Abnormal vehicle detection server and abnormal vehicle detection method

Abstract

An abnormal vehicle detection server (10) includes: an abnormal score calculation unit (106) that, based on a plurality of vehicle information received from a plurality of vehicles respectively, which is based on a vehicle log including the content of an event that has occurred in a vehicle system (20) mounted on a vehicle, detects a suspicious behavior different from a prescribed driving behavior, and obtains, for each of the plurality of vehicles, an abnormal score indicating the possibility that the vehicle is being reverse-engineered; and an abnormal vehicle determination unit (108) that determines whether a vehicle is an abnormal vehicle based on the abnormal score of one vehicle among the plurality of vehicles and a statistical value of the abnormal scores of two or more vehicles among the plurality of vehicles.

Description

Technical Field

[0001] The present disclosure relates to an abnormal vehicle detection server and an abnormal vehicle detection method. Background Art

[0002] In recent years, multiple devices called electronic control units (hereinafter referred to as ECUs) have been installed in automobile systems. The network connecting these ECUs is called an in-vehicle network. There are multiple standards for in-vehicle networks, and one of the most mainstream in-vehicle networks is the Controller Area Network (hereinafter referred to as CAN (registered trademark, hereinafter the same)) standard. Furthermore, with the popularization of autonomous driving and connected cars, the amount of in-vehicle network communication is expected to increase, and in-vehicle Ethernet (registered trademark, hereinafter the same (hereinafter also referred to as Ethernet)) is becoming popular.

[0003] On the other hand, there are also reports of threats of intrusion into in-vehicle systems and unauthorized control of the vehicle. To address this threat, Non-Patent Document 1 discloses a method for preventing unauthorized control of communications by unauthorized nodes by leveraging encryption used in conventional Internet Protocol (IP) communications. Furthermore, Patent Document 1 discloses a method for detecting abnormal communications in an in-vehicle network and blocking unauthorized frames.

[0004] (Prior art literature)

[0005] (Patent Document)

[0006] Patent Document 1: Japanese Patent No. 5664799

[0007] (Non-patent literature)

[0008] Non-patent document 1: RFC5406: Guidelines for Specifying the Use of IPsec Version 2, February 2009

[0009] However, the method in Non-Patent Document 1 utilizes cryptographic communication, requiring encryption and decryption processing at both the transmitting and receiving nodes, resulting in overhead. Furthermore, key management for cryptographic communication becomes crucial. If ECU control is compromised or keys are leaked, illicit control can be achieved through the transmission of unauthorized frames. Furthermore, the method in Patent Document 1 does not prevent attacks by addressing exceptions caused by the transmission of unauthorized frames. Therefore, there is room for improvement in the security of in-vehicle networks. Summary of the Invention

[0010] Accordingly, the present disclosure provides a vehicle anomaly detection server and a vehicle anomaly detection method that can further improve the security of in-vehicle networks.

[0011] The vehicle anomaly detection server according to one aspect of the present disclosure includes: an anomaly score acquisition unit that detects suspicious behaviors different from a prescribed driving behavior based on a plurality of vehicle information respectively received from a plurality of vehicles, and obtains an anomaly score indicating the likelihood that reverse engineering is being performed on each of the plurality of vehicles, where the plurality of vehicle information is respectively vehicle information based on vehicle logs including the content of events occurring in vehicle systems; and an anomalous vehicle determination unit that determines whether one vehicle among the plurality of vehicles is an anomalous vehicle based on the anomaly score of one vehicle among the plurality of vehicles and a statistical value of the anomaly scores of two or more vehicles among the plurality of vehicles.

[0012] The vehicle anomaly detection method according to one aspect of the present disclosure includes: an anomaly score acquisition step of detecting suspicious behaviors different from a prescribed driving behavior based on a plurality of vehicle information respectively received from a plurality of vehicles, and obtaining an anomaly score indicating the likelihood that reverse engineering is being performed on each of the plurality of vehicles, where the plurality of vehicle information is respectively vehicle information based on vehicle logs including the content of events occurring in vehicle systems mounted on the vehicles; and an anomalous vehicle determination step of determining whether one vehicle among the plurality of vehicles is an anomalous vehicle based on the anomaly score of one vehicle among the plurality of vehicles and a statistical value of the anomaly scores of two or more vehicles among the plurality of vehicles.

[0013] According to the vehicle anomaly detection server and the like according to one aspect of the present disclosure, the security of in-vehicle networks can be further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is an overall configuration diagram of the anomalous vehicle detection system according to the embodiment.

[0015] Figure 2 is a configuration diagram of the vehicle system according to the embodiment.

[0016] Figure 3 is a configuration diagram of the anomalous vehicle detection server according to the embodiment.

[0017] Figure 4 is a configuration diagram of the vehicle log transmission device according to the embodiment.

[0018] Figure 5 is a diagram showing an example of the vehicle log according to the embodiment.

[0019] Figure 6 is a diagram showing an example of the anomaly rule according to the embodiment.

[0020] Figure 7 This is a diagram showing an example of the exclusion rule of the embodiment.

[0021] Figure 8 This is a diagram showing an example of the anomaly score of the embodiment.

[0022] Figure 9 This is a diagram showing an example of the countermeasure rule of the embodiment.

[0023] Figure 10 This is a diagram showing an example of the anomaly score list display screen of the embodiment.

[0024] Figure 11 This is a diagram showing an example of the anomaly area display screen of the embodiment.

[0025] Figure 12 This is a diagram showing an example of the anomaly hierarchy display screen of the embodiment.

[0026] Figure 13 This is a diagram showing the sequence of the vehicle log reception process of the embodiment.

[0027] Figure 14 This is a diagram showing the sequence of the process until the anomaly vehicle detection server of the embodiment receives and stores the exclusion rule from the exclusion rule sharing server.

[0028] Figure 15 This is a diagram showing the sequence of the anomaly score calculation process of the embodiment.

[0029] Figure 16 This is a diagram showing the sequence of the anomaly countermeasure process of the embodiment.

[0030] Figure 17 This is a diagram showing the sequence of the anomaly display process of the embodiment.

[0031] Figure 18 This is a flowchart of the vehicle anomaly score calculation process of the embodiment.

[0032] Figure 19 This is a flowchart of the anomaly score calculation process by vehicle type of the embodiment.

[0033] Figure 20 This is a flowchart of the anomaly score calculation process by region of the embodiment.

[0034] Figure 21 This is a flowchart of the anomaly vehicle judgment process of the embodiment.

[0035] Figure 22 This is a flowchart of the anomaly countermeasure process of the embodiment.

[0036] Figure 23 This is an example of a flowchart for exception countermeasure processing by exception category in an embodiment.

[0037] Figure 24 This is another example of a flowchart for exception countermeasure processing by exception category in an embodiment.

[0038] Figure 25 This is a flowchart for area attack stage determination processing in an embodiment.

[0039] Figure 26 This is a flowchart for vehicle model attack stage determination processing in an embodiment. Detailed Embodiment

[0040] (Process of obtaining the present disclosure)

[0041] Before describing the embodiments of the present disclosure and the like, the process that forms the basis for obtaining the present disclosure will be described.

[0042] As described above, from the viewpoint of improving the security of in-vehicle networks, there is room for improvement in the technologies disclosed in Patent Document 1 and Non-Patent Document 1.

[0043] Generally, an attacker who attempts to illegally control a vehicle performs reverse engineering of the in-vehicle network such as investigating frames used to cause illegal control of the vehicle in advance. If the activities of the attacker at the frame investigation stage of the in-vehicle network at this time can be grasped, actions such as obstructing the investigation of the attacker or intensively monitoring the target vehicle can be taken by regarding the frame investigation stage as an omen of an attack.

[0044] Therefore, the inventors of the present application intensively studied a vehicle anomaly detection server or the like that can grasp the activities of an attacker at the investigation stage of the in-vehicle network, and proposed a vehicle anomaly detection server or the like described below. For example, the inventors of the present application found the following situation: by monitoring the vehicle logs of multiple vehicles on a server, regarding vehicle behaviors different from the specified (e.g., normal) ones caused by the attacker's reverse engineering as suspicious behaviors, calculating an anomaly score indicating a high possibility that the vehicle is being reverse engineered, detecting a vehicle with an anomaly score higher than the statistical value (e.g., average value) of the anomaly scores of the same vehicle model, etc. as an abnormal vehicle, and executing countermeasures against the anomaly according to the value of the anomaly score and the anomaly category, the security of the in-vehicle network can be effectively improved.

[0045] An abnormal vehicle detection server according to an embodiment of the present disclosure includes: an abnormal score acquisition unit that detects a suspicious behavior different from a prescribed driving behavior based on a plurality of vehicle information respectively received from a plurality of vehicles, and obtains an abnormal score indicating the possibility that the vehicle is being reverse engineered for each of the plurality of vehicles, where the plurality of vehicle information is respectively vehicle information based on a vehicle log including the content of events occurring in a vehicle system; and an abnormal vehicle determination unit that determines whether the one vehicle is an abnormal vehicle based on the abnormal score of one vehicle among the plurality of vehicles and a statistical value of the abnormal scores of two or more vehicles among the plurality of vehicles.

[0046] Accordingly, it is possible to calculate the suspiciousness that the in-vehicle network system is being reverse engineered, and to identify more suspicious vehicles. Therefore, the security of the in-vehicle network system can be effectively improved.

[0047] Moreover, for example, the two or more vehicles may include vehicles of the same model as the one vehicle, and the abnormal vehicle determination unit compares the abnormal score of the one vehicle with the statistical value based on the abnormal scores of vehicles of the same model as the one vehicle, and determines whether the one vehicle is the abnormal vehicle according to the comparison result.

[0048] Accordingly, it is possible to exclude abnormalities that are likely to occur in a specific model, where the number of occurrences in other vehicles of the same model is small, and to extract more suspicious abnormalities and vehicles. Therefore, the security of the in-vehicle network system can be more effectively improved.

[0049] Moreover, for example, the two or more vehicles may include vehicles located in the same area as the one vehicle, and the abnormal vehicle determination unit compares the abnormal score of the one vehicle with the statistical value based on the abnormal scores of vehicles located in the same area as the one vehicle, and determines whether the one vehicle is the abnormal vehicle according to the comparison result.

[0050] Accordingly, it is possible to exclude abnormalities that are likely to occur in a specific area, where the number of occurrences in other vehicles located in the same area is small, and to extract more suspicious abnormalities and vehicles. Therefore, the security of the in-vehicle network system can be more effectively improved.

[0051] Also, for example, it can also be that the abnormal vehicle determination unit further determines that when the number of the abnormal vehicles is equal to or less than a specified number in the same vehicle model as the abnormal vehicle, i.e., the abnormal vehicle model, or in the area where the abnormal vehicle is detected, i.e., the abnormal area, the progress degree of the attack in the reverse engineering is determined as the first attack stage, and when the number of the abnormal vehicles is more than the specified number, it is determined as the second attack stage where the progress degree of the attack in the reverse engineering is more advanced than the first attack stage.

[0052] Accordingly, when an abnormality occurs in only a small number of vehicles equal to or less than the specified number, it can be determined that the attacker is in the first attack stage (e.g., the reconnaissance stage) during the process of analyzing the abnormal vehicle. When an abnormality occurs in more vehicles than the specified number, it can be determined that the attacker is in the second attack stage (e.g., the delivery stage where the attacker has successfully analyzed the vehicle's network and system and attempts to apply the attack to other vehicles). If the attack stage can be determined, the means of countermeasures can be switched and the priority of analysis can be changed.

[0053] Also, for example, it can also be that the abnormal score acquisition unit calculates the abnormal score according to the event content included in the vehicle log, detects any one of the frequent connection of network devices, abnormal Internet connection, frequent diagnostic instructions, change of access destination address, and change of access source address determined according to the event content as the suspicious behavior, and when the suspicious behavior is detected, determines the suspicious behavior as a network analysis activity and increases the abnormal score of the one vehicle.

[0054] Accordingly, the situation where the attacker attempts to analyze the communication function of the vehicle system can be grasped, and thus the security of the in-vehicle network system can be more effectively improved.

[0055] Also, for example, it can also be that when the abnormal score acquisition unit determines the suspicious behavior as the network analysis activity, the abnormal countermeasure notification unit executes any one or more of blocking the network interface, restricting the access destination and access source addresses, restricting the number of connections of the network device, and warning the driver according to the value of the abnormal score.

[0056] Accordingly, the situation where the attacker attempts to analyze the communication function of the vehicle system can be obstructed, and thus the security of the in-vehicle network system can be more effectively improved.

[0057] Furthermore, for example, the abnormality score obtaining unit may calculate the abnormality score based on the event content included in the vehicle log, and detect any one of the frequent occurrence of vehicle control functions, frequent occurrence of system errors, deletion of system errors, frequent occurrence of fault codes, system logins, and changes in the number of files or processes determined based on the event content as the suspicious behavior. When the suspicious behavior is detected, the suspicious behavior is determined to be a system analysis activity, thereby increasing the abnormality score of the vehicle.

[0058] This makes it possible to understand situations in which attackers attempt to analyze the vehicle control functions of the vehicle system or the host itself, thereby more effectively improving the security of the in-vehicle network system.

[0059] Furthermore, for example, when the abnormality score obtaining unit determines that the suspicious behavior is the system analysis activity, the abnormality countermeasure notification unit may, according to the value of the abnormality score, execute any one or more of the starting and stopping of the vehicle control function, increasing the frequency of sending the vehicle log, increasing the number of types of the vehicle log, and warning the driver.

[0060] This prevents attackers from attempting to analyze the vehicle control functions of the vehicle system or the status of the host itself, thereby more effectively improving the security of the in-vehicle network system.

[0061] Furthermore, for example, the abnormality score obtaining unit may not increase the abnormality score even if the suspicious behavior is detected, if the suspicious behavior is detected again within a specified period based on the time when the suspicious behavior was detected, or if the suspicious behavior is detected in a specified area.

[0062] Based on this, it is possible to prevent false detections caused by suspicious behavior detection, such as situations where developers cause suspicious behavior to occur for the purpose of verifying the vehicle system, situations where maintenance providers perform incorrect removals, and situations where the number of files changes due to software updates of the vehicle system. Therefore, the accuracy of suspicious behavior detection can be effectively improved.

[0063] Furthermore, for example, the abnormality score obtaining unit may not reduce the abnormality score if the suspicious behavior is not detected again in the vehicle that detected the suspicious behavior within a predetermined period based on the time when the suspicious behavior was detected.

[0064] Based on this, it can be considered that the attacker has a low possibility of using the target vehicle for normal driving. Therefore, if no suspicious behavior occurs after temporarily driving normally, it can be considered that the possibility of it being the target vehicle is low, thereby effectively improving the accuracy of determining whether it is the target vehicle.

[0065] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal countermeasure notification unit, and the abnormal countermeasure notification unit requests any one or more of the following countermeasures for the vehicle determined by the abnormal vehicle determination unit to be an abnormal vehicle, based on the value of the abnormal score or the category of the suspicious behavior: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver.

[0066] Accordingly, for a vehicle with a high suspicion of an attacker's reverse engineering activity, it is possible to restrict the vehicle control function to hinder the attacker's analysis and increase the number of types of vehicle logs to analyze the attack content, and it is possible to effectively hinder the attacker's analysis and grasp the attacker's attack content.

[0067] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal countermeasure notification unit, and the abnormal countermeasure notification unit, when the abnormal vehicle determination unit determines that the abnormal vehicle model is in the second attack stage, requests any one or more of the following based on the value of the abnormal score or the category of the suspicious behavior: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver for vehicles of the same model as the vehicle determined to be an abnormal vehicle.

[0068] Accordingly, for a vehicle model with a high suspicion of an attacker's reverse engineering activity, it is possible to restrict the vehicle control function to hinder the attacker's analysis and increase the number of types of vehicle logs to analyze the attack content, and it is possible to effectively hinder the attacker's analysis and grasp the attacker's attack content.

[0069] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal countermeasure notification unit. When the abnormal vehicle determination unit determines that the abnormal vehicle in the abnormal area is in the second attack stage, the abnormal countermeasure notification unit requests any one or more of the following actions for vehicles other than the abnormal vehicle located in the abnormal area, based on the value of the abnormal score or the category of the suspicious behavior: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, restriction of network connection, restriction of vehicle control functions, start / stop of vehicle control functions, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver.

[0070] Accordingly, for an area with a high suspicion of the attacker's reverse engineering activities, it is possible to restrict vehicle control functions to hinder the attacker's analysis, and increase the number of types of vehicle logs to analyze the attack content, thus effectively hindering the analysis of the attacker and grasping the attacker's attack content.

[0071] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal display unit that displays a list of the abnormal vehicles in descending order of the abnormal score.

[0072] Accordingly, by confirming the display content of the abnormal display unit to analyze the operator of the abnormal vehicle, it is possible to prioritize the analysis of more suspicious vehicles, and thus effectively carry out the analysis work.

[0073] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal display unit that displays the location information of the vehicle determined to be the abnormal vehicle on a map.

[0074] Accordingly, by confirming the display content of the abnormal display unit to analyze the operator of the abnormal vehicle, it is possible to determine which area the abnormal vehicle is located in and where the abnormality occurred in which facility, which can be used as a clue for analysis, and thus effectively carry out the analysis work.

[0075] Also, for example, it may be that the abnormal vehicle detection server further includes an abnormal display unit. When the abnormal vehicle determination unit determines that the abnormal vehicle model is in the first attack stage, the abnormal display unit displays at least one of the vehicle, vehicle model, and location information of the vehicle determined to be the abnormal vehicle. When it is determined to be in the second attack stage, it displays a level with a higher progress degree of the attack than the first attack stage.

[0076] Accordingly, by confirming the display content of the abnormal display unit to analyze the operator of the abnormal vehicle, it is possible to grasp the progress degree of the attack on the abnormal vehicle and determine the priority of analysis, and thus effectively carry out the analysis work.

[0077] Moreover, an abnormal vehicle detection method according to an embodiment of the present disclosure includes: an abnormal score obtaining step of detecting a suspicious behavior different from a prescribed driving behavior based on a plurality of vehicle information respectively received from a plurality of vehicles, and obtaining, for each of the plurality of vehicles, an abnormal score indicating the possibility that the vehicle is being reverse engineered, where the plurality of vehicle information is respectively vehicle information based on a vehicle log including the content of an event occurring in a vehicle system mounted on the vehicle; and an abnormal vehicle determination step of determining whether the one vehicle is an abnormal vehicle based on the abnormal score of one vehicle among the plurality of vehicles and a statistical value of the abnormal scores of two or more vehicles among the plurality of vehicles.

[0078] Accordingly, the same effect as that of the abnormal vehicle detection server is obtained.

[0079] Hereinafter, with reference to the drawings, an abnormal vehicle detection system according to an embodiment of the present disclosure will be described. Moreover, each of the embodiments described below shows a preferred specific example of the present disclosure. That is, the numerical values, shapes, materials, constituent elements, arrangements and connection forms of the constituent elements, steps, and the order of steps shown in the following embodiments are examples of the present disclosure and do not limit the gist of the present disclosure. The present disclosure is determined according to the description of the embodiments. Therefore, among the constituent elements of the following embodiments, the constituent elements not described in the embodiment showing the uppermost concept of the present disclosure are not necessarily required to achieve the problems of the present disclosure, but are described as constituent elements for constructing a more preferred form.

[0080] Moreover, each figure is a schematic diagram and is not necessarily a precisely shown figure. Also, in each figure, the same reference numerals are attached to actually identical structures, and there may be cases where repeated descriptions are omitted or simplified.

[0081] (Embodiment)

[0082] [1 Overall Structure Diagram of Abnormal Vehicle Detection System]

[0083] Figure 1 is a diagram showing the overall structure of the abnormal vehicle detection system of the present embodiment. As Figure 1It is shown that the abnormal vehicle detection system includes an abnormal vehicle detection server 10, a vehicle system 20, and an exclusion rule sharing server 30. Also, in the abnormal vehicle detection system, the abnormal vehicle detection server 10, the exclusion rule sharing server 30, and the vehicle system 20 are connected via an external network in a communicable manner. The external network is, for example, the Internet. The communication method of the external network can be wired or wireless. Also, the wireless communication method can be Wi-Fi (registered trademark), or 3G / LTE (Long Term Evolution) as existing technologies, but it is not limited thereto.

[0084] The vehicle system 20 is mounted on a vehicle and includes a vehicle log sending device 200. The vehicle log sending device 200 is a communication device that sends vehicle logs to the abnormal vehicle detection server 10 via an external network. The vehicle logs will be described in detail later. Also, Figure 1 it is shown that in the case where the abnormal vehicle detection system includes only one vehicle system 20, vehicle logs can also be sent from each of one or more vehicle systems 20 to the abnormal vehicle detection server 10. The abnormal vehicle detection system can also include, for example, a plurality of vehicle systems 20.

[0085] The exclusion rule sharing server 30 is a server that sends the exclusion rules used by the abnormal vehicle detection server 10 to the abnormal vehicle detection server 10. The exclusion rules are, for example, created by the developer of the vehicle system 20 and uploaded to the exclusion rule sharing server 30. The exclusion rules include a list of software updates of the vehicle system 20, or a list of dealers, development bases, verification bases, repair shops, etc. It is recorded in the exclusion rules that at least one of the exclusion rules, its period, and location information that are to be excluded when the abnormal vehicle detection server 10 refers to the event content of the vehicle log and the abnormal rules to calculate the abnormal score. The exclusion rules will be described in detail later.

[0086] The abnormal vehicle detection server 10 receives vehicle logs from the vehicle log sending device 200 and receives exclusion rules from the exclusion rule sharing server 30. Also, the abnormal vehicle detection server 10 is a server that calculates an abnormal score for each vehicle and detects abnormal vehicles based on the vehicle logs, the exclusion rules, and the abnormal rules that are pre-stored and record the conditions for determining that the vehicle logs are abnormal. The calculation method of the abnormal score and the determination method of abnormal vehicles will be described in detail later.

[0087] Moreover, regarding the calculation of the anomaly score, an example of the operation performed by the anomaly vehicle detection server 10 will be described below. However, the calculation may also be performed by the vehicle system 20. The anomaly vehicle detection server 10 may also obtain the anomaly score of the vehicle system 20 from the vehicle system 20 via an external network. The vehicle log or anomaly score obtained by the anomaly vehicle detection server 10 from the vehicle system 20 via the external network is an example of vehicle information based on the vehicle log.

[0088] [Structural diagram of the vehicle system]

[0089] Figure 2 This is a structural diagram of the vehicle system 20 of the present embodiment. The vehicle system 20 includes a vehicle log transmission device 200, a central ECU 300, Zone ECUs 400a, 400b, 400c, 400d, a body ECU 500a, a car navigation ECU 500b, a steering ECU 500c, and a brake ECU 500d. The vehicle log transmission device 200, the central ECU 300, Zone ECUs 400a, 400b, 400c, and 400d are connected via Ethernet 13, which is an in-vehicle network. The body ECU 500a and the Zone ECU 400a are connected via Ethernet 11. Also, the car navigation ECU 500b and the Zone ECU 400b are connected via Ethernet 12. Further, the steering ECU 500c and the Zone ECU 400c are connected via CAN 14. Additionally, the brake ECU 500d and the Zone ECU 400d are connected via CAN-FD (CAN with Flexible Data Rate) 15. The vehicle log transmission device 200 and the central ECU 300 are also connected to an external network.

[0090] The vehicle log transmission device 200 is a device that collects vehicle logs from the central ECU 300 via Ethernet 13 and transmits the collected vehicle logs to the anomaly vehicle detection server 10 via an external network.

[0091] The central ECU 300 controls the Zone ECUs 400a, 400b, 400c, and 400d via Ethernet 13 and controls the entire vehicle system 20. For example, the central ECU 300 controls vehicle control functions such as automatic parking and autonomous driving. Also, the central ECU 300 collects event information such as connection anomalies of network devices or Internet connection anomalies that occur within the vehicle system 20 from the Zone ECUs 400a to 400d, stores the collected event information as vehicle logs, and transmits the vehicle logs to the vehicle log transmission device 200.

[0092] ZoneECU400a, ZoneECU400b, ZoneECU400c, and ZoneECU400d communicate with the central ECU300 and other ZoneECUs via Ethernet 13. For example, ZoneECU400a communicates with the body ECU500a via Ethernet 11 to control body-related functions such as vehicle locks and wipers. Also, ZoneECU400b communicates with the car navigation ECU500b via Ethernet 12 to control the display of the car navigation. For example, ZoneECU400c communicates with the steering ECU500c via CAN 14 to control the steering of the steering gear. And ZoneECU400d communicates with the brake ECU500d via CAN-FD 15 to control the brakes.

[0093] The body ECU500a controls functions related to the vehicle body mounted on the vehicle.

[0094] The car navigation ECU500b controls the display of the car navigation mounted on the vehicle.

[0095] The steering ECU500c controls the steering of the steering gear mounted on the vehicle.

[0096] The brake ECU500d controls the brakes mounted on the vehicle.

[0097] [Structure diagram of the abnormal vehicle detection server 10]

[0098] Figure 3 It is the structure diagram of the abnormal vehicle detection server 10 of the present embodiment. The abnormal vehicle detection server 10 includes a server-side communication unit 101, a vehicle log receiving unit 102, a vehicle log storage unit 103, an exception rule receiving unit 104, a rule storage unit 105, an abnormal score calculation unit 106, an abnormal score storage unit 107, an abnormal vehicle determination unit 108, an abnormal countermeasure notification unit 109, and an abnormal display unit 110.

[0099] The server-side communication unit 101 receives vehicle logs from the vehicle log sending device 200 via the external network and sends them to the vehicle log receiving unit 102. Also, it receives exception rules from the exception rule sharing server 30 and sends the received exception rules to the exception rule receiving unit 104.

[0100] The vehicle log receiving unit 102 receives vehicle logs from the server-side communication unit 101 and stores the received vehicle logs in the vehicle log storage unit 103.

[0101] The exclusion rule receiving unit 104 receives exclusion rules from the server-side communication unit 101 and stores the received exclusion rules in the rule storage unit 105.

[0102] The rule storage unit 105 pre-stores an anomaly rule that describes the conditions for determining that a certain event included in the vehicle log is abnormal, and a countermeasure rule that describes the anomaly category described in the anomaly rule and the countermeasure content corresponding to the anomaly score. In addition, the rule storage unit 105 stores the exclusion rules received by the exclusion rule receiving unit 104 from the exclusion rule sharing server 30.

[0103] When receiving a vehicle log, the anomaly score calculation unit 106 obtains the anomaly rule and the exclusion rule from the rule storage unit 105, and calculates the anomaly score for each vehicle based on the event content, anomaly rule, and exclusion rule recorded in the vehicle log, thereby obtaining the anomaly score for each vehicle. For example, the anomaly score calculation unit 106 detects suspicious behaviors different from the specified driving behavior based on the vehicle information of the vehicle log, which is data based on the event content occurring in the vehicle system 20 and is the event content of multiple vehicle information received from multiple vehicles respectively, and obtains an anomaly score indicating the possibility that the vehicle is being reverse-engineered for each of the multiple vehicles. For example, the anomaly score calculation unit 106 calculates the anomaly score based on the event content included in the vehicle log. Moreover, the anomaly score calculation unit 106 records the obtained (e.g., calculated) anomaly score in the anomaly score storage unit 107. The calculation method of the anomaly score will be described in detail later. The anomaly score calculation unit 106 is an example of the anomaly score obtaining unit.

[0104] The anomaly score is, for example, an index indicating the possibility of being reverse-engineered (e.g., the suspiciousness of the attacker being reverse-engineered). In addition, the anomaly score is, for example, an index that can judge the possibility of being reverse-engineered. Moreover, it can also be said that the anomaly score is, for example, an index indicating the utilization of the vehicle that a normal driver would not perform or the possibility of performing is low. In this specification, reverse engineering is the analysis of in-vehicle networks. Therefore, it can also be said that the anomaly score is, for example, an index indicating the possibility or degree of analysis of the in-vehicle network of the vehicle.

[0105] The abnormal vehicle determination unit 108 detects an abnormal vehicle estimated to be under an attempted attack with reference to the abnormal scores stored in the abnormal score storage unit 107. The abnormal vehicle determination unit 108 determines whether a vehicle is an abnormal vehicle, for example, based on the abnormal score of one vehicle among multiple vehicles and the statistical value of the abnormal scores of two or more vehicles among the multiple vehicles, thereby detecting the abnormal vehicle. Further, the abnormal vehicle determination unit 108 determines the attack stage based on the information of the abnormal vehicle (e.g., vehicle information). The method for detecting the abnormal vehicle and the method for determining the attack stage will be described in detail later. Also, the two or more vehicles may include vehicles of the same model as the one vehicle determined to be an abnormal vehicle, and may include vehicles located in the same area as the one vehicle. Further, the two or more vehicles may include vehicles equipped with the same ECU as the one vehicle, may include vehicles of the same provider (the same manufacturer) as the one vehicle, and may include vehicles that perform wireless communication using the same base station as the one vehicle. Moreover, the two or more vehicles may or may not include the one vehicle.

[0106] The abnormal countermeasure notification unit 109 sends an abnormal countermeasure notification to at least one vehicle among the vehicle determined by the abnormal vehicle determination unit 108 to be an abnormal vehicle, vehicles of the same model as the abnormal vehicle, and vehicles located in the same area as the abnormal vehicle. The abnormal countermeasure notification is, for example, a notification including any one or more of the following countermeasures: blocking of the network interface, restriction of the addresses of the access destination and access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver. When the suspicious behavior is determined to be a network analysis activity or a system analysis activity, the abnormal countermeasure notification unit 109 notifies the vehicle log transmission device 200 or the central ECU 300 of the vehicle system 20, thereby causing the vehicle system 20 to execute any one or more of the above countermeasures.

[0107] The abnormal display unit 110 displays information related to at least one vehicle among the vehicle determined by the abnormal vehicle determination unit 108 to be an abnormal vehicle, vehicles of the same model as the vehicle (abnormal vehicle), and vehicles located in the same area as the vehicle (abnormal vehicle) to the user. For example, the operator who analyzes using the abnormal vehicle detection server 10 is the user, and the abnormal display unit 110 displays the information using a graphical user interface. The information includes the information capable of identifying the abnormal vehicle that the user focuses on monitoring.

[0108] [Structure diagram of the vehicle log transmission device]

[0109] Figure 4It is a structural diagram of the vehicle log transmission device 200 of the present embodiment. The vehicle log transmission device 200 includes a vehicle-side communication unit 210, a vehicle log transmission unit 220, and an abnormality countermeasure unit 230.

[0110] The vehicle-side communication unit 210 is connected to the abnormal vehicle detection server 10 via an external network to exchange various information.

[0111] The vehicle log transmission unit 220 is connected to the central ECU 300 via Ethernet 13, receives vehicle logs from the central ECU 300, and transmits the received vehicle logs to the abnormal vehicle detection server 10 via the vehicle-side communication unit 210.

[0112] When the abnormal vehicle detection server 10 detects an abnormal vehicle, the abnormality countermeasure unit 230 receives an abnormality countermeasure notification sent by the abnormal vehicle detection server 10, and according to the content of the received abnormality countermeasure notification, instructs a countermeasure to the central ECU 300 or the vehicle log transmission unit 220. For example, when the content of the countermeasure notification is a vehicle control function limit, the abnormality countermeasure unit 230 instructs the central ECU 300 to limit the function, and when the content of the countermeasure notification is an increase in the transmission frequency of vehicle logs, the abnormality countermeasure unit 230 instructs the vehicle log transmission unit 220 to increase the transmission frequency.

[0113] [An example of a vehicle log]

[0114] Figure 5 It is an example of the vehicle log stored in the vehicle log storage unit 103 of the present embodiment. The vehicle log is the content of an event that occurs within the vehicle system 20, and this vehicle log is used when the abnormal score calculation unit 106 calculates an abnormal score. The vehicle log is composed of a vehicle log number, a vehicle identifier, a vehicle model, a time, vehicle position information, and an event name for each event. Figure 5 It shows that in the row where the vehicle log number is 1, the vehicle identifier corresponding to the vehicle one-to-one is "A1", the vehicle model indicating the vehicle model is "A", the time indicating the event occurrence time is "TA11", the vehicle position information indicating the position of the vehicle at the time of the event is "X1, Y1", and the event name is "Network device registration". For example, the vehicle position information is the position information of the vehicle at the time of the event obtained using GPS information. Network device registration and network device deletion are, for example, events where a smartphone is connected to or deleted from the car navigation ECU 500b via Bluetooth (registered trademark). Or, network device registration and network device deletion are, for example, events where a tablet device is connected to or deleted from the car navigation ECU 500b via Wi-Fi.

[0115] Furthermore, the vehicle control function operation is an event for controlling the function operation of the vehicle system 20 , such as an emergency brake operation or activation of an automatic parking mode.

[0116] Furthermore, a system error occurs when an error occurs in the central ECU 300 or the Zone ECUs 400a to 400d, or a network error occurs on the Ethernet 13, Ethernet 11, Ethernet 12, CAN 14, or CAN-FD 15. Furthermore, a system error is resolved when a system error is resolved using a vehicle diagnostic tool used by a dealer or the like.

[0117] Furthermore, the access to address A is an event in which the car navigation ECU 500b accesses the web server at address A.

[0118] Furthermore, an access from address B is an event in which the server at address B accesses the car navigation ECU 500b.

[0119] Furthermore, the system login is an event in which a login attempt is made to the car navigation ECU 500b.

[0120] An increase in the number of files is an event in which the number of types of files stored in central ECU 300 increases.

[0121] That is to say, in Figure 5 In the example, referring to the row with the same vehicle identifier and event name of network device registration and the row with event name of network device deletion, it is known that between time TA11 and TA12, one network device was connected and then reduced by one.

[0122] Then, by referring to the row with the same vehicle identifier and event name of Internet disconnection and the row with the event name of Internet connection that occurred most recently, the Internet disconnection time can be obtained based on the time difference. The same applies to VPN (Virtual Private Network) disconnection and VPN connection.

[0123] Furthermore, referring to the vehicle log lines 7 and 8, we know that emergency braking was initiated at time TA23 in the area "X1, Y3" and at time TA24 in the area "X1, Y4." Later, vehicle location information may be represented as areas. Areas can be pre-defined on a map (static areas) or defined based on the location of the abnormal vehicle (dynamic areas).

[0124] Furthermore, referring to the event named "access to address A" and the event named "access to address B", it is known that the car navigation ECU 500b accessed address 2, and thus the change in the access destination address can be obtained.

[0125] Moreover, by referring to multiple events whose names indicate an increase in the number of files or processes, it is possible to obtain the change in the number of files or processes. The event name is an example of the event content.

[0126] Moreover, by referring to the time information included in the vehicle log, it is possible to determine whether it is consistent with an anomaly rule for adding an anomaly score when a certain event occurs a specified number of times within a specified period.

[0127] [An example of an anomaly rule]

[0128] Figure 6 This is an example of the anomaly rule stored in the rule storage unit 105 of the present embodiment. The anomaly rule includes an anomaly rule number, anomaly rule content, period, number of times, anomaly score, and anomaly category. The occurrence of the suspicious behavior shown in the anomaly rule content can be determined based on the vehicle log (e.g., event name, etc.).

[0129] In Figure 6 in the row with the rule number "1", the rule content is "Network device connection", the period is "1 hour", the number of times is "4", the anomaly score is "+1", and the anomaly category is "Network analysis". In Figure 6 it is recorded that, for example, based on the vehicle log, the number of network connections within 1 hour is obtained, and if it is 4 times or more, the anomaly score is set to "+1". Also, the period "-" indicates that the period is not considered. For example, in the row with the anomaly rule number 8, it is recorded that based on the vehicle log, the number of system logins is obtained, and if it is 1 time or more, the anomaly score is set to "+5".

[0130] The network device connection increases when an attacker attempts to connect a terminal such as a smartphone to the vehicle system 20 to intrude, so a connection of 4 times in 1 hour is determined to be abnormal.

[0131] The Internet or VPN disconnection occurs when an attacker listens to the communication between the vehicle system 20 and the server connected to the vehicle system 20, or when the attacker deliberately cuts off the connection for fear of being discovered, so an occurrence of 1 time in 10 minutes is determined to be abnormal.

[0132] The change in the access destination address changes when an attacker attempts to make the vehicle system 20 access a malicious URL, so as an example, 1 time is determined to be abnormal.

[0133] The change in the access source address changes when an attacker attempts an attack such as port scanning on the vehicle system 20, so 1 time is determined to be abnormal.

[0134] The vehicle control function is activated when the attacker activates the emergency brake multiple times while investigating the activation command of the emergency brake. Therefore, the occurrence of 10 times per hour is determined to be abnormal.

[0135] A system error occurs when an attacker performs a brute force attack on the vehicle system 20 and an erroneous communication occurs. Therefore, occurrence of a system error twice in 24 hours is determined to be abnormal.

[0136] The system error cancellation occurs when a system error is generated by an attacker and the system error is automatically cleared using a vehicle diagnostic tool or the like. Therefore, it is judged as an abnormality once.

[0137] System login occurs when an attacker attempts to log in as a user to the vehicle system 20 , and therefore is determined to be abnormal once.

[0138] The change in the number of files or the number of processes is caused by an attacker installing malware into the vehicle system 20 , and therefore is determined to be abnormal once.

[0139] The anomaly type specifies either network analysis or system analysis. Network analysis indicates a high probability that an attacker has analyzed the communication functions of vehicle system 20. Network analysis indicates a high probability that an attacker has analyzed the host computer of vehicle system 20. The anomaly type is used to select an effective anomaly countermeasure during anomaly countermeasures.

[0140] The anomaly score calculation unit 106 may also, for example, detect any one of the following as suspicious behavior: frequent network device connections, abnormal internet connections, frequent diagnostic command transmissions, changes in access destination addresses, or changes in access source addresses. If such suspicious behavior occurs, the unit may determine that the activity is a network analysis activity and increase the anomaly score for the vehicle. Furthermore, the anomaly score calculation unit 106 may also detect any one of the following as suspicious behavior: frequent vehicle control functions, frequent system errors, deletion of system errors, frequent fault codes, system logins, or changes in the number of files or processes. If such suspicious behavior occurs, the unit may determine that the activity is a system analysis activity and increase the anomaly score for the vehicle.

[0141] and, Figure 6 The exception rules shown are just one example and are not limited to this. Figure 6 The periods, times, and numerical values of abnormality scores shown are examples and are not limited thereto.

[0142] [An example of the 7-exclusion rule]

[0143] Figure 7 This is an example of the exclusion rule stored in the rule storage unit 105 of this embodiment. Figure 7For each exception rule, the exception rule number, location information, effective period, content, and exception rule of the exception object are recorded.

[0144] exist Figure 7 In the row with exception rule number "3," the location information is "X6, Y6," the expiration date is "-" indicating no setting, the content is "Repairman A," and the exception rule is "System Error Resolved." This indicates that repairman A exists at location information X6, Y6, and there's a possibility that repairman A will resolve the system error using specialized tools. Therefore, the exception rule does not consider this system error resolver an exception, and no exception score is calculated.

[0145] And, in Figure 7 In the row with exception rule number "4," the location information is "Japan," the validity period is "T3 to T4," the content is "Software Update A," and the exception rule is "Change in the Number of Files or Processes." This indicates that a software update to vehicle system 20 occurred between the validity period T3 and T4, which may have increased the number of files. Therefore, the change in the number of files or processes is not considered abnormal, and no abnormality score is calculated.

[0146] And shows that in Figure 7 It can be seen in the row of exclusion rule number M that there is a tunnel in the area shown in the location information X4, Y4. Therefore, there is a possibility that the Internet or VPN is disconnected not by the attacker. Therefore, even if the Internet or VPN is disconnected, it is not judged as an abnormality and the abnormality score is not counted.

[0147] [An example of 8 anomaly scores]

[0148] Figure 8 This is an example of anomaly scores stored in the anomaly score storage unit 107 of this embodiment. Anomaly scores are calculated by the anomaly score calculation unit 106 using vehicle logs, anomaly rules, and exclusion rules. Anomaly scores include a vehicle-specific anomaly score, the average of the anomaly scores for each vehicle model, and a region-specific average anomaly score. Furthermore, anomaly scores can be calculated using at least the vehicle log and anomaly rules.

[0149] In the vehicle anomaly score, the anomaly score is calculated for each anomaly rule number. The method for calculating the anomaly score will be described later. For example, in the row where the anomaly rule number is 2, it is shown that the anomaly score of the vehicle with the vehicle identifier A1 is 1. Also, in the vehicle anomaly score, for each vehicle, the occurrence time of the event finally determined to be an anomaly, that is, the last anomaly date and time, is stored. By confirming the last anomaly date and time, for a specific vehicle, the period during which no anomaly has occurred can be obtained. Therefore, for a vehicle that the attacker does not attack, that is, a vehicle for which no anomaly has occurred during a certain period, the anomaly score can be reduced.

[0150] In the average anomaly score by vehicle type, the anomaly score is calculated for each anomaly rule number and vehicle type, including the average value for each vehicle type. For example, in the row where the anomaly rule number is 1, it is shown that the average anomaly score of vehicle type A is 0.

[0151] In the average anomaly score by region, the anomaly score is calculated for each anomaly rule number and vehicle type, including the average value for each region. For example, in the row where the anomaly rule number is 6, it is shown that the average anomaly score of the region indicated by the location information X2, Y2 is 0.5.

[0152] [An example of a countermeasure rule]

[0153] Figure 9 This is an example of the countermeasure rule stored in the rule storage unit 105 of the present embodiment. The countermeasure rule includes a countermeasure rule number, an anomaly category, an anomaly score, and countermeasure rule content. The anomaly countermeasure notification unit 109 refers to the anomaly score of the vehicle determined to be an anomaly, obtains the anomaly category of the anomaly rule with the highest anomaly score, and the value of the anomaly score of this anomaly category, selects a countermeasure rule according to the anomaly category and the value of the anomaly score, and notifies the countermeasure rule content to the anomaly countermeasure unit 230.

[0154] The anomaly countermeasure notification unit 109, for example, when the anomaly category is network analysis and the anomaly score is 25, selects "restrict the access destination and the access source address" in the countermeasure rule content.

[0155] According to the magnitude of the value of the anomaly score, the possibility of the attacker attempting an attack can be grasped. According to Figure 9 the selected countermeasure rule, the greater the anomaly score, the more countermeasures that can hinder the attacker's attack attempt can be executed. The smaller the anomaly score, the lower the possibility of the attacker's attack attempt. Therefore, countermeasures can be executed within the range that does not affect the normal use of the vehicle system 20.

[0156] "Cut off the network interface" is a countermeasure that makes the interface with the external network unusable and completely cuts off the Internet connection.

[0157] "Restricting the access destination and the access source address" is a countermeasure that restricts the addresses of the access destinations on the Internet to a part and restricts the access source addresses and ports to a part, thereby preventing the attacker's network analysis.

[0158] "Restricting the number of network-connected devices" is a countermeasure that restricts the number of network-connected devices to a small number, thereby preventing network analysis such as brute-force attacks on WiFi passwords.

[0159] "Stopping the vehicle control function" is a countermeasure that, for example, stops the activation of the automatic parking mode or emergency braking itself, thereby preventing the attacker's system analysis.

[0160] "Increasing the transmission frequency of vehicle logs" is a countermeasure that, when the vehicle logs are stable and are transmitted once an hour, changes to be transmitted once every 10 minutes, that is, increases the transmission frequency of vehicle logs, thereby more detailedly grasping the situation of the attacker's system analysis.

[0161] "Increasing the number of types of vehicle logs" is a countermeasure that, when the vehicle logs are stable and there are two types, changes to five types, that is, increases the number of types of vehicle logs, thereby more detailedly grasping the situation of the attacker's system analysis.

[0162] "Warning to the driver" is a countermeasure that, in the case of an attacker, notifies the situation of monitoring the vehicle system, thereby preventing subsequent analysis.

[0163] As Figure 9 shown, the anomaly countermeasure notification unit 109, for example, when it is determined that the suspicious behavior is a network analysis activity, executes any one or more of blocking the network interface, restricting the access destination and the access source address, restricting the number of network-connected devices, and warning the driver according to the value of the anomaly score. And the anomaly countermeasure notification unit 109, for example, when it is determined that the suspicious behavior is a system analysis activity, executes any one or more of starting and stopping the vehicle control function, increasing the transmission frequency of vehicle logs, increasing the number of types of vehicle logs, and warning the driver according to the value of the anomaly score.

[0164] [An example of the anomaly score list display screen]

[0165] Figure 10This is an example of the abnormal score list display screen displayed by the abnormality display unit 110 of the present embodiment. The abnormality display unit 110 displays vehicle identifiers in descending order of abnormal scores, for example, on the abnormal score list display screen. The abnormality display unit 110 may also display abnormal vehicles in a list in descending order of abnormal scores, for example. Accordingly, the operator using the abnormal vehicle detection server 10 can easily find vehicles more suspected of being attacked and can preferentially analyze vehicle logs. Moreover, on the abnormal score list display screen, the vehicle identifiers are not limited to being displayed in descending order of abnormal scores.

[0166] [11 An example of the abnormal score map display screen]

[0167] Figure 11 This is an example of the display screen of the abnormal score map displayed by the abnormality display unit 110 of the present embodiment. On this screen, a map is displayed, and latitudes X2, X3, X4 and longitudes Y2, Y3, Y4 are displayed on the map. Moreover, the situation where the abnormal vehicle exists at the latest position, that is, the position information X4, Y4 of the vehicle determined to be an abnormal vehicle is displayed on the map. And the area where the vehicle determined to be an abnormal vehicle exists, for example, X3, Y3, is displayed as an abnormal area on the map. For example, the abnormal area may be a static or dynamic area including the location where the abnormal vehicle is determined to be abnormal. Figure 11 It shows that, for example, at the position shown by the position information X3, Y3, the vehicle is determined to be abnormal, and the abnormal vehicle determined to be abnormal moves to the position shown by the position information X4, Y4. The abnormal area and the position of the latest abnormal vehicle may be different positions on the map. Thus, the abnormality display unit 110 may also display the position information of the vehicle determined to be an abnormal vehicle on the map, for example.

[0168] Accordingly, the operator can easily and intuitively grasp the position where a vehicle with a high possibility of being attacked by an attacker exists, and can estimate the situation of the attacker's attack based on the facility name, etc. on the map.

[0169] [12 An example of the abnormal score stage display screen]

[0170] Figure 12 This is an example of the abnormal score stage display screen displayed by the abnormality display unit 110 of the present embodiment. On the screen, stages indicating the progress of the attack, namely reconnaissance, weaponization, delivery, vulnerability, installation, C&C (Command and Control), and objective execution, are displayed in a phased manner. When the vehicle identifier A1 of the vehicle determined to be an abnormal vehicle is determined to be in the current reconnaissance stage, a check mark is displayed in the reconnaissance column, and when it is determined to be in the current delivery stage, a check mark is displayed in the delivery column. Figure 12An example is shown in which the vehicle with vehicle identifier A1 is judged to be in the reconnaissance phase and the delivery phase. The method for judging the reconnaissance phase and the method for judging the delivery phase will be described in detail later.

[0171] The abnormality display unit 110, for example, when the abnormal vehicle determination unit 108 determines that the abnormal vehicle model is in the reconnaissance phase (an example of the first attack phase), displays at least one of the vehicle determined to be an abnormal vehicle, the vehicle model of the vehicle, and the position information of the vehicle. When it is determined that the progress of the attack is higher than the reconnaissance phase, in the delivery phase (an example of the second attack phase), information indicating the current phase of the delivery phase may also be displayed. Moreover, the position information is information indicating the current position of the abnormal vehicle, but may also be information indicating the position determined to be the abnormal vehicle.

[0172] Accordingly, the operator can easily and intuitively grasp the progress of the attack on vehicle A1.

[0173] Moreover, the progress of the attack indicates the progress based on the network kill chain, but is not limited to the progress based on the network kill chain.

[0174] [Sequence of vehicle log reception processing]

[0175] Figure 13 The processing sequence is shown in which the abnormal vehicle detection server 10 of the present embodiment receives the vehicle log from the vehicle system 20 and stores it.

[0176] (S1301) The central ECU 300 of the vehicle system 20 collects the vehicle log via the Ethernet 13 and sends the collected vehicle log to the vehicle log sending unit 220 of the vehicle log sending device 200.

[0177] (S1302) The vehicle log sending unit 220 of the vehicle log sending device 200 sends the vehicle log to the vehicle side communication unit 210.

[0178] (S1303) The vehicle side communication unit 210 of the vehicle log sending device 200 sends the vehicle log to the server side communication unit 101 of the abnormal vehicle detection server 10 via the external network.

[0179] (S1304) The server side communication unit 101 of the abnormal vehicle detection server 10 receives the vehicle log and transfers the received vehicle log to the vehicle log receiving unit 102. The server side communication unit 101 receives the vehicle logs from multiple vehicles respectively and transfers the received multiple vehicle logs to the vehicle log receiving unit 102 respectively.

[0180] (S1305) The vehicle log receiving unit 102 of the abnormal vehicle detection server 10 receives vehicle logs and stores the received vehicle logs in the vehicle log storage unit 103.

[0181] Figure 13 The operations shown can also be performed periodically, or can be performed by the abnormal vehicle detection server 10 sending an instruction to multiple vehicles to indicate the sending of vehicle logs.

[0182] [Sequence of exception rule reception processing]

[0183] Figure 14 Shows the processing sequence from when the abnormal vehicle detection server 10 of the present embodiment receives an exception rule from the exception rule sharing server 30 until it is stored.

[0184] (S1401) The exception rule sharing server 30 sends an exception rule to the vehicle side communication unit 210 of the abnormal vehicle detection server 10 via an external network.

[0185] (S1402) The server side communication unit 101 of the abnormal vehicle detection server 10 receives the exception rule and transfers the received exception rule to the exception rule receiving unit 104.

[0186] (S1403) The exception rule receiving unit 104 of the abnormal vehicle detection server 10 receives the exception rule and stores the received exception rule in the rule storage unit 105.

[0187] Figure 14 The operations shown can also be performed periodically, or can be performed using as a trigger the abnormal vehicle detection server 10 receiving vehicle logs from multiple vehicles, the abnormal vehicle detection server 10 sending an instruction to multiple vehicles to indicate the sending of vehicle logs, or performing the operations shown later Figure 15 shown.

[0188] [Sequence of abnormal score calculation processing]

[0189] Figure 15 Shows the processing sequence of the abnormal vehicle detection server 10 of the present embodiment until it calculates an abnormal score and detects an abnormal vehicle.

[0190] (S1501) The abnormal score calculation unit 106 of the abnormal vehicle detection server 10 obtains vehicle logs from the vehicle log storage unit 103 and obtains exception rules and abnormal rules from the rule storage unit 105.

[0191] (S1502) The anomaly score calculation unit 106 calculates an anomaly score based on the obtained vehicle logs, exclusion rules, and anomaly rules, and stores it in the anomaly score storage unit 107. The anomaly score calculation unit 106 calculates the anomaly scores of multiple vehicles respectively, and stores the calculated anomaly scores of the multiple vehicles in the anomaly score storage unit 107. The anomaly score calculation unit 106 may also, for example, calculate the anomaly score for each anomaly category for each of the multiple vehicles.

[0192] (S1503) After calculating the anomaly score, the anomaly score calculation unit 106 notifies the anomaly vehicle determination unit 108 that the anomaly score has been updated. The anomaly score calculation unit 106, for example, for each of the multiple vehicles, after calculating the anomaly score, notifies the anomaly vehicle determination unit 108. Also, the anomaly score calculation unit 106 may send information (such as a vehicle identifier, etc.) for determining the vehicle for which the anomaly score has been updated together with the notification to the anomaly vehicle determination unit 108.

[0193] (S1504) The anomaly vehicle determination unit 108 of the anomaly vehicle detection server 10 obtains the anomaly score from the anomaly score storage unit 107 and detects the anomaly vehicle.

[0194] [16 Sequence of anomaly countermeasure processing]

[0195] Figure 16 The anomaly vehicle detection server 10 of the present embodiment shows the processing sequence until countermeasures are taken for the detected anomaly vehicle.

[0196] (S1601) The anomaly vehicle determination unit 108 of the anomaly vehicle detection server 10 sends the vehicle identifier, vehicle model, area (such as the anomaly area), and anomaly score of the detected anomaly vehicle to the anomaly countermeasure notification unit 109.

[0197] (S1602) The abnormality countermeasure notification unit 109 of the abnormal vehicle detection server 10 sends the notification to the server-side communication unit 101 in such a way as to notify the compliant vehicles of the detected abnormality (abnormal vehicle notification) based on the information sent in step S1601. The abnormality countermeasure notification unit 109 sends the notification to the server-side communication unit 101 in such a way as to notify at least one of the vehicles corresponding to the vehicle identifier of the received abnormal vehicle, the vehicles of the same vehicle model as the received abnormal vehicle, and the vehicles located in the same area as the received abnormal vehicle of the detected abnormality (abnormal vehicle notification). The abnormality countermeasure notification unit 109 may also, for example, in step S1602, send the notification to the server-side communication unit 101 in such a way as to notify at least one of the abnormal vehicle, the vehicles of the same vehicle model as the abnormal vehicle, and the vehicles located in the same area as the abnormal vehicle of the detected abnormality. The notification may also include the abnormality score for each abnormality category.

[0198] (S1603) The server-side communication unit 101 of the abnormal vehicle detection server 10 sends the notification (abnormal vehicle notification) in step S1602 to the vehicle-side communication unit 210 of the vehicle log transmission device 200 via an external network.

[0199] (S1604) The vehicle-side communication unit 210 of the vehicle log transmission device 200 sends the notification (abnormal vehicle notification) in step S1602 to the abnormality countermeasure unit 230.

[0200] (S1605) The abnormality countermeasure unit 230 of the vehicle log transmission device 200 requests an abnormality countermeasure from the vehicle log transmission unit 220. The abnormality countermeasure unit 230 requests an abnormality countermeasure based on the notification (abnormal vehicle notification) in step S1602 and Figure 9 the shown countermeasure rules. The abnormality countermeasure unit 230, for example, requests an increase in the number of types of vehicle logs from the vehicle log transmission unit 220 when the abnormality category is system analysis and the abnormality score of the system analysis abnormality category is 10 or more and less than 20. And the abnormality countermeasure unit 230, for example, requests an increase in the transmission frequency of vehicle logs from the vehicle log transmission unit 220 when the abnormality category is system analysis and the abnormality score of the system analysis abnormality category is 20 or more and less than 30.

[0201] (S1606) The abnormality countermeasure unit 230 of the vehicle log transmission device 200 requests an abnormality countermeasure from the central ECU 300 via Ethernet 13. The abnormality countermeasure unit 230, for example, requests a restriction of the vehicle control function (function restriction) from the central ECU 300.

[0202] [17 Sequence of Abnormal Display Processing]

[0203] Figure 17 The abnormal vehicle detection server 10 of the present embodiment is shown. After detecting an abnormal vehicle, it displays the processing sequence until the abnormality to the operator.

[0204] (S1701) The abnormal vehicle determination unit 108 of the abnormal vehicle detection server 10 sends the vehicle identifier, vehicle type, and area of the detected abnormal vehicle to the abnormal display unit 110. The abnormal vehicle determination unit 108 may further send the abnormal score to the abnormal display unit 110.

[0205] (S1702) The abnormal display unit 110 of the abnormal vehicle detection server 10 uses a graphical user interface to display the received vehicle identifier, vehicle type, and area of the abnormal vehicle. The abnormal display unit 110 may also use a graphical user interface to display the obtained abnormal score when obtaining an abnormality from the abnormal vehicle determination unit 108.

[0206] (S1703) The abnormal vehicle determination unit 108 of the abnormal vehicle detection server 10 determines the attack stage by area and the attack stage by vehicle type, and sends the determination result to the abnormal display unit 110. The method for determining the attack stage will be described later.

[0207] (S1704) The abnormal display unit 110 of the abnormal vehicle detection server 10 uses a graphical user interface to display the received attack stage.

[0208] Moreover, the processing of steps S1703 and S1704 may not be performed. And step S1703 is executed when there is an abnormal vehicle.

[0209] [Flowchart of the abnormal vehicle score calculation process]

[0210] Figure 18 A flowchart of the per-vehicle abnormal score calculation process of the abnormal score calculation unit 106 of the present embodiment is shown. Specifically, Figure 18 is, in detail, shown Figure 15 A flowchart showing a part of the processing of step S1502 shown, and showing the process of calculating the abnormal score for each vehicle.

[0211] (S1801) The abnormal score calculation unit 106 prepares a variable i and sets i = 1. Moreover, step S1802 is executed. Here, the variable i is a value from 1 to N, and N represents the number of abnormal rules.

[0212] (S1802) The abnormal score calculation unit 106 selects the abnormal rule i and executes step S1803.

[0213] (S1803) The abnormality score calculation unit 106 refers to the event content, location information, time, and abnormality rules recorded in the vehicle log, and determines whether the event in the vehicle log matches the abnormality rule i and whether it is an abnormality. When the abnormality score calculation unit 106 determines that the event in the vehicle log matches the abnormality rule i and is an abnormality (Yes in S1803), it executes step S1804. Also, when the abnormality score calculation unit 106 determines that the event in the vehicle log does not match the abnormality rule i and is not an abnormality (No in S1803), it executes step S1805.

[0214] (S1804) The abnormality score calculation unit 106 refers to the event content, location information, time, and exclusion rules recorded in the vehicle log, and determines whether the abnormality rule i is an abnormality rule that is an exclusion target. When the abnormality rule i is not an abnormality rule that is an exclusion target (No in S1804), the abnormality score calculation unit 106 executes step S1806. When the abnormality rule i is an abnormality rule that is an exclusion target (Yes in S1804), it executes step S1805. Accordingly, the abnormality score calculation unit 106 can prevent misdetection of abnormal vehicles during the work of dealers or repairers where system errors are easily resolved and during software updates where there is a possibility of an increase or decrease in the number of files within the system.

[0215] (S1805) The abnormality score calculation unit 106 refers to the last abnormality date and time recorded in the abnormality score (refer to Figure 8 ) and determines whether 24 hours have passed based on the current date and time. When 24 hours have passed from the read last abnormality date and time to the current date and time (Yes in S1805), the abnormality score calculation unit 106 executes step S1807. Also, when 24 hours have not passed from the read last abnormality date and time to the current date and time (No in S1805), it executes step S1808. That is, the abnormality score calculation unit 106 calculates the abnormality score of the vehicle corresponding to the vehicle identifier recorded in the vehicle log without including the abnormality score of the abnormality rule i.

[0216] The abnormal score calculation unit 106 may not increase the abnormal score of the vehicle even when a suspicious behavior is detected ("Yes" in S1803), and also when a suspicious behavior is detected again within a specified period from the moment when the suspicious behavior is detected ("No" in S1805). Moreover, the determination in step S1805 may also be made according to whether a suspicious behavior is detected in a specified area. In this case, the abnormal score calculation unit 106 may not increase the abnormal score of the vehicle even when a suspicious behavior is detected ("Yes" in S1803), and also when a suspicious behavior is detected again in a specified area of the area where the suspicious behavior is detected ("No" in S1805). The specified period may be, for example, a period including the moment when the suspicious behavior is detected as the initial moment of the period.

[0217] (S1806) The abnormal score calculation unit 106 adds the abnormal score corresponding to the vehicle identifier recorded in the vehicle log and the abnormal score recorded in the abnormal rule i, and executes step S1808. That is, the abnormal score calculation unit 106 calculates the abnormal score of the vehicle corresponding to the vehicle identifier recorded in the vehicle log, including it in the abnormal score of the abnormal rule i.

[0218] (S1807) The abnormal score calculation unit 106 changes the abnormal score corresponding to the vehicle identifier recorded in the vehicle log to 0 and executes step S1808. It can also be said that the abnormal score calculation unit 106 resets the abnormal score if the abnormal rule i is an excluded object and the current date and time have passed a specified time from the last abnormal date and time.

[0219] Moreover, in step S1807, the abnormal score calculation unit 106 may not only set the abnormal score to 0, but also reduce the abnormal score. Thus, the abnormal score calculation unit 106 may also reduce the abnormal score when no suspicious behavior is detected again among the vehicles in which suspicious behavior is detected during a specified period including the moment when the suspicious behavior is detected.

[0220] (S1808) The abnormal score calculation unit 106 determines whether the abnormal rule i is N. That is, the abnormal score calculation unit 106 determines whether the processing after step S1803 has been performed for all the abnormal rules i. When the abnormal rule i is N ("Yes" in S1808), the abnormal score calculation unit 106 ends the processing; otherwise ("No" in S1808), it executes step S1809.

[0221] (S1809) The abnormal score calculation unit 106 increments the abnormal rule i by 1 and executes the processing after step S1802. The abnormal score calculation unit 106 performs the processing after step S1803 for the next abnormal rule i.

[0222] Moreover, when the answer in step S1808 is "Yes", the abnormal score calculation unit 106 may perform a prescribed operation on the abnormal scores for each abnormal rule i for each vehicle. When the answer in step S1808 is "Yes", the abnormal score calculation unit 106 totals all the abnormal scores of the abnormal rules. However, for example, it may also total the abnormal scores for each abnormal category (e.g., each network analysis, system analysis). The total value of the abnormal scores calculated in this way is an example of the abnormal score for a vehicle.

[0223] [Flowchart of abnormal score calculation process by vehicle type]

[0224] Figure 19 The flowchart shows the abnormal score calculation process by vehicle type of the abnormal score calculation unit 106 in the present embodiment. Specifically, Figure 19 it shows in detail Figure 15 a part of the process of step S1502 shown, the process of calculating the statistical value for each vehicle type (in the Figure 19 example, the average value of the abnormal scores) for the determination of whether a vehicle is abnormal by the abnormal vehicle determination unit 108.

[0225] (S1901) The abnormal score calculation unit 106 obtains the abnormal score by vehicle from the abnormal score storage unit 107. The abnormal score calculation unit 106, for example, obtains the abnormal score by vehicle for each vehicle calculated according to the Figure 18 operation (e.g., the total value of the abnormal scores for each vehicle).

[0226] (S1902) The abnormal score calculation unit 106 prepares a variable i and sets i = 1. Moreover, the abnormal score calculation unit 106 executes step S1903. Here, the variable i takes values from 1 to N, and N represents the number of abnormal rules.

[0227] (S1903) The abnormal score calculation unit 106 selects the abnormal rule i and executes step S1904. The abnormal score calculation unit 106, for example, selects the corresponding abnormal rule i (abnormal rule content) corresponding to the variable i according to the abnormal rule number (refer to Figure 6 ). The abnormal score calculation unit 106, for example, when i = 1, selects the network device connection with the abnormal rule number 1.

[0228] (S1904) The anomaly score calculation unit 106 extracts, for each vehicle model, the anomaly scores corresponding to the anomaly rule i from the vehicle anomaly scores of all vehicles, and calculates the average value of the extracted anomaly scores of all vehicles. The anomaly score calculation unit 106 calculates the average value of the anomaly scores in the anomaly rule i for all vehicles of the vehicle model as the anomaly score in the anomaly rule i for that vehicle model.

[0229] Moreover, the anomaly score in the anomaly rule i for a vehicle model is not limited to the average value, but can be a statistical value. The anomaly score in the anomaly rule i for a vehicle model can also be the maximum value, minimum value, median, mode, etc., or other statistical values.

[0230] (S1905) The anomaly score calculation unit 106 determines whether the variable i is N. The anomaly score calculation unit 106 ends the process when the variable i is N (the "yes" in S1905), otherwise (the "no" in S1904), it executes step S1906.

[0231] (S1906) The anomaly score calculation unit 106 increments the variable i by 1 and executes step S1903. The anomaly score calculation unit 106 performs the processing after step S1903 for the next anomaly rule.

[0232] Moreover, the anomaly score calculation unit 106 can also perform a specified operation on the average value of the anomaly scores for each anomaly rule i for each vehicle model when the result in step S1905 is "yes". The anomaly score calculation unit 106 calculates the average value of all anomaly scores for each vehicle model when the result in step S1905 is "yes". However, for example, it can also calculate the average value of the anomaly scores for each anomaly category (e.g., each network analysis, system analysis). The total value of the anomaly scores calculated in this way is an example of the anomaly score for each vehicle model.

[0233] [Flowchart of anomaly score calculation processing by region]

[0234] Figure 20 The flowchart shows the anomaly score calculation processing by region of the anomaly score calculation unit 106 according to this embodiment. Specifically, Figure 20 it shows in detail Figure 15 a part of the processing in step S1502 shown, which is the processing of calculating the statistical value ( Figure 20 in the example, the average value of the anomaly scores) for each region (e.g., anomaly region) used for the determination of whether a vehicle is an abnormal vehicle by the abnormal vehicle determination unit 108. Figure 20 Each of steps S2001 to S2003, S2005, and S2006 shown Figure 19Similarly, each of steps S1901 to S1903, S1905, and S1906 shown is simplified for explanation.

[0235] (S2001) The anomaly score calculation unit 106 obtains the per-vehicle anomaly score from the anomaly score storage unit 107.

[0236] (S2002) The anomaly score calculation unit 106 prepares a variable i and sets i = 1. Then, step S2003 is executed. Here, the variable i takes values from 1 to N, and N represents the number of anomaly rules.

[0237] (S2003) The anomaly score calculation unit 106 selects anomaly rule i and executes step S2004.

[0238] (S2004) The anomaly score calculation unit 106 extracts, for each area, the anomaly scores corresponding to anomaly rule i from the per-vehicle anomaly scores of all vehicles, and calculates the average value of the extracted anomaly scores of all vehicles. The anomaly score calculation unit 106 calculates the average value of the anomaly scores in anomaly rule i for all vehicles within the area as the anomaly score in anomaly rule i for that area.

[0239] Moreover, the anomaly score in anomaly rule i for the area is not limited to the average value, but can be a statistical value. The anomaly score in anomaly rule i for the area can also be the maximum value, minimum value, median value, mode value, etc., or other statistical values.

[0240] (S2005) If the variable i is N (the "yes" case in S2005), the anomaly score calculation unit 106 ends the process; otherwise (the "no" case in S2005), it executes step S2006.

[0241] (S2006) The anomaly score calculation unit 106 increments the variable i by 1 and executes step S2003.

[0242] Moreover, in the case of "yes" in step S2005, the anomaly score calculation unit 106 can also perform a prescribed operation on the average value of the anomaly scores for each anomaly rule i for each area. In the case of "yes" in step S2005, the anomaly score calculation unit 106 calculates the average value of the anomaly scores of all vehicles located in that area for each area. However, for example, it can also calculate the average value of the anomaly scores for each anomaly category (e.g., network analysis, system analysis). The total value of the anomaly scores calculated in this way is an example of the per-area anomaly score.

[0243] [Flowchart of the 21 Anomaly Vehicle Detection Process]

[0244] Figure 21The flowchart showing the abnormal vehicle detection process of the abnormal vehicle determination unit 108 of the present embodiment. Specifically, Figure 21 Yes, it shows in detail Figure 15 A flowchart showing a part of the process of step S1504 shown.

[0245] (S2101) The abnormal vehicle determination unit 108 selects a specific vehicle, obtains the abnormal score of the selected vehicle, and executes step S2102. Here, the abnormal score includes the vehicle abnormal score, the model abnormal score, and the regional abnormal score. The abnormal score of the specific vehicle is the total value of the abnormal scores for each abnormal rule. However, it can also be the total value of the abnormal scores in network analysis or the total value of the abnormal scores in system analysis. Step S2101 is an example of an obtaining step.

[0246] (S2102) The abnormal vehicle determination unit 108 determines whether the abnormal score is greater than 10. If the abnormal score is greater than 10 (Yes in S2102), the abnormal vehicle determination unit 108 executes step S2103; otherwise (No in S2102), it executes step S2104. Moreover, the criterion for the determination in step S2102 is not limited to 10 and can be appropriately determined. Step S2102 is an example of an abnormal vehicle determination step.

[0247] (S2103) When it is Yes in step S2102, the abnormal vehicle determination unit 108 detects the selected vehicle (specific vehicle) as an abnormal vehicle and executes step S2104.

[0248] (S2104) The abnormal vehicle determination unit 108 determines whether the abnormal score obtained in step S2101 is greater than the average model abnormal score of the same model as the selected vehicle (specific vehicle). For example, in step S2104, the abnormal vehicle determination unit 108 compares the abnormal score of the vehicle with the statistical value of the abnormal scores of the vehicles of the same model as this vehicle, and determines whether this vehicle is an abnormal vehicle based on the comparison result. If the abnormal score is greater than the average model abnormal score of the same model as the selected vehicle (Yes in S2104), the abnormal vehicle determination unit 108 executes step S2105; otherwise (No in S2104), it executes step S2106. Step S2104 is an example of an abnormal vehicle determination step.

[0249] (S2105) The abnormal vehicle determination unit 108 detects the selected vehicle (specific vehicle) as an abnormal vehicle, doubles the abnormal score obtained in step S2101, stores it in the abnormal score storage unit 107, and executes step S2106. The abnormal vehicle determination unit 108 doubles both the abnormal score regarding network analysis and the abnormal score regarding system analysis. The abnormal vehicle determination unit 108 stores the doubled abnormal score as the abnormal score of the specific vehicle in the abnormal score storage unit 107. It can also be said that the abnormal vehicle determination unit 108 updates the abnormal score of the specific vehicle according to the abnormal average score by vehicle type. Accordingly, for vehicles of the same model, the abnormal score of a vehicle showing a driving behavior different from normal can be made larger, and thus, priority analysis can be performed.

[0250] Moreover, normal driving behavior is the driving behavior that a driver who is not estimated to perform reverse engineering can perform when driving a vehicle. And here, driving behavior includes both the behavior of the driving state during vehicle driving (for example, Figure 6 the vehicle control function shown works, etc.) and the behavior of internal processing of the vehicle (for example, Figure 6 the connection of network devices, the occurrence of system errors, etc.). Normal driving behavior is an example of specified driving behavior. Specified driving behavior can also be, for example, driving behavior that does not conform to Figure 6 the abnormal rules, periods, and layers shown.

[0251] (S2106) The abnormal vehicle determination unit 108 determines whether the abnormal score obtained in step S2101 is larger than the abnormal average score by region of the area where the selected vehicle (specific vehicle) is located. It can also be said that the abnormal vehicle determination unit 108 compares the abnormal score of the vehicle with the statistical value based on the abnormal scores of vehicles located in the same area as this vehicle, and determines whether this vehicle is an abnormal vehicle according to the comparison result. The abnormal vehicle determination unit 108, when the abnormal score is larger than the abnormal average score by region of the area where the selected vehicle is located ( "Yes" in S2106), executes step S2107, otherwise ( "No" in S2106), ends the process. Step S2106 is an example of an abnormal vehicle determination step.

[0252] (S2107) The abnormal vehicle determination unit 108 detects the selected vehicle (specific vehicle) as an abnormal vehicle, doubles the abnormal score obtained in step S2101 or the abnormal score calculated in step S2105, stores it in the abnormal score storage unit 107, and ends the process. The abnormal vehicle determination unit 108 doubles both the abnormal score regarding network analysis and the abnormal score regarding system analysis. The abnormal vehicle determination unit 108 stores the doubled abnormal score as the abnormal score of the specific vehicle in the abnormal score storage unit 107. It can also be said that the abnormal vehicle determination unit 108 updates the abnormal score of the specific vehicle according to the abnormal average score by region. Accordingly, for vehicles in the same region, it is possible to make the abnormal score of a vehicle showing a driving behavior different from the normal (a specified example) larger, so that the operator can preferentially analyze the abnormal vehicle with a large abnormal score.

[0253] Moreover, the abnormal vehicle determination unit 108 may also Figure 21 detect an abnormal vehicle through at least one of the judgments in steps S2102, S2104, and S2106 shown.

[0254] [Flowchart of abnormal countermeasure processing]

[0255] Figure 22 The flowchart showing the abnormal countermeasure processing of the abnormal countermeasure notification unit 109 of the present embodiment is shown. Specifically, Figure 22 it is a flowchart showing Figure 16 the decision-making process of the content of the abnormal vehicle notification notified in step S1602 shown.

[0256] (S2201) The abnormal countermeasure notification unit 109 obtains the information of the abnormal vehicle detected by the abnormal vehicle determination unit 108 and executes step S2202. This information includes the abnormal score.

[0257] (S2202) The abnormal countermeasure notification unit 109 refers to the abnormal score of the vehicle determined to be an abnormal vehicle, calculates the total value of the abnormal scores for each abnormal category, and executes step S2203.

[0258] (S2203) The abnormal countermeasure notification unit 109 executes processing for the total value of the abnormal scores (abnormal score total value) for the abnormal category of network analysis.

[0259] (S2204) The abnormal countermeasure notification unit 109 executes processing for the total value of the abnormal scores (abnormal score total value) for the abnormal category of system analysis.

[0260] Here, for Figure 22 steps S2203 and S2204 shown, refer to Figure 23 andFigure 24 will be described in detail. Figure 23 is an example of a flowchart of anomaly countermeasure processing by anomaly type in this embodiment. Figure 23 is shown in detail Figure 22 is an example of a flowchart showing the step S2203. Moreover, Figure 23 is the processing performed using the anomaly score in network analysis among the anomaly scores. In other words, in the Figure 23 processing shown, the anomaly score in system analysis among the anomaly scores is not used. Moreover, when it is determined that it is in the second attack stage in the anomalous vehicle or anomalous area, Figure 23 the work shown can be executed.

[0261] (S2231) The anomaly countermeasure notification unit 109 determines whether the anomaly type in network analysis is 30 (first threshold) or more. When the anomaly type is 30 or more (Yes in S2231), the anomaly countermeasure notification unit 109 executes step S2232.

[0262] (S2233) When the anomaly type is less than 30 (No in S2231), the anomaly countermeasure notification unit 109 determines whether the anomaly type is 20 or more (second threshold smaller than the first threshold). When it is less than 30 and 20 or more (Yes in S2233), the anomaly countermeasure notification unit 109 executes step S2234. <~

[0263] (S2235) When the anomaly type is less than 20 (No in S2235), the anomaly countermeasure notification unit 109 determines whether the anomaly type is 10 or more (third threshold smaller than the second threshold). When it is less than 20 and 10 or more (Yes in S2235), the anomaly countermeasure notification unit 109 executes step S2236.

[0264] (S~2237) When the anomaly type is less than 10 (No in S2235), the anomaly countermeasure notification unit 109 determines whether the anomaly type is 1 or more (fourth threshold smaller than the third threshold). When the anomaly type is 1 or more (Yes in S2237), the anomaly countermeasure notification unit 109 executes step S2238. When the anomaly type is 0 (No in S2237), no countermeasure is executed and step S2204 is executed.

[0265] (S2232) The anomaly countermeasure notification unit 109 shuts off the network interface and executes S2204.

[0266] (S2234) The anomaly countermeasure notification unit 109 restricts the access destination and the access source address and executes S2204.

[0267] (S2236) The exception countermeasure notification unit 109 restricts the number of network connection devices and executes S2204.

[0268] (S2238) The exception countermeasure notification unit 109 warns the driver and executes S2204.

[0269] In this way, the exception countermeasure notification unit 109 determines countermeasures in such a manner that the higher the exception score in network analysis, the stronger the network restriction. Moreover, the above first to fourth thresholds are, for example, numerical values and are not limited thereto.

[0270] Moreover, the exception countermeasure notification unit 109 may, in addition to the processing corresponding to the total value of the exception scores in network analysis, also execute the processing corresponding to values below the total value of the exception scores. For example, in the case of "Yes" in step S2231, the exception countermeasure notification unit 109 may execute at least one of the processes of steps S2234, S2236, and S2238 in addition to the process of step S2232.

[0271] Figure 24 This is another example of the flowchart of the exception countermeasure processing by exception category in the present embodiment. Figure 24 This shows in detail Figure 22 This is an example of the flowchart showing step S2204. Moreover, Figure 24 This is the processing using the exception score in system analysis among the exception scores. In other words, in the Figure 24 processing shown, the exception score in network analysis among the exception scores is not used. Moreover, when it is determined that it is in the second attack stage in the abnormal vehicle or abnormal area, the Figure 24 work shown may be executed.

[0272] (S2241) The exception countermeasure notification unit 109 determines whether the exception category in system analysis is 30 (the fifth threshold) or more. When the exception category is 30 or more (Yes in S2241), the exception countermeasure notification unit 109 executes step S2242.

[0273] (S2243) When the exception category is less than 30 (No in S2241), the exception countermeasure notification unit 109 determines whether the exception category is 20 or more (the sixth threshold smaller than the fifth threshold). When it is less than 30 and 20 or more (Yes in S2243), the exception countermeasure notification unit 109 executes step S2244.

[0274] (S2245) When the anomaly countermeasure notification unit 109 determines that the anomaly category is less than 20 (No in S2243), it checks whether the anomaly category is 10 or more (the seventh threshold value smaller than the sixth threshold value). When the anomaly category is less than 20 and 10 or more (Yes in S2245), the anomaly countermeasure notification unit 109 executes step S2246.

[0275] (S2247) When the anomaly countermeasure notification unit 109 determines that the anomaly category is less than 10 (No in S2245), it checks whether the anomaly category is 1 or more (the eighth threshold value smaller than the seventh threshold value). When the anomaly category is 1 or more (Yes in S2247), the anomaly countermeasure notification unit 109 executes step S2248. When the anomaly category is 0 (No in S2247), no countermeasure is taken and the process ends.

[0276] (S2242) The anomaly countermeasure notification unit 109 stops the vehicle control function and ends.

[0277] (S2244) The anomaly countermeasure notification unit 109 increases the transmission frequency of the vehicle log sent to the anomaly vehicle detection server 10 and ends.

[0278] (S2246) The anomaly countermeasure notification unit 109 increases the number of types of vehicle logs sent to the anomaly vehicle detection server 10 and ends.

[0279] (S2248) The anomaly countermeasure notification unit 109 warns the driver and ends.

[0280] In this way, the anomaly countermeasure notification unit 109 determines countermeasures in such a way that the higher the anomaly score in the system analysis, the more restrictions on the vehicle system 20 are strengthened. Moreover, the above fifth to eighth threshold values are, for example, numerical values and are not limited to this.

[0281] Moreover, in addition to the processing corresponding to the total value of the anomaly scores in the system analysis, the anomaly countermeasure notification unit 109 may also execute processing corresponding to values less than or equal to the total value of the anomaly scores. For example, when the result of step S2241 is Yes, in addition to the processing of step S2242, the anomaly countermeasure notification unit 109 may also execute at least one of the processing of steps S2244, S2246, and S2248.

[0282] Such as Figure 23 and Figure 24It is shown that the abnormal situation countermeasure notification unit 109 may also request any one or more of the interruption of the network interface, the restriction of the access destination and access source addresses, the restriction of the number of network connection devices, the warning to the driver, the network connection restriction, the vehicle control function restriction, the start / stop of the vehicle control function, the increase in the transmission frequency of vehicle logs, the increase in the number of types of vehicle logs, and the notification to the driver, based on the value of the abnormal score (for example, the value of the abnormal score of the vehicle determined to be an abnormal vehicle) or the category of suspicious behavior (for example, network analysis or system analysis), for vehicles of the same model as the vehicle determined to be an abnormal vehicle or vehicles located in the abnormal area where the vehicle determined to be an abnormal vehicle exists. The above one or more requests are, for example, made for the abnormal vehicle, vehicles of the same model as the vehicle determined to be an abnormal vehicle, and vehicles other than the abnormal vehicles located in the abnormal area.

[0283] [Flowchart of the judgment process for the area attack stage]

[0284] Figure 25 A flowchart showing the judgment process for the area attack stage of the abnormal vehicle judgment unit 108 according to the present embodiment is shown. Specifically, Figure 25 It is a flowchart showing an example of the process of judging the progress of the attacker's attack. Figure 25 The process shown may also be, for example, Figure 22 performed in parallel with the process shown.

[0285] (S2301) The abnormal vehicle judgment unit 108 obtains the information of the detected abnormal vehicle, obtains the position information of the detected abnormal vehicle as the abnormal area, and executes step S2302.

[0286] (S2302) The abnormal vehicle judgment unit 108 judges whether there are multiple abnormal vehicles in the abnormal area obtained in step S2301. When there are multiple abnormal vehicles other than the abnormal vehicle obtained in step S2301 in the abnormal area (Yes in S2302), the abnormal vehicle judgment unit 108 executes step S2303. When there are no abnormal vehicles other than the abnormal vehicle obtained in step S2301 in the abnormal area (No in S2302), the abnormal vehicle judgment unit 108 executes step S2305. Moreover, the abnormal vehicle judgment unit 108 may judge as "Yes" in step S2302 when the number of abnormal vehicles other than the abnormal vehicle obtained in step S2301 in the abnormal area is equal to or more than a specified number, and judge as "No" in step S2302 when the number of abnormal vehicles other than the abnormal vehicle obtained in step S2301 in the abnormal area is less than the specified number.

[0287] (S2303) When the abnormal vehicle determination unit 108 determines "Yes" in step S2302, it determines that the attack on the abnormal area where the abnormal vehicle is detected is in the delivery stage (an example of the second attack stage).

[0288] (S2304) In the case of the delivery stage, the abnormal vehicle determination unit 108 warns the vehicles in the abnormal area via the abnormal countermeasure notification unit 109 and ends the process. The abnormal vehicle determination unit 108 sends information for notifying the driver or the like of the information indicating the delivery stage to the vehicles in the abnormal area. The abnormal vehicle determination unit 108, for example, warns all the vehicles located in the abnormal area. It can also be said that the abnormal vehicle determination unit 108, for example, also warns one or more vehicles that are not abnormal vehicles respectively. The information for notification may also include information for taking countermeasures against the abnormality. The information for notification may include, for example, information for executing Figure 23 the steps S2232, S2234, S2236, S2238 shown in Figure 24 and at least one of the steps S2242, S2244, S2246, S2248 shown in

[0289] (S2305) The abnormal vehicle determination unit 108 determines that the attack on the abnormal area where the abnormal vehicle is detected is in the reconnaissance stage (an example of the first attack stage), and ends. The abnormal vehicle determination unit 108, for example, does not warn the vehicles other than the abnormal vehicles in the abnormal area. Moreover, if the abnormal vehicle determination unit 108 makes the determination in step S2305, the abnormal countermeasure notification unit 109 may notify the vehicles of the information indicating the current reconnaissance stage.

[0290] In this way, the abnormal vehicle determination unit 108 determines the first attack stage when the number of abnormal vehicles in the abnormal area where the abnormal vehicle is detected is equal to or less than a specified number, and determines the second attack stage in which the progress of the attack in reverse engineering is more advanced than the first attack stage when the number of abnormal vehicles is more than the specified number. Moreover, in the case where the attack is in the second attack stage, the vehicles in the abnormal area are warned.

[0291] [Flowchart of attack stage determination process by vehicle type]

[0292] Figure 26 A flowchart showing the attack stage determination process by vehicle type of the abnormal vehicle determination unit 108 of the present embodiment. Specifically, Figure 26 It is a flowchart showing another example of the process for determining the progress of the attacker's attack.

[0293] (S2401) The abnormal vehicle determination unit 108 obtains information on the detected abnormal vehicle, obtains the vehicle type of the abnormal vehicle as an abnormal vehicle type based on the obtained information, and executes step S2402.

[0294] (S2402) The abnormal vehicle determination unit 108 determines whether there are multiple abnormal vehicles among the abnormal vehicle types obtained in step S240. If there are multiple abnormal vehicles other than the abnormal vehicle obtained in step S2401 among the abnormal vehicle types ( "Yes" in S2402), the abnormal vehicle determination unit 108 executes step S2403. If there are no abnormal vehicles other than the abnormal vehicle obtained in step S2401 ( "No" in S2402), the abnormal vehicle determination unit 108 executes step S2405. Moreover, the abnormal vehicle determination unit 108 may also determine as "Yes" in step S2402 when there are more than a specified number of abnormal vehicles other than the abnormal vehicle obtained in step S2401 among the abnormal vehicle types, and determine as "No" in step S2402 when there are less than the specified number of abnormal vehicles other than the abnormal vehicle obtained in step S2401 among the abnormal vehicle types.

[0295] (S2403) When it is determined as "Yes" in step S2402, the abnormal vehicle determination unit 108 determines that the attack on the vehicle type of the abnormal vehicle is in the delivery stage (an example of the second attack stage).

[0296] (S2404) In the case of the delivery stage, the abnormal vehicle determination unit 108 warns the vehicles of the abnormal vehicle type via the abnormal countermeasure notification unit 109, and ends the process. The abnormal vehicle determination unit 108 sends information for notifying the driver, etc. of the information indicating the delivery stage to the vehicles of the abnormal vehicle type. The abnormal vehicle determination unit 108, for example, warns all of the vehicles of the abnormal vehicle type. It can also be said that the abnormal vehicle determination unit 108, for example, warns one or more vehicles that are not abnormal vehicles among the abnormal vehicle types respectively. The information for notification may also include information for taking countermeasures against the abnormality. The information for notification may also include information for executing Figure 23 the steps S2232, S2234, S2236, S2238 shown, and Figure 24 the information of at least one of the steps S2242, S2244, S2246, S2248 shown.

[0297] (S2405) The abnormal vehicle determination unit 108 determines that an attack on the vehicle type of an abnormal vehicle is in the reconnaissance phase (an example of the first attack phase), and then ends. The abnormal vehicle determination unit 108, for example, does not give a warning to vehicles other than abnormal vehicles of the abnormal vehicle type. Moreover, the abnormal situation countermeasure notification unit 109 may notify the vehicle of the information indicating the current reconnaissance phase if the abnormal vehicle determination unit 108 makes the determination in step S2405.

[0298] In this way, the abnormal vehicle determination unit 108 determines the first attack phase when the number of abnormal vehicles in the detected vehicle type (abnormal vehicle type) is below a specified number, and determines the second attack phase in which the progress of the attack in reverse engineering is more advanced than the first attack phase when the number of abnormal vehicles is more than the specified number. Moreover, when the attack is in the second attack phase, a warning is given to vehicles of the abnormal vehicle type.

[0299] Moreover, an example in which the first attack phase is the reconnaissance phase and the second attack phase is the delivery phase has been described, but the first attack phase and the second attack phase are not limited to this. Taking the Figure 12 network kill chain shown as an example, if the second attack phase is a phase different from the first attack phase and a phase with a higher attack progress than the first attack phase, there is no particular limitation.

[0300] [Other modification examples]

[0301] Moreover, for the present disclosure, it has been described according to the respective embodiments, but the present disclosure is of course not limited to the respective embodiments. The present disclosure also includes the following cases.

[0302] (1) In the above embodiment, it has been described as a security countermeasure for an in-vehicle network mounted on an automobile, but the scope of application is not limited to this. It is not limited to automobiles and can also be applied to moving bodies such as construction machinery, agricultural machinery, ships, railways, and airplanes.

[0303] That is, it can be applied as a network security countermeasure for a mobile body network and a mobile body network system.

[0304] Moreover, it can also be applied to a communication network used in an industrial control system such as a factory and a building, or a communication network for controlling an embedded device.

[0305] (2) In the above embodiment, the values of the period, the number of times, and the abnormal score described in the abnormal rule can also be changed. There is no particular limitation as long as the abnormal score is added when specific conditions for suspecting an attack are met for each value.

[0306] (3) In the above-described embodiment, it is described that the anomaly score calculation unit 106 calculates an anomaly score for each anomaly rule. However, it is also possible to calculate the total value of all the anomaly scores to which the anomaly rules are applied.

[0307] (4) In the above-described embodiment, it is described that the anomaly score calculation unit 106 calculates the average value of the anomaly scores for each vehicle model and region. However, it is also possible to use statistical values such as the total value or the median value.

[0308] (5) In the above-described embodiment, it is described that the anomaly score list display screen is displayed in descending order of the anomaly scores. However, it is also possible to prepare a function that can be sorted in ascending or descending order of the anomaly scores.

[0309] (6) In the above-described embodiment, it is described that the anomaly score map display screen displays the anomaly regions and the anomaly vehicles on the map. However, it is also possible to display multiple anomaly regions and anomaly vehicles separately, or to display the anomaly scores together.

[0310] (7) In the above-described embodiment, it is described that the anomaly score stage display screen is displayed according to the stages showing the progress of the attack on a specific anomaly vehicle. However, it is not necessary to display all the stages, and it is also possible to display only the reconnaissance stage.

[0311] (8) In the above-described embodiment, in the flowchart of the anomaly score calculation process, when 24 hours have elapsed since the last anomaly date and time, the anomaly score is set to 0. However, it is not necessarily 24 hours, but a specified time is sufficient. Also, it is not necessary to set the anomaly score to 0, and it is also possible to decrease it.

[0312] (9) In the above-described embodiment, in the flowchart of the anomaly vehicle detection process, when the anomaly score is greater than the average anomaly score by vehicle model and greater than the average anomaly score by region, the anomaly score is doubled. However, it is not necessarily doubled, but a fixed value or the like can be added as long as the anomaly score increases.

[0313] (10) In the above-described embodiment, in the flowchart of the attack stage determination process by region and the flowchart of the attack stage determination process by vehicle model, if there is only one anomaly vehicle, it is determined as the reconnaissance stage, and if there are multiple anomaly vehicles, it is determined as the delivery stage. However, the number of anomaly vehicles as the determination criterion is not limited to 1, and it is also possible to determine based on a specified value.

[0314] (11) Specifically, each of the devices in the above-described embodiments is a computer system composed of a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is recorded in the RAM or the hard disk unit. The microprocessor operates according to the computer program, and thereby each device realizes its function. Here, the computer program is constituted by combining a plurality of instruction codes showing instructions for the computer in order to realize a prescribed function.

[0315] (12) Part or all of the constituent elements constituting each of the devices in the above-described embodiments may also be constituted by a single system LSI (Large Scale Integration). A system LSI is a super-multi-functional LSI manufactured by integrating a plurality of constituent parts on one chip. Specifically, it is a computer system including a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The microprocessor operates according to the computer program, and thereby the system LSI realizes its function.

[0316] Moreover, each part of the constituent elements constituting each of the devices may be individually made into a single chip, or may be made into a single chip in a manner including part or all of them.

[0317] And here, it is assumed to be a system LSI, but depending on the degree of integration, there may be cases called IC, LSI, super LSI, and ultra LSI. And the method of integrating into an integrated circuit is not limited to LSI, and may also be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI, or a reconfigurable processor that can reconstruct the connection and setting of the circuit units inside the LSI may also be used.

[0318] Furthermore, if an integrated circuit technology that replaces the LSI appears due to the progress of semiconductor technology or other derived technologies, of course, such technology can also be used for the integration of functional blocks. There may be possibilities such as the application of biotechnology.

[0319] (13) Part or all of the constituent elements constituting each of the above-described devices may also be constituted by an IC card or a single module that can be attached to and detached from each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may also include the above-mentioned super-multi-functional LSI. The microprocessor operates according to the computer program, and thereby the IC card or module realizes its function. The IC card or module may also have anti-tampering properties.

[0320] (14) Further, the present disclosure may also be the above-described method. Moreover, it may also be a computer program implemented by a computer for these methods, or a digital signal constituted by a computer program.

[0321] Further, the present disclosure may also record a computer program or a digital signal onto a computer-readable recording medium, such as a floppy disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Moreover, it may also be the digital signal recorded on these recording media.

[0322] Further, the present disclosure may also transmit a computer program or a digital signal via an electric communication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, etc.

[0323] Moreover, the present disclosure is a computer system including a microprocessor and a memory, the memory stores the computer program, and the microprocessor operates according to the computer program.

[0324] Moreover, it may also record a program or a digital signal onto a recording medium for transmission, or transmit a program or a digital signal via a network or the like, so as to be executed by an independent other computer system.

[0325] (15) Further, the order of the multiple processes described in the above-described embodiments is an example. The order of the multiple processes may be changed, and the multiple processes may also be executed in parallel. Moreover, a part of the processes among the multiple processes may not be executed.

[0326] (16) Moreover, it may also be that the abnormal vehicle detection server of the above-described embodiment may be configured to receive a vehicle log including data of the event content occurring in a vehicle system from one or more vehicles, and include: an abnormal score calculation unit that detects a suspicious behavior different from normal driving according to the event content of the received vehicle log, and calculates an abnormal score indicating the possibility that the vehicle corresponding to the vehicle log is being reverse-engineered; and an abnormal vehicle determination unit that determines the vehicle as an abnormal vehicle when the abnormal score is equal to or higher than a specified value.

[0327] (17) The above-described embodiments and the above-described modification examples may be combined respectively.

[0328] Thus, an object of the present disclosure is to provide an information processing apparatus for managing a moving body that has a possibility of reverse-engineering activities by an attack.

[0329] Symbol Explanation

[0330] 10 Abnormal Vehicle Detection Server

[0331] 11, 12, 13 Ethernet

[0332] 14 CAN

[0333] 15 CAN-FD

[0334] 20 Vehicle system

[0335] 30 Exception rule sharing server

[0336] 101 Server-side communication unit

[0337] 102 Vehicle log receiving unit

[0338] 103 Vehicle log storage unit

[0339] 104 Exception rule receiving unit

[0340] 105 Rule storage unit

[0341] 106 Abnormal score calculation unit

[0342] 107 Abnormal score storage unit

[0343] 108 Abnormal vehicle judgment unit

[0344] 109 Abnormal countermeasure notification unit

[0345] 110 Abnormal display unit

[0346] 200 Vehicle log transmission device

[0347] 210 Vehicle-side communication unit

[0348] 220 Vehicle log transmission unit

[0349] 230 Abnormal countermeasure unit

[0350] 300 Central ECU

[0351] 400a, 400b, 400c, 400d Zone ECU

[0352] 500a Body ECU

[0353] 500b Automotive navigation ECU

[0354] 500c Steering ECU

[0355] 500d Brake ECU

Claims

1. An abnormal vehicle detection server, comprising: An abnormal score acquisition unit that, based on multiple vehicle information received from multiple vehicles respectively, detects suspicious behaviors different from prescribed driving behaviors. For each of the multiple vehicles, when such a suspicious behavior is detected, it determines the suspicious behavior as a network analysis activity or a system analysis activity, and obtains an abnormal score indicating the degree to which the vehicle is being reverse-engineered by an attacker. The multiple vehicle information is respectively vehicle information based on vehicle logs including the content of events occurring in the vehicle systems mounted on the vehicles. The abnormal score is associated with network analysis or system analysis. The network analysis indicates a high possibility that the attacker analyzes the communication function of the vehicle system, and the system analysis indicates a high possibility that the attacker analyzes the host of the vehicle system; and An abnormal vehicle determination unit that, based on the abnormal score of one vehicle among the multiple vehicles and the statistical value of the abnormal scores of two or more vehicles among the multiple vehicles, detects an abnormal vehicle estimated to be attacked by determining whether the one vehicle is an abnormal vehicle. When the one vehicle among the multiple vehicles is detected as an abnormal vehicle, the abnormal vehicle determination unit further determines the progress of the attack being carried out by the attacker according to the number of abnormal vehicles other than the one vehicle among the abnormal vehicles of the same vehicle model as the one vehicle detected as the abnormal vehicle, i.e., the abnormal vehicle model, or the number of abnormal vehicles other than the one vehicle among the multiple vehicles in the area where the one vehicle among the multiple vehicles is detected as the abnormal vehicle, i.e., the abnormal area. The abnormal vehicle detection server further comprises an abnormal countermeasure notification unit. When the abnormal score acquisition unit determines the suspicious behavior as the network analysis activity, the abnormal countermeasure notification unit, according to the value of the abnormal score, executes any one or more of the interruption of the network interface, the restriction of the addresses of the access destination and the access source, the restriction of the number of connections of network devices, and the warning to the driver. When the abnormal score acquisition unit determines the suspicious behavior as the system analysis activity, the abnormal countermeasure notification unit, according to the value of the abnormal score, executes any one or more of the start / stop of the vehicle control function, the increase in the transmission frequency of the vehicle logs, the increase in the number of types of the vehicle logs, and the warning to the driver.

2. The abnormal vehicle detection server according to claim 1, wherein the two or more vehicles include vehicles of the same vehicle model as the one vehicle, and the abnormal vehicle determination unit compares the abnormal score of the one vehicle with the statistical value based on the abnormal scores of vehicles of the same vehicle model as the one vehicle, and determines whether the one vehicle is the abnormal vehicle according to the comparison result.

3. The abnormal vehicle detection server according to claim 1, wherein the two or more vehicles include vehicles located in the same area as the one vehicle. The abnormal vehicle determination unit compares the abnormal score of the one vehicle with the statistical value based on the abnormal scores of the vehicles located in the same area as the one vehicle, and determines whether the one vehicle is the abnormal vehicle according to the comparison result.

4. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal vehicle determination unit, further, when there are the abnormal vehicles of a prescribed number or less in the abnormal vehicle types or the abnormal area, determines that the progress degree of the attack in the reverse engineering is the first attack stage, and when there are more abnormal vehicles than the prescribed number, determines that the progress degree of the attack in the reverse engineering is the second attack stage which is more progressed than the first attack stage.

5. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal score acquisition unit calculates the abnormal score according to the event content included in the vehicle log, detects any one of frequent connection of network devices, abnormal Internet connection, frequent occurrence of diagnostic instructions, change of access destination address, and change of access source address determined according to the event content as the suspicious behavior, and when the suspicious behavior is detected, determines the suspicious behavior as a network analysis activity and increases the abnormal score of the one vehicle.

6. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal score acquisition unit calculates the abnormal score according to the event content included in the vehicle log, detects any one of frequent occurrence of vehicle control functions, frequent occurrence of system errors, deletion of system errors, frequent occurrence of fault codes, system login, and change of the number of files or processes determined according to the event content as the suspicious behavior, and when the suspicious behavior is detected, determines the suspicious behavior as a system analysis activity and increases the abnormal score of the one vehicle.

7. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal score acquisition unit, even when the suspicious behavior is detected, does not increase the abnormal score when the suspicious behavior is detected again within a prescribed period based on the time when the suspicious behavior is detected, or when the suspicious behavior is detected in a prescribed area.

8. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal score acquisition unit reduces the abnormal score when the suspicious behavior is not detected again among the vehicles in which the suspicious behavior is detected within a prescribed period based on the time when the suspicious behavior is detected.

9. The abnormal vehicle detection server according to any one of claims 1 to 3, The abnormal vehicle detection server further includes an abnormal countermeasure notification unit, which, based on the value of the abnormal score or the category of the suspicious behavior, requests any one or more of the following countermeasures for the vehicle determined by the abnormal vehicle determination unit to be an abnormal vehicle: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver.

10. The abnormal vehicle detection server according to claim 4, The abnormal vehicle detection server further includes an abnormal countermeasure notification unit, which, when the abnormal vehicle determination unit determines that the abnormal vehicle model is in the second attack stage, based on the value of the abnormal score or the category of the suspicious behavior, requests any one or more of the following for vehicles of the same model as the vehicle determined to be an abnormal vehicle: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver.

11. The abnormal vehicle detection server according to claim 4, The abnormal vehicle detection server further includes an abnormal countermeasure notification unit, which, when the abnormal vehicle determination unit determines that the abnormal vehicle in the abnormal area is in the second attack stage, based on the value of the abnormal score or the category of the suspicious behavior, requests any one or more of the following for vehicles other than the abnormal vehicle located in the abnormal area: blocking of the network interface, restriction of the addresses of the access destination and the access source, restriction of the number of network connection devices, warning to the driver, network connection restriction, vehicle control function restriction, start / stop of the vehicle control function, increase in the transmission frequency of vehicle logs, increase in the number of types of vehicle logs, and notification to the driver.

12. The abnormal vehicle detection server according to any one of claims 1 to 3, 10, and 11, The abnormal vehicle detection server further includes an abnormal display unit that displays the abnormal vehicles in a list in descending order of the abnormal score.

13. The abnormal vehicle detection server according to any one of claims 1 to 3, 10, and 11, The abnormal vehicle detection server further includes an abnormal display unit that displays the location information of the vehicle determined to be an abnormal vehicle on a map.

14. The abnormal vehicle detection server according to claim 4, The abnormal vehicle detection server further includes an abnormal display unit. When the abnormal vehicle determination unit determines that the abnormal vehicle type is in the first attack stage, the abnormal display unit displays at least one of the vehicle, vehicle type, and location information determined to be the abnormal vehicle. When it is determined to be in the second attack stage, it displays a level where the progress of the attack is higher than that in the first attack stage.

15. An abnormal vehicle detection method, comprising: An abnormal score acquisition step of detecting a suspicious behavior different from a specified driving behavior based on a plurality of vehicle information respectively received from a plurality of vehicles, and for each of the plurality of vehicles, when the suspicious behavior is detected, determining the suspicious behavior as a network analysis activity or a system analysis activity, and obtaining an abnormal score indicating the degree to which the vehicle is being reverse-engineered by an attacker. The plurality of vehicle information is respectively vehicle information based on a vehicle log including the content of events occurring in a vehicle system mounted on the vehicle. The abnormal score is associated with network analysis or system analysis. The network analysis indicates a high possibility that the attacker analyzes the communication function of the vehicle system, and the system analysis indicates a high possibility that the attacker analyzes the host of the vehicle system; And An abnormal vehicle determination step of detecting an abnormal vehicle estimated to be attacked by determining whether one vehicle among the plurality of vehicles is an abnormal vehicle based on the abnormal score of one vehicle among the plurality of vehicles and the statistical value of the abnormal scores of two or more vehicles among the plurality of vehicles. When one vehicle among the plurality of vehicles is detected as an abnormal vehicle, In the abnormal vehicle determination step, further, based on the number of abnormal vehicles other than the one vehicle among the plurality of vehicles of the same vehicle type as the one vehicle detected as the abnormal vehicle, i.e., the abnormal vehicle type, or the number of abnormal vehicles other than the one vehicle among the plurality of vehicles in the area where the one vehicle among the plurality of vehicles is detected as the abnormal vehicle, i.e., the abnormal area, the progress of the attack being carried out by the attacker is determined. The abnormal vehicle detection method further includes an abnormal countermeasure notification step. When the suspicious behavior is determined to be the network analysis activity in the abnormal score acquisition step, in the abnormal countermeasure notification step, according to the value of the abnormal score, any one or more of blocking the network interface, restricting the addresses of the access destination and access source, restricting the number of connections of network devices, and warning the driver are performed. When the suspicious behavior is determined to be the system analysis activity in the abnormal score acquisition step, in the abnormal countermeasure notification step, according to the value of the abnormal score, any one or more of starting and stopping the vehicle control function, increasing the transmission frequency of the vehicle log, increasing the number of types of the vehicle log, and warning the driver are performed.

Images