate the situation of storage space shortage in the storage unit 21.

[0086] Alternatively, the processing unit 20 of the vehicle-mounted device 2 may perform a processing method (mode D) that stores the event data (Msg3, Msg4, Msg5) received during the event transmission permission period as external data for determining whether the event is normal or not in the log information. By using this processing method (mode D), the processing time can be shortened to the maximum extent compared with other processing methods.

[0087] In this embodiment, when no periodic data is received within the normal periodic range, or when multiple periodic data are received, the processing method for event data (Msg3, Msg4, Msg5) received within the event transmission allowable period is not limited to a fixed or uniform setting, but can be variably set. The processing method for this event data (Msg3, Msg4, Msg5) can, for example, be determined separately according to the data category. In this case, the data category table can also contain management items for managing the processing method, defining, for example, any one of patterns A to D for each data category. It is assumed that the processing method (pattern) to be applied to the received data is determined by a trade-off between the log storage strategy and the processing time required for detection processing. The log storage strategy refers, for example, to product specifications or application settings related to whether to broadly log slightly suspicious data or reliably log abnormal data. In contrast, by using a data category table to determine the processing method (pattern) for each data category, an appropriate processing method corresponding to the data importance determined by that data category can be used.

[0088] Figure 7 This diagram illustrates the determination of whether event data is normal (normal value range). In this embodiment, both the earlier periodic data (reference Msg) and the later periodic data (Msg2) are determined to be normal. Among the event data (Msg1) received from the receiving time of the earlier periodic data (reference Msg) to the lower limit of the current normal periodic range, the receiving time of this event data (Msg1) is included within the event transmission allowed period. Therefore, from the viewpoint of the receiving time, it can be said that the event data (Msg1) is normal. However, since the payload value (signal value) of the event data (Msg1) exceeds the normal value range, the processing unit 20 of the vehicle-mounted device 2 determines that the event data (Msg1) is an anomaly detection (specific) "abnormal (specific)".

[0089] In the illustration of this embodiment, the payload area of ​​the event data (Msg1) includes the values ​​of signal A and signal B. For example, only the value of signal A is outside the normal payload value range (normal value range of signal A) defined in the data category table. Thus, even if only one of the multiple signal values ​​is outside the normal value range, the processing unit 20 of the vehicle-mounted device 2 can still determine the event data containing a signal value outside the normal value range (a signal value outside the obtainable range) in the payload area as an anomaly detection (specific) "anomaly (specific)".

[0090] Figure 8 This diagram illustrates the determination (prediction) of whether event data is normal. In this embodiment, both the earlier periodic data (reference Msg) and the later periodic data (Msg2) are determined to be normal. The reception time of event data (Msg1) is included within the event transmission allowed period. The payload value (signal value) of event data (Msg1) is within the normal payload value range (the normal value ranges for signal A and signal B respectively). Therefore, from the viewpoint that the reception time of event data (Msg1) and the payload value (signal value) are within the normal range, it can be said that event data (Msg1) is normal. However, in a comparison with the payload value (signal value) of periodic data (reference Msg), the payload values ​​(all signal values) of event data (Msg1) and periodic data (reference Msg) are the same, and the periodic data (reference Msg) is data of the same type as event data (Msg1) and is the data received immediately before it.

[0091] Event data has the following transmission characteristics: when an event occurs where the payload value of the preceding periodic data changes, it is transmitted before the periodic data to be transmitted in the next transmission cycle. Therefore, within the same data category, the payload value of the event data is the same as the payload value of the periodic data received immediately preceding the event data, which is the opposite of this transmission characteristic. The processing unit 20 of the vehicle-mounted device 2 determines that event data with a payload value that is the same as the payload value of the preceding periodic data is an anomaly detection (specific) "abnormal (specific)". If the processing unit 20 of the vehicle-mounted device 2 determines that the event data is normal when the payload value of the periodic data received immediately preceding the event data reception time is different from the payload value of the event data, i.e., when they are different values.

[0092] The processing unit 20 of the vehicle-mounted device 2 determines whether the event data is normal based on the similarity between the payload value of the periodic data and the payload value of the event data. However, the determination of similarity is not limited to the case where the values ​​are completely identical. The processing unit 20 of the vehicle-mounted device 2 can also determine that the event data is abnormal when the difference between the payload value (signal value) of the periodic data and the event data is below a predetermined value (substantially the same), and determine that the event data is normal when the difference between the payload value (signal value) of the periodic data and the event data exceeds a predetermined value (substantially different). When the predetermined value is 0, it indicates that the payload value (signal value) is completely identical. However, by setting the predetermined value to a relatively small value, such as close to 0, it is possible to flexibly handle the transmission characteristics determined by the data category of the event data. That is, the predetermined value (threshold for difference determination) used in the comparison (difference determination) of the payload value (signal value) can also be set separately, for example, through a data category table, according to the data category of the event data transmitted in an event-driven manner.

[0093] Figure 9 This diagram illustrates the determination of whether event data is normal (payload change). In this embodiment, both the preceding periodic data (reference Msg) and the subsequent periodic data (Msg6) are determined to be normal. Based on this, five event data (Msg1 to 5) are received during the event transmission permission period. As described above, the event data has the following transmission characteristics: when a phenomenon (event) occurs such as a change in the payload value of the preceding periodic data, it is transmitted in an event-driven manner. Therefore, if this phenomenon (event) occurs multiple times during the same event transmission permission period, multiple transmissions of event data are performed each time the phenomenon (event) occurs.

[0094] In the illustrations of this embodiment, among these multiple event data (Msg1 to 5), the payload value of a certain event data is within the normal range; that is, from the viewpoint of the event data's payload value itself, it can be considered normal. Based on this, the processing unit 20 of the vehicle-mounted device 2 compares the payload value of the event data to be determined at the reception time point with the payload value of the same type of data (periodic data or event data) received immediately prior. Regarding the event data (Msg1) received immediately after the reception time point of the preceding periodic data (reference Msg: number 0), as in... Figure 8 As explained, the payload values ​​of the periodic data (baseline Msg: number 0) and the event data (Msg1) are compared. If these payload values ​​are different, the event data (Msg1) is considered normal.

[0095] Event data received after the reception time of event data (Msg1) (Msg2 to 5) is considered normal event data, and its normality is determined by comparing it with the payload value of the immediately preceding event data. That is, the normality of event data (Msg2) is determined by comparing its payload value with that of event data (Msg1), and if these payload values ​​are different (substantially different), it is determined to be normal. Similarly, the payload values ​​of two consecutive event data (Msg2 and Msg3, Msg3 and Msg4) are also compared separately.

[0096] In both event data (Msg3 and Msg4), the payload values ​​are the same. Therefore, the processing unit 20 of the vehicle-mounted device 2 determines that the later-received event data (Msg4) is abnormal. The processing unit 20 of the vehicle-mounted device 2 may also determine that the event data (Msg4) is "abnormal (range)" in the anomaly detection (range). When the determination object is event data (Msg5), the data received immediately before the event data that is determined to be normal relative to event data (Msg5) becomes event data (Msg4). That is, this event data (Msg4) becomes the data used for comparing the payload value when determining whether the event data (Msg5) that is the determination object is normal.

[0097] In this way, the processing unit 20 of the vehicle-mounted device 2 performs the following processing (predictive processing): based on the prior periodic data (reference Msg: number 0) that has been determined to be normal, and based on whether there is a change in the payload value (signal value) from that periodic data (reference Msg: number 0), it sequentially determines whether multiple event data received during the event transmission allowance period set based on the reception time of that periodic data are normal. Therefore, when a predetermined phenomenon (event) occurs, that is, when the payload value (signal value) changes relative to the immediate transmission time, it can effectively determine whether the event data is normal based on the transmission characteristics of the event data transmitted deviating from the transmission cycle (design cycle).

[0098] Figure 10This diagram illustrates the process of determining whether event data is normal (in reverse order). In this embodiment, both the preceding periodic data (reference Msg) and the subsequent periodic data (Msg2) are determined to be normal. That is, the subsequent periodic data (Msg2) is the only data of the same type received within a normal period set based on the reception time of the preceding periodic data (reference Msg), and the payload value of this periodic data (Msg2) is within the normal range, therefore it is determined to be normal. Event data (Msg1) is received during the event transmission permission period, and its payload value (signal value) is also within the normal range. Furthermore, the payload value (signal value) of event data (Msg1) is different (substantially different) from the payload value (signal value) of the preceding periodic data (reference Msg), so from the viewpoint of having a change in payload value compared to the preceding periodic data (reference Msg), event data (Msg1) appears normal at first glance. In contrast, the payload value (signal value) of the event data (Msg1) is different from the payload value (signal value) of the subsequent periodic data (Msg2).

[0099] Event data exhibits an event-driven transmission characteristic where transmission occurs only when an event (such as a change in the payload value of preceding data (periodic data or event data)) happens. Conversely, periodic data is transmitted periodically when no such event (such as a change in the payload value of preceding data (periodic data or event data) occurs. Therefore, it is envisioned that, relative to the reception time of the periodic data, the payload value (signal value) of the preceding event data is consistent (substantially identical) with the payload value (signal value) of the periodic data. In determining whether this consistency (substantially identical) is true, the aforementioned difference determination threshold can also be used. That is, within the same data category, if the payload value of the event data is different from the payload value of the periodic data received immediately following that event data (substantially not identical), this is contrary to the transmission characteristic.

[0100] The processing unit 20 of the vehicle-mounted device 2 performs a comparison process (reverse processing) between the payload value (signal value) of the last received event data (Msg1) during the event transmission permission period and the payload value (signal value) of the subsequent periodic data (Msg2). The processing unit 20 of the vehicle-mounted device 2 determines that event data with a payload value different from the payload value of the immediately following received periodic data is an anomaly (specific) "anomaly (specific)". The processing unit 20 of the vehicle-mounted device 2 determines that event data with a payload value that is the same as (substantially the same as) the payload value of the immediately following received periodic data is normal.

[0101] Figure 11This is an explanatory diagram (matrix table) regarding the determination method (determination table) of the event data by the processing unit 20 of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 performs determination processing (predictive processing) based on whether the payload value of the event data received during the event transmission permission period has changed from the previous periodic data, and determination processing (reverse processing) based on the similarity of the payload value with the subsequent periodic data.

[0102] In this scenario, for example, both predictive processing and reverse processing are performed on the last event data received during the event transmission permission period. At this time, the processing unit 20 of the vehicle-mounted device 2 can also combine the results of the predictive and reverse processing to derive a final result determination. For event data other than the last event data received during the event transmission permission period, only predictive processing may be performed, and the processing unit 20 of the vehicle-mounted device 2 derives the final result determination based on this predictive processing. When deriving this final result determination, the processing unit 20 of the vehicle-mounted device 2 can, for example, use a determination table shown in matrix form to derive the determination method (final result determination) for the event data.

[0103] The decision table is stored in a designated storage area accessible to the processing unit 20, such as the storage unit 21. The decision table, in matrix form, contains the predicted results for vertical management items and the reverse results for horizontal management items.

[0104] The prediction results include qualified (normal), unqualified (abnormal), and anomalous (specific) items as sub-categories. A qualified (normal) prediction result indicates that the prediction processing judgment is normal. An unqualified (abnormal) prediction result indicates that the prediction processing judgment is anomalous, that is, the payload value (signal value) of the event data of the judgment object has not changed. Anomalous (specific) prediction result indicates that the payload value (signal value) of the event data of the judgment object exceeds the normal range.

[0105] The reverse engineering results are categorized into four subcategories: no judgment, qualified (normal), unqualified (abnormal), and abnormal (specific). No judgment result indicates that no reverse engineering processing was performed on the event data of the judgment object. A qualified (normal) reverse engineering result indicates that the judgment result of the reverse engineering process was normal. An unqualified (abnormal) reverse engineering result indicates that the judgment result of the reverse engineering process was abnormal, meaning that the payload value (signal value) of the event data of the judgment object is different from (not actually the same as) the payload value of the immediately following received periodic data. An abnormal (specific) reverse engineering result indicates that the payload value (signal value) of the event data of the judgment object exceeds the normal range.

[0106] The processing unit 20 of the vehicle-mounted device 2 derives the final result determination based on the combination of the detailed items of the prediction result and the detailed items of the reverse calculation result. In the absence of a determination of the reverse calculation result, the final result determination is normal if the prediction result is qualified (normal), abnormal if the prediction result is unqualified (abnormal), and abnormal if the prediction result is specific.

[0107] If the reverse-engineered result is qualified (normal), the final result is judged as normal if the predicted result is qualified (normal). If the result is unqualified (abnormal), the final result is judged as an anomaly detection (range). If the result is abnormal (specific), the final result is judged as an anomaly detection (specific). That is, if the reverse-engineered result and the predicted result differ between qualified (normal) and unqualified (abnormal), it becomes an anomaly detection (range).

[0108] When the reverse calculation result is unqualified (abnormal), the final result is determined as an anomaly detection (range) when the predicted result is qualified (normal). When the result is unqualified (abnormal), the final result is determined as an anomaly detection (specific). When the result is abnormal (specific), the final result is determined as an anomaly detection (specific). That is, when both the reverse calculation result and the predicted result are unqualified (abnormal), it becomes an anomaly detection (specific).

[0109] In cases where the reverse calculation result is abnormal (specific), regardless of the prediction result, all results become anomaly detection (specific). An abnormal (specific) result in either the reverse calculation result or the prediction result indicates that the payload value (signal value) of the event data of the judgment object exceeds the normal range. In this case, the processing unit 20 of the vehicle-mounted device 2 may also determine that the event data of the judgment object is abnormal, i.e., anomaly detection (specific), without comparing the payload value (signal value) of the event data of the judgment object with other data (periodic data or event data).

[0110] Figure 12 This is a flowchart illustrating the processing of the processing unit 20 of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 stably performs the following processing, for example, when the vehicle C is in a starting state (IG switch 6 or power switch is turned on) or a stopping state (IG switch 6 or power switch is turned off).

[0111] The processing unit 20 of the vehicle-mounted device 2 sets an event data transmission prohibition period and a normal period range based on the received periodic data (reference data). Whenever periodic data is received, the processing unit 20 of the vehicle-mounted device 2 determines whether the received periodic data is normal. Based on the reception time of the periodic data (reference data) determined to be normal, the processing unit 20 of the vehicle-mounted device 2 sets an event data transmission prohibition period and a normal period range (the normal period range for this instance) by referring, for example, to a data category table.

[0112] The processing unit 20 of the vehicle-mounted device 2 stores information related to the received event data in the storage unit 21 (S102). The processing unit 20 of the vehicle-mounted device 2 stores information (serial number, reception time, etc.) related to the event data received during the period from the reception time of the received periodic data (reference data) to the lower limit time point of the set normal periodic range in the storage unit 21, for example, in the form of a list (data reception list). The processing unit 20 of the vehicle-mounted device 2 may also store the periodic data received within the normal periodic range in the storage unit 21 by saving (adding) it to the data reception list.

[0113] The period from the time point at which the received baseline periodic data (baseline data) is received to the lower limit of the set normal periodic range includes an event data transmission prohibition period (prohibiting event transmission) and an event transmission permission period (allowing event transmission). The event data transmission prohibition period and the event transmission permission period are consecutive; that is, the event transmission permission period begins immediately after the event data transmission prohibition period ends. The normal periodic range begins immediately after the event transmission permission period ends.

[0114] The processing unit 20 of the vehicle-mounted device 2 acquires data received during the event data transmission prohibition period and the event transmission permission period as event data (Msg outside the normal cycle range) that is subject to normality determination. The event data transmission prohibition period and the event transmission permission period correspond to periods outside the normal cycle range. The processing unit 20 of the vehicle-mounted device 2 acquires data received within the normal cycle range as cycle data (Msg within the normal cycle range) that is subject to normality determination. Even in cases where no data is received within the normal cycle range, i.e., when the number of data received within the normal cycle range is 0, the processing unit 20 of the vehicle-mounted device 2 performs subsequent processing after a period determined by the normal cycle range has elapsed.

[0115] The processing unit 20 of the vehicle-mounted device 2 determines whether the time point of receiving the received event data is within the event data transmission prohibition period (S103). If the time point of receiving the event data is within the event data transmission prohibition period (S103: Yes), the processing unit 20 of the vehicle-mounted device 2 determines that the event data is abnormal (abnormality detection (specific)) (S1031).

[0116] If the event data reception time is not within the event data transmission prohibition period (S103: No), that is, if the event data reception time is within the event transmission permission period, the processing unit 20 of the vehicle-mounted device 2 determines whether the received periodic data within the normal period range is one (S104). If the periodic data obtained within the normal period range is not one (S104: No), that is, if the periodic data obtained within the normal period range is 0 (none) or multiple, the processing unit 20 of the vehicle-mounted device 2 determines the received event data and multiple periodic data as abnormal (abnormality detection (range)) (S1041). Alternatively, the processing unit 20 of the vehicle-mounted device 2 may also determine the event data received during the event data transmission prohibition period as abnormal (specific) if the periodic data obtained within the normal period range is 0 (none) or multiple. In this case, the processing unit 20 of the vehicle-mounted device 2 may also perform any of the aforementioned processing methods (modes A to D) for the event data received during the event transmission permission period, for example, based on the data category of the event data.

[0117] If only one periodic data point is acquired within the normal periodicity (S104: Yes), the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value of the event data to be determined is within the normal range (S105). If only one periodic data point is acquired within the normal periodicity (the current normal periodicity) and the payload value of that periodic data is within the normal range, the processing unit 20 of the vehicle-mounted device 2 determines that the periodic data is normal. Thus, if both consecutively received periodic data points (the earlier periodic data and the later periodic data) are normal, for more than one event data point received between the reception times of these two periodic data points, the prerequisite for starting determination processing based on a comparison with the payload value of the periodic data is met.

[0118] The processing unit 20 of the vehicle-mounted device 2 refers to the data reception list stored in the storage unit 21 and sequentially begins the processing from the event data received at the earliest reception time, or in other words, from the event data received at the reception time closest to the earliest periodic data (reference data). That is, the event data received immediately after the periodic data (reference data) used as the reference is equivalent to the event data received at the earliest reception time.

[0119] If the value is outside the normal range (S105: No), the processing unit 20 of the vehicle-mounted device 2 determines that the event data of the target is abnormal (abnormality detection (specific)) (S1051). If the payload value of the event data of the target is not within the normal range, that is, if a signal value contained in the payload area of ​​the event data is not within the normal range, the processing unit 20 of the vehicle-mounted device 2 determines that the event data of the target is abnormal (abnormality detection (specific)).

[0120] If the value is within the normal range (S105: Yes), the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value of the event data to be determined is different from the payload value of the data received immediately before and determined to be normal, i.e., whether the payload value has changed (S106). If the payload value of the event data to be determined is within the normal range (all signal values ​​are within the normal range), the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value is different from the payload value of the data received immediately before and determined to be normal, i.e., whether the payload value has changed.

[0121] When event data of the target to be determined is received immediately after the reception time of prior periodic data (reference data) that serves as a reference, the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value, i.e., the signal value, of the event data has changed (whether it is different) from that of the prior periodic data. When event data of the target to be determined is received immediately after the reception time of event data that has already been determined to be normal, the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value (i.e., the signal value) of the event data of the target to be determined has changed (whether it is different) from that of the event data that has already been determined to be normal. As described above, the processing unit 20 of the vehicle-mounted device 2 performs determination processing sequentially on the event data stored in the data reception list according to the reception time in a time sequence, thus effectively determining the event data of the target to be determined as the data to be compared (the periodic data or event data that was received immediately before and determined to be normal).

[0122] If the payload value does not change (no difference) (S106: No), the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1061). The event data has the transmission characteristic of being sent in an event-driven manner when a phenomenon (event) such as a change in payload value occurs. Therefore, if the payload value does not change (no difference), that is, if the event data has the same payload value as the data to be compared (previously received and judged as normal periodic data or event data), the processing unit 20 of the vehicle-mounted device 2 determines that the event data has an abnormality (abnormality detection (range)).

[0123] If the payload value changes (is different) (S106: Yes), the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is normal (S107). When the payload value changes (is different), that is, when the payload value of the event data has a different payload value than the data to be compared (previously received and judged as normal periodic data or event data), the processing unit 20 of the vehicle-mounted device 2 temporarily judges the event data as normal. The processing unit 20 of the vehicle-mounted device 2 appends the judgment result for the event data to be judged to the prediction result field in the data reception list.

[0124] The processing unit 20 of the vehicle-mounted device 2 determines whether the determination of all received event data has ended (S108). The processing unit 20 of the vehicle-mounted device 2 determines, by referring to the data reception list stored in the storage unit 21, whether there is any event data for which the determination of all event data has ended, that is, no determination processing has been performed.

[0125] If the determination of all event data is not completed (S108: No), the processing unit 20 of the vehicle-mounted device 2 performs loop processing in order to execute the processing of S103 again. At this time, the processing unit 20 of the vehicle-mounted device 2 refers to the data reception list and takes the next received event data of the event data determined in the current processing as the determination object, and executes the processing from S103. As a result, it is possible to perform determination processing (predictive processing) sequentially for multiple received event data, starting from the event data with the earliest reception time.

[0126] When the determination of all event data is completed (S108: Yes), the processing unit 20 of the vehicle-mounted device 2 determines whether the payload value of the last received event data is the same as that of the subsequently received periodic data (S109). When the determination of all event data (prediction processing) is completed, the processing unit 20 of the vehicle-mounted device 2 performs processing (reverse processing) to determine whether the payload value of the last received event data and the subsequently received periodic data is the same during the event transmission permission period.

[0127] If the payload values ​​are the same (S109: Yes), the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is normal (S110). If the payload values ​​are the same, that is, if the payload values ​​(all signal values) of the last received event data and the subsequent received periodic data are the same, the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is normal.

[0128] If the payload values ​​are different (S109: No), the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1091). If the payload values ​​are different, that is, if the payload value (a certain signal value) of the last received event data is different from the payload value (a certain signal value) of the subsequently received periodic data, the processing unit 20 of the vehicle-mounted device 2 determines that the event data to be judged is abnormal (abnormality detection (range). The processing unit 20 of the vehicle-mounted device 2 appends the judgment result for the event data to be judged to the reverse result field of the data receiving list.

[0129] For each event data that is subject to determination, the processing unit 20 of the vehicle-mounted device 2 derives a final determination result based on the prediction result and the reverse deduction result (S111). For each event data that is subject to determination, the processing unit 20 of the vehicle-mounted device 2 derives a final determination result based on the prediction result and the reverse deduction result in the data reception list. For event data that only has a prediction result among the event data that is subject to determination, the processing unit 20 of the vehicle-mounted device 2 derives that prediction result as the final determination result.

[0130] The processing unit 20 of the vehicle-mounted device 2, among the event data that becomes the judgment object, derives the final judgment result based on the combination of the prediction result and the reverse deduction result for the event data that has a prediction result and the reverse deduction result. For example, the processing unit 20 of the vehicle-mounted device 2 may also refer to the judgment table stored in the storage unit 21 and derive the final judgment result based on the combination of the prediction result and the reverse deduction result.

[0131] If both the prediction and reverse engineering results are normal (qualified), the processing unit 20 of the vehicle-mounted device 2 can also output that the event data is normal as the final judgment result. If both the prediction and reverse engineering results are abnormal (unqualified), the processing unit 20 of the vehicle-mounted device 2 can also output that the event data is abnormal (abnormality detection (specific)) as the final judgment result. If the prediction and reverse engineering results are different, the processing unit 20 of the vehicle-mounted device 2 can also output that the event data is abnormal (abnormality detection (range)) as the final judgment result.

[0132] The processing unit 20 of the vehicle-mounted device 2 can also save (append) the exported final judgment result to the data receiving list, and thus store it as log information in the storage unit 21. The processing unit 20 of the vehicle-mounted device 2 can also output the data receiving list stored as log information to the external server 100 or the display device 5.

[0133] The embodiments disclosed herein are illustrative in all respects and should not be considered restrictive. The scope of the invention is not as described above, but is defined by the claims and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0134] The multiple claims recited in the claims can be combined with each other regardless of the form of reference. The claims may also include multiple dependent claims that are subordinate to multiple claims. Even if multiple dependent claims are not recited, this does not limit the possibility of reciting multiple dependent claims that are subordinate to multiple dependent claims.

[0135] Label Explanation Vehicle C S vehicle in-vehicle system 100 external servers 1. External communication device 11 antennas 2. Vehicle-mounted device (vehicle-mounted relay device) 20. Processing Department (Control Department) 21 Storage Department P program (program product) M recording medium 22 Input / Output I / F 23. In-vehicle communication department 3. Vehicle ECU 4. In-vehicle network 41 Communication Line 5. Display device (HMI device) 6. IG switch.

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, wherein, The vehicle-mounted device includes a processing unit that performs processing related to determining whether the data flowing in the vehicle network is normal. The processing unit receives periodic data that is periodically transmitted through the vehicle network. When the processing unit receives event data of the same type as the periodic data between the reception time points of two consecutively received periodic data, it determines whether the event data is normal based on the payload value of the event data and the payload value of at least one of the two periodic data.

2. The vehicle-mounted device according to claim 1, wherein, If the difference between the payload value of the first received periodic data and the payload value of the event data in two consecutively received periodic data sets is below a predetermined value, the processing unit determines that the event data is abnormal. If the difference between the payload value of the previously received periodic data and the payload value of the event data exceeds a predetermined value, the processing unit determines that the event data is normal.

3. The vehicle-mounted device according to claim 1, wherein, If the difference between the payload value of the later received periodic data and the payload value of the event data in two consecutively received periodic data sets is below a predetermined value, the processing unit determines that the event data is normal. If the difference between the payload value of the first received data in two consecutively received cycles and the payload value of the event data is greater than a predetermined value, the processing unit determines that the event data is abnormal.

4. The vehicle-mounted device according to claim 1, wherein, When the processing unit receives multiple event data between the receiving time points of two consecutively received periodic data, it determines whether the multiple event data are normal based on the changes in the effective payload values ​​of each of the multiple event data.

5. The vehicle-mounted device according to claim 4, wherein, If the payload values ​​of two consecutively received event data sets among the plurality of event data sets do not change, the processing unit determines that at least one of the two consecutive event data sets is abnormal.

6. The vehicle-mounted device according to claim 1, wherein, If the processing unit determines that the later received periodic data in a series of continuously received periodic data is normal if the reception time of the later received periodic data is within the normal periodic range based on the reception time of the earlier received periodic data, then the processing unit considers the later received periodic data in a series of continuously received periodic data to be normal. The processing unit only determines whether the event data is normal based on the payload value if it determines that the received periodic data is normal.

7. The vehicle-mounted device according to claim 6, wherein, The normal cycle range is a range of upper and lower limits set based on the transmission cycle determined by the category of the data.

8. The vehicle-mounted device according to claim 7, wherein, If the processing unit fails to receive periodic data within the normal periodic range or receives multiple periodic data, it does not perform any determination processing related to the value of the payload of the event data, but instead determines that the event data is abnormal.

9. The vehicle-mounted device according to claim 7, wherein, The processing unit determines whether the value of the payload of the event data is within a normal range predetermined according to the category of periodic data. If the processing unit determines that the value of the event data's payload is within the normal range, it performs a judgment on whether the event data is normal based on a comparison with the value of the payload of the periodic data. If the processing unit determines that the value of the event data's payload is not within the normal range, it will not compare it with the value of the periodic data's payload, but will instead determine that the event data is abnormal.

10. The vehicle-mounted device according to claim 7, wherein, The processing unit determines whether the received event data is within an event data transmission prohibition period based on the received time of the first received periodic data in a series of consecutively received periodic data. If the processing unit determines that the time point at which the event data is received is not within the event data transmission prohibition period, it performs a determination process related to the value of the payload of the event data. If the processing unit determines that the time point for receiving the event data falls within the event data transmission prohibition period, it will not perform any determination processing related to the value of the event data's payload, but will instead determine that the event data is abnormal.

11. A program that causes a computer connected to an in-vehicle network to perform the following processing: Receive periodic data sent periodically through the vehicle network. If event data of the same type as the periodic data is received between the reception time points of two consecutively received periodic data, the normality of the event data is determined based on the payload value of the event data and the payload value of at least one of the two periodic data.

12. An information processing method that causes a computer connected to an in-vehicle network to perform the following processing: Receive periodic data sent periodically through the vehicle network. If event data of the same type as the periodic data is received between the reception time points of two consecutively received periodic data, the normality of the event data is determined based on the payload value of the event data and the payload value of at least one of the two periodic data.

Images