Anomaly detection device, anomaly detection system, and anomaly detection method

Abstract

Anomaly detection device (100) has: flow collection unit (110), collect the network system (10) of vehicle network of 2 or more networks each of 2 or more networks flow traffic, the flow traffic is for the information of 1 or more frames about traffic after being classified based on the specified rule of network protocol header information;And anomaly determination unit (140), based on the flow traffic, calculate the observation ratio as the ratio of the communication between 2 or more networks, based on the calculated observation ratio and the normal ratio as the ratio of the communication between 2 or more networks in normal time, determine whether 2 or more networks are abnormal.

Description

Technical Field

[0001] This invention relates to anomaly detection devices, anomaly detection systems, and anomaly detection methods. Background Technology

[0002] In recent years, vehicles have been equipped with numerous devices called Electronic Control Units (ECUs). The network connecting these ECUs is called the vehicle network.

[0003] In vehicular networks, control frames are sent and received to instruct vehicles on actions such as moving, stopping, and turning. For example, in cases where a malicious attacker performs an attack disguised as a legitimate ECU to send control frames, or a DoS attack aimed at preventing specific control frames from being received, not only vehicle occupants but also pedestrians around the vehicle are exposed to danger.

[0004] As a countermeasure, methods for detecting anomalies on a network using detection algorithms specifically designed for a particular protocol are known. For example, Patent Document 1 describes a method for detecting anomalies based on the reception interval of specific frames flowing on a network.

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent No. 5664799

[0008] Non-patent literature

[0009] Non-patent document 1: Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information (RFC7011) Summary of the Invention

[0010] The problem that the invention aims to solve

[0011] Incidentally, there are many protocols used in in-vehicle networks. For example, protocols used in in-vehicle networks include CAN (Controller Area Network) as defined by ISO 11898-1, FlexRay (registered trademark) as defined by the FlexRay Association, and Ethernet (registered trademark) as defined by IEEE 802.3.

[0012] However, while the method in Patent Document 1 is effective for detecting anomalies in CAN where the receive interval is disordered when an anomaly occurs, it is not effective for detecting anomalies in FlexRay where frames are always sent at a certain communication interval even when an anomaly occurs.

[0013] Furthermore, as a method for monitoring the overall communication of a network, there exists a specification such as IPFIX, which is not described in Patent Document 1. In IPFIX, anomalies are detected based on information contained in the Ethernet or TCP / IP header, but it is not effective for detecting anomalies in CAN or FlexRay, etc.

[0014] Alternatively, multiple anomaly detection devices specifically designed for particular protocols could be integrated into the vehicle, but this presents cost challenges. Consequently, in previous technologies, it was difficult to detect anomalies in the vehicle's network communication using a simple configuration.

[0015] Therefore, the purpose of this invention is to provide an anomaly detection device, anomaly detection system, and anomaly detection method that can detect communication anomalies in vehicle networks with a simple configuration.

[0016] Methods used to solve problems

[0017] An anomaly detection device according to a technical solution of the present invention comprises: a flow collection unit that collects the flow traffic of each of the two or more networks in a vehicle network system having two or more networks, wherein the flow traffic is information summed for the traffic of one or more frames classified according to a rule based on the header information of the network protocol; and an anomaly determination unit that calculates an observation ratio as a ratio of the traffic between the two or more networks based on the flow traffic, and determines whether the two or more networks are abnormal based on the calculated observation ratio and a normal ratio as a ratio of the traffic between the two or more networks when they are in normal condition.

[0018] An anomaly detection system according to one technical solution of the present invention is an anomaly detection system for an in-vehicle network system having two or more networks, comprising: an anomaly detection device as described in any one of technical solutions 1 to 10; and a stream generation device connected to one or more of the two or more networks to sum the stream traffic; the stream generation device comprising: a frame acquisition unit that acquires frames from the one or more networks; a frame classification unit that classifies the acquired frames according to a predetermined rule based on the header information of the protocols used in the one or more networks; a stream summation unit that sums the stream traffic as information about the total traffic for one or more frames classified by the frame classification unit; and a stream transmission unit that transmits the summed stream traffic to the anomaly detection device.

[0019] An anomaly detection method according to a technical solution of the present invention includes: a flow collection step, collecting the flow traffic of each of the two or more networks in a vehicle network system having two or more networks, wherein the flow traffic is information summed for the traffic of one or more frames classified according to a rule based on the header information of the network protocol; and an anomaly determination step, calculating an observation ratio as the ratio of traffic between the two or more networks based on the flow traffic, and determining whether the two or more networks are abnormal based on the calculated observation ratio and a normal ratio as the ratio of normal traffic between the two or more networks.

[0020] Invention Effects

[0021] According to an anomaly detection device or the like of the present invention, anomalies in the communication of an in-vehicle network can be detected with a simple configuration. Attached Figure Description

[0022] Figure 1 This is a diagram showing the overall configuration of the vehicle network system according to the implementation method.

[0023] Figure 2 This is a diagram illustrating the functional configuration of the anomaly detection device in the implementation method.

[0024] Figure 3 This is a diagram illustrating the functional configuration of the flow generation device in the implementation method.

[0025] Figure 4 This is a diagram illustrating an example of the classification rules for implementation methods.

[0026] Figure 5 This is a diagram illustrating an example of a CAN frame in an implementation method.

[0027] Figure 6 This is a diagram illustrating an example of a FlexRay frame used in an implementation.

[0028] Figure 7 This is a diagram illustrating an example of an Ethernet (SOME / IP) frame implementation.

[0029] Figure 8 This is a diagram illustrating an example of the total flow value in an implementation method.

[0030] Figure 9 This is a diagram illustrating an example of the detection rules for an implementation method.

[0031] Figure 10 This is a diagram illustrating the processing order from frame reception to stream transmission in an implementation method.

[0032] Figure 11 This is a diagram illustrating the processing order of receiving an exception notification from the stream in the implementation method.

[0033] Figure 12 This is a flowchart illustrating the frame classification process in the implementation method.

[0034] Figure 13 This is a flowchart illustrating the flow total processing of the implementation method.

[0035] Figure 14 This is a flowchart illustrating the streaming transmission process of an implementation method.

[0036] Figure 15 This is a flowchart illustrating the anomaly detection process in the implementation method. Detailed Implementation

[0037] (The process of achieving this invention)

[0038] Before describing the embodiments of the present invention, the understanding that forms the basis of the present invention will be explained.

[0039] As described in the "Problems to be Solved by the Invention" section above, many protocols exist in vehicle networks. However, in the method of Patent Document 1, it is difficult to correctly detect anomalies when using protocols other than specific protocols (e.g., CAN, which has the characteristic of receiving interval disorder when an anomaly occurs). Therefore, it is desirable to have an anomaly detection device that can detect anomalies on vehicle networks regardless of the protocols used.

[0040] Furthermore, in vehicular networks, there are instances where multiple protocols are used within the same system, depending on communication conditions and cost considerations. For example, within the same vehicular system, CAN (Controller Area Network) as defined by ISO 11898-1, FlexRay as defined by the FlexRay Association, and Ethernet as defined by IEEE 802.3 may be used as the vehicular network.

[0041] In this context, the method in Patent Document 1 is ineffective for anomaly detection of protocols other than the specific protocol. Furthermore, it is difficult to install effective anomaly detection methods for multiple protocols. Additionally, while it is possible to install multiple anomaly detection methods tailored to specific protocols, this presents a cost problem.

[0042] Furthermore, as a method for monitoring overall network communication, there is, for example, the IPFIX specification described in Non-Patent Document 1. In IPFIX, based on information contained in the Ethernet or TCP / IP header, the Ethernet switch classifies multiple frames flowing over the Ethernet and generates statistical information called flow statistics. Moreover, an anomaly detection device above the Ethernet switch collects these flows, and by monitoring them on a flow-by-flow basis, overall network communication can be monitored with low computational and communication overhead.

[0043] However, in vehicle networks, there are situations where not only Ethernet exists, but also CAN or FlexRay, so it is difficult to monitor the overall communication of the vehicle network using only Ethernet or TCP / IP headers.

[0044] Thus, in conventional technologies, it is difficult to detect communication anomalies in vehicular networks (e.g., the entire vehicular network) with a simple configuration. Therefore, the inventors of this invention have specifically researched anomaly detection devices and the like that can detect communication anomalies in vehicular networks with a simple structure, and have proposed the anomaly detection device and the like shown below.

[0045] An anomaly detection device according to a technical solution of the present invention comprises: a flow collection unit that collects the flow traffic of each of the two or more networks in a vehicle network system having two or more networks, wherein the flow traffic is information summed for the traffic of one or more frames classified according to a rule based on the header information of the network protocol; and an anomaly determination unit that calculates an observation ratio as a ratio of the traffic between the two or more networks based on the flow traffic, and determines whether the two or more networks are abnormal based on the calculated observation ratio and a normal ratio as a ratio of the traffic between the two or more networks when they are in normal condition.

[0046] Therefore, by classifying frames using a common classification method across protocols, the higher-level anomaly detection device can uniformly process information regardless of the differences in headers and payloads according to each protocol. This eliminates the need to install multiple anomaly detection methods specifically designed for each network, enabling low-cost monitoring of the overall communication of the vehicular network. Consequently, anomalies in vehicular network communication can be detected with a simple configuration.

[0047] Alternatively, for example, if the above-mentioned anomaly determination unit determines that two or more of the above-mentioned networks are abnormal when there is a discrepancy between the above-mentioned observation ratio and the above-mentioned normal ratio at a ratio exceeding a specified value.

[0048] Therefore, it is easy to determine anomalies based on whether the difference is greater than or equal to the specified value.

[0049] Alternatively, for example, the anomaly determination unit may determine that, among the two or more networks, the network in which the observed ratio and the normal ratio differ by the largest proportion is an anomaly.

[0050] Therefore, we not only know that an anomaly has occurred in a certain network, but we can also identify the network where the anomaly occurred. That is, by being able to identify the network where the anomaly occurred, we can more accurately detect anomalies on the network. For example, by identifying the network where the anomaly occurred, we can change the routing of frames passing through the network where the anomaly occurred, and quickly implement countermeasures such as switching to other networks.

[0051] Alternatively, for example, the two or more networks may communicate using different network protocols; the observation ratio is the ratio of communication volume between the two or more protocols calculated based on the aforementioned flow traffic; the anomaly determination unit calculates the ratio of communication volume between the two or more protocols based on the aforementioned flow traffic as the observation ratio.

[0052] Therefore, by using a method that detects anomalies by comparing the communication traffic between protocols, it is no longer necessary to install multiple anomaly detection methods specifically designed for each protocol, and the overall communication of the vehicle network can be monitored at low cost.

[0053] Alternatively, for example, the above-mentioned anomaly determination unit may determine that among the above two or more protocols, the protocol whose observed ratio and normal ratio differ by the largest proportion is abnormal.

[0054] Therefore, we not only know that an anomaly has occurred in a certain protocol, but we can also identify the protocol that caused the anomaly. That is, by being able to identify the protocol that caused the anomaly, we can more accurately detect anomalies on the network. For example, by identifying the protocol that caused the anomaly, we can change the routing of frames passing through the network using the anomalous protocol, and quickly implement countermeasures against the anomaly, such as sending frames using other protocols.

[0055] Alternatively, for example, the aforementioned streaming traffic could be information summed in each of the two or more networks regarding the traffic of one or more frames classified as follows: categorized by ID for each function when the network protocol is CAN, CAN-FD, or J1939; categorized by period and time slot for each function when the network protocol is FlexRay; categorized by MAC address, IP address, or port number for each function when the network protocol is Ethernet; categorized by message ID for each function when the network protocol is SOME / IP; and categorized by topic ID or GUID for each function when the network protocol is DDS.

[0056] Therefore, the anomaly detection device can compare the communication volume for each specific function across multiple different protocols. In vehicles, various electronic control devices communicate via in-vehicle networks or protocols to achieve specific functions. For example, in autonomous driving, functions are achieved by controlling steering, the engine, cameras, etc., not just through a single in-vehicle network. In such cases, if frames related to a specific function increase in one network or protocol, frames related to the same function may increase in other networks or protocols. That is, if the communication volume for a specific function differs from the normal communication volume, it can be determined that an anomaly affecting the communication volume has occurred in that specific network.

[0057] Alternatively, for example, the aforementioned streaming traffic could be information summed in each of the two or more networks regarding the traffic of one or more frames classified as follows: based on ID for each source or destination when the network protocol is CAN, CAN-FD, or J1939; based on period and time slot for each source or destination when the network protocol is FlexRay; based on MAC address, IP address, or port number for each source or destination when the network protocol is Ethernet; based on message ID for each source or destination when the network protocol is SOME / IP; and based on topic ID or GUID for each source or destination when the network protocol is DDS.

[0058] Therefore, the anomaly detection device can compare the traffic according to each specific source or destination for multiple different protocols. In Ethernet, source and destination information is stored in the header using MAC and IP addresses, while in protocols such as CAN and FlexRay, this information is not stored in the header. Therefore, by pre-associating IDs or timeslots with source and destination information, frames can be classified according to their source and destination. For example, in autonomous driving, functions such as steering, engine, and cameras are controlled via multiple in-vehicle networks, not just one, and the autonomous driving ECU sends frames for multiple protocols. In such cases, if the autonomous driving ECU sends more frames with one network or protocol, more frames may be sent from the autonomous driving ECU in other networks or protocols. That is, if the traffic according to a specific source or destination differs from the normal traffic, it can be determined that an anomaly affecting the traffic has occurred in that specific network.

[0059] Alternatively, for example, the aforementioned streaming traffic may be information summed for the aforementioned one or more frames regarding a certain type of traffic that includes at least the number of frames or the data size, during a period corresponding to at least one of the vehicle states, including autonomous driving, automatic parking, cruise control, software updates, vehicle diagnostics, and Internet communication connections, in each of the aforementioned two or more networks.

[0060] Therefore, the anomaly detection device can compare the traffic for multiple different protocols according to each specific vehicle state. The traffic of the entire network changes temporarily depending on the vehicle state. For example, in autonomous driving, vehicle control frames increase; in software updates, frames related to software updates increase; in vehicle diagnostics, frames related to vehicle diagnostics increase; and in internet communication connections, frames related to web services increase. In such cases, for networks where traffic does not increase, anomalies can be detected because vehicle control software updates, vehicle diagnostics, internet connections, etc., performed under specific vehicle states, may be disrupted. That is, anomalies on the network can be detected in greater detail.

[0061] In addition, for example, it may also include an exception notification unit that notifies the passenger or a server outside the vehicle of the exception when the exception determination unit determines that an exception is an exception.

[0062] Therefore, in the event of an anomaly, the system can quickly notify passengers or external servers of the danger.

[0063] Alternatively, for example, it may also include a detection rule update unit that updates the above-mentioned normal ratio based on information obtained via an external network.

[0064] Therefore, even if the ratio of normal traffic changes during a software update, it can be adjusted by updating the normal ratio.

[0065] Alternatively, for example, the rules specified above could be used to assign classification labels to frames to classify them; the above streaming traffic is based on information about one or more frames classified according to the above classification labels.

[0066] Therefore, frames can be easily classified using classification labels.

[0067] Alternatively, for example, the rules specified above may establish a correspondence between the field names contained in the header information, the classification labels, and the validity status indicating whether the assignment of the classification labels is valid, according to each of the aforementioned network protocols; if the aforementioned exception determination unit is invalid, it shall not assign the aforementioned classification labels to the frame.

[0068] This allows for the differentiation between classified and unclassified frames. For example, by using only the desired frames, anomalies on the network can be detected more accurately.

[0069] Alternatively, the above category labels could include full frame, autonomous driving ECU, vehicle control, software update, and vehicle diagnostics.

[0070] Therefore, it is possible to detect whether the anomaly pertains to the entire frame, the autonomous driving ECU, vehicle control, software updates, or vehicle diagnostics. Furthermore, "entire frame" refers to, for example, all frames related to autonomous driving.

[0071] Alternatively, for example, the observation ratio may include at least one of the frame rate ratio and data size ratio of the network protocol; the normal ratio may include at least one of the frame rate ratio and data size ratio under normal conditions; and the anomaly determination unit may determine that it is abnormal if there is a difference between at least one of the frame rate ratio and data size ratio included in the observation ratio and at least one of the frame rate ratio and data size ratio included in the normal ratio by a specified value or more.

[0072] Therefore, networks with at least one of the frame rate ratio and data size ratio that differs by a specified ratio can be identified as abnormal.

[0073] Furthermore, one aspect of the present invention relates to an anomaly detection system for a vehicle network system having two or more networks, comprising: the aforementioned anomaly detection device; and a stream generation device connected to one or more of the two or more networks to sum the stream traffic; the stream generation device comprising: a frame acquisition unit that acquires frames from one or more networks; a frame classification unit that classifies the acquired frames according to a predetermined rule based on the header information of the protocols used in the one or more networks; a stream summarization unit that sums the stream traffic, the stream traffic being information summed for the traffic of one or more frames classified by the frame classification unit; and a stream transmission unit that transmits the summed stream traffic to the anomaly detection device.

[0074] Therefore, by incorporating the components of an anomaly detection system, it is possible to perform everything from frame classification to anomaly detection on the network within a single system. For example, by mounting the anomaly detection device and the stream generation device inside a vehicle, anomaly determination can be performed without communication with external devices. That is, anomaly determination can be performed more reliably regardless of the communication status between the vehicle and external devices.

[0075] Alternatively, for example, the frame classification department may classify frames according to each function based on ID when the network protocol is CAN, CAN-FD, or J1939; according to period and time slot when the network protocol is FlexRay; according to MAC address, IP address, or port number when the network protocol is Ethernet; according to message ID when the network protocol is SOME / IP; and according to topic ID or GUID when the network protocol is DDS.

[0076] Therefore, the anomaly detection device can compare the communication volume for each specific function across multiple different protocols. In vehicles, various electronic control devices communicate via in-vehicle networks or protocols to achieve specific functions. For example, in autonomous driving, functions are achieved by controlling steering, the engine, cameras, etc., not just through a single in-vehicle network. In such cases, if frames related to a specific function increase in one network or protocol, frames related to the same function may increase in other networks or protocols. That is, if the communication volume for a specific function differs from the normal communication volume, it can be determined that an anomaly affecting the communication volume has occurred in that specific network.

[0077] Alternatively, for example, the frame classification department may classify frames based on ID according to each sending source or destination in each of the above two or more networks, if the network protocol is CAN, CAN-FD, or J1939; if the network protocol is FlexRay, classify frames based on period and time slot according to each sending source or destination; if it is Ethernet, classify frames based on MAC address or IP address and port number according to each sending source or destination; if it is SOME / IP, classify frames based on message ID according to each sending source or destination; and if it is DDS, classify frames based on topic ID or GUID according to each sending source or destination.

[0078] Therefore, the anomaly detection device can compare the traffic according to each specific source or destination for multiple different protocols. In Ethernet, source and destination information is stored in the header using MAC addresses and IP addresses, while in protocols such as CAN and FlexRay, this information is not stored in the header. Therefore, by pre-associating IDs or timeslots with source and destination information, frames can be classified according to each source and destination. For example, in autonomous driving, functions such as steering, engine, and cameras are controlled via multiple in-vehicle networks, not just one, and the autonomous driving ECU sends frames for multiple protocols. In such cases, if the autonomous driving ECU sends more frames with one network or protocol, more frames may be sent from the autonomous driving ECU in other networks or protocols. That is, if the traffic according to a specific source or destination differs from the normal traffic, it can be determined that an anomaly affecting the traffic has occurred in that specific network.

[0079] Alternatively, for example, the frame classification unit may classify frames in each of the two or more networks based on at least one of the vehicle states, including autonomous driving, automatic parking, cruise control, software updates, vehicle diagnostics, and Internet communication connections.

[0080] Therefore, the anomaly detection device can compare the traffic for each specific vehicle state across multiple different protocols. The traffic across the entire network temporarily changes depending on the vehicle state. For example, in autonomous driving, vehicle control frames increase; in software updates, frames related to software updates increase; in vehicle diagnostics, frames related to vehicle diagnostics increase; and in internet communication connections, frames related to web services increase. In such cases, for networks where traffic does not increase, anomalies can be detected because vehicle control software updates, vehicle diagnostics, internet connections, etc., performed under specific vehicle states, may be disrupted.

[0081] Alternatively, for example, the aforementioned stream generation apparatus may also include a classification rule updating unit that updates the rules specified above.

[0082] Therefore, for example, if the association between ID and function changes due to a software update, or if the ratio of normal traffic changes, it is possible to respond by updating the normal ratio of the detection rules.

[0083] Furthermore, an anomaly detection method according to one technical solution of the present invention includes: a flow collection step, collecting the flow traffic of each of the two or more networks in a vehicle network system having two or more networks, wherein the flow traffic is information summed for the traffic of one or more frames classified according to a rule based on the header information of the network protocol; and an anomaly determination step, calculating an observation ratio as the ratio of traffic between the two or more networks based on the flow traffic, and determining whether the two or more networks are abnormal based on the calculated observation ratio and a normal ratio as the ratio of normal traffic between the two or more networks.

[0084] Therefore, it achieves the same effect as the aforementioned anomaly detection device.

[0085] In addition, these global or specific technical solutions can also be implemented by systems, methods, integrated circuits, computer programs or computer-readable CD-ROMs and other recording media, or by any combination of systems, methods, integrated circuits, computer programs and recording media.

[0086] The following is a reference to the appendix. Figure 1 The following describes the anomaly detection device and other related embodiments. The embodiments described herein are specific examples of the present invention. Therefore, the numerical values, constituent elements, arrangement positions and connection patterns of constituent elements, and steps and their order as processing elements shown in the following embodiments are examples and are not intended to limit the present invention. Constituent elements in the following embodiments that are not described in the independent claims are optional additions. Furthermore, the figures are schematic diagrams and are not necessarily strictly representational.

[0087] (Implementation Method)

[0088] [Overall configuration diagram of vehicle network system 10]

[0089] Figure 1 This is a diagram showing the overall configuration of the vehicle network system 10 according to this embodiment.

[0090] like Figure 1 As shown, the vehicle network system 10 includes an anomaly detection device 100, a stream generation device 210, a steering ECU 220, a body ECU 230, an autonomous driving ECU 240, a stream generation device 310, an engine ECU 320, a brake ECU 330, a stream generation device 410, a navigation ECU 420, a camera ECU 430, and a switch 440. The anomaly detection system comprises the anomaly detection device 100, the stream generation device 210, the stream generation device 310, and the stream generation device 410.

[0091] The anomaly detection device 100, the flow generation device 210, the steering ECU 220, the body ECU 230, and the autonomous driving ECU 240 are connected via a CAN network 20, which is a type of vehicle network.

[0092] In addition, the anomaly detection device 100, the flow generation device 310, the engine ECU 320, the brake ECU 330, and the autonomous driving ECU 240 are connected via a FlexRay network 30, which is a type of vehicle network.

[0093] In addition, the anomaly detection device 100, the stream generation device 410, the navigation ECU 420, the camera ECU 430, the switch 440, and the autonomous driving ECU 240 are connected via an Ethernet network 40, which is a type of vehicle network.

[0094] In addition, Figure 1 The text indicates three distinct vehicular networks, but the number of vehicular networks in the vehicular network system 10 is not limited to three; two or more are acceptable. Furthermore, while the three vehicular networks may use different protocols, at least two vehicular networks may share the same protocol.

[0095] In addition to the CAN network 20, FlexRay network 30, and Ethernet network 40, the anomaly detection device 100 is also connected to an external network such as the Internet.

[0096] The anomaly detection device 100 detects anomalies on the network and notifies passengers, such as the driver, of the anomaly via an external network to a server on the Internet or via the navigation ECU 420. Furthermore, the anomaly detection device 100 may also have the function of converting the protocol of acquired frames and forwarding them to other networks. For example, the anomaly detection device 100 may also convert frames acquired via the CAN network 20 to at least one of the FlexRay network 30 and the Ethernet network 40, converting them to the protocol used in that network and forwarding them. Details regarding the anomaly detection device 100 will be described later.

[0097] The stream generation device 210 monitors the frames flowing into the CAN network 20 and sends the stream information to the anomaly detection device 100. Details about the stream generation device 210 and the frames flowing in the CAN network 20 will be described later.

[0098] The steering ECU220 is an ECU that controls the steering angle of a vehicle (such as a car).

[0099] The vehicle body ECU230 is an ECU that controls vehicle body functions such as opening and closing windows.

[0100] The autonomous driving ECU 240 is an ECU that enables autonomous driving by instructing the steering ECU 220, engine ECU 320, brake ECU 330, and camera ECU 430 to control the vehicle. Here, the autonomous driving ECU can also be an automatic parking ECU that controls automatic parking, or a cruise control ECU that controls cruise control.

[0101] The autonomous driving ECU 240 is connected to the CAN network 20, the FlexRay network 30, and the Ethernet network 40, respectively. The autonomous driving ECU 240 may also have the function of protocol conversion of the acquired frames and forwarding them to other networks.

[0102] The stream generation device 310 monitors the frames flowing into the FlexRay network 30 and sends the stream information to the anomaly detection device 100. Since the stream generation device 310 has the same function as the stream generation device 210, it is sometimes referred to as the stream generation device 210, etc. Furthermore, the frames flowing in the FlexRay network 30 will be described later.

[0103] The engine ECU320 is an ECU that controls the acceleration of the vehicle speed.

[0104] The brake ECU330 is an ECU that controls the deceleration of the vehicle.

[0105] Stream generation device 410 monitors frames in the Ethernet network 40 and sends stream information to anomaly detection device 100. Here, on the Ethernet network 40, the SOME / IP (Scalable Service-Oriented Middleware over IP) protocol, a service-oriented communication protocol, is used. SOME / IP frames will be described later. Furthermore, since stream generation device 410 has the same functions as stream generation device 210, it is sometimes referred to as stream generation device 210, etc. Also, the protocol used in the Ethernet network 40 is not limited to SOME / IP.

[0106] The navigation ECU420 is an ECU that controls the output of the display mounted on the vehicle.

[0107] The camera ECU430 is an ECU that controls the images from the camera mounted on the vehicle.

[0108] Switch 440 is a device for switching frames flowing over Ethernet.

[0109] [Diagram of the anomaly detection device 100]

[0110] Figure 2 This is a diagram illustrating the functional configuration of the anomaly detection device 100 in this embodiment.

[0111] like Figure 2 As shown, the anomaly detection device 100 includes a stream collection unit 110, a stream storage unit 120, a detection rule storage unit 130, an anomaly detection unit 140, a detection rule update unit 150, and an anomaly notification unit 160.

[0112] The stream collection unit 110 receives stream information from the stream generation device 210 via the CAN network 20, FlexRay network 30 and Ethernet network 40.

[0113] The stream storage unit 120 stores the received stream information according to each protocol.

[0114] The detection rule storage unit 130 stores the normal flow information as detection rules.

[0115] The anomaly detection unit 140 detects anomalies in the vehicle network system 10 based on the normal flow information recorded in the detection rules and the flow information stored in the flow storage unit 120. For example, the anomaly detection unit 140 detects anomalies by comparing the normal flow information with the flow information stored in the flow storage unit 120. For instance, the anomaly detection unit 140 detects anomalies in the vehicle network system 10 based on whether the normal flow information and the flow information stored in the flow storage unit 120 satisfy a predetermined relationship. The anomaly detection unit 140 is an example of an anomaly determination unit.

[0116] The detection rule update unit 150 updates the detection rules stored in the detection rule storage unit 130 via an external network. The detection rule update unit 150 can also be described as updating the rules based on information obtained via the external network. This information may include, for example, the updated detection rules, or information indicating the difference between the updated rules and those stored in the detection rule storage unit 130.

[0117] When the anomaly detection unit 140 detects an anomaly, the anomaly notification unit 160 notifies at least one party, such as an external server or a passenger, including the driver. Alternatively, the anomaly notification unit 160 may be described as notifying either the passenger or a server outside the vehicle when the anomaly detection unit 140 determines an anomaly.

[0118] The anomaly detection device 100 described above collects streaming traffic as information that sums the traffic of one or more frames classified based on protocol header information. It calculates the ratio of inter-network traffic based on the streaming traffic and compares it with the ratio of normal inter-network traffic. This allows for the safe and cost-effective determination of anomalies without installing anomaly detection methods on each protocol. For example, the anomaly detection device 100 can be incorporated into an automated driving assistance system, an advanced driver assistance system, or the like.

[0119] In addition, details regarding the detection rules and anomaly detection methods will be described later.

[0120] [Diagram of the flow generation device 210]

[0121] Figure 3 This diagram illustrates the functional configuration of the flow generation apparatus 210 according to this embodiment. Furthermore, flow generation apparatuses 310 and 410 also have the same functional configuration as flow generation apparatus 210.

[0122] exist Figure 3 In this process, the stream generation device 210 includes a frame receiving unit 211, a classification rule storage unit 212, a frame classification unit 213, a vehicle status extraction unit 214, a stream totalizing unit 215, a stream storage unit 216, a stream sending unit 217, and a classification rule updating unit 218.

[0123] The frame receiving unit 211 receives frames flowing on the network.

[0124] The classification rule storage unit 212 stores classification rules that record the classification method of frames.

[0125] The frame classification unit 213 classifies the received frames according to classification rules. For example, the frame classification unit 213 uses classification rules based on header information of protocols used in one or more networks to classify the acquired frames. Furthermore, the frame classification unit 213 may also classify frames in each of two or more networks based on at least one vehicle state, including autonomous driving, automatic parking, cruise control, software updates, vehicle diagnostics, and Internet communication connections.

[0126] The vehicle status extraction unit 214 extracts the vehicle status from the received frames. The vehicle status includes at least one of the following: autonomous driving, automatic parking, cruise control, software update, vehicle diagnostics, and Internet communication connection.

[0127] The stream totalizer 215 uses the classified frames, the extracted vehicle status, and the streams stored in the stream storage unit 216 to total the data for each stream type, based on the number of frames or the data size. The stream totalizer 215 can also be described as totaling the stream traffic, which is information about the traffic totaled from one or more frames classified by the frame classification unit 213. Totaling by each stream type is an example of totaling by each function.

[0128] The stream storage unit 216 will store the totaled stream.

[0129] The stream transmission unit 217 sends stream information to the anomaly detection device 100 at predetermined intervals. The stream information includes stream traffic.

[0130] The classification rule update unit 218 updates the classification rules based on information obtained from an external network via the anomaly detection device 100. A classification rule is an example of a set of rules.

[0131] In addition, details about the classification rules, stream totalization method, and stream sending method will be described later.

[0132] [An example of a classification rule]

[0133] Figure 4 This diagram illustrates an example of the classification rules in this embodiment. These classification rules are stored in the classification rule storage unit 212 of the stream generation apparatus 210. Classification rules are information used to assign classification labels to frames, classifying them accordingly. Furthermore, streaming traffic is based on data processed according to the following... Figure 4 The classification rules shown contain information from more than one frame of the classification labels.

[0134] like Figure 4 As shown, the classification rules include classification number, protocol, classification field, classification label, and validity status.

[0135] A classification number is a unique number corresponding to a classification rule. The protocol details the protocol name used in the network, such as CAN, CAN-FD, J1939, FlexRay, LIN, MOST, Ethernet, Ethernet (TCP / IP), Ethernet (SOME / IP), Ethernet (DDS), etc.

[0136] The classification field includes a field name and a reference value. The field name records the field name included in the header of the network protocol used for classification. If the value of the field in a received frame matches the reference value of the classification rule, the frame is assigned the classification label recorded in the classification label.

[0137] For example, the field name is the ID in the CAN protocol, the slot in the FlexRay protocol, and the message ID in the SOME / IP protocol. Since FlexRay identifies frames using two units, period and slot, in this invention, the slot records the slot taking into account the period (e.g., the slot in a specific period).

[0138] In addition, the classification labels include, for example, full frames, autonomous driving ECU, vehicle control, software updates, and vehicle diagnostics. A full frame refers to all frames flowing using the CAN protocol; an autonomous driving ECU refers to all frames sent from the autonomous driving ECU; vehicle control refers to frames related to vehicle control; software updates refer to frames related to software updates; and vehicle diagnostics refer to frames related to vehicle diagnostics.

[0139] In addition, the validity status records whether the corresponding classification rule is valid or invalid. Even if the value of the field of the received frame is the same as the corresponding value of the classification rule, if the validity status is invalid, no classification label will be assigned to the frame.

[0140] As described above, the classification rules establish a correspondence between the field names, classification labels, and validity states indicating whether the classification label assignment is valid, according to each protocol. Furthermore, the frame classification unit 213 does not assign a classification label to the frame if the validity state is invalid.

[0141] For example, in the CAN protocol, when a frame with ID field 21 is received, although the classification rule for classifying the entire frame is recorded in the classification rule for classification number 1, no classification label is assigned to the frame because the valid state is invalid.

[0142] Furthermore, the classification rules for classification number 3 contain rules for assigning classification labels to vehicle control and autonomous driving ECUs. Since the valid state is valid, two classification labels for vehicle control and autonomous driving ECUs are assigned to this frame. Thus, the classification labels assigned to a frame are not limited to one; multiple labels can also be assigned.

[0143] Furthermore, for example, in the case of a FlexRay protocol frame with a time slot of 34, since the classification rule for classification number 6 contains a rule for assigning a classification label to the entire frame, and the valid state is valid, a classification label is assigned to the entire frame.

[0144] In this way, by assigning a unified classification label to frames of each protocol, the higher-level anomaly detection device 100 can comprehensively analyze frames classified with the same classification label or the stream of total information of such classified frames.

[0145] However, since the header information used to identify frames differs between protocols, the stream generation device 210 and the like need to maintain... Figure 4 The classification rules for each protocol are shown below. Furthermore, the stream generation device 210, etc., can each store... Figure 4 The classification rules shown can also be stored only. Figure 4 The part of the classification rules shown corresponds to the protocol used in the connected network.

[0146] Furthermore, the example described above is a classification rule that assigns a classification label corresponding to the function of the frame, that is, a rule that classifies the frame according to each function. However, it is not limited to this. It can also be a rule that classifies the frame according to the sending source or destination of each frame.

[0147] [An example of a CAN frame]

[0148] Figure 5 This diagram illustrates an example of a CAN frame in this embodiment. A CAN frame is a frame that flows within the CAN network 20.

[0149] A CAN frame consists of an ID, a data length, and a payload. The ID is used to identify the frame. The data length indicates the size of the frame's payload. The ID and data length are examples of header information. The payload records the content of the frame's data, identified by the ID.

[0150] Furthermore, for example, a CAN frame with ID 20 has a data length of 8 bytes. The first byte stores a counter, the second byte stores the autonomous driving status, and bytes 3 through 8 are unused. Similarly, a CAN frame with ID 22 also has a data length of 8 bytes. The first byte stores a counter, bytes 2 through 5 store update software data, and the eighth byte stores a flag indicating that the update is complete.

[0151] In this way, the stream generation device 210 can obtain the ID, data length and payload when it receives a CAN frame.

[0152] Furthermore, for example, upon receiving a CAN frame with ID 20, information can be obtained regarding whether the vehicle is in an autonomous driving state, which is one of the vehicle states. Upon receiving a CAN frame with ID 20, the vehicle state—whether it is in autonomous driving or manual driving mode—can be obtained. Furthermore, upon receiving a CAN frame with ID 21, a speed indication for accelerating or decelerating the vehicle to a target speed and the target speed can be obtained. Upon receiving a CAN frame with ID 22, an update completion flag indicating that software data has been updated and the software update is complete can be obtained. Upon receiving a CAN frame with ID 23, a diagnostic indication indicating vehicle diagnostics and a diagnostic completion flag indicating that vehicle diagnostics are complete can be obtained.

[0153] Furthermore, even when the protocol is not CAN but CAN-FD or J1939, it is also possible to send and receive data over the network. Figure 5 The same frame as the CAN frame shown.

[0154] [An example of a FlexRay frame]

[0155] Figure 6 This diagram illustrates an example of a FlexRay frame in this embodiment. A FlexRay frame is a frame that flows within the FlexRay network 30.

[0156] A FlexRay frame consists of a timeslot, a data length, and a payload. The timeslot is used for frame identification. The data length is used to determine the size of the payload data. The timeslot and data length are examples of header information. The payload contains the data content of the frame identified by its ID. Here, the period, which is one of the identifiers used by FlexRay, is omitted, and the timeslot is recorded as a timelot taking the period into account. Furthermore, in Figure 6 In this context, the Xth byte represents the final byte of each payload.

[0157] For example, a FlexRay frame with slot 31 has a data length of 16 bytes. The first byte contains a counter, the second byte contains a steering instruction indicating the vehicle's steering direction in the manner of steering angle for steering purposes, the third byte contains the angle as the steering angle for steering purposes, and bytes 4 through 16 are unused.

[0158] In this way, the stream generation device 310 can obtain the time slot, data length and payload when it receives a FlexRay frame.

[0159] [An example of an Ethernet (SOME / IP) frame]

[0160] Figure 7 This diagram illustrates an example of an Ethernet (SOME / IP) frame in this embodiment. An Ethernet frame is a frame that flows within an Ethernet network 40. Here, an example of Ethernet frames communicating using the SOME / IP protocol is described.

[0161] An Ethernet frame consists of a MAC address, IP address, port, message ID (as defined in the TCP / IP protocol), data length, and payload. The MAC address is uniquely assigned to a network device and contains the MAC address of the source (Src) and the MAC address of the destination (Dst). The IP address is assigned to the network device via the TCP / IP protocol and contains the IP address of the source (Src) and the IP address of the destination (Dst). The port is assigned to the network device by the application and contains the port number of the source (Src) and the port number of the destination (Dst).

[0162] As the payload in the TCP / IP protocol, it contains the SOME / IP protocol header and payload. The SOME / IP header contains the message ID and data length; the message ID identifies the payload content. The message ID and data length are examples of header information.

[0163] The payload may contain information such as autonomous driving status, camera control instructions, video data, updated software data, update completion flags, diagnostic instructions, diagnostic codes, and diagnostic completion flags. For example, a frame with message ID 41 in SOME / IP has a source (Src) MAC address of M1, a destination (Dst) MAC address of M2, a source (Src) IP address of IP1, a destination (Dst) IP address of IP2, a source (Src) port of P13, a destination (Dst) port of P22, and a SOME / IP data length of 512 bytes. The payload includes camera control instructions and video data.

[0164] In addition, when using the DDS protocol instead of the SOME / IP protocol, the topic number or GUID is recorded instead of the message ID.

[0165] In this way, when the stream generation device 410 receives an Ethernet frame, it can obtain the MAC address, IP address, port, message ID in the SOME / IP protocol, data length, and payload.

[0166] [An example of total flow value]

[0167] Figure 8 This is a diagram illustrating an example of the total flow value in this embodiment. The total flow value is maintained by the flow generation device 210, etc., and sent to the anomaly detection device 100. Furthermore, Figure 8 This represents the total value of the streams obtained from each stream generation device, such as stream generation device 210, and stored in the stream storage unit 120 of the anomaly detection device 100.

[0168] like Figure 8 As shown, the total stream value includes the total value of protocol, stream type, number of frames, data size, and transmission conditions.

[0169] The protocol pre-defines protocols used in the network, such as CAN, FlexRay, and Ethernet's SOME / IP.

[0170] The stream types are pre-defined and are standardized across protocols in the higher-level anomaly detection device 100. Examples of stream types include full frames, autonomous driving ECUs, vehicle control, software updates, and vehicle diagnostics in autonomous driving. Stream types are one example of the functions of a stream.

[0171] The total number of frames is the sum of the number of frames corresponding to the stream type among the frames received by the stream generation device 210.

[0172] The total data size is the sum of the payload data lengths of the frames corresponding to the stream type received by the stream generation device 210, where the stream type is recorded in advance. Furthermore, the classification label of the received frame is used to determine whether the received frame matches the stream type. For example, the classification label of the received frame and the vehicle status can also be used to determine whether the received frame matches the stream type. Details of the stream totaling process will be described later.

[0173] Sending conditions are set in advance for each stream type, such as after 10 minutes, update complete, and diagnosis complete. After 10 minutes means that the stream is sent 10 minutes after the initial count, update complete means that the stream is sent after the software update is completed, and diagnosis complete means that the stream is sent after the vehicle diagnosis is completed.

[0174] For example, a full-frame stream in the FlexRay protocol's autonomous driving system, with a total frame count of 100 and a total data size of 1600 bytes, is sent to the anomaly detection device 100 at a timed interval 10 minutes after the initial count.

[0175] In addition, for example, a software update stream for Ethernet (SOME / IP) with a total frame count of 10 and a total data size of 1280 is sent to the anomaly detection device 100 at the timer when the software update is completed.

[0176] Thus, because Ethernet (SOME / IP) can transmit a larger maximum data length per frame than CAN and FlexRay, there are cases where the total data size is larger but the total number of frames is smaller. Furthermore, when no frames related to vehicle control are transmitted, the total number of frames and the total data size of Ethernet (SOME / IP) are always 0.

[0177] Since the anomaly detection device 100 receives and stores the total flow values ​​from each protocol from the flow generation devices 210, 310, and 410, it is able to use the total flow values ​​calculated by the sub-protocol for anomaly detection.

[0178] For example, in the CAN protocol's autonomous driving system, the total number of frames in a full-frame stream is 10, and the total data size is 80 bytes. In the FlexRay protocol's autonomous driving system, the total number of frames in a full-frame stream is 100, and the total data size is 1600 bytes. In the Ethernet (SOME / IP) protocol's autonomous driving system, the total number of frames in a full-frame stream is 10000, and the total data size is 320000 bytes. Therefore, it can be calculated that the ratio of the total number of frames between CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1 to 10 to 1000.

[0179] Similarly, it can be calculated that the ratio of the total data size between CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1 to 20 to 4000. Thus, by summing the total stream values ​​of each protocol at point 1, it is possible to calculate the ratio of the total number of frames to the total data size between protocols.

[0180] Furthermore, in the presence of multiple networks using the same protocol, by summing the streams for each network, even with the same protocol, it is possible to calculate the ratio of the total number of frames to the total data size for each network.

[0181] in addition, Figure 8 The total number of frames and the total data size shown are calculated based on the frames acquired during the specified period.

[0182] In addition, Figure 8 In this context, the classification rules are defined when classifying by each stream type (an example of stream functionality). However, when classifying by each sending source or destination of a frame, the classification rules are replaced by... Figure 8 The classification rules shown include information indicating the source or destination of the stream.

[0183] [An example of a detection rule]

[0184] Figure 9 This diagram illustrates an example of the detection rules in this embodiment. The detection rules are those used by the anomaly detection device 100 in anomaly detection.

[0185] like Figure 9 As shown, the detection rules include flow type, sub-protocol frame rate ratio, and sub-protocol data size ratio. The detection rules record the normal sub-protocol frame rate ratio and the normal sub-protocol data size ratio for each flow type. These normal ratios are pre-set or mechanically learned and stored in the detection rule storage unit 130. Furthermore, Figure 9 The subprotocol frame ratio and subprotocol data size ratio shown are determined based on the frames acquired within the specified period.

[0186] in addition, Figure 9 The normal protocol frame ratio shown represents the ratio of the number of frames transmitted and received by the vehicular network system 10 according to each protocol, assuming no anomalies are detected (e.g., no cyber attack). Similarly, the normal protocol data size ratio represents the ratio of the data size transmitted and received by the vehicular network system 10 according to each protocol, assuming no anomalies are detected (e.g., no cyber attack).

[0187] In addition, the subprotocol frame rate ratio and subprotocol data size ratio are examples of normal ratios. Furthermore, the detection rules only need to include at least one of the subprotocol frame rate ratio and subprotocol data size ratio.

[0188] The anomaly detection device 100 receives the total flow value of the sub-protocol and calculates at least one of the current sub-protocol frame rate ratio (an example of the observation ratio) and the current sub-protocol data size ratio (an example of the observation ratio) for each flow type. In this embodiment, both the sub-protocol frame rate ratio and the sub-protocol data size ratio are calculated. Furthermore, the anomaly detection device 100 detects anomalies, for example, by comparing the ratio under normal conditions as described in the detection rules with the calculated ratio.

[0189] For example, in Figure 8 In one example of the recorded total stream values, regarding the full-frame stream in autonomous driving, the ratio of the total frame count between CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1 to 10 to 1000, and the ratio of the total data size is 1 to 20 to 4000. The ratio of the total frame count (1 to 10 to 1000) and the ratio of the total data size (1 to 20 to 4000) are examples of observed ratios.

[0190] In contrast, in the detection rules, the ratio of the total number of frames in the full-frame stream of CAN, FlexRay, and Ethernet (SOME / IP) protocols during autonomous driving is 1 to 10 to 1000, and the ratio of the total data size is 1 to 20 to 4000. The ratio of the total number of frames (1 to 10 to 1000) and the ratio of the total data size (1 to 20 to 4000) are examples of normal ratios. In this case, since the observed ratio is consistent with the normal ratio, the anomaly detection unit 140 can determine that all protocols are normal.

[0191] In addition, Figure 8 In one example of the recorded total flow values, for vehicle diagnostics flows, the ratio of the total frame count between CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1 to 2 to 1, and the ratio of the total data size is 1 to 2 to 1. The ratio of the total frame count (1 to 2 to 1) and the ratio of the total data size (1 to 2 to 1) are examples of observed ratios.

[0192] In contrast, in the detection rules, the ratio of the total number of frames in the full-frame stream of CAN, FlexRay, and Ethernet (SOME / IP) protocols during autonomous driving is 1:1:1, and the ratio of the total data size is also 1:1:1. The ratio of the total number of frames (1:1:1) and the ratio of the total data size (1:1:1) are examples of normal ratios.

[0193] The number of frames and data size for vehicle diagnostics in the FlexRay protocol are larger than normal. That is, since the ratio of CAN to Ethernet (SOME / IP) is correct, the anomaly detection unit 140 considers the probability of an anomaly occurring in FlexRay to be high and can determine that FlexRay is abnormal.

[0194] For example, the anomaly detection unit 140 can also calculate the value obtained by dividing the current ratio by the normal ratio between protocols, and determine an anomaly if there is a difference of more than a threshold between protocols. Furthermore, the anomaly detection unit 140 can also determine that an anomaly has occurred in the protocol with the largest difference. For example, if the ratio of the total number of CAN, FlexRay, and Ethernet (SOME / IP) frames is 1 to 10 to 1000 in normal conditions, and the current ratio is 1 to 20 to 950, the ratio value is (1 / 1) to (20 / 10) to (950 / 1000) = 1 to 2 to 0.95.

[0195] For example, if the threshold is set to 1, the anomaly detection unit 140 will determine that there is an anomaly because there is a difference of more than 1 between the protocols, and can determine that an anomaly has occurred in the FlexRay protocol with the largest difference. A difference of more than 1 is an example of a difference that is proportional to a specified value.

[0196] Alternatively, the anomaly detection unit 140 may determine only the presence or absence of an anomaly, without specifying the protocol of the anomaly.

[0197] As described above, the anomaly detection device 100 includes: a flow collection unit 110 that collects the flow traffic in each of the CAN network 20, FlexRay network 30, and Ethernet network 40 of the vehicle network system 10 having a CAN network 20, a FlexRay network 30, and an Ethernet network 40 (an example of two or more networks), wherein the flow traffic is information summed about the traffic of one or more frames classified according to a classification rule (an example of a prescribed rule) based on the header information of a protocol (network protocol); and an anomaly detection unit 140 that calculates an observation ratio as the ratio of the traffic between the CAN network 20, FlexRay network 30, and Ethernet network 40 based on the flow traffic, and determines whether the CAN network 20, FlexRay network 30, and Ethernet network 40 are abnormal based on the calculated observation ratio and a normal ratio as the ratio of the normal traffic between the CAN network 20, FlexRay network 30, and Ethernet network 40.

[0198] With this configuration, anomalies in the communication of the vehicle network system 10 can be detected with a simple setup. Furthermore, by collecting only the total value of traffic, it is expected that the traffic of frames flowing in the network for anomaly detection can be suppressed. Moreover, by comparing traffic between networks, it is expected that an increase in traffic can be detected and anomalies can be identified when attacks such as those masquerading as legitimate ECUs sending frames or DDoS attacks that disrupt service execution are carried out.

[0199] Furthermore, as described above, the anomaly detection unit 140 can, for example, determine that the CAN network 20, FlexRay network 30, and Ethernet network 40 are abnormal if the observed ratio and the normal ratio differ by a specified proportion or more. Moreover, the CAN network 20, FlexRay network 30, and Ethernet network 40 can communicate using different network protocols. Furthermore, the observed ratio can also be the ratio of communication volume between two or more protocols calculated based on streaming traffic. Additionally, for example, the anomaly detection unit 140 can determine the protocol with the largest difference between the observed ratio and the normal ratio among two or more protocols as abnormal. Additionally, the normal ratio can also be the ratio of communication volume between two or more protocols calculated based on normal streaming traffic. Furthermore, by determining that a protocol is abnormal, for example, the CAN network 20, FlexRay network 30, or Ethernet network 40 using that protocol can be determined as abnormal.

[0200] In addition, the anomaly detection unit 140 can also determine abnormal networks based on detection rules. For example, the anomaly detection unit 140 can also determine the network in the CAN network 20, FlexRay network 30 and Ethernet network 40 that has the largest difference between the observed ratio and the normal ratio as an anomaly.

[0201] Furthermore, as described above, the anomaly detection system is an anomaly detection system for an in-vehicle network system 10 having a CAN network 20, a FlexRay network 30, and an Ethernet network 40, comprising: an anomaly detection device 100; and a stream generation device 210, which is connected to one or more of the CAN network 20, FlexRay network 30, and Ethernet network 40, and sums up streaming traffic, etc. The stream generation device 210, etc., includes: a frame receiving unit 211 (an example of a frame acquisition unit), which acquires frames from one or more networks; a frame classification unit 213, which classifies the frames acquired by means of a classification rule (an example of a prescribed rule) based on the header information of the protocols used in one or more networks; a stream summarization unit 215, which sums up the streaming traffic, the streaming traffic being information summed up regarding the traffic of one or more frames classified by the frame classification unit 213; and a stream transmission unit 217, which transmits the summed streaming traffic to the anomaly detection device 100.

[0202] [Processing order]

[0203] Figure 10 This is a diagram illustrating the processing order from frame reception to stream transmission in this embodiment. Figure 11 This is a diagram illustrating the processing order of receiving an exception notification from the stream in this embodiment. Figure 10 and Figure 11 This describes the processing sequence in this embodiment, from the stream generation device 210 receiving a frame and sending the stream total value to the anomaly detection device 100, to the anomaly detection device 100 receiving the stream total value and notifying of an anomaly. The processing performed by the stream generation device 210 will be described below, but... Figure 10 The processes shown up to steps S1001 to S1006 are also performed in the same way in the flow generation apparatuses 310 and 410.

[0204] First of all, Figure 10 Please provide an explanation.

[0205] (S1001) The frame receiving unit 211 of the stream generating device 210 receives the frames flowing on the network and sends them to the vehicle status extraction unit 214.

[0206] (S1002) Next, if the frame contains a vehicle state, the vehicle state extraction unit 214 extracts the vehicle state and stores it as the current vehicle state. The vehicle state includes at least one of the following: autonomous driving, automatic parking, cruise control, software update, vehicle diagnostics, and Internet communication connection, which is extracted from the received frame.

[0207] (S1003) Similar to S1001, the frame receiving unit 211 receives frames flowing on the network and sends them to the frame classification unit 213 if the frame does not contain vehicle status.

[0208] In this way, the frame receiving unit 211 determines whether the received frame contains vehicle status, and determines the transmission target of the frame based on the determination result.

[0209] (S1004) Next, the frame classification unit 213 classifies the frames according to the classification rules (for example, assigning classification labels to received frames) and sends them to the stream totalizing unit 215. Furthermore, the frame classification unit 213 discards frames that do not follow the classification rules. That is, it does not send frames that do not follow the classification rules to the stream totalizing unit 215.

[0210] (S1005) Next, the stream totalizer 215 receives frames assigned classification tags, obtains the current vehicle status stored in the vehicle status extraction unit 214, and, if the received frame matches the stream type, performs a total from the perspective of at least one of the frame count and data size, updating the stream total value held by the stream storage unit 216. In step S1005, the stream totalizer 215 performs a total of at least one of the frame count and the data size.

[0211] For example, if the current vehicle state is autonomous driving, the flow totalizer 215 will, in the case of a CAN frame, be based on the vehicle state (in the case of a CAN frame). Figure 5 The total number of frames received and the total data size of all frames during the period from when the autonomous driving state becomes ON (activated) to when it becomes OFF (disactivated) in the vehicle status field shown are used as... Figure 8 The total number of frames and the total data size are shown for the "Full Frames in Autonomous Driving" stream type. The same totals are also calculated for other vehicle states.

[0212] (S1006) The stream sending unit 217 sends the stream (total stream value) to the anomaly detection device 100 under specified conditions. For example, whenever the total stream value is updated, the stream sending unit 217 checks the sending conditions held by the stream storage unit 216, and sends the total stream value to the anomaly detection device 100 if the sending conditions are met. Furthermore, the stream sending unit 217 updates the total stream value of the sent stream to 0.

[0213] (S1007) Next, the flow collection unit 110 of the anomaly detection device 100 receives the flow (total flow value) from the flow generation device 210.

[0214] The total flow value can also be information that sums the traffic of one or more frames classified as follows, with respect to at least one of the following: in each of the CAN network 20, FlexRay network 30, and Ethernet network 40 (an example of two or more networks), the classification is based on ID for each function when the protocol (network protocol) is CAN, CAN-FD, or J1939; based on period and time slot for each function when the protocol is FlexRay; based on MAC address, IP address, or port number for each function when the protocol is Ethernet; based on message ID for each function when the protocol is SOME / IP; and based on topic ID or GUID for each function when the protocol is DDS.

[0215] Furthermore, as described above, the flow total can also be information that sums the traffic of one or more frames classified as follows, with respect to at least one of the following: in each of the CAN network 20, FlexRay network 30, and Ethernet network 40, classification is based on ID for each source or destination when the protocol is CAN, CAN-FD, or J1939; classification is based on period and time slot for each source or destination when the protocol is FlexRay; classification is based on MAC address, IP address, or port number for each source or destination when the protocol is Ethernet; classification is based on message ID for each source or destination when the protocol is SOME / IP; and classification is based on topic ID or GUID for each source or destination when the protocol is DDS. The flow total can also be described as classifying frames by each ECU.

[0216] In addition, the function, sending source, or destination is predetermined.

[0217] In addition, streaming traffic can also be information that sums up one or more frames with respect to some kind of traffic, including at least the number of frames or the data size, during a period corresponding to at least one of the vehicle states, including autonomous driving, automatic parking, cruise control, software updates, vehicle diagnostics, and Internet communication connections, in each of the CAN network 20, FlexRay network 30, and Ethernet network 40.

[0218] Next, regarding Figure 11 Please provide an explanation.

[0219] (S1101) The stream collection unit 110 of the anomaly detection device 100 receives the stream total value sent in step S1006 and stores the stream total value in the stream storage unit 120 according to each protocol. Receiving the stream total value is an example of collecting streams.

[0220] (S1102) The anomaly detection unit 140 determines an anomaly based on the total stream value according to the detection rules stored in the detection rule storage unit 130. The anomaly determination includes, for example, determining whether an anomaly exists. Furthermore, if an anomaly is detected, the stream transmission unit 217 notifies the anomaly notification unit 160 of the anomaly (for example, indicating that an anomaly has been detected).

[0221] (S1103) Next, the exception notification unit 160 notifies the passenger or external server of the exception.

[0222] [Flowchart of frame classification processing]

[0223] Figure 12This is a flowchart illustrating the frame classification process of this embodiment. The frame classification process is performed by the stream generation device 210.

[0224] (S1201) The frame receiving unit 211 of the stream generating device 210 receives frames flowing in the network.

[0225] (S1202) Next, the frame classification unit 213 determines whether the received frame is a frame sent from the ECU in autonomous driving according to the classification rules set according to each protocol. Furthermore, if the received frame is a frame sent from the ECU in autonomous driving ("Yes" in S1202), the frame classification unit 213 performs step S1203, and if the received frame is not a frame sent from the ECU in autonomous driving ("No" in S1202), the frame classification unit 213 performs step S1204.

[0226] (S1203) Next, the frame classification unit 213 assigns an autonomous driving ECU tag to the received frame and performs step S1204.

[0227] (S1204) Next, the frame classification unit 213 determines whether the received frame is a frame related to vehicle control according to the classification rules set according to each protocol. Furthermore, if the received frame is a frame related to vehicle control ("Yes" in S1204), the frame classification unit 213 performs step S1205, and if the received frame is not a frame related to vehicle control ("No" in S1204), the frame classification unit 213 performs step S1206.

[0228] (S1205) Next, the frame classification unit 213 assigns a vehicle control tag to the received frame and performs step S1206.

[0229] (S1206) Next, the frame classification unit 213 determines whether the received frame is a software update frame according to the classification rules set according to each protocol. Furthermore, if the received frame is a software update frame ("Yes" in S1206), the frame classification unit 213 performs step S1207, and if the received frame is not a software update frame ("No" in S1206), the frame classification unit 213 performs step S1208.

[0230] (S1207) The frame classification unit 213 assigns a vehicle control tag to the received frame and performs step S1208.

[0231] (S1208) The frame classification unit 213 determines whether the received frame is a frame related to vehicle diagnostics according to the classification rules set according to each protocol. Furthermore, if the received frame is a frame related to vehicle diagnostics ("Yes" in S1208), the frame classification unit 213 performs step S1209; if the received frame is not a frame related to vehicle diagnostics ("No" in S1208), the processing ends.

[0232] (S1209) The frame classification unit 213 assigns a vehicle control tag to the received frame and ends the processing.

[0233] The determination processes in steps S1202, S1204, S1206, and S1208 described above are respectively processed using... Figure 4 The classification rules shown are applied. For example, the frame classification unit 213 can classify frames according to each function based on ID when the network protocol is CAN, CAN-FD, or J1939, according to period and time slot when the network protocol is FlexRay, according to MAC address, IP address, or port number when the network protocol is Ethernet, according to message ID when the network protocol is SOME / IP, and according to topic ID or GUID when the network protocol is DDS. Furthermore, for example, the frame classification unit 213 can classify frames according to each sending source or destination based on ID when the network protocol is CAN, CAN-FD, or J1939; according to period and time slot when the network protocol is FlexRay; according to MAC address, IP address, or port number when the network protocol is Ethernet; according to message ID when the network protocol is SOME / IP; and according to topic ID or GUID when the network protocol is DDS.

[0234] Alternatively, the frame classification unit 213 may not perform the processing after step S1206 if at least one of steps S1202 and S1204 is "yes". Furthermore, in the determination processing of steps S1202, S1204, S1206, and S1208, the determination processing of steps S1202 and S1204 may be performed before the determination processing of steps S1206 and S1208, but the order of the determination processing is not limited to this.

[0235] In addition, the processing after step S1202 can be performed whenever a frame is received, or when a specified number of frames have been stored.

[0236] In addition, as mentioned above, classifying frames according to each stream type is an example of classifying frames according to each function of the stream.

[0237] [Flowchart of stream total processing]

[0238] Figure 13 This is a flowchart illustrating the stream aggregation process of this embodiment. The processing performed by the stream generation apparatus 210 will be described below, but... Figure 13 The processing shown is also performed in the same way in the flow generation apparatuses 310 and 410.

[0239] (S1301) The stream totalization unit 215 of the stream generation device 210 receives the classified frames that have been assigned classification tags from the frame classification unit 213 and performs step S1302.

[0240] (S1302) Next, the stream totalizer 215 obtains the data length of the classification frame and performs step S1303.

[0241] (S1303) Next, the flow totalizing unit 215 obtains the current vehicle status from the vehicle status extraction unit 214 and performs step S1304. The current vehicle status may be, for example, the latest vehicle status.

[0242] (S1304) Next, the flow totalizer 215 determines whether the vehicle is in autonomous driving mode. If the vehicle is in autonomous driving mode ("Yes" in S1304), the flow totalizer 215 performs step S1305; if the vehicle is not in autonomous driving mode ("No" in S1304), the flow totalizer 215 performs step S1306.

[0243] In addition, in step S1304, the determination of the vehicle status is not limited to determining whether it is in autonomous driving, but can also be a determination of at least one or more combinations of autonomous driving, automatic parking, cruise control, software update, vehicle diagnosis and Internet communication connection.

[0244] (S1305) Next, the stream totalizer 215 adds 1 to the total number of frames of the stream type "full frame in autonomous driving" in the stream totalizer stored in the stream storage unit 216, and adds the data length of the classified frame to the total value of the frame size, and performs step S1306.

[0245] (S1306) Next, the flow totalizing unit 215 determines whether the classification label of the classification frame is an autonomous driving ECU. If the classification label of the classification frame is an autonomous driving ECU ("Yes" in S1306), the flow totalizing unit 215 performs step S1307, and if the classification label of the classification frame is not an autonomous driving ECU ("No" in S1306), the flow totaling unit 215 performs step S1308.

[0246] (S1307) Next, the stream totalizer 215 adds 1 to the total number of frames of the stream type "Autonomous Driving ECU" in the stream totalizer stored in the stream storage unit 216, and adds the data length of the classified frame to the total value of the frame size, and performs step S1308.

[0247] (S1308) Next, the stream totalizer 215 determines whether the classification label of the classification frame is vehicle control. If the classification label of the classification frame is vehicle control ("Yes" in S1308), the stream totalizer 215 performs step S1309; if the classification label of the classification frame is not vehicle control ("No" in S1308), the stream totalizer 215 performs step S1310.

[0248] (S1309) Next, the stream totalizer 215 adds 1 to the total number of frames of the stream type "vehicle control" in the stream totalizer stored in the stream storage unit 216, and adds the data length of the classified frame to the total value of the frame size, and performs step S1310.

[0249] (S1310) Next, the stream totalizer 215 determines whether the classification label of the classification frame is a software update. If the classification label of the classification frame is a software update ("Yes" in S1310), the stream totalizer 215 performs step S1311; if the classification label of the classification frame is not a software update ("No" in S1310), the stream totalizer 215 performs step S1312.

[0250] (S1311) Next, the stream totalizer 215 adds 1 to the total number of frames of the stream type "software update" in the stream totalizer stored in the stream storage unit 216, and adds the data length of the classified frame to the total value of the frame size, and performs step S1312.

[0251] (S1312) Next, the flow totalizing unit 215 determines whether the classification label of the classification frame is vehicle diagnosis. If the classification label of the classification frame is vehicle diagnosis ("Yes" in S1312), the flow totalizing unit 215 performs step S1313; if the classification label of the classification frame is not vehicle diagnosis ("No" in S1312), the flow totalizing unit 215 performs step S1314.

[0252] (S1313) Next, the stream totalizer 215 increments the total number of frames for the stream type "vehicle diagnostics" in the stream totalizer stored in the stream storage unit 216 by 1, and ends the totalizer process.

[0253] Therefore, the total number of frames received during the period from the start of autonomous driving mode to the start of the off mode, along with the total data size of all frames, can be used as... Figure 8The total number of frames and the total data size for the stream type "Full Frame in Autonomous Driving" are shown. Furthermore, the total number of frames and the total data size of all frames received during the period from when the software update state is ON to when it is OFF can be used as... Figure 8 The total number of frames and the total data size for the "Software Update" stream type are shown. Furthermore, the total number of frames and the total data size of all frames received during the period from when the vehicle diagnostics is ON to when it is OFF can be used as... Figure 8 The total number of frames and the total data size for the "Vehicle Diagnostics" stream type are shown. Additionally, the periods from when autonomous driving mode becomes ON to when it becomes OFF, from when software update mode becomes ON to when it becomes OFF, and from when vehicle diagnostics becomes ON to when it becomes OFF are examples of periods corresponding to vehicle states.

[0254] Furthermore, it is possible to use the total number of frames and the total data size of all frames related to the autonomous driving ECU and vehicle control as... Figure 8 The total number of frames and the total data size for the stream types "Autonomous Driving ECU" and "Vehicle Control" are shown.

[0255] Alternatively, at least one of the frame number and frame size can be added in at least one of steps S1305, S1307, S1309, S1311 and S1313.

[0256] Alternatively, the flow totalizer 215 may not perform the processing after step S1308 if at least one of steps S1304 and S1306 is "yes". Furthermore, in the decision processing of steps S1304, S1306, S1308, S1310, and S1312, the decision processing of steps S1304 and S1306 may be performed before the decision processing of steps S1308, S1310, and S1312, but the order of the decision processing is not limited to this.

[0257] As described above, streaming traffic can also be included in each of the CAN network 20, FlexRay network 30, and Ethernet network 40, depending on whether the vehicle is in autonomous driving, automatic parking, cruise control, software update, vehicle diagnostics, or Internet communication connection, or whether it is a combination of two or more, and the number of frames and frame size are determined accordingly.

[0258] [Flowchart of stream sending process]

[0259] Figure 14 This is a flowchart illustrating the stream transmission process of this embodiment. The stream transmission process is performed by the stream generation device 210.

[0260] (S1401) If the total value of the stream is updated, the stream sending unit 217 of the stream generation device 210 obtains the sending conditions according to each stream type from the stream storage unit 216 and performs step S1402.

[0261] (S1402) Next, if the transmission condition is a 10-minute interval ("Yes" in S1402), the stream transmission unit 217 performs step S1403, and if the transmission condition is not a 10-minute interval ("No" in S1402), it performs step S1406.

[0262] (S1403) Next, the streaming unit 217 determines whether 10 minutes have elapsed since the initial reception time. If 10 minutes have elapsed (yes in S1403), the streaming unit 217 executes step S1404; otherwise, if no 10 minutes have elapsed (no in S1403), the streaming process ends. Here, if there is no initial reception time, the streaming unit 217 stores the current system time as the initial reception time.

[0263] (S1404) Next, the stream sending unit 217 sends a stream to the anomaly detection device 100 and performs step S1405.

[0264] (S1405) Next, the stream sending unit 217 changes the total number of frames and the total frame size of the stream to 0 and ends the stream sending process. That is, the stream sending unit 217 resets the total number of frames and the total frame size.

[0265] (S1406) Next, the streaming unit 217 obtains (for example, extracts) the vehicle status from the vehicle status extraction unit 214 and performs step S1407.

[0266] (S1407) Next, the streaming unit 217 determines whether the sending condition is that the update is complete and the vehicle status has been updated. If the sending condition is that the update is complete and the vehicle status has been updated (yes in S1407), the streaming unit 217 performs step S1404; otherwise (no in S1407), it performs step S1408.

[0267] (S1408) Next, the streaming unit 217 determines whether the sending condition is that the diagnosis is complete and the vehicle status has been diagnosed. If the sending condition is that the diagnosis is complete and the vehicle status has been diagnosed (yes in S1408), the streaming unit 217 performs step S1404; otherwise (no in S1408), the streaming process ends.

[0268] [Flowchart of anomaly detection and processing]

[0269] Figure 15 This is a flowchart illustrating the anomaly detection process of this embodiment. The anomaly detection process is performed by the anomaly detection device 100.

[0270] (S1501) Prior to the event, the stream collection unit 110 of the anomaly detection device 100 receives streams from various stream generation devices such as the stream generation device 210 and stores them in the stream storage unit 120. Furthermore, the anomaly detection unit 140 obtains the streams of each protocol stored in the stream storage unit 120, calculates the ratio of the total number of frames between protocols (frame ratio) to the ratio of the total data size (data size ratio) according to each stream type, and performs step S1502.

[0271] (S1502) Next, the anomaly detection unit 140 determines whether there is a protocol that differs from at least one of the normal frame rate ratio and the normal data size ratio. The anomaly detection unit 140 may also determine whether an anomaly exists based on whether the frame rate ratio and data size ratio calculated in step S1501 differ from the normal ratio of those ratios by a predetermined value or more. For example, the anomaly detection unit 140 calculates, for instance, the normal ratio of the total number of frames between protocols recorded in the detection rules (the normal frame rate ratio) and the current ratio of the total number of frames between protocols calculated in step S1501, to determine whether there are protocols with a difference in ratio that is greater than or equal to a predetermined value. Furthermore, the anomaly detection unit 140 compares the normal ratio of the total data size between protocols recorded in the detection rules with the current ratio of the total data size between protocols calculated in step S1501 to determine whether there are protocols with a difference that is greater than or equal to a predetermined value. Furthermore, if the protocol exists ("Yes" in S1502), the anomaly detection unit 140 executes step S1503; otherwise ("No" in S1502), it terminates the anomaly detection process. For example, if both the frame rate ratio calculated in step S1501 and the data size ratio calculated in step S1501 are normal, the anomaly detection unit 140 terminates the anomaly detection process.

[0272] Frame rate ratio and data size ratio are examples of observation ratio. Furthermore, frame rate ratio is an example of frame rate ratio, and data size ratio is an example of data size ratio.

[0273] (S1503) Next, the anomaly detection unit 140 determines the protocol that is different from the difference of the specified value calculated in step S1501 as an abnormal protocol and ends the anomaly detection process.

[0274] As described above, the observation ratio includes at least one of the frame rate ratio and data size ratio of the sub-protocol, and the normal ratio includes at least one of the frame rate ratio and data size ratio under normal conditions. Furthermore, the anomaly detection unit 140 determines an anomaly if there is a difference between at least one of the frame rate ratio and data size ratio included in the observation ratio and at least one of the frame rate ratio and data size ratio included in the normal ratio by a specified value or more.

[0275] In addition, in step S1502, it is sufficient to determine whether there is a protocol with a different frame rate ratio than normal and whether there is a protocol with a different data size ratio than normal.

[0276] (Other implementation methods)

[0277] As described above, embodiments have been illustrated as examples of the technology related to the present invention. However, the technology related to the present invention is not limited thereto, and embodiments with appropriate changes, substitutions, additions, omissions, etc., can also be applied. For example, the following variations are also included in the embodiments of the present invention.

[0278] (1) In the above embodiments, safety measures for vehicles (e.g., automobiles) have been described, but the scope of application is not limited to this. It is not limited to automobiles, but can also be applied to machinery such as construction machinery, agricultural machinery, ships, railways, and airplanes.

[0279] (2) In the above embodiment, the stream storage unit 120 stores streams according to each protocol, but it can also store streams according to each network. Therefore, it is possible to detect anomalies by analyzing the traffic between networks using the same protocol.

[0280] (3) In the above embodiment, the anomaly detection unit 140 calculates the ratio of the observed ratio to the normal ratio for each protocol and determines the protocol with the largest difference in the calculated ratio as an anomaly. However, any method that compares the observed ratio with the normal ratio to detect anomalies is acceptable, and the calculation method is not limited. For example, the anomaly detection device 100 may also determine anomalies based on the difference between the observed ratio and the normal ratio.

[0281] (4) In the above embodiments, the vehicle status is recorded as, for example, autonomous driving, software update, or vehicle diagnostics, but Internet connection status can also be used as the vehicle status. In this case, the navigation ECU sends a frame containing the vehicle status in Internet connection to the network, and the vehicle status extraction unit 214 extracts the vehicle status from the frame.

[0282] (5) In the above embodiment, it is described that the abnormality notification unit 160 notifies the driver or an external server of the abnormality, but the notification target may also be the police or traffic department, an approaching vehicle, a traffic system, or a vulnerability information sharing organization.

[0283] (6) In the above embodiment, it is only described that the stream sending unit 217 sends the stream to the anomaly detection device 100, but it can also be sent in IPFIX format. In this case, the Enterprise-oriented field prepared for IPFIX format is used.

[0284] (7) Some or all of the constituent elements of each device constituting the above embodiments may also be constituted by a single system LSI (Large Scale Integration). A system LSI is a multifunctional LSI manufactured by integrating multiple constituent parts onto a single chip. Specifically, it is a computer system comprising a microprocessor, ROM, RAM, etc. The computer program is recorded in the RAM. The system LSI performs its functions by operating the microprocessor according to the computer program. Furthermore, each constituent element constituting the above devices may be individually chipped or chipped in a manner that includes some or all of them. In addition, it is referred to as a system LSI here, but depending on the degree of integration, it may also be called IC, LSI, super LSI, or very large scale LSI. Furthermore, the method of integration is not limited to LSI; it may also be implemented by dedicated circuits or general-purpose processors. FPGAs (Field Programmable Gate Arrays) that can be programmed after LSI manufacturing, or reconfigurable processors that can reconfigure the connection or configuration of circuit units inside the LSI, may also be used. Furthermore, if advancements in semiconductor technology or other derived technologies lead to the development of integrated circuit technologies that replace LSIs, then these technologies can certainly be used for the integration of functional blocks. This could include applications in biotechnology, among others.

[0285] (8) Some or all of the constituent elements of the above-mentioned devices may also be composed of IC cards or individual modules that are detachable from each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may also include the aforementioned multi-functional LSI. The IC card or the above-mentioned module performs its functions by operating the microprocessor according to the computer program. The IC card or the module may also be tamper-resistant.

[0286] (9) As a technical solution of the present invention, it can also be implemented by a computer. Figures 10-15The program (computer program) of any of the anomaly detection methods shown can also be a digital signal composed of a computer program. Furthermore, as a technical solution of the present invention, the computer program or digital signal can be recorded on a computer-readable recording medium, such as a floppy disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc), semiconductor memory, etc. Alternatively, it can be a digital signal recorded on these recording media. Furthermore, as a technical solution of the present invention, the computer program or digital signal can be transmitted via electrical communication lines, wireless or wired communication lines, networks such as the Internet, data broadcasting, etc. Furthermore, as a technical solution of the present invention, it can be a computer system equipped with a microprocessor and memory, the memory recording the aforementioned computer program, and the microprocessor operating according to the computer program. Furthermore, the program or digital signal can be transferred by recording it on a recording medium, or by transferring it via a network, etc., and the transferred program or digital signal can be implemented by an independent computer system.

[0287] (10) The order in which the steps in the flowchart shown in the above embodiments are executed is illustrated for the purpose of specifically explaining the present invention, and may be in a different order than described above. In addition, some of the above steps may be executed simultaneously (in parallel) with other steps, or some of the above steps may not be executed.

[0288] Furthermore, the functional block division in the block diagram shown in the above embodiment is one example. Multiple functional blocks can also be implemented as a single functional block, or a single functional block can be divided into multiple functional blocks, or a portion of the functionality can be transferred to other functional blocks. Additionally, multiple functional blocks with similar functions can be processed in parallel or time-divisionally by a single piece of hardware or software.

[0289] (11) The forms achieved by arbitrarily combining the constituent elements and functions shown in the above embodiments and the above variations are also included in the scope of the present invention.

[0290] Industrial availability

[0291] An anomaly detection device according to one of the technical solutions of the present invention is useful for detecting anomalies in vehicle-mounted networks with two or more networks installed in vehicles, etc.

[0292] Label Explanation

[0293] 10. In-vehicle network system

[0294] 20 CAN Network

[0295] 30 FlexRay networks

[0296] 40 Ethernet network

[0297] 100 Anomaly Detection Device

[0298] 110 Stream Collection Department

[0299] 120 Stream Storage Unit

[0300] 130 Detection Rule Storage Department

[0301] 140 Anomaly Detection Department (Anomaly Judgment Department)

[0302] 150 Detection Rule Update Department

[0303] 160 Abnormal Notification Department

[0304] 210 Flow generation device

[0305] Frame 211 receiver

[0306] 212 Classification Rule Storage Department

[0307] 213 Frame Classification Department

[0308] 214 Vehicle Status Extraction Department

[0309] 215 Flow Total Department

[0310] 216 Stream Storage Unit

[0311] 217 Streaming Unit

[0312] 218 Classification Rules Update Department

[0313] 220 Steering ECU

[0314] 230 Body ECU

[0315] 240 Autonomous Driving ECU

[0316] 310 Flow Generation Device

[0317] 320 Engine ECU

[0318] 330 Brake ECU

[0319] 410 Flow generation device

[0320] 420 Navigation ECU

[0321] 430 Camera ECU

[0322] 440 switch

Claims

1. An anomaly detection device, have: A flow collection unit collects the flow traffic of each of the two or more networks in a vehicle network system having two or more networks. The flow traffic is information summed for each function of one or more frames classified according to rules based on the header information of the network protocol. The anomaly determination unit calculates an observation ratio, which is the ratio of communication volume between the two or more networks, based on the aforementioned streaming traffic for each function. Based on the calculated observation ratio and a normal ratio, which is the ratio of normal communication volume between the two or more networks, the unit determines whether the two or more networks are abnormal. The two or more networks mentioned above communicate using different network protocols. The above observation ratio is the ratio of communication volume between the above two or more protocols, calculated based on the above streaming communication volume. The anomaly determination unit calculates the ratio of communication traffic between the two or more protocols based on the above-mentioned streaming traffic, and uses this ratio as the observation ratio.

2. The anomaly detection device as described in claim 1, If the above-mentioned anomaly determination unit determines that two or more of the above-mentioned networks are abnormal when there is a discrepancy between the above-mentioned observation ratio and the above-mentioned normal ratio exceeding a specified value.

3. The anomaly detection device as described in claim 1 or 2, The above-mentioned anomaly determination unit determines that among the above two or more networks, the network whose observed ratio and normal ratio differ by the largest proportion is an anomaly.

4. The anomaly detection device as described in claim 1 or 2, The above-mentioned anomaly determination unit determines that among the above two or more protocols, the protocol whose observed ratio and normal ratio differ by the largest proportion is abnormal.

5. The anomaly detection device as described in claim 1 or 2, The aforementioned streaming traffic is information summed in each of the two or more networks for the aforementioned one or more frames, categorized as follows, regarding at least one of the following: categorized by ID for each function when the network protocol is CAN, CAN-FD, or J1939; categorized by period and time slot for each function when the network protocol is FlexRay; categorized by MAC address, IP address, or port number for each function when the network protocol is Ethernet; categorized by message ID for each function when the network protocol is SOME / IP; and categorized by topic ID or GUID for each function when the network protocol is DDS.

6. The anomaly detection device as described in claim 1 or 2, The aforementioned streaming traffic is information summed in each of the above two or more networks for the above one or more frames, categorized as follows: based on ID for each source or destination when the network protocol is CAN, CAN-FD, or J1939; based on period and time slot for each source or destination when the network protocol is FlexRay; based on MAC address, IP address, or port number for each source or destination when the network protocol is Ethernet; based on message ID for each source or destination when the network protocol is SOME / IP; and based on topic ID or GUID for each source or destination when the network protocol is DDS.

7. The anomaly detection device as described in claim 1 or 2, The aforementioned streaming traffic is information summed for the traffic of at least one of the above-mentioned frames, which includes at least one of the following: frame number or data size, during the period corresponding to at least one of the vehicle states, including autonomous driving, automatic parking, cruise control, software update, vehicle diagnostics, and Internet communication connection, in each of the above-mentioned two or more networks.

8. The anomaly detection device as described in claim 1 or 2, It also has an anomaly notification unit that notifies the passenger or a server outside the vehicle of the anomaly when the anomaly determination unit determines that an anomaly is present.

9. The anomaly detection device as described in claim 1 or 2, It also has a detection rule update unit that updates the above-mentioned normal ratio based on information obtained through an external network.

10. The anomaly detection device as described in claim 1 or 2, The rules mentioned above are used to assign classification labels to frames to categorize them. The above-mentioned streaming traffic is based on information obtained from one or more frames classified according to each of the above-mentioned classification labels.

11. The anomaly detection device as described in claim 10, The rules specified above establish a correspondence between the field names contained in the header information, the category labels, and the valid status indicating whether the assignment of the category labels is valid, according to each of the aforementioned network protocols. If the above-mentioned valid state is invalid, the above-mentioned anomaly determination unit will not assign the above-mentioned classification label to the frame.

12. The anomaly detection device as described in claim 10, The above category tags include full frame, autonomous driving ECU, vehicle control, software update, and vehicle diagnostics.

13. The anomaly detection device as described in claim 10, The aforementioned observation ratio includes at least one of the frame rate ratio and data size ratio of the aforementioned network protocols; The above-mentioned normal ratio includes at least one of the above-mentioned frame rate ratio and data size ratio under normal conditions; If the above-mentioned anomaly determination unit determines that there is an anomaly when at least one of the above-mentioned frame rate ratio and the above-mentioned data size ratio included in the above-mentioned observation ratio differs from at least one of the above-mentioned frame rate ratio and the above-mentioned data size ratio included in the above-mentioned normal ratio by a proportion exceeding a predetermined value.

14. An anomaly detection system, which is an anomaly detection system for an in-vehicle network system with two or more networks. have: The anomaly detection device according to claim 1 or 2; and A stream generation device is connected to one or more of the two or more networks mentioned above, and the stream traffic is totaled. The above-mentioned flow generation apparatus has: The frame acquisition unit acquires frames from one or more of the aforementioned networks; The frame classification unit classifies the acquired frames according to rules based on the header information of the protocols used in the above-mentioned one or more networks. The flow totalizer sums the flow traffic, which is information summarizing the traffic for each function for one or more frames classified by the frame classification section; and The streaming unit sends the total streaming traffic to the anomaly detection device.

15. The anomaly detection system as described in claim 14, In each of the two or more networks mentioned above, the frame classification department classifies frames according to each function based on ID when the network protocol is CAN, CAN-FD, or J1939; according to period and time slot when the network protocol is FlexRay; according to MAC address, IP address, or port number when the network protocol is Ethernet; according to message ID when the network protocol is SOME / IP; and according to topic ID or GUID when the network protocol is DDS.

16. The anomaly detection system as described in claim 14, In each of the two or more networks mentioned above, the frame classification department classifies frames based on ID according to each sending source or destination when the network protocol is CAN, CAN-FD, or J1939; based on period and time slot when the network protocol is FlexRay; based on MAC address or IP address and port number when the network protocol is Ethernet; based on message ID when the network protocol is SOME / IP; and based on topic ID or GUID when the network protocol is DDS.

17. The anomaly detection system as described in claim 14, The frame classification unit classifies frames in each of the two or more networks based on at least one of the vehicle states, including autonomous driving, automatic parking, cruise control, software updates, vehicle diagnostics, and Internet communication connections.

18. The anomaly detection system as described in claim 14, The aforementioned stream generation apparatus also includes a classification rule updating unit that updates the rules specified above.

19. An anomaly detection method, include: The flow collection step collects the flow traffic of each of the two or more networks in an in-vehicle network system having two or more networks. The flow traffic is information about the total traffic of one or more frames classified according to the rules based on the header information of the network protocol, according to each function. as well as The anomaly determination step involves calculating an observed ratio, which is the ratio of communication volume between the two or more networks, for each function based on the aforementioned traffic volume. Then, based on this observed ratio and a normal ratio, which is the ratio of normal communication volume between the two or more networks, it is determined whether the two or more networks are abnormal. The two or more networks mentioned above communicate using different network protocols. The above observation ratio is the ratio of communication volume between the above two or more protocols, calculated based on the above streaming communication volume. In the above anomaly determination step, based on the above streaming traffic, the ratio of the traffic between the above two or more protocols is calculated as the above observation ratio.

Images