Abnormality detection device, abnormality detection method, and program recording medium

Abstract

The abnormality detection device (100) comprises: an acquisition unit (1001) which acquires vehicle information related to the state of a vehicle (30), the vehicle information including position information indicating the position of the vehicle (30); a model storage unit (1002) which stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating the vehicle information of a vehicle (30) located in the grid; and a determination unit (1003) which calculates an abnormality degree indicating the degree of abnormality of the vehicle information based on an evaluation model for the evaluation grid in the evaluation model and the vehicle information, determines whether the vehicle information is abnormal based on the abnormality degree, and outputs a determination result, wherein the evaluation grid is composed of a first grid including the position of the vehicle (30) indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid.

Description

Technical Field

[0001] The invention relates to an abnormality detection device for detecting abnormalities related to a vehicle. Background Art

[0002] Conventionally, an abnormality detection device that detects abnormality related to a vehicle is known (for example, see Patent Document 1).

[0003] Prior art literature

[0004] Patent Document 1: Japanese Patent Application Laid-Open No. 2015-026252 Summary of the Invention

[0005] Problems to be solved by the invention

[0006] Regarding an abnormality detection device that detects an abnormality related to a vehicle, improvement in abnormality detection accuracy is desired.

[0007] Therefore, an object of the present disclosure is to provide an abnormality detection device capable of improving the accuracy of abnormality detection compared with conventional devices.

[0008] Technical solutions to solve problems

[0009] A technical solution disclosed herein relates to an abnormality detection device comprising: an acquisition unit that acquires vehicle information related to a state of a vehicle, the vehicle information including position information indicating the position of the vehicle; a model storage unit that stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating the vehicle information of the vehicle located in the grid; and a determination unit that calculates an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid in the evaluation models and the vehicle information, determines whether the vehicle information is abnormal based on the abnormality degree, and outputs a determination result, the evaluation grid being composed of a first grid including the position of the vehicle indicated by the position information, and one or more second grids having a predetermined positional relationship with the first grid.

[0010] A technical solution disclosed herein involves an abnormality detection method performed by an abnormality detection device, wherein the abnormality detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to a state of a vehicle located in the grid, the vehicle information including position information of the vehicle, the abnormality detection method comprising: obtaining the vehicle information; calculating an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid in the evaluation model, the evaluation grid comprising a first grid including a position of the vehicle indicated by the position information, and one or more second grids in a predetermined positional relationship with the first grid; determining whether the vehicle information is abnormal based on the abnormality degree; and outputting a determination result.

[0011] A technical solution disclosed herein relates to a program for causing an abnormality detection device to perform abnormality detection processing, wherein the abnormality detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to a state of a vehicle located in the grid, the vehicle information including position information of the vehicle, the abnormality detection processing comprising the following steps: a step of obtaining the vehicle information; a step of calculating an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid composed of a first grid including a position of the vehicle indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid; a step of determining whether the vehicle information is abnormal based on the abnormality degree; and a step of outputting a determination result.

[0012] Effects of the Invention

[0013] According to an abnormality detection device and the like according to one technical solution of the present disclosure, an abnormality detection device capable of improving abnormality detection accuracy compared to conventional devices is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a block diagram showing an example of the configuration of an information processing system according to an embodiment.

[0015] Figure 2 This is a block diagram showing an example of the configuration of an in-vehicle network according to the embodiment.

[0016] Figure 3 This is a block diagram showing an example of functions implemented by the monitoring server according to the embodiment.

[0017] Figure 4 This is a block diagram showing an example of the configuration of an abnormality detection device according to an embodiment.

[0018] Figure 5This is a schematic diagram showing an example of a map divided into a plurality of grids by region.

[0019] Figure 6 This is a schematic diagram showing an example of the data structure of vehicle information according to the embodiment.

[0020] Figure 7 This is a schematic diagram showing an example of the data structure of vehicle information according to the embodiment.

[0021] Figure 8 This is a schematic diagram showing an example of the data structure of the evaluation model according to the embodiment.

[0022] Figure 9 This is a flowchart of an abnormality detection process according to an embodiment.

[0023] Figure 10 This is a sequence diagram of the information processing system according to the embodiment.

[0024] Figure 11 This is a flowchart showing an example of a method for determining an evaluation grid.

[0025] Figure 12A This is a schematic diagram showing an example of an evaluation grid.

[0026] Figure 12B This is a schematic diagram showing an example of an evaluation grid.

[0027] Figure 12C This is a schematic diagram showing an example of an evaluation grid.

[0028] Figure 13 This is a flowchart showing an example of a method for determining an evaluation grid.

[0029] Figure 14A This is a schematic diagram showing an example of an evaluation grid.

[0030] Figure 14B This is a schematic diagram showing an example of an evaluation grid.

[0031] Figure 14C This is a schematic diagram showing an example of an evaluation grid.

[0032] Figure 15 This is a flowchart showing an example of a method for correcting the abnormality degree.

[0033] Figure 16 This is a flowchart showing an example of a method for determining whether vehicle information is abnormal.

[0034] Figure 17 This is a flowchart showing an example of a method for determining an abnormal sequence.

[0035] Figure 18This is a flowchart showing an example of a method for determining an abnormal sequence.

[0036] Figure 19 This is a flowchart showing an example of an abnormal mesh interpolation method.

[0037] Figure 20 This is a flowchart showing an example of an abnormal mesh interpolation method.

[0038] Figure 21 It is a schematic diagram showing an example of an image displayed on the display unit according to the embodiment. DETAILED DESCRIPTION

[0039] (The origin of a technical solution disclosed in this disclosure)

[0040] Vehicles such as automobiles are equipped with multiple electronic control units (ECUs). Vehicle control is achieved through communication between these ECUs via an in-vehicle network. CAN (Controller Area Network) is one of the most widely used standards for this type of in-vehicle network.

[0041] An in-vehicle network that complies with the CAN protocol can be constructed as a closed communication path within a single vehicle. However, it is not uncommon for vehicles to be equipped with an in-vehicle network that is configured as an externally accessible network. For example, an in-vehicle network may include a port for externally extracting information circulating on the network for diagnostic purposes in various in-vehicle systems, or may be connected to a car navigation system equipped with a wireless LAN capable of connecting to an external network. Allowing external access to the in-vehicle network can improve convenience for vehicle users, but it also increases threats.

[0042] For example, in 2013, it was confirmed that improper (illegal, abnormal) vehicle control could be achieved through the misuse of parking assistance functions from outside the vehicle network. Furthermore, in 2015, it was confirmed that a specific vehicle model could be improperly controlled remotely, and this confirmation led to a recall of that model.

[0043] One method of attacking an in-vehicle network involves externally accessing an ECU connected to the network and forcibly taking over the ECU. This ECU then transmits attack frames (hereinafter referred to as attack frames) to illicitly control the vehicle. Attack frames are abnormal frames that differ in some way from normal frames circulating on an unattacked in-vehicle network.

[0044] As a technique for performing such abnormality detection in an in-vehicle network, for example, Patent Document 1 discloses a method of applying a statistical method to vehicle travel data.

[0045] This anomaly detection technology uses features or machine learning parameters that serve as a benchmark for anomaly detection as an evaluation model, and then determines whether the vehicle deviates from the evaluation model. However, since this existing technology generates an evaluation model based on driving data observed within a wide range of driving areas, it generates an evaluation model that includes driving data from various driving environments. In anomaly detection using this evaluation model, even if an improper acceleration instruction is made through an attack on a normal road, if the speed is at a level that can be observed on a highway, it will be considered a normal acceleration instruction and will not be determined to be an anomaly.

[0046] As in this example, the conventional technology has a problem in that there are attacks that cannot be determined as abnormal based on the position of the vehicle, and the detection accuracy is reduced.

[0047] Therefore, the inventors have conducted repeated and careful experiments and studies to solve the above-mentioned problems. As a result, the inventors have come up with the following abnormality detection device, abnormality detection method, and program.

[0048] A technical solution of the present disclosure relates to an abnormality detection device comprising: an acquisition unit that acquires vehicle information related to a state of a vehicle, the vehicle information including position information indicating the position of the vehicle; a model storage unit that stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating the vehicle information of the vehicle located in the grid; and a determination unit that calculates an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid in the evaluation models and the vehicle information, determines whether the vehicle information is abnormal based on the abnormality degree, and outputs a determination result, the evaluation grid being composed of a first grid including the position of the vehicle indicated by the position information, and one or more second grids having a predetermined positional relationship with the first grid.

[0049] The anomaly detection device determines whether vehicle information is abnormal based on an evaluation model for an evaluation grid that is in a predetermined positional relationship with the vehicle's location. Therefore, the anomaly detection device can detect vehicle-related anomalies based on the evaluation model for a local area corresponding to the vehicle's location. Consequently, the anomaly detection device can improve the accuracy of anomaly detection compared to conventional methods.

[0050] Furthermore, the determination unit may determine that the vehicle information is abnormal when the abnormality level is equal to or greater than a threshold value.

[0051] In addition, it may also be that when the abnormality degree is above a threshold value, the determination unit corrects (corrects) the abnormality degree in a manner that reduces the abnormality degree, and determines whether the vehicle information is abnormal based on the corrected abnormality degree when the total number of data used when generating the evaluation model of each grid included in the evaluation grid, that is, the number of evaluation data, is less than a first predetermined number.

[0052] In addition, the determination unit may correct the abnormality level in a manner that reduces the abnormality level to a level indicating that the vehicle information is normal when the abnormality level is above the threshold and the number of evaluation data is less than a second predetermined number that is smaller than the first predetermined number.

[0053] Furthermore, the determination unit may correct the abnormality by multiplying the abnormality by a ratio of the number of evaluation data to the first predetermined number when the abnormality is greater than or equal to the threshold and the number of evaluation data is less than the first predetermined number.

[0054] In addition, the vehicle information may also include speed information indicating the driving speed of the vehicle, and the determination unit may determine the predetermined position relationship as the first predetermined position relationship when the driving speed indicated by the speed information is lower than the first speed, and may determine the predetermined position relationship as the second predetermined position relationship when the driving speed is higher than the first speed, and the number of the second grids in the second predetermined position relationship is greater than the number of the second grids in the first predetermined position relationship.

[0055] In addition, the vehicle information may also include speed information indicating the driving speed of the vehicle, and the determination unit may determine the predetermined position relationship as a first predetermined position relationship when the driving speed indicated by the speed information is lower than a first speed, and may determine the predetermined position relationship as a second predetermined position relationship when the driving speed is greater than the first speed, wherein the number of the second grids in the second grid in the second predetermined position relationship that are arranged from the first grid toward the first direction is greater than the number of the second grids in the second grid in the first predetermined position relationship that are arranged from the first grid toward the first direction.

[0056] In addition, it can also be that the acquisition unit acquires the vehicle information in sequence, the judgment unit calculates the abnormality degree in sequence, judges whether the vehicle information is abnormal in sequence, and outputs the judgment results in sequence, and the abnormality detection device also has: an accumulation (reserve, storage) unit, which associates the judgment results and the position information corresponding to the judgment results output in sequence from the judgment unit and stores them in sequence; and an abnormal sequence judgment unit, which, when the first judgment result output from the judgment unit indicates that it is abnormal, when the second judgment result last stored in the accumulation unit indicates that it is abnormal, if the distance between the first position represented by the first position information corresponding to the first judgment result and the second position represented by the second position information associated with the second judgment result is less than a predetermined distance, then the first judgment result and the second judgment result are judged to be the same abnormal sequence.

[0057] In addition, the vehicle information may also include speed information indicating the driving speed of the vehicle, and the abnormal sequence determination unit may determine the predetermined distance based on the driving speed indicated by the speed information corresponding to the first judgment result when the first judgment result output from the judgment unit indicates an abnormality.

[0058] In addition, it may also be possible to further include a display control unit, which causes the display unit to display at least a portion of the map, and when the abnormal sequence determination unit determines that the first determination result and the second determination result are the same abnormal sequence, the first grid corresponding to the first determination result and the first grid corresponding to the second determination result are determined to be abnormal grids, and the display control unit causes the display unit to display at least a portion of the map in a manner such that the abnormal grid is displayed in a display format different from that of other grids.

[0059] In addition, it may also be that, when the abnormal sequence determination unit determines that the first determination result and the second determination result are the same abnormal sequence, when the first abnormal grid corresponding to the first determination result and the second abnormal grid corresponding to the second determination result are in a predetermined relationship, the grid existing between the first abnormal grid and the second abnormal grid is also determined to be the abnormal grid.

[0060] In addition, the vehicle information may further include speed information indicating the driving speed of the vehicle, and the abnormal sequence determination unit may determine the predetermined relationship based on the driving speed indicated by the speed information corresponding to the first judgment result when the first judgment result indicates an abnormality.

[0061] In addition, it may be that, when the abnormal sequence determination unit determines that the first determination result and the second determination result are the same abnormal sequence, when there is a grid adjacent to the first abnormal grid corresponding to the first determination result and the second abnormal grid corresponding to the second determination result, if the area ratio of the roads in the grid is less than the predetermined area ratio, the grid is also determined to be the abnormal grid.

[0062] A technical solution disclosed herein involves an abnormality detection method performed by an abnormality detection device, wherein the abnormality detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to a state of a vehicle located in the grid, the vehicle information including position information of the vehicle, the abnormality detection method comprising: obtaining the vehicle information; calculating an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid in the evaluation model, the evaluation grid comprising a first grid including a position of the vehicle indicated by the position information, and one or more second grids in a predetermined positional relationship with the first grid; determining whether the vehicle information is abnormal based on the abnormality degree; and outputting a determination result.

[0063] The above-described anomaly detection method determines whether vehicle information is abnormal based on an evaluation model of an evaluation grid that is in a predetermined positional relationship with the vehicle's location. Therefore, the above-described anomaly detection method can detect vehicle-related anomalies based on the evaluation model of a local area corresponding to the vehicle's location. Consequently, the above-described anomaly detection method can improve the accuracy of anomaly detection compared to conventional methods.

[0064] A technical solution disclosed herein relates to a program for causing an abnormality detection device to perform abnormality detection processing, wherein the abnormality detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to a state of a vehicle located in the grid, the vehicle information including position information of the vehicle, the abnormality detection processing comprising the following steps: a step of obtaining the vehicle information; a step of calculating an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid composed of a first grid including a position of the vehicle indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid; a step of determining whether the vehicle information is abnormal based on the abnormality degree; and a step of outputting a determination result.

[0065] The anomaly detection program determines whether vehicle information is abnormal based on an evaluation model for an evaluation grid that is in a predetermined positional relationship with the vehicle's location. Therefore, the anomaly detection program can detect vehicle-related anomalies based on the evaluation model for a local area corresponding to the vehicle's location. Consequently, the anomaly detection program can improve the accuracy of anomaly detection compared to conventional methods.

[0066] Hereinafter, with reference to the accompanying drawings, a specific example of an abnormality detection device involved in a technical solution of the present disclosure will be described. The embodiments shown here each represent a specific example of the present disclosure. Therefore, the numerical values, shapes, constituent elements, configurations and connection forms of constituent elements, as well as steps (processes) and the order of steps shown in the following embodiments are examples and are not intended to limit the present disclosure. In addition, each drawing is a schematic diagram and is not necessarily a strict illustration. In each drawing, the same reference numeral is attached to substantially the same structure, and repeated descriptions are omitted or simplified.

[0067] (Implementation Method)

[0068] Hereinafter, an abnormality detection device according to an embodiment will be described. This abnormality detection device is a device that detects abnormalities related to a vehicle, for example, abnormalities caused by a cyber attack on the vehicle.

[0069] <Composition of the abnormality detection device>

[0070] Figure 1 This is a block diagram showing an example of the configuration of the information processing system 1 that monitors abnormalities related to the vehicle 30 using the abnormality detection device 100 according to the embodiment.

[0071] like Figure 1 As shown, the information processing system 1 is configured to include a monitoring server 10 , a vehicle 30 , and a network 40 .

[0072] The monitoring server 10 is a so-called computer device, and includes a processor (not shown), a memory (not shown), a communication interface (not shown), a storage device (not shown), and a display (not shown).

[0073] The monitoring server 10 implements the abnormality detection device 100 and the display unit 130 by having the processor execute the program stored in the memory.

[0074] The vehicle 30 has a communication function and is equipped with the in-vehicle network 20. The vehicle 30 is, for example, a car.

[0075] The network 40 is a wide area network such as the Internet, and its connection destinations include the abnormality detection device 100 and the in-vehicle network 20 .

[0076] Figure 2 It is a block diagram showing an example of the configuration of the in-vehicle network 20 .

[0077] like Figure 2 As shown, the in-vehicle network 20 is configured to include an external communication device 210 , various ECUs (Electronic Control Units), and a bus 220 .

[0078] In the in-vehicle network 20 , communication is performed according to, for example, the CAN protocol. The in-vehicle network 20 is not necessarily limited to CAN, and may be, for example, a communication network based on Ethernet (registered trademark), FlexRay (registered trademark), or the like.

[0079] The bus 220 is connected to each ECU and the external communication device 210 , and transmits signals between the connected devices.

[0080] The external communication device 210 is connected to the network 40 and the bus 220 , and transmits signals flowing on the bus 220 to the network 40 and flows signals received from the network 40 into the bus 220 .

[0081] Examples of ECUs installed in vehicle 30 include those associated with the steering, brakes, engine, doors, and windows. An ECU is a device that includes, for example, a processor, memory, digital circuits, analog circuits, and communication circuits. The memory, such as ROM or RAM, can store programs executed by the processor. The ECU, for example, performs various functions by executing programs stored in the memory through the processor. Each ECU transmits and receives data via bus 220, for example, in accordance with the CAN protocol.

[0082] Each ECU transmits and receives data in accordance with the CAN protocol to and from bus 220. For example, it receives data from other ECUs from bus 220 and generates data containing information intended for transmission to other ECUs and transmits it to bus 220. Specifically, each ECU processes the received data in accordance with its content and generates and transmits data indicating the status of devices and sensors connected to the ECU, as well as instruction values ​​(control values) to other ECUs.

[0083] Figure 3 This is a block diagram showing an example of functions implemented by the monitoring server 10 .

[0084] like Figure 3 As shown, the monitoring server 10 implements the abnormality detection device 100 and the display unit 130 .

[0085] The abnormality detection device 100 is connected to the network 40 and the display unit 130. The abnormality detection device 100 performs an abnormality detection process for detecting an abnormality related to the vehicle 30, and outputs the result to the display unit 130. The abnormality detection process will be described later.

[0086] The display unit 130 is connected to the abnormality detection device 100 and displays an image based on a signal output from the abnormality detection device 100. The image displayed by the display unit 130 will be described later.

[0087] For example, a user who utilizes the information processing system 1 can recognize abnormality related to the vehicle 30 by visually recognizing the display content displayed on the display unit 130 .

[0088] Figure 4 This is a block diagram showing an example of the configuration of the abnormality detection device 100 .

[0089] like Figure 4 As shown, the abnormality detection device 100 includes an acquisition unit 1001 , a model storage unit 1002 , a determination unit 1003 , an abnormality sequence determination unit 1004 , an accumulation unit 1005 , and a display control unit 1006 .

[0090] The acquisition unit 1001 acquires vehicle information related to the state of the vehicle 30, and the vehicle information includes at least position information indicating the position of the vehicle 30. The acquisition unit 1001 sequentially acquires the vehicle information at predetermined time intervals, for example.

[0091] The acquisition unit 1001 communicates with the vehicle 30 via the network 40 , for example, to receive a vehicle control signal conforming to the communication protocol of the in-vehicle network 20 from the vehicle 30 , and acquires vehicle information by analyzing the received vehicle control signal.

[0092] Here, the vehicle information is described as including, in addition to the position information, speed information (sometimes simply referred to as "speed") indicating the travel speed of the vehicle 30. The vehicle information may also include, for example, curvature, acceleration, yaw rate, throttle opening, steering amount, gear position, and the like.

[0093] The acquisition unit 1001 sequentially outputs the sequentially acquired vehicle information to the determination unit 1003 and the accumulation unit 1005 , and holds the latest vehicle information.

[0094] The model storage unit 1002 stores an evaluation model for evaluating vehicle information of the vehicle 30 located in each of the plurality of grids of the map divided into a plurality of grids. The data structure of the evaluation model will be described later. Figure 8 Provide explanation.

[0095] Figure 5 is a schematic diagram showing an example of a map divided into a plurality of grids by regions. Here, it is assumed that the shape of each grid is as follows Figure 5The length of one side of the grid may be, for example, the width of the road on which the vehicle 30 travels, or the distance traveled per unit time by the vehicle 30, such as 50 meters.

[0096] Furthermore, although the shapes of the meshes are described here as being identical squares, they are not necessarily limited to identical squares and may be any shapes.

[0097] Back to Figure 4 The description of the abnormality detection device 100 continues.

[0098] Each time the acquisition unit 1001 sequentially acquires vehicle information, the determination unit 1003 first refers to the position information included in the vehicle information and, based on the position of the vehicle 30, determines an evaluation grid corresponding to the evaluation model referenced in the abnormality detection process. Here, the determination unit 1003 determines as the evaluation grid a grid consisting of a first grid including the position of the vehicle 30 indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid.

[0099] Next, the determination unit 1003 acquires the evaluation model of the determined evaluation grid from the model storage unit 1002. Then, based on the acquired evaluation model and the vehicle information, the determination unit 1003 calculates an abnormality degree indicating the degree of abnormality of the vehicle information.

[0100] Next, the determination unit 1003 determines whether the vehicle information is abnormal based on the calculated abnormality degree and outputs the determination result. In this case, if the calculated abnormality degree is above the threshold, and if the total amount of data used to create the evaluation model for each grid included in the evaluation grid, i.e., the number of evaluation data, is less than a first predetermined number, the determination unit 1003 corrects the abnormality degree to reduce the degree of abnormality and determines whether the vehicle information is abnormal based on the corrected abnormality degree. Here, if the calculated abnormality degree is above the threshold, and if the number of evaluation data is less than the first predetermined number, the determination unit 1003 corrects the abnormality degree by multiplying the abnormality degree by the ratio of the number of evaluation data to the first predetermined number.

[0101] Furthermore, when the calculated abnormality degree is above the threshold value, and the number of evaluation data is less than a second predetermined number that is smaller than the first predetermined number, the determination unit 1003 corrects the abnormality degree in such a manner as to reduce the abnormality degree to a level indicating that the vehicle information is normal, and determines whether the vehicle information is abnormal based on the corrected abnormality degree.

[0102] The accumulation unit 1005 stores the determination results and the position information corresponding to the determination results sequentially outputted from the determination unit 1003 in association with each other. Here, when the vehicle information is outputted from the acquisition unit 1001, the accumulation unit 1005 temporarily stores the vehicle information. Thereafter, when the determination result corresponding to the vehicle information is outputted from the determination unit 1003, the accumulation unit 1005 stores the determination result in association with the vehicle information. The data structure of the vehicle information stored in the accumulation unit 1005 before being associated with the determination result will be described later. Figure 6 Provide explanation.

[0103] The abnormal sequence determination unit 1004 obtains the determination results sequentially output from the determination unit 1003 (hereinafter, such determination results are referred to as "first determination results"). Furthermore, when the first determination result indicates an abnormality, and when the second determination result previously stored in the accumulation unit 1005 indicates an abnormality, the abnormal sequence determination unit 1004 determines that the first and second determination results are the same abnormal sequence if the distance between the first position indicated by the first position information corresponding to the first determination result and the second position indicated by the second position information associated with the second determination result is less than a predetermined distance, and outputs the determination result.

[0104] Furthermore, when the abnormal sequence determination unit 1004 determines that the first determination result and the second determination result are the same abnormal sequence, it specifies the first mesh corresponding to the first determination result and the first mesh corresponding to the second determination result as abnormal meshes.

[0105] In addition, when the abnormal sequence determination unit 1004 determines that the first determination result and the second determination result are the same abnormal sequence, when the first abnormal grid corresponding to the first determination result and the second abnormal grid corresponding to the second determination result are in a predetermined relationship, the grid existing between the first abnormal grid and the second abnormal grid is also determined to be an abnormal grid.

[0106] Furthermore, when the abnormal sequence determination unit 1004 determines that the first and second determination results are the same abnormal sequence, if there is a grid adjacent to the first abnormal grid and the second abnormal grid, then if the area ratio of the roads in the grid is less than a predetermined area ratio, the grid is also determined to be an abnormal grid.

[0107] When the abnormal sequence determination unit outputs a determination result indicating that the first determination result and the second determination result are the same abnormal sequence, the accumulation unit 1005 associates the same abnormal sequence identifier with the vehicle information associated with the first determination result and the vehicle information associated with the second determination result, and stores the associated vehicle information. The data structure of the vehicle information stored in the accumulation unit 1005 after being associated with the determination result obtained by the determination unit 1003 and the abnormal sequence identifier will be described later. Figure 7 Provide explanation.

[0108] The display control unit 1006 causes the display unit 130 to display at least a portion of the map divided into a plurality of grids. More specifically, the display control unit 1006 causes the display unit 130 to display at least a portion of the map such that the abnormal grid identified by the abnormal sequence determination unit 1004 is displayed in a different display format than the other grids.

[0109] Data Structure

[0110] Next, the structure of data processed by the abnormality detection device 100 will be described.

[0111] Figure 6 1003 is a schematic diagram showing an example of the data structure of vehicle information stored in the accumulation unit 1005 before being associated with the determination result obtained by the determination unit 1003 .

[0112] The vehicle information is generated each time the acquisition unit 1001 receives a vehicle control signal from the vehicle 30 via the network 40 and analyzes the vehicle control signal.

[0113] like Figure 6 As shown, the vehicle information before being associated with the judgment result is composed of an identifier of the vehicle information, namely the vehicle information ID, an identifier of the vehicle 30, namely the vehicle ID, a timestamp, position information indicating the position of the vehicle 30, an identifier of the grid including the position of the vehicle 30 (i.e., the first grid), namely the grid ID, and information indicating the driving state of the vehicle 30 (here, the driving speed, steering angle, yaw rate, longitudinal acceleration, and lateral acceleration).

[0114] Figure 7 This is a schematic diagram showing an example of the data structure of vehicle information stored in the accumulation unit 1005 and associated with the determination result obtained by the determination unit 1003 and the abnormality sequence identifier.

[0115] like Figure 7 As shown, the vehicle information after being associated with the judgment result and the abnormal sequence identifier is relative to Figure 6The vehicle information shown before being associated with the determination result is configured to further include the determination result obtained by the determination unit 1003 , the abnormality degree calculated by the determination unit 1003 , and the abnormal sequence ID, which is an identifier of the abnormal sequence determined by the abnormal sequence determination unit 1004 .

[0116] Figure 8 This is a schematic diagram showing an example of the data structure of the evaluation model stored in the model storage unit 1002 .

[0117] like Figure 8 As shown, the evaluation model is composed of a grid identifier, i.e., a grid ID, the longitude and latitude of the four corners of the grid area for determining the grid area, the amount of data used when generating the evaluation model, and the minimum value (MIN) and maximum value (MAX) of information representing the driving state of the vehicle (here, the driving speed, steering angle, yaw rate, longitudinal acceleration, and lateral acceleration).

[0118] The determination unit 1003 calculates the abnormality level based on, for example, the degree to which the vehicle's driving state indicated by the vehicle information deviates from the maximum value or the minimum value indicated by the evaluation model.

[0119] Furthermore, for example, when there are a plurality of evaluation grids, the determination unit 1003 calculates the abnormality degree based on the degree of deviation from the largest maximum value or the smallest minimum value indicated by the plurality of evaluation models.

[0120] Alternatively, the determination unit 1003 may use a pre-learned machine learning model to calculate the abnormality based on the vehicle information and the evaluation model. In this case, the evaluation model does not necessarily need to include the maximum and minimum values ​​of the information representing the vehicle's driving state.

[0121] <Operation of the abnormality detection device>

[0122] As described above, the abnormality detection device 100 performs an abnormality detection process for detecting an abnormality associated with the vehicle 30 .

[0123] Hereinafter, the abnormality detection process performed by the abnormality detection device 100 will be described.

[0124] Figure 9 This is a flowchart of the abnormality detection process.

[0125] Figure 10 This is a sequence diagram of the information processing system 1 when the abnormality detection device 100 performs abnormality detection processing.

[0126] The abnormality detection process is started when the vehicle 30 transmits a vehicle control signal to the abnormality detection device 100 via the network 40 (step S10 ).

[0127] The vehicle control signal may be, for example, a CAN message or a signal measured by a sensor mounted on the vehicle 30 or a device external to the vehicle 30. Here, a CAN message refers to data transmitted and received between ECUs via the bus 220 in accordance with the CAN protocol.

[0128] When the abnormality detection process starts, the acquisition unit 1001 receives a vehicle control signal and acquires vehicle information by analyzing the received vehicle control signal (step S11 ).

[0129] When the vehicle information is obtained, the determination unit 1003 refers to the position information included in the vehicle information and determines the evaluation grid corresponding to the evaluation model referenced in the abnormality detection process based on the position of the vehicle 30 (step S12). The specific method of determining the evaluation grid will be described later. Figures 11 to 14C Provide explanation.

[0130] When the evaluation grid is determined, the determination unit 1003 obtains the evaluation model of the determined evaluation grid from the model storage unit 1002 and calculates the abnormality degree indicating the degree of abnormality of the vehicle information based on the obtained evaluation model and the vehicle information (step S13 ).

[0131] When the abnormality is calculated, the determination unit 1003 corrects the abnormality based on the number of evaluation data (step S14). Figure 15 Provide explanation.

[0132] When the abnormality is corrected, the determination unit 1003 determines whether the vehicle information is abnormal based on the corrected abnormality (step S15). Figure 16 Provide explanation.

[0133] When determining whether the vehicle information is abnormal, the abnormal sequence determination unit 1004 determines that the first determination result output from the determination unit 1003 indicates that it is abnormal, and when the second determination result stored in the accumulation unit 1005 last time indicates that it is abnormal, if the distance between the first position indicated by the first position information corresponding to the first determination result and the second position indicated by the second position information associated with the second determination result is less than a predetermined distance, the first determination result and the second determination result are determined to be the same abnormal sequence (step S16). Regarding the specific abnormal sequence determination method, the following will be used later. Figure 17 、 Figure 18 Provide explanation.

[0134] When an abnormal sequence is determined, the abnormal sequence determination unit 1004 interpolates the abnormal grid (step S17). The specific method of interpolating the abnormal grid will be described later. Figure 19 、 Figure 20 Provide explanation.

[0135] When the abnormal grid is fully interpolated, the display control unit 1006 controls the display content by outputting a display signal to the display unit 130 so that the abnormal grid is displayed in a display format different from other grids, causing the display unit 130 to display at least a portion of the map divided into multiple grids (step S18).

[0136] When the process of step S18 is completed, the abnormality detection device 100 ends the abnormality detection process.

[0137] In the abnormality detection process, when a display signal is output, the display unit 130 obtains the display signal and displays an image based on the obtained display signal (step S19). Figure 21 An example of an image displayed on the display unit 130 will be described.

[0138] Figure 11 1003 is a flowchart showing an example of a method for determining an evaluation mesh by the determination unit 1003. This method is an example of a method for determining meshes located radially from a first mesh including the vehicle 30 as a second mesh.

[0139] If the speed of vehicle 30 indicated by the speed information is lower than a first speed (e.g., 30 kilometers per hour), that is, if vehicle 30 is traveling at a low speed (step S21: traveling at a low speed), determination unit 1003 determines as a second grid eight grids located radially from the first grid, excluding the first grid from a total of nine grids in a "3×3 grid" centered on the first grid (step S22). In other words, the 3×3 grid including the first grid is determined as the evaluation grid.

[0140] Figure 12A Schematic diagram showing the eight meshes determined by the determination unit 1003 .

[0141] If the speed of vehicle 30 indicated by the speed information is greater than or equal to the first speed and less than or equal to the second speed (e.g., 60 kilometers per hour), that is, if vehicle 30 is traveling at a medium speed (step S21: traveling at a medium speed), determination unit 1003 determines that 24 grids located radially from the first grid are the second grids, excluding the first grid from the total of 25 grids in the "5×5 grid" centered on the first grid (step S23). In other words, the 5×5 grid including the first grid is determined as the evaluation grid.

[0142] Figure 12B Schematic diagram showing the 24 meshes determined by the determination unit 1003 .

[0143] If the speed of vehicle 30 indicated by the speed information is greater than or equal to the second speed, that is, if vehicle 30 is traveling at a high speed (step S21: traveling at a high speed), determination unit 1003 determines that 48 grids located radially from the first grid are the second grids, excluding the first grid from the total of 49 grids in the "7×7 grid" centered on the first grid (step S24). In other words, the 7×7 grid including the first grid is determined as the evaluation grid.

[0144] Figure 12C Schematic diagram showing the 48 meshes determined by the determination unit 1003 .

[0145] In this way, when the determination unit 1003 determines the predetermined position relationship as the first predetermined position relationship when the traveling speed of the vehicle 30 is lower than the first speed, and determines the predetermined position relationship as the second predetermined position relationship when the traveling speed is higher than the first speed, the first predetermined position relationship and the second predetermined position relationship are determined in such a manner that the number of the second grids in the second predetermined position relationship is greater than the number of the second grids in the first predetermined position relationship.

[0146] Figure 13 1003 is a flowchart showing another example of a method for determining an evaluation grid by the determination unit 1003. This method is an example of a method for determining a grid located in a specific direction relative to a first grid including the vehicle 30 as a second grid.

[0147] If the speed of vehicle 30 indicated by the speed information is lower than a first speed (e.g., 30 kilometers per hour), that is, if vehicle 30 is traveling at a low speed (step S31: traveling at a low speed), determination unit 1003 determines as a second grid eight grids located radially from the first grid, excluding the first grid from a total of nine grids in a "3×3 grid" centered on the first grid (step S32). In other words, the 3×3 grid including the first grid is determined as the evaluation grid.

[0148] Figure 14A Schematic diagram showing the eight meshes determined by the determination unit 1003 .

[0149] If the speed of vehicle 30 indicated by the speed information is greater than or equal to the first speed and less than or equal to the second speed (e.g., 60 kilometers per hour), that is, if vehicle 30 is traveling at a medium speed (step S31: traveling at a medium speed), determination unit 1003 determines that a total of 14 grids, which are the 8 grids plus the 3 grids located in front of the vehicle in the direction of travel and the 3 grids located behind the vehicle in the direction of travel, are the second grids (step S33). In other words, the 3×3 grid including the first grid and the 3 grids located in front and behind the vehicle in the direction of travel are determined as evaluation grids.

[0150] Figure 14B Schematic diagram showing the 14 meshes determined by the determination unit 1003 .

[0151] If the speed of vehicle 30 indicated by the speed information is greater than or equal to the second speed, that is, if vehicle 30 is traveling at a high speed (step S31: traveling at a high speed), determination unit 1003 determines that a total of 20 grids, which are the 14 grids plus three grids located in front of the vehicle in the direction of travel and three grids located behind the vehicle in the direction of travel, are the second grids (step S34). In other words, the 3×3 grid including the first grid and the six grids located in front and behind the vehicle in the direction of travel are determined as evaluation grids.

[0152] Figure 14C Schematic diagram showing the 20 meshes determined by the determination unit 1003 .

[0153] In this way, when the determination unit 1003 determines the predetermined position relationship as the first predetermined position relationship when the traveling speed of the vehicle 30 is lower than the first speed, and determines the predetermined position relationship as the second predetermined position relationship when the traveling speed is greater than the first speed, the first predetermined position relationship and the second predetermined position relationship are determined in such a manner that the number of second grids in the second grid in the second predetermined position relationship that are arranged from the first grid toward the first direction (here, the direction of travel of the vehicle) is greater than the number of second grids in the second grid in the first predetermined position relationship that are arranged from the first grid toward the first direction.

[0154] Figure 15 This is a flowchart showing an example of a method for correcting the abnormality level performed by the determination unit 1003 .

[0155] When generating an evaluation model, a certain amount of data is required to ensure the comprehensiveness (inclusiveness) of the data within the grid. However, since the map area is divided into multiple grids, the amount of data used to generate the evaluation model may vary for each grid. Therefore, if the amount of data used to generate the evaluation model is insufficient, the determination unit 1003 corrects the abnormality degree so that the insufficient data amount is reflected in the abnormality degree.

[0156] The determination unit 1003 uses the abnormality degree indicating abnormality as the target for abnormality degree correction. Therefore, the determination unit 1003 determines whether the abnormality degree is greater than the threshold indicating abnormality (step S41). If the abnormality degree is determined to be less than the threshold (step S41: No), the abnormality degree is not corrected.

[0157] When determining that the abnormality level is equal to or greater than the threshold (step S41 : Yes), the determination unit 1003 checks the total number of evaluation data used to create the evaluation model for each grid included in the evaluation grid (step S42 ).

[0158] In the processing of step S42, when the number of evaluation data is greater than the first predetermined number indicating that the number of data used in generating the evaluation model is sufficient (step S42: first predetermined number ≤ number of evaluation data), since the number of data used in generating the evaluation model is sufficient, the judgment unit 1003 does not correct the abnormality.

[0159] Here, the first predetermined number may be, for example, a number obtained by multiplying the number of grids included in the evaluation grid by a pre-calculated number indicating that the amount of data used to generate the evaluation model per grid is sufficient.

[0160] In the process of step S42, if the amount of evaluation data is greater than or equal to the second predetermined amount, indicating that the amount of data used to generate the evaluation model is insufficient, and less than the first predetermined amount (step S42: second predetermined amount ≤ amount of evaluation data < first predetermined amount), since the amount of data used to generate the evaluation model is insufficient but not inadequate, the determination unit 1003 corrects the abnormality degree to reduce the degree of abnormality (step S44). In this case, the determination unit 1003 corrects the abnormality degree by multiplying the abnormality degree by the ratio of the amount of evaluation data to the first predetermined amount.

[0161] Here, the second predetermined number may be, for example, a number obtained by multiplying the number of meshes included in the evaluation mesh by a precalculated number indicating that the number of data used to generate the evaluation model is insufficient per mesh.

[0162] In the processing of step S42, when the number of evaluation data is less than the second predetermined number (number of evaluation data < second predetermined number), since the number of data used in generating the evaluation model is insufficient, the judgment unit 1003 corrects the abnormality degree in a manner that reduces the abnormality degree to a level indicating that the vehicle information is normal, that is, to a normal value (step S43).

[0163] Figure 16 This is a flowchart showing an example of a determination method performed by the determination unit 1003 to determine whether the vehicle information is abnormal.

[0164] The judging unit 1003 judges that the Figure 15 The abnormality degree corrected using the illustrated abnormality degree correction method or the uncorrected abnormality degree is determined to be above a threshold indicating abnormality (step S51). If the determination unit 1003 determines in step S51 that the abnormality degree is above the threshold (step S51: Yes), it determines that the vehicle information is abnormal (step S53). If the abnormality degree is below the threshold (step S51: No), it determines that the vehicle information is normal (step S52). Furthermore, the storage unit 1005 stores the determination result obtained by the determination unit 1003 in association with the vehicle information (step S54).

[0165] Figure 17 This is a flowchart showing an example of a method for determining an abnormal sequence by the abnormal sequence determination unit 1004 .

[0166] When the determination unit 1003 determines that the vehicle information is abnormal, the abnormality sequence determination unit 1004 determines whether the abnormality is part of the same abnormality sequence that has occurred consecutively with previously determined abnormalities. The result of this determination can be used, for example, to notify the driver of the vehicle 30 or to analyze the abnormality response by analysts.

[0167] When the determination unit 1003 determines whether the vehicle information is abnormal, the abnormal sequence determination unit 1004 checks whether the determination result (hereinafter also referred to as “first determination result”) is abnormal (step S61 ).

[0168] In the process of step S61, if the first determination result is "normal" (step S61: No), the abnormal sequence determination unit 1004 does not determine that the first determination result is the same abnormal sequence as the other determination results. Therefore, the accumulation unit 1005 assigns information that does not indicate a specific abnormal sequence, such as the symbol "-", to the abnormal sequence ID of the vehicle information corresponding to the first determination result and stores the vehicle information.

[0169] In the processing of step S61, when the first judgment result is "abnormal" (step S61: yes), the abnormal sequence judgment unit 1004 calculates the moving distance of the vehicle 30 from the first position to the second position based on the first position represented by the vehicle information corresponding to the first judgment result and the second position represented by the latest vehicle information stored in the accumulation unit 1005, that is, the vehicle information of the judgment result determined to be abnormal by the judgment unit 1003 (hereinafter also referred to as the "second judgment result") (step S62).

[0170] When the moving distance of the vehicle 30 is calculated, the abnormal sequence determination unit 1004 determines whether the moving distance of the vehicle is less than a predetermined distance (step S63 ).

[0171] If, during the processing of step S63, it is determined that the vehicle's travel distance is less than the predetermined distance (step S63: Yes), the abnormal sequence determination unit 1004 determines that the first and second determination results are the same abnormal sequence (step S64). Therefore, the accumulation unit 1005 assigns the same abnormal sequence ID to the vehicle information corresponding to the first determination result as to the abnormal sequence ID of the vehicle information corresponding to the second determination result, and stores the vehicle information.

[0172] If, during the processing of step S63, it is determined that the vehicle's travel distance is greater than the predetermined distance (step S63: No), the abnormal sequence determination unit 1004 determines that the first and second determination results are not the same abnormal sequence (step S65). Therefore, the accumulation unit 1005 assigns a new abnormal sequence ID, different from the abnormal sequence ID of the vehicle information corresponding to the second determination result, to the abnormal sequence ID of the vehicle information corresponding to the first determination result, and stores the vehicle information.

[0173] Figure 18 This is a flowchart showing another example of the abnormal sequence determination method performed by the abnormal sequence determination unit 1004 .

[0174] Figure 17 The method of determining an abnormal sequence illustrated is an example of a determination method when the predetermined distance is a fixed value. Figure 18 The abnormal sequence determination method shown is an example of a determination method in the case where the predetermined distance is determined based on the traveling speed of the vehicle 30 .

[0175] therefore, Figure 18 The method for determining abnormal sequences is compared with Figure 17 The illustrated abnormal sequence determination method can determine abnormal sequences more accurately.

[0176] Figure 18 The method of determining abnormal sequence shown in the example becomes relative to Figure 17The illustrated abnormal sequence determination method includes the addition of the processing of step S76 to step S79. Therefore, the description here will focus on the processing of step S76 to step S79.

[0177] When the travel distance of the vehicle 30 is calculated in the process of step S62 , the abnormal sequence determination unit 1004 checks the travel speed of the vehicle 30 indicated by the speed information (step S76 ).

[0178] In the processing of step S76, when the driving speed of the vehicle 30 is lower than the first speed (for example, 30 kilometers per hour), that is, when the vehicle 30 is traveling at a low speed (step S76: traveling at a low speed), the abnormal sequence determination unit 1004 determines the predetermined distance as 5 meters (step S77).

[0179] In the processing of step S76, when the driving speed of the vehicle 30 is greater than the first speed and less than the second speed (for example, 60 kilometers per hour), that is, when the vehicle 30 is traveling at a medium speed (step S76: medium speed driving), the abnormal sequence determination unit 1004 determines the predetermined distance as 15 meters (step S78).

[0180] In the process of step S76 , if the traveling speed of the vehicle 30 is equal to or higher than the second speed, that is, if the vehicle 30 is traveling at high speed (step S76 : traveling at high speed), the abnormal sequence determination unit 1004 determines the predetermined distance to be 30 meters (step S79 ).

[0181] When the process of step S77, the process of step S78, or the process of step S79 is completed, the process proceeds to step S63.

[0182] Figure 19 This is a flowchart showing an example of an abnormal grid interpolation method performed by the abnormal sequence determination unit 1004 .

[0183] In cases where the vehicle 30 is traveling at a high speed relative to the grid size, or where the position information does not accurately represent the position of the vehicle 30 due to noise or other factors, abnormal grids corresponding to the same abnormal sequence may not necessarily be adjacent to each other. If abnormal grids corresponding to the same abnormal sequence are not adjacent to each other, by also identifying the grids between these abnormal grids as abnormal grids, the section where the abnormality associated with the vehicle 30 occurred can be more accurately identified.

[0184] The abnormal sequence determination unit 1004 obtains vehicle information assigned with the same abnormal sequence ID from the vehicle information stored in the accumulation unit 1005 (step S81), and checks whether there are abnormal grids that are not adjacent to each other in the abnormal grids corresponding to the determination result that they are the same abnormal sequence (step S82).

[0185] In the process of step S82 , when there are no abnormal grids that are not adjacent to each other (step S82 : No), the abnormal sequence determination unit 1004 ends the process.

[0186] In the process of step S82 , when there are abnormal grids that are not adjacent to each other (step S82 : Yes), the abnormal sequence determination unit 1004 checks the traveling speed of the vehicle 30 indicated by the speed information (step S83 ).

[0187] In the processing of step S83, when the driving speed of the vehicle 30 is lower than the first speed (for example, 30 kilometers per hour), that is, when the vehicle 30 is traveling at a low speed (step S83: traveling at a low speed), the abnormal sequence determination unit 1004 determines the number of abnormal grids to be interpolated to be 1 grid (step S84).

[0188] In the processing of step S83, when the driving speed of the vehicle 30 is greater than the first speed and less than the second speed (for example, 60 kilometers per hour), that is, when the vehicle 30 is traveling at a medium speed (step S83: traveling at a medium speed), the abnormal sequence determination unit 1004 determines the number of abnormal grids to be interpolated to be less than 2 grids (step S85).

[0189] In the processing of step S83, when the traveling speed of the vehicle 30 is greater than or equal to the second speed, that is, when the vehicle 30 is traveling at a high speed (step S83: traveling at a high speed), the abnormal sequence determination unit 1004 determines the number of abnormal grids to be interpolated to be less than or equal to 3 grids (step S86).

[0190] When the number of abnormal grids to be interpolated is determined by the processing of step S84, step S85, or step S86, the abnormal sequence determination unit 1004 determines whether the number of grids between non-adjacent abnormal grids is the determined number of abnormal grids (step S87).

[0191] In the process of step S87 , if the number of grids between mutually non-adjacent abnormal grids is the number of identified abnormal grids (step S87 : Yes), the abnormal sequence determination unit 1004 interpolates the abnormal grids by also identifying the grids between the abnormal grids as abnormal grids (step S88 ).

[0192] In the process of step S87 , if the number of grids between the non-adjacent abnormal grids is not the number of determined abnormal grids (step S87 : No), the abnormal sequence determination unit 1004 does not determine the grids between the abnormal grids as abnormal grids and does not interpolate abnormal grids.

[0193] Figure 20 This is a flowchart showing another example of the abnormal grid interpolation method performed by the abnormal sequence determination unit 1004 .

[0194] When a map area is divided into multiple grids, grids may sometimes contain a relatively small ratio of roads to the area of ​​the grid. When the ratio of roads to the area of ​​a grid is relatively small, it is difficult to obtain vehicle information in that grid. Therefore, it is conceivable that a grid that should be identified as an abnormal grid may not be so. Therefore, by also identifying grids with a relatively small ratio of roads to the area of ​​the grid and having two or more abnormal grids in adjacent grids as abnormal grids on the travel path of vehicle 30, grids with relatively small ratios of roads to the area of ​​the grid can be identified as abnormal grids.

[0195] The abnormal sequence determination unit 1004 acquires vehicle information to which the same abnormal sequence ID is assigned from the vehicle information stored in the accumulation unit 1005 (step S91 ).

[0196] When the vehicle information is acquired, the abnormal sequence determination unit 1004 acquires map information in the vicinity of the abnormal grid corresponding to the acquired vehicle information (step S92 ).

[0197] When the map information is acquired, the abnormal sequence determination unit 1004 determines whether there is a grid on the travel path of the vehicle 30 that has not been identified as an abnormal grid and has a road area ratio smaller than a predetermined area ratio based on the map information (step S93 ).

[0198] In the process of step S93 , if there is a matching grid (step S93 : Yes), the abnormal sequence determination unit 1004 determines whether the matching grid is adjacent to two or more abnormal grids (step S94 ).

[0199] In the process of step S93 , if there is no matching mesh (step S93 : No), the abnormal sequence determination unit 1004 ends the process.

[0200] In the process of step S94 , when two or more abnormal grids are adjacent (step S94 : Yes), the abnormal sequence determination unit 1004 interpolates the abnormal grid by also identifying the corresponding grid as an abnormal grid (step S95 ).

[0201] In the process of step S94 , when there are not two or more abnormal grids adjacent to each other (step S94 : No), the abnormal sequence determination unit 1004 does not identify the corresponding grid as an abnormal grid and does not interpolate the abnormal grid.

[0202] When the abnormal sequence determination unit 1004 interpolates all abnormal grids, the display control unit 1006 causes the display unit 130 to display at least a portion of the map divided into a plurality of grids so that the abnormal grid is displayed in a different display format from other grids.

[0203] Figure 21 1 is a schematic diagram showing an example of an image displayed on the display unit 130 by the display control unit 1006. Figure 21 In FIG. 1 , the grids hatched with oblique lines are abnormal grids determined by the abnormal sequence determination unit 1004 , and the black dots are positions of the vehicles 30 indicated by the vehicle information determined to be abnormal by the determination unit 1003 .

[0204] In this way, the display control unit 1006 can cause the display unit 130 to effectively display the detection results obtained by the abnormality detection device 100 so as to play a role in notifying the driver of the vehicle 30 and analyzing the abnormality by analysts.

[0205] <Inspection>

[0206] As described above, abnormality detection device 100 determines whether vehicle information is abnormal based on the evaluation model of the evaluation grid that is in a predetermined positional relationship with the position of vehicle 30. Therefore, abnormality detection device 100 can detect vehicle-related abnormalities based on the evaluation model of the local area corresponding to the position of vehicle 30. Consequently, abnormality detection device 100 can improve the accuracy of abnormality detection compared to conventional methods.

[0207] Furthermore, the anomaly detection device 100 can appropriately determine the range of the grid used as the evaluation grid based on the vehicle 30's travel speed. Furthermore, if the amount of data used to generate the evaluation model varies for each grid due to the division of the map area into multiple grids, resulting in insufficient data for generating the evaluation model, the anomaly detection device 100 can correct the anomaly degree so that this insufficient data is reflected in the anomaly degree. Furthermore, the anomaly detection device 100 can group anomalies that have occurred consecutively from previously determined anomalies into the same anomaly sequence.

[0208] As described above, according to the abnormality detection device 100 , abnormality related to the vehicle 30 can be detected efficiently.

[0209] (Replenish)

[0210] As described above, as examples of the technology disclosed in this application, descriptions are given based on embodiments. However, the present disclosure is not limited to these embodiments. As long as they do not depart from the purport of the present disclosure, various modifications that one skilled in the art would conceive of and implement in this embodiment, and methods of combining constituent elements in different embodiments to construct these embodiments, may also be included within the scope of one or more technical solutions of the present disclosure.

[0211] (1) In the embodiment, the abnormality detection device 100 is described as including the abnormality sequence determination unit 1004, the accumulation unit 1005, and the display control unit 1006. Alternatively, as another example, the abnormality detection device 100 may not include the abnormality sequence determination unit 1004, the accumulation unit 1005, and the display control unit 1006, and the abnormality sequence determination unit 1004, the accumulation unit 1005, and the display control unit 1006 may be implemented by an external device. In this case, the abnormality sequence determination unit 1004, the accumulation unit 1005, and the display control unit 1006 may be implemented by, for example, the monitoring server 10.

[0212] (2) In the embodiment, the map divided into a plurality of grids may be a pre-prepared map or a dynamically generated map such as a dynamic map. In the case of a dynamically generated map, for example, the evaluation model may be updated each time a new map is generated.

[0213] (3) In the embodiment, the abnormality detection device 100 detects an abnormality related to the vehicle 30, for example, caused by a cyber attack on the vehicle 30. However, the abnormality detection device 100 detects an abnormality related to the vehicle 30, for example, is not limited to this. The abnormality detection device 100 can also detect an abnormality related to, for example, the driver's operation of the vehicle 30. For example, a false start can be detected based on the amount of depression of the accelerator pedal.

[0214] (4) In the embodiment, the vehicle 30 is described as an automobile as an example. However, the vehicle 30 is not limited to an automobile. The vehicle 30 may also be, for example, a mobile vehicle such as construction machinery, agricultural machinery, a ship, a train, or an airplane. In other words, the abnormality detection device 100 can also detect abnormalities related to mobility or a mobile network or mobile network system during mobility.

[0215] (5) In the embodiment, the branch destinations in step S21, step S31, step S63, and step S83 are described as being three: low-speed driving, medium-speed driving, and high-speed driving. However, the branch destinations are not limited to these. The branch destinations may be two or more.

[0216] (6) Some or all of the components included in the abnormality detection device 100 may be implemented as dedicated or general-purpose circuits.

[0217] Some or all of the components of abnormality detection device 100 may be implemented, for example, as a system LSI (Large Scale Integration). A system LSI is a highly multifunctional LSI that integrates multiple components onto a single chip. Specifically, it is a computer system consisting of a microprocessor, ROM (Read Only Memory), and RAM (Random Access Memory). RAM stores computer programs. The microprocessor operates according to the computer program, enabling the system LSI to achieve its functions.

[0218] Although referred to here as a system LSI, it is sometimes also referred to as an IC, LSI, super LSI, or ultra LSI, depending on the degree of integration. Furthermore, integrated circuitry is not limited to LSIs and can also be achieved through dedicated circuits or general-purpose processors. Alternatively, an FPGA (Field Programmable Gate Array) that can be programmed after LSI fabrication or a reconfigurable processor that can reconfigure the connections and / or settings of circuit cells within the LSI can be utilized.

[0219] Furthermore, if semiconductor technology or other derivative technologies lead to the emergence of integrated circuit technology that replaces LSI, it is natural to use this technology to integrate functional blocks. Applications in biotechnology, etc. are also possible.

[0220] (7) One technical solution of the present disclosure is not only the abnormality detection device 100, but also an abnormality detection method having the characteristic components of the abnormality detection device 100 as steps. Furthermore, one technical solution of the present disclosure is also a computer program that causes a computer to execute the characteristic steps of the abnormality detection method. Furthermore, one technical solution of the present disclosure is also a computer-readable non-transitory recording medium having such a computer program recorded thereon.

[0221] Industrial applicability

[0222] The present disclosure can be widely utilized in an abnormality detection device that detects abnormalities related to vehicles.

[0223] Description of labels

[0224] 1 Information processing system; 10 Monitoring server; 20 In-vehicle network; 30 Vehicle; 40 Network; 100 Abnormality detection device; 130 Display unit; 210 External communication device; 220 Bus; 1001 Acquisition unit; 1002 Model storage unit; 1003 Determination unit; 1004 Abnormal sequence determination unit; 1005 Accumulation unit; 1006 Display control unit.

Claims

1. An anomaly detection device comprising: an acquiring unit configured to acquire vehicle information related to a state of a vehicle, the vehicle information including position information indicating a position of the vehicle; a model storage unit storing, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating the vehicle information of the vehicle located in the grid; and a determination unit that calculates an abnormality degree indicating a degree of abnormality in the vehicle information based on an evaluation model for an evaluation grid in the evaluation model and the vehicle information, determines whether the vehicle information is abnormal based on the abnormality degree, and outputs a determination result, wherein the evaluation grid is composed of a first grid including the position of the vehicle indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid. When the abnormality degree is greater than a threshold value, and when the total number of data used when generating an evaluation model for each grid included in the evaluation grid, that is, the number of evaluation data, is less than a first predetermined number, the determination unit corrects the abnormality degree in such a manner as to reduce the abnormality degree, and determines whether the vehicle information is abnormal based on the corrected abnormality degree.

2. The abnormality detection device according to claim 1, The determination unit determines that the vehicle information is abnormal when the abnormality level is equal to or greater than a threshold value.

3. The abnormality detection device according to claim 1, When the abnormality level is equal to or greater than the threshold value and the number of evaluation data is less than a second predetermined number that is smaller than the first predetermined number, the determination unit corrects the abnormality level so as to reduce the abnormality level to a level indicating that the vehicle information is normal.

4. The abnormality detection device according to claim 1, When the abnormality level is equal to or greater than the threshold value and the number of evaluation data is less than the first predetermined number, the determination unit corrects the abnormality level by multiplying the abnormality level by a ratio of the number of evaluation data to the first predetermined number.

5. An anomaly detection method, performed by an anomaly detection device, wherein the anomaly detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to the state of a vehicle located in the grid, the vehicle information including position information of the vehicle, the anomaly detection method comprising: obtaining the vehicle information; calculating an abnormality degree indicating a degree of abnormality in the vehicle information based on an evaluation model for an evaluation grid in the evaluation model, the evaluation grid including a first grid including the position of the vehicle indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid; determining whether the vehicle information is abnormal based on the abnormality degree; as well as Output the judgment result, In the abnormality detection method, when the abnormality degree is above a threshold value, and when the total number of data used when generating the evaluation model of each grid included in the evaluation grid, that is, the number of evaluation data, is less than a first predetermined number, the abnormality degree is corrected in such a manner as to reduce the degree of abnormality, and whether the vehicle information is abnormal is determined based on the corrected abnormality degree.

6. A program recording medium recording a program for causing an anomaly detection device to execute an anomaly detection process, wherein the anomaly detection device stores, for each of a plurality of grids of a map divided into a plurality of grids, an evaluation model for evaluating vehicle information related to the state of a vehicle located in the grid, the vehicle information including position information of the vehicle. The anomaly detection process includes the following steps: The step of obtaining the vehicle information; a step of calculating an abnormality degree indicating a degree of abnormality of the vehicle information based on an evaluation model for an evaluation grid composed of a first grid including the position of the vehicle indicated by the position information and one or more second grids having a predetermined positional relationship with the first grid; a step of determining whether the vehicle information is abnormal based on the abnormality degree; as well as Steps for outputting the judgment results, In the abnormality detection process, when the abnormality degree is above a threshold value, and when the total number of data used when generating the evaluation model of each grid included in the evaluation grid, that is, the number of evaluation data, is less than a first predetermined number, the abnormality degree is corrected in such a manner as to reduce the degree of abnormality, and whether the vehicle information is abnormal is determined based on the corrected abnormality degree.

7. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the anomaly detection method according to claim 5 is implemented.

Images