Vehicle Log Sending Device, Vehicle Log Collection System, Vehicle Log Sending Method, and Saving Priority Change Device

Abstract

The vehicle log transmission device (10) includes: an abnormality detection unit (420) that obtains vehicle logs from one or more electronic control devices, detects an abnormality based on one or more log information included in the obtained vehicle logs, and extracts the log information in which the abnormality is detected as an abnormality log; an abnormality log notification unit (470) that sends the abnormality log to the vehicle log collection server (20); a vehicle log storage priority change instruction unit (450) that sends, to one or more electronic control devices, an instruction to change the storage priority indicating the priority of leaving one or more log information included in the vehicle logs based on the vehicle state extracted from the vehicle logs; and a vehicle log request response unit (480) that, when receiving a vehicle log request for requesting the transmission of a vehicle log from the vehicle log collection server (20), obtains a vehicle log including the log information stored based on the storage priority changed by the change instruction from one or more electronic control devices, and sends the obtained vehicle log to the vehicle log collection server (20).

Description

Technical Field

[0001] The present disclosure relates to a vehicle log sending device, a vehicle log collection system, a vehicle log sending method, and a save priority change device. Background Art

[0002] In recent years, a large number of devices called electronic control units (ECUs) have been configured in automotive systems. The network connecting these ECUs is called an in-vehicle network. There are a large number of standards for in-vehicle networks. One of the most mainstream in-vehicle networks is the CAN (Controller Area Network) standard defined by ISO11898-1.

[0003] In CAN, the communication path consists of two buses, and the ECUs connected to the buses are called nodes. Each node connected to the buses transmits and receives messages called frames. In CAN, there is no identifier indicating the destination node or the source node. The sending node adds an ID called a message ID to each frame for transmission, and each receiving node only receives messages with a pre-determined message ID. Therefore, there is a threat that by connecting an ECU to the CAN bus and impersonating a legitimate ECU to send frames containing abnormal control commands, it is possible to improperly control the vehicle.

[0004] Patent Document 1 discloses a method for detecting the intrusion of improper data in an in-vehicle network or the like for such threats. When a server outside the vehicle uses the technology of Patent Document 1 to monitor and analyze the data of the in-vehicle system, it is possible to send a large amount of data from the in-vehicle system to the server outside the vehicle. In addition, Patent Document 2 discloses a method for switching the logs sent to the server according to the detected level of abnormality for a large amount of data (logs), thereby reducing the communication data volume.

[0005] Prior Art Documents

[0006] Patent Document 1: Japanese Patent Application Laid-Open No. 2014-146868

[0007] Patent Document 2: Japanese Patent Application Laid-Open No. 2019-125867 Summary of the Invention

[0008] Technical Problem to be Solved by the Invention

[0009] However, in the technologies disclosed in Patent Documents 1 and 2, it is necessary to store the logs for sending to the server in the vehicle for a long period of time, but it is not easy to prepare resources (the storage capacity of the storage device) for storing such logs inside the vehicle for a long period of time. In addition, when deleting the past logs from the stored logs in sequence, sometimes the data required for analysis in the server outside the vehicle will be deleted.

[0010] Therefore, the present disclosure relates to a vehicle log transmission device, a vehicle log collection system, and a vehicle log transmission method, which can store the logs required for analysis in the server even when the resources for storing the logs are limited.

[0011] Technical solutions for solving the problems

[0012] To solve the above problems, a vehicle log transmission device according to one aspect of the present disclosure is a vehicle log transmission device that transmits vehicle logs to a vehicle log collection server, where the vehicle logs are logs stored in one or more electronic control devices mounted on the vehicle and include one or more log information related to the vehicle. The vehicle log transmission device includes: an abnormality detection unit that obtains the vehicle logs from the one or more electronic control devices, detects an abnormality based on the one or more log information included in the obtained vehicle logs, and extracts the log information detected as the abnormality as abnormal logs; an abnormality notification unit that sends the abnormal logs to the vehicle log collection server; a change instruction unit that sends a change instruction of the storage priority indicating the priority of leaving the one or more log information included in the vehicle logs to the one or more electronic control devices based on the vehicle state extracted from the vehicle logs; and a vehicle log request response unit that, when receiving a vehicle log request for requesting the transmission of the vehicle logs from the vehicle log collection server, obtains the vehicle logs including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices, and sends the obtained vehicle logs to the vehicle log collection server.

[0013] In addition, to solve the above problems, a vehicle log collection system according to an aspect of the present disclosure includes: a vehicle log sending device as described; one or more electronic control devices mounted on the vehicle; and a vehicle log collection server. Each of the one or more electronic control devices includes: a vehicle log priority setting unit that changes the storage priority of the vehicle log according to a change instruction of the storage priority of the vehicle log received from the vehicle log sending device; a vehicle log deletion unit that deletes log information corresponding to the storage priority from one or more pieces of log information included in the vehicle log according to the storage priority of the vehicle log; and a vehicle log request response unit that sends the vehicle log stored in the electronic control device to the vehicle log sending device according to the vehicle log request received from the vehicle log sending device. The vehicle log collection server includes: an abnormal log receiving unit that receives the abnormal log from the vehicle log sending device; a vehicle log request unit that sends the vehicle log request to the vehicle log sending device; and a vehicle log receiving unit that receives the vehicle log based on the vehicle log request from the vehicle log sending device.

[0014] In addition, a vehicle log sending method according to an aspect of the present disclosure, which is a vehicle log sending method for sending a vehicle log to a vehicle log collection server, where the vehicle log is stored in one or more electronic control devices mounted on a vehicle and includes one or more pieces of log information related to the vehicle. The vehicle log sending method includes: an abnormality detection step of obtaining the vehicle log from the one or more electronic control devices, detecting an abnormality based on the one or more pieces of log information included in the obtained vehicle log, and extracting the log information detected to be abnormal as an abnormal log; a first sending step of sending the abnormal log to the vehicle log collection server; a second sending step of sending a change instruction of a storage priority indicating a priority of leaving the one or more pieces of log information included in the vehicle log to the one or more electronic control devices based on the vehicle state extracted from the vehicle log; and a third sending step of, when a vehicle log request for requesting the sending of the vehicle log is received from the vehicle log collection server, obtaining the vehicle log including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices and sending the obtained vehicle log to the vehicle log collection server.

[0015] In addition, to solve the above problems, a storage priority change device according to an aspect of the present disclosure includes: an abnormality detection unit that obtains the vehicle log from one or more electronic control devices mounted on the vehicle that store one or more pieces of log information related to the vehicle, detects an abnormality based on the one or more pieces of log information included in the obtained vehicle log, and extracts the log information detected as the abnormality as an abnormal log; an abnormality notification unit that sends the abnormal log to a vehicle log collection server; and a change instruction unit that sends a change instruction for the storage priority indicating the priority of leaving the one or more pieces of log information included in the vehicle log to the one or more electronic control devices based on the vehicle state extracted from the vehicle log.

[0016] Effect of the Invention

[0017] According to a vehicle log sending device and the like according to an aspect of the present disclosure, even when resources for storing logs are limited, it is possible to store the logs required for analysis in the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is an overall configuration diagram of a vehicle log collection system in an embodiment.

[0019] Figure 2 It is a configuration diagram of a vehicle log sending device in an embodiment.

[0020] Figure 3 It is a configuration diagram of an abnormality detection device in an embodiment.

[0021] Figure 4 It is a configuration diagram of a Zone ECU in an embodiment.

[0022] Figure 5 It is a configuration diagram of a vehicle log collection server in an embodiment.

[0023] Figure 6 It is a diagram showing an example of vehicle logs in an in-vehicle network in an embodiment.

[0024] Figure 7 It is a diagram showing an example of vehicle logs in an ECU in an embodiment.

[0025] Figure 8 It is a diagram showing an example of an abnormal log in an embodiment.

[0026] Figure 9 It is a diagram showing an example of an associated vehicle log list in an embodiment.

[0027] Figure 10It is a diagram showing an example of the vehicle log storage priority setting in the embodiment.

[0028] Figure 11 It is a diagram showing the timing of the exception log notification process in the embodiment.

[0029] Figure 12 It is a diagram showing the timing of the vehicle log request response process in the embodiment.

[0030] Figure 13 It is a flowchart of the vehicle log storage priority change process in the embodiment.

[0031] Figure 14 It is a flowchart of the determination of whether a vehicle log request is necessary in the embodiment.

[0032] Figure 15 It is a flowchart of the vehicle log deletion process in the embodiment.

[0033] Reference Numeral Explanation

[0034] 1 Vehicle Log Collection System

[0035] 10 Vehicle Log Sending Device

[0036] 10a Vehicle

[0037] 20 Vehicle Log Collection Server

[0038] 210 External Network Communication Unit

[0039] 220 Exception Log Receiving Unit

[0040] 230 Exception Log Storage Unit

[0041] 240 Vehicle Log Necessity Judgment Unit

[0042] 250 Vehicle Log Request Unit

[0043] 260 Vehicle Log Storage Unit

[0044] 270 Log Provision Unit

[0045] 300 Central ECU

[0046] 400 Exception Detection Device

[0047] 410 Internal Network Communication Unit

[0048] 420 Exception Detection Unit

[0049] 430 Exception Log Storage Unit

[0050] 440 Vehicle State Extraction Unit

[0051] 450 Vehicle Log Saving Priority Change Indicator Section (Change Indicator Section)

[0052] 460 Associated Vehicle Log List Storage Section

[0053] 470 Abnormal Log Notification Section (Abnormal Notification Section)

[0054] 480 Vehicle Log Request Response Section

[0055] 490 External Network Communication Section

[0056] 500a - 500d ZoneECU

[0057] 510 Internal Network Communication Section

[0058] 520 Vehicle Log Priority Setting Section

[0059] 530 Vehicle Log Storage Section

[0060] 540 Vehicle Log Deletion Section

[0061] 550 Vehicle Log Request Response Section

[0062] 560 ECU Communication Section

[0063] 600a Vehicle Navigation ECU

[0064] 600b Brake ECU

[0065] 600c Steering System ECU

[0066] 600d Body ECU Detailed Implementation Manner

[0067] (Process of Obtaining This Disclosure)

[0068] In recent years, automobiles are being electronically controlled, and there is a threat of being improperly operated due to spoofed control commands. Regarding such a threat, it has been studied to collect logs from multiple in - vehicle systems (multiple vehicles) in a server outside the vehicle, and perform monitoring and analysis. When determining the level of an abnormality based on the logs of multiple vehicles or the abnormalities detected in multiple vehicles in the server, the in - vehicle system needs to send the logs after obtaining a response from the server (vehicle log request). Therefore, it is necessary to save the logs in the vehicle for a long period of time.

[0069] Since the resources for storing logs in a vehicle (the storage capacity of the storage device) are limited, it is desirable to store (leave) the data required for monitoring and analysis in the server. The inventors of the present application have intensively studied a vehicle log transmission device and the like that can effectively store the data required for monitoring and analysis in the server, and found that by switching the logs to be preferentially stored according to the vehicle state when an abnormality is detected, even when the amount of stored vehicle log data exceeds the upper limit, it is possible to preferentially leave the logs required for analysis in the server in the vehicle.

[0070] A vehicle log transmission device according to one aspect of the present disclosure is a vehicle log transmission device that transmits vehicle logs to a vehicle log collection server, where the vehicle logs are logs containing one or more log information related to the vehicle and are stored in one or more electronic control devices mounted on the vehicle. The vehicle log transmission device includes: an abnormality detection unit that obtains the vehicle logs from the one or more electronic control devices, detects an abnormality based on the one or more log information included in the obtained vehicle logs, and extracts the log information detected as the abnormality as abnormal logs; an abnormality notification unit that transmits the abnormal logs to the vehicle log collection server; a change instruction unit that, based on the vehicle state extracted from the vehicle logs, transmits a change instruction of the save priority indicating the priority of leaving the one or more log information included in the vehicle logs to the one or more electronic control devices; and a vehicle log request response unit that, when receiving a vehicle log request for requesting the transmission of the vehicle logs from the vehicle log collection server, obtains the vehicle logs including the log information saved based on the save priority changed by the change instruction from the one or more electronic control devices, and transmits the obtained vehicle logs to the vehicle log collection server.

[0071] Thereby, the vehicle log transmission device can transmit, to the vehicle log collection server (server), vehicle logs including log information left (not deleted) according to the save priority corresponding to the vehicle state when an abnormality is detected. In the electronic control device, the log information corresponding to the vehicle state is preferentially left, so that log information useful for analysis in the vehicle log collection server can be stored. Thereby, the vehicle log transmission device can store the logs required for analysis in the server even when the resources for storing logs are limited.

[0072] In addition, for example, it may be that the abnormality detection unit further stores the abnormality detection time when an abnormality is detected, and the change instruction unit further transmits a change instruction of the save priority to the one or more electronic control devices based on the abnormality detection time.

[0073] Accordingly, the vehicle log transmission device can send an instruction to change the storage priority at a timing corresponding to the abnormality detection time. That is, even when no abnormality is detected, the vehicle log transmission device can send an instruction to change the storage priority at this timing. Accordingly, the vehicle log transmission device can store (leave) log information corresponding to the vehicle state at this timing.

[0074] In addition, for example, it may be that the change instruction unit sends an instruction to change the storage priority to the one or more electronic control devices when the first time has elapsed since the abnormality detection time.

[0075] Accordingly, even when no abnormality is detected after the abnormality detection time, the vehicle log transmission device can change the storage priority after the first time has elapsed since the abnormality detection time. Accordingly, even when no abnormality is detected, the vehicle log transmission device can set the storage priority corresponding to the situation at that time, and thus can store logs that are more useful for analysis in the server.

[0076] In addition, for example, it may be that the change instruction unit sets the changed storage priority based on the communication ID included in the in-vehicle message in the in-vehicle network of the vehicle, the process ID of the operating system or application executed on the one or more electronic control devices, and the vehicle state.

[0077] Accordingly, the vehicle log transmission device can manage the storage priority of vehicle logs by confirming the IDs included in the vehicle logs and can identify the required vehicle logs. In addition, the vehicle log transmission device can set the storage priority in its own device based on the communication ID, the process ID, and the vehicle state.

[0078] In addition, for example, it may be that the vehicle state includes a plurality of states in the vehicle, and the change instruction unit sets the changed storage priority for each of the plurality of states based on the degree of indicating whether to preferentially leave the log information corresponding to the communication ID associated with the vehicle state and the log information corresponding to the process ID associated with the vehicle state.

[0079] Accordingly, the vehicle log transmission device can determine whether to leave vehicle logs based on at least one of vehicle states such as the driving mode, the Internet connection status, and the status of each vehicle control function. Accordingly, the vehicle log transmission device can set an appropriate storage priority.

[0080] Alternatively, for example, the change instruction unit may use a state including at least one of a driving mode indicating whether it is in autonomous driving or manual driving, a driving condition indicating whether the vehicle is in motion or stopped, an Internet connection condition indicating whether it is connected to the Internet or not, a first vehicle control function condition indicating whether the automatic parking function is activated or deactivated, a second vehicle control function condition indicating whether the cruise control function is activated or deactivated, and a third vehicle control function condition indicating whether the emergency braking is activated or deactivated as the vehicle state.

[0081] Thereby, the vehicle log transmission device can set a storage priority corresponding to the vehicle state. For example, the vehicle log transmission device can determine whether to leave a vehicle log based on whether important functions related to vehicle body control such as autonomous driving and automatic parking in the in-vehicle system and functions important when an attacker hijacks the vehicle such as the presence or absence of an Internet connection are valid. Thereby, the vehicle log transmission device can set a more appropriate storage priority.

[0082] Alternatively, for example, the change instruction unit may instruct the one or more electronic control devices to perform at least one of the following changes: when the driving mode is the autonomous driving mode, change the storage priority for functions related to autonomous driving to a second priority higher than the first priority; when the driving mode is the manual driving mode, change the storage priority for functions related to the autonomous driving to a third priority lower than the first priority; when the vehicle is in motion, change the storage priority for functions related to body control functions including the door locking function to a fifth priority lower than the fourth priority; when the vehicle is stopped, change the storage priority for functions related to the body control functions to a sixth priority higher than the fourth priority; when the Internet is connected, change the storage priority for functions using the Internet connection to an eighth priority higher than the seventh priority; when the Internet is not connected, change the storage priority for functions using the Internet connection to an eighth priority lower than the seventh priority; when the automatic parking function is activated, change the storage priority for the first vehicle control function related to the automatic parking function to a tenth priority higher than the ninth priority; when the automatic parking function is deactivated, change the storage priority for the first vehicle control function related to the automatic parking function to an eleventh priority lower than the ninth priority; when the cruise control function is activated, change the storage priority for the second vehicle control function related to the cruise control function to a thirteenth priority higher than the twelfth priority; when the cruise control function is deactivated, change the storage priority for the second vehicle control function related to the cruise control function to a fourteenth priority lower than the twelfth priority; when the emergency braking function is activated, change the storage priority for the third vehicle control function related to the emergency braking function to a sixteenth priority higher than the fifteenth priority; when the emergency braking function is deactivated, change the storage priority for the third vehicle control function related to the emergency braking function to an eighteenth priority lower than the fifteenth priority.

[0083] Accordingly, the vehicle log transmission device can set a storage priority corresponding to the vehicle state. For example, when the driving mode is manual driving, vehicle logs such as camera images related to autonomous driving are not as useful as the position of the accelerator pedal and the angle of steering during manual driving. Therefore, the vehicle log transmission device can lower their storage priority. Additionally, for example, when the vehicle is stopped, the concern about vehicle theft is higher than when the vehicle is in motion. Therefore, the vehicle log transmission device can increase the storage priority of logs related to functions related to vehicle body control such as door locking or door opening. Further, the vehicle log transmission device can, for example, increase the storage priority of functions that utilize an Internet connection such as online software updates when the Internet is connected. Additionally, for example, when a specific vehicle control function is activated (ON), the importance during analysis is higher than when the specific vehicle control function is deactivated (OFF). Therefore, the vehicle log transmission device can increase the storage priority.

[0084] Further, for example, it may be that the abnormality notification unit further generates an identifier of the abnormality log that corresponds one-to-one with the abnormality log, sends the abnormality detection time and the identifier of the abnormality log to the vehicle log collection server, the vehicle log request response unit receives the identifier of the abnormality log from the vehicle log collection server, collects log information for a certain period before and after the abnormality detection time corresponding to the identifier of the abnormality log from the one or more electronic control devices, and sends the vehicle log including the collected log information to the vehicle log collection server.

[0085] Accordingly, the vehicle log collection server can collect vehicle logs generated before and after an abnormality that are useful for analyzing the abnormality just by being notified of the identifier of the abnormality log by the vehicle log transmission device.

[0086] In addition, a vehicle log collection system according to one aspect of the present disclosure includes: a vehicle log transmission device as described; one or more electronic control devices mounted on the vehicle; and a vehicle log collection server. Each of the one or more electronic control devices includes: a vehicle log priority setting unit that changes the storage priority of the vehicle log according to a change instruction of the storage priority of the vehicle log received from the vehicle log transmission device; a vehicle log deletion unit that deletes log information corresponding to the storage priority from one or more pieces of log information included in the vehicle log according to the storage priority of the vehicle log; and a vehicle log request response unit that transmits the vehicle log stored in the electronic control device to the vehicle log transmission device according to the vehicle log request received from the vehicle log transmission device. The vehicle log collection server includes: an abnormal log reception unit that receives the abnormal log from the vehicle log transmission device; a vehicle log request unit that transmits the vehicle log request to the vehicle log transmission device; and a vehicle log reception unit that receives the vehicle log based on the vehicle log request from the vehicle log transmission device.

[0087] Accordingly, in the vehicle log collection system, the vehicle log storage device changes the storage priority of the vehicle log that is important in a specific vehicle state. Therefore, even if a long period of time elapses from the detection of an abnormality until the vehicle log request is received, high-priority vehicle logs can be left when the electronic control device periodically deletes vehicle logs. Accordingly, in the vehicle log collection system, even if the electronic control device does not use abundant resources, it is possible to store the vehicle logs required for analysis by the vehicle log collection server and provide the vehicle logs to the vehicle log collection server.

[0088] In addition, for example, it may be that the vehicle log deletion unit deletes the log information with a low storage priority when a second time has elapsed or the capacity of the stored vehicle log is equal to or greater than a certain value.

[0089] Accordingly, the vehicle log deletion unit can continuously store high-priority vehicle logs without exceeding the limit of the memory capacity (size) maintained by the electronic control device.

[0090] In addition, for example, it may be that when the capacity of the vehicle log after deleting the log information with a low storage priority is equal to or greater than the certain value, the vehicle log deletion unit further deletes the log information with a high storage priority in the order from the oldest to the newest by time.

[0091] Accordingly, when the capacity of the stored logs remains large even after deleting the logs with low storage priority, the vehicle log deletion unit can continuously maintain the logs with higher storage priority among the logs with high storage priority by using time. For example, the vehicle log deletion unit can also delete logs in a way that preferentially leaves the logs close to the anomaly detection time or new logs.

[0092] In addition, for example, it can also be that the vehicle log deletion unit deletes the sent vehicle logs after the vehicle log request response unit sends the vehicle logs to the vehicle log sending device.

[0093] Accordingly, the vehicle log deletion unit can delete the vehicle logs that have already been sent to the server even for the logs with high storage priority. Therefore, it can delete unnecessary logs and free up the storage capacity of the electronic control unit.

[0094] In addition, for example, it can also be that the vehicle log collection server further includes a vehicle log request determination unit that determines whether the vehicle log request is needed based on the anomaly log.

[0095] Accordingly, by determining on the server side whether vehicle logs are needed, the vehicle log collection system can reduce the communication volume compared to the case where vehicle logs are sent whenever an anomaly is detected in the vehicle. For example, when the module that generates the anomaly log is a safety-related module, the vehicle log collection server can request vehicle logs to collect only important vehicle logs.

[0096] In addition, for example, it can also be that the vehicle log request determination unit determines whether the vehicle log request is needed based on the reception count of the anomaly log.

[0097] Accordingly, the vehicle log collection server can send a vehicle log request, for example, when the same anomaly log has been sent multiple times from other vehicles and the possibility of a specific attack or malware spread is higher than that of an anomaly log that has occurred only once and urgent analysis is required.

[0098] In addition, a vehicle log sending method according to one aspect of the present disclosure sends vehicle logs to a vehicle log collection server. The vehicle logs are logs stored in one or more electronic control units mounted on the vehicle and containing one or more log information related to the vehicle. The vehicle log sending method includes: an abnormality detection step of obtaining the vehicle logs from the one or more electronic control units, detecting an abnormality based on the one or more log information included in the obtained vehicle logs, and extracting the log information detected as the abnormality as abnormal logs; a first sending step of sending the abnormal logs to the vehicle log collection server; a second sending step of sending a change instruction for the storage priority indicating the priority of leaving the one or more log information included in the vehicle logs to the one or more electronic control units based on the vehicle state extracted from the vehicle logs; and a third sending step of, when a vehicle log request for requesting the sending of the vehicle logs is received from the vehicle log collection server, obtaining the vehicle logs containing the log information stored based on the storage priority changed by the change instruction from the one or more electronic control units, and sending the obtained vehicle logs to the vehicle log collection server.

[0099] Thereby, the same effect as the above-described vehicle log sending device is achieved.

[0100] In addition, a storage priority change device according to one aspect of the present disclosure includes: an abnormality detection unit that obtains the vehicle logs from one or more electronic control units mounted on the vehicle and storing vehicle logs containing one or more log information related to the vehicle, detects an abnormality based on the one or more log information included in the obtained vehicle logs, and extracts the log information detected as the abnormality as abnormal logs; an abnormality notification unit that sends the abnormal logs to a vehicle log collection server; and a change instruction unit that sends a change instruction for the storage priority indicating the priority of leaving the one or more log information included in the vehicle logs to the one or more electronic control units based on the vehicle state extracted from the vehicle logs.

[0101] Thereby, the storage priority change device can leave log information useful for analysis in the vehicle log collection server (server) in the electronic control unit by sending a storage priority corresponding to the vehicle state when an abnormality is detected. Thus, the storage priority change device can make the log required for analysis in the storage server even when the resources for storing logs are limited.

[0102] In addition, these general or specific technical solutions can be implemented by a system, a method, an integrated circuit, a computer program, or a recording medium such as a CD-ROM readable by a computer, or can be implemented by any combination of a system, a method, an integrated circuit, a computer program, or a recording medium.

[0103] Hereinafter, a vehicle log transmission device and the like according to an embodiment will be described with reference to the drawings. Each of the embodiments shown here represents a specific example of the present disclosure. Therefore, the numerical values, constituent elements, arrangements of constituent elements, connection methods, steps as processing elements, and the order of steps shown in the following embodiments are examples and do not limit the present disclosure. In addition, constituent elements in the following embodiments that are not described in the independent claims are constituent elements that can be arbitrarily added. In addition, each drawing is a schematic diagram and is not necessarily a strictly illustrated drawing.

[0104] (Embodiment)

[0105] [Overall configuration diagram of vehicle log collection system]

[0106] Figure 1 is the overall configuration diagram of the vehicle log collection system in this embodiment.

[0107] In Figure 1 , the vehicle log collection system 1 includes a vehicle log transmission device 10 and a vehicle log collection server 20, and the vehicle log transmission device 10 and the vehicle log collection server 20 are connected to be communicable via an external network such as the Internet. The vehicle log transmission device 10 is mounted on, for example, a vehicle 10a. In addition, the vehicle log hereinafter includes one or more log information related to the vehicle 10a.

[0108] The vehicle log transmission device 10 is connected to an in-vehicle network, obtains vehicle logs from devices connected to the in-vehicle network, and detects an abnormality as a safety surprise based on the vehicle logs. Then, the vehicle log transmission device 10 transmits an abnormality log, which is a part of the detected abnormality in the vehicle logs, to the vehicle log collection server 20, and transmits the vehicle logs according to a request (vehicle log request) from the vehicle log collection server 20. Details of the vehicle logs and the abnormality logs will be described later. In addition, the abnormality log includes at least one log information. In addition, the request includes a request to transmit the vehicle logs used in the analysis of the abnormality log. In addition, a part of the detected abnormality is an example of the log information in which an abnormality is detected.

[0109] The vehicle log collection server 20 is a server that receives an abnormality log and a vehicle log from the vehicle log transmission device 10 and uses them for the purpose of providing the log to the security incident response team of the security operation center in order to analyze the cause of the abnormality.

[0110] [Configuration diagram of the vehicle log transmission device]

[0111] Figure 2 It is a configuration diagram of the vehicle log transmission device 10 in the present embodiment.

[0112] In Figure 2 the vehicle log transmission device 10 includes a central ECU 300, an abnormality detection device 400, Zone ECUs 500a, 500b, 500c, 500d, a vehicle navigation ECU 600a, a brake ECU 600b, a steering system ECU 600c, and a body ECU 600d. The central ECU 300, Zone ECUs 500a, 500b, 500c, 500d are connected via Ethernet (registered trademark, the same applies hereinafter) 11 which is an in-vehicle network. In addition, the vehicle navigation ECU 600a and the Zone ECU 500a are connected via Ethernet 12, and the brake ECU 600b and the Zone ECU 500b are connected via Ethernet 13. In addition, the steering system ECU 600c and the Zone ECU 500c are connected via CAN 14, and the body ECU 600d and the Zone ECU 500d are connected via CAN-FD 15. In addition, the central ECU 300 and the abnormality detection device 400 are also connected to an external network. In addition, hereinafter, the Zone ECUs 500a to 500d are also referred to as the ECU group 500a. In addition, vehicle logs containing log information corresponding to the respective Zone ECUs are stored in each of the Zone ECUs 500a to 500d. For example, the vehicle logs in each of the Zone ECUs 500a to 500d contain different log information.

[0113] In addition, in Figure 2The example in the figure shows that the vehicle log transmission device 10 includes each ECU and the like, but it is sufficient to have at least the abnormality detection device 400. In the following, an example in which the vehicle log transmission device 10 is implemented by the abnormality detection device 400 will be described. That is, in the present embodiment, it can be said that the vehicle log collection system 1 includes the vehicle log transmission device 10, the ECU group 500a, and the vehicle log collection server 20. In addition, in the present embodiment, in the vehicle log collection system 1, the vehicle log transmission device 10 and the ECU group 500a are mounted on the vehicle 10a and connected to the in-vehicle network. The vehicle log collection system 1 includes one or more vehicles 10a on which the vehicle log transmission device 10 and the ECU group 500a are mounted. For example, the vehicle log collection system 1 includes a plurality of such vehicles 10a.

[0114] The vehicle log transmission device 10 transmits a vehicle log containing one or more log information related to the vehicle 10a, which is stored in the ECU group 500a (an example of one or more electronic control devices) mounted on the vehicle 10a, to the vehicle log collection server 20. The vehicle log transmission device 10 receives the vehicle logs stored in the central ECU 300 and the ECU group 500a via the Ethernet 11, and detects abnormalities based on the vehicle logs. And, when the vehicle log transmission device 10 detects an abnormality, it transmits an abnormality log to the vehicle log collection server 20 via the external network. In addition, when the vehicle log transmission device 10 receives a request (vehicle log request) to transmit the vehicle log corresponding to the abnormality log from the vehicle log collection server 20, it obtains the vehicle log from the central ECU 300 and the ECU group 500a and transmits it to the vehicle log collection server 20.

[0115] The central ECU 300 is connected to the abnormality detection device 400 and the ECU group 500a via the Ethernet 11. The central ECU 300 controls the ECU group 500a and controls the entire vehicle system. For example, the central ECU 300 controls vehicle control functions such as automatic parking and autonomous driving.

[0116] The anomaly detection device 400 is connected to the central ECU 300 and the ECU group 500a via Ethernet 11. The anomaly detection device 400 acquires vehicle logs from the ECU group 500a, and based on one or more log information included in the acquired vehicle logs, detects an anomaly that is a safety surprise of the vehicle 10a. Further, when the anomaly detection device 400 detects an anomaly, it extracts the log information in which the anomaly is detected as an anomaly log. In addition, when the anomaly detection device 400 detects an anomaly, it notifies the ECU group 500a of the vehicle logs to be preferentially saved. Further, when the anomaly detection device 400 receives a vehicle log request from the vehicle log collection server 20, it collects vehicle logs from the ECU group 500a and sends them to the vehicle log collection server 20.

[0117] The Zone ECU 500a, Zone ECU 500b, Zone ECU 500c, and Zone ECU 500d communicate with the central ECU 300 and other Zone ECUs via Ethernet 11, respectively. The Zone ECU 500a is an ECU that communicates with the vehicle navigation ECU 600a via Ethernet 12 and controls the display of the vehicle navigation. The Zone ECU 500b is an ECU that communicates with the brake ECU 600b via Ethernet 13 and controls the brakes. The Zone ECU 500c is an ECU that communicates with the steering system ECU 600c via CAN 14 and controls the steering of the steering system. The Zone ECU 500d is an ECU that communicates with the body ECU 600d via CAN-FD 15 and controls functions related to the vehicle body such as the lock or wiper of the vehicle 10a.

[0118] The vehicle navigation ECU 600a is an ECU that controls the display of the vehicle navigation mounted on the vehicle 10a. The brake ECU 600b is an ECU that controls the brakes mounted on the vehicle 10a. The steering system ECU 600c is an ECU that controls the steering of the steering system mounted on the vehicle 10a. The body ECU 600d is an ECU that controls functions related to the vehicle body such as the lock and wiper of the vehicle 10a mounted on the vehicle 10a.

[0119] [Configuration diagram of the anomaly detection device]

[0120] Figure 3 is a configuration diagram of the anomaly detection device 400 in the present embodiment. In the present embodiment, Figure 3 is also a configuration diagram of the vehicle log sending device 10.

[0121] In Figure 3In this case, the anomaly detection device 400 includes an internal network communication unit 410, an anomaly detection unit 420, an anomaly log storage unit 430, a vehicle state extraction unit 440, a vehicle log save priority change instruction unit 450, an associated vehicle log list storage unit 460, an anomaly log notification unit 470, a vehicle log request response unit 480, and an external network communication unit 490. In addition, the save priority change device is composed of the anomaly detection unit 420, the vehicle log save priority change instruction unit 450, and the anomaly log notification unit 470.

[0122] The internal network communication unit 410 has a function of communicating with the ECU group 500a via the Ethernet 11. The internal network communication unit 410 is constituted by, for example, a communication circuit (communication module).

[0123] The anomaly detection unit 420 has the following functions: collecting vehicle logs from the ECU group 500a, detecting anomalies that are security threats based on one or more log information included in the obtained vehicle logs, extracting the log information of the part where the detected anomaly is located in the vehicle logs as anomaly logs, and storing them in the anomaly log storage unit 430. Here, the vehicle logs are logs including at least one of the logs (log information) of the operating system of the ECU group 500a, the logs (log information) of applications, and the communication logs (log information) of in-vehicle networks. The communication logs are logs of at least one of the in-vehicle networks including the Ethernet 11, the Ethernet 12, the Ethernet 13, the CAN 14, and the CAN-FD 15.

[0124] The anomaly detection unit 420 may further detect the anomaly detection time and store it in the anomaly log storage unit 430, where the anomaly detection time is the time when the anomaly is detected.

[0125] The anomaly log storage unit 430 has a function of storing the logs detected by the anomaly detection unit 420. The anomaly log storage unit 430 is implemented by a semiconductor memory or the like, but is not limited thereto.

[0126] The vehicle state extraction unit 440 has a function of collecting vehicle logs from the ECU group 500a and extracting the vehicle state from the vehicle logs. Here, the vehicle state includes multiple states in the vehicle 10a (refer to Figure 9)。The vehicle state includes at least one of the driving mode, driving condition, Internet connection condition, and vehicle control function condition (e.g., the condition of the autonomous driving function, the condition of the cruise control function, the condition of emergency braking) of the vehicle 10a. The driving mode indicates the mode in which the vehicle 10a is currently driving, including whether the vehicle 10a is in autonomous driving (autonomous driving mode) or in manual driving (manual driving mode). Additionally, it may also include whether the driving mode is in remote operation (remote operation mode). The driving condition includes whether the vehicle 10a is driving or still stopped. The Internet connection condition includes whether it is Internet-connected or not. The condition of the autonomous driving function includes whether the automatic parking function is activated (ON) or deactivated (OFF). The condition of the cruise control function includes whether the cruise control function (CC function) is activated (ON) or deactivated (OFF). The condition of emergency braking includes whether emergency braking is activated (ON) or deactivated (OFF).

[0127] In addition, the condition of the autonomous driving function is an example of the first vehicle control function condition, the condition of the cruise control function is an example of the second vehicle control function condition, and the condition of emergency braking is an example of the third vehicle control function condition.

[0128] The vehicle log save priority change instruction unit 450 has the following functions: obtaining the vehicle state from the vehicle state extraction unit 440, obtaining the associated vehicle log list stored in the associated vehicle log list storage unit 460, and notifying (sending) it to the ECU group 500a. The associated vehicle log list is a list of the IDs of vehicle logs prioritized by vehicle state. The vehicle log save priority change instruction unit 450 sends a change instruction for the save priority indicating the priority of leaving one or more log information included in the vehicle log to the ECU group 500a based on the vehicle state extracted from the vehicle log. The save priority can also be said to be the priority of leaving the log information, for example. The vehicle log save priority change instruction unit 450 may further send a change instruction for the save priority to the ECU group 500a based on the anomaly detection time when the anomaly detection unit 420 detects the anomaly detection time. Details of the method for changing the associated vehicle log list and the vehicle log save priority will be described later. In addition, the vehicle log save priority change instruction unit 450 is an example of the change instruction unit.

[0129] The associated vehicle log list storage unit 460 has the function of storing the associated vehicle log list. The associated vehicle log list storage unit 460 is implemented by a semiconductor memory or the like, but is not limited thereto.

[0130] The abnormality log notification unit 470 has a function of sending the abnormality logs detected by the abnormality detection unit 420 to the vehicle log collection server 20. The abnormality log notification unit 470 is an example of the abnormality notification unit.

[0131] The vehicle log request response unit 480 has the following functions: when a vehicle log request is received, in the case where a vehicle log request is received from the vehicle log collection server 20 via the external network communication unit 490, it collects vehicle logs from the ECU group 500a and sends the vehicle logs to the vehicle log collection server 20. It can also be said that when a vehicle log request for which a vehicle log has been received from the vehicle log collection server 20 is received, the vehicle log request response unit 480 obtains a vehicle log including log information saved based on the save priority changed by the change instruction from the ECU group 500a, and sends the obtained vehicle log to the vehicle log collection server 20. The obtained vehicle log is, for example, log information saved based on the change instruction of the save priority.

[0132] The external network communication unit 490 has a function of communicating with the vehicle log collection server 20 via an external network. The external network communication unit 490 is constituted by, for example, a communication circuit (communication module).

[0133] [Configuration diagram of ZoneECU]

[0134] Figure 4 It is the configuration diagram of the ZoneECU 500a in the present embodiment.

[0135] In Figure 4 the ZoneECU 500a includes an internal network communication unit 510, a vehicle log priority setting unit 520, a vehicle log storage unit 530, a vehicle log deletion unit 540, a vehicle log request response unit 550, and an ECU communication unit 560.

[0136] The internal network communication unit 510 has a function of communicating with the abnormality detection device 400 and the ECU group 500a via Ethernet 11. The internal network communication unit 510 is constituted by, for example, a communication circuit (communication module).

[0137] The vehicle log priority setting unit 520 has the following function: receiving a vehicle log priority change instruction sent by the abnormality detection device 400 and changing the priority setting of the vehicle log according to the instruction.

[0138] The vehicle log storage unit 530 has a function of storing vehicle logs. The vehicle log storage unit 530 is implemented by a semiconductor memory or the like, but is not limited thereto.

[0139] The vehicle log deletion unit 540 has a function of deleting vehicle logs periodically or when the amount of stored data of the vehicle logs reaches the upper limit. For example, the vehicle log deletion unit 540 deletes log information corresponding to the storage priority from one or more pieces of log information included in the vehicle logs according to the storage priority of the vehicle logs. In addition, the log information deleted here is, for example, log information that is not sent to the vehicle log collection server 20. Further, the vehicle log deletion unit 540 may delete the sent vehicle logs after the vehicle log request response unit 550 sends the vehicle logs to the vehicle log sending device 10. Details of the method for deleting vehicle logs will be described later.

[0140] The vehicle log request response unit 550 has the following functions: receiving a vehicle log request sent by the anomaly detection device 400 and sending (responding with) the vehicle logs stored in the vehicle log storage unit 530 to the anomaly detection device 400. It can also be said that the vehicle log request response unit 550 sends the vehicle logs stored in the vehicle log storage unit 530 to the vehicle log sending device 10 according to the vehicle log request received from the vehicle log sending device 10.

[0141] The ECU communication unit 560 has a function of communicating with the vehicle navigation ECU 600a via the Ethernet 12. The ECU communication unit 560 is constituted by, for example, a communication circuit (communication module).

[0142] In addition, the Zone ECUs 500b to 500d and the central ECU 300 may also have the same constitution as that Figure 4 shown. The ECU communication unit 560 of the Zone ECU 500b is connected to the brake ECU 600b, the ECU communication unit 560 of the Zone ECU 500c is connected to the steering system ECU 600c, and the ECU communication unit 560 of the Zone ECU 500d is connected to the body ECU 600d. Instead of the ECU communication unit 560, the central ECU 300 has an ECU control unit and controls the entire vehicle system by controlling the ECU group 500a, for example, implementing vehicle control functions such as autonomous driving, automatic parking, and cruise control. In addition, the central ECU 300 has an external network communication unit and has a function of mediating the Internet connection of the vehicle navigation ECU 600a.

[0143] [Configuration diagram of vehicle log collection server]

[0144] Figure 5 is a configuration diagram of the vehicle log collection server 20 in the present embodiment.

[0145] In Figure 5Among them, the vehicle log collection server 20 includes an external network communication unit 210, an exception log receiving unit 220, an exception log storage unit 230, a vehicle log necessity judgment unit 240, a vehicle log request unit 250, a vehicle log storage unit 260, and a log providing unit 270.

[0146] The external network communication unit 210 has a function of communicating with the vehicle log sending device 10 via an external network. The external network communication unit 210 is constituted by, for example, a communication circuit (communication module).

[0147] The exception log receiving unit 220 has a function of receiving exception logs from the exception detection device 400. It can also be said that the exception log receiving unit 220 receives vehicle logs corresponding to vehicle log requests from the vehicle log sending device 10. In the present embodiment, the exception log receiving unit 220 also has a function of receiving vehicle logs based on vehicle log requests from the exception detection device 400. That is, the exception log receiving unit 220 also functions as a vehicle log receiving unit.

[0148] The exception log storage unit 230 has a function of storing the exception logs received by the exception log receiving unit 220. The exception log storage unit 230 is implemented by a semiconductor memory or the like, but is not limited thereto.

[0149] The vehicle log necessity judgment unit 240 has the following function: based on the exception logs stored in the exception log storage unit 230, judge whether vehicle logs are needed. The vehicle log necessity judgment unit 240 can, for example, also judge whether vehicle logs are needed according to the number of received exception logs. The vehicle log necessity judgment unit 240 can, for example, also judge whether vehicle logs are needed according to the number of received exception logs of the same type. The exception logs of the same type can be either logs indicating exceptions related to the same process ID or communication ID, or exceptions in the same device. The details of the vehicle log necessity judgment method will be described later.

[0150] The vehicle log request unit 250 has the following function: when the vehicle log necessity judgment unit 240 judges that vehicle logs are needed, send a vehicle log request to the exception detection device 400 and receive vehicle logs. It can also be said that the vehicle log request unit 250 sends a vehicle log request to the vehicle log sending device 10.

[0151] The vehicle log storage unit 260 has a function of storing the vehicle logs received by the vehicle log request unit 250. The vehicle log storage unit 260 is implemented by a semiconductor memory or the like, but is not limited thereto.

[0152] The log providing unit 270 has the following function: providing the abnormal logs stored in the abnormal log storage unit 230 and the vehicle logs stored in the vehicle log storage unit 260 to the users of the vehicle log collection server 20. For example, the user is a member of the security event response team of the security operation center that uses the vehicle log collection server 20. For example, the providing method includes downloading the logs, visualizing them using a graphical interface for display, etc., but is not limited thereto. The log providing unit 270 is composed of a display device, a voice output device, etc.

[0153] [An example of vehicle logs in an in-vehicle network]

[0154] Figure 6 This is a diagram showing an example of vehicle logs in the in-vehicle network of the present embodiment. Vehicle logs are classified into vehicle logs in the in-vehicle network and vehicle logs in the ECU. The vehicle logs in the ECU are described later. Figure 7 Described later.

[0155] In Figure 6 , the vehicle logs in the in-vehicle network are logs of communication messages circulating on the in-vehicle network. The log of one communication message includes a communication ID, a time, and payload data (also recorded as data). The communication ID is an identifier indicating the category of the communication message. The payload data is a hexadecimal value, and the content can be read by referring to the definition determined in advance according to the communication ID.

[0156] For example, for a communication message with a communication ID of "M1", it can be known that it was sent at time "T11". In addition, in the communication message with a communication ID of "M1", the content indicating the Internet connection status is included in the third byte of the payload data. For example, when the third byte of the payload data is "00", it can be determined that it represents "OFF" indicating the state of not being connected to the Internet, and when it is "01", it can be determined that it represents "ON" indicating the state of being connected to the Internet.

[0157] Similarly, the driving speed can be read from the payload data in the third and fourth bytes of the communication message with a communication ID of "M2". For example, when it is faster than 0 km / h, it can be determined that the driving condition is in motion, and when it is 0 km / h, it can be determined that the driving condition is stopped. The presence or absence of an emergency braking instruction can be read from the payload data in the fifth byte.

[0158] In addition, similarly, it is possible to read the door locked state from a communication message with a communication ID of "M3", and to read the driving mode, vehicle control function, steering indication, and steering indication angle from a communication message with a communication ID of "M4". Here, the CC of the vehicle control function refers to the cruise control mode, which is a mode in which the vehicle 10a automatically travels by tracking the vehicle ahead. In this way, by using the vehicle log, the current vehicle state can be grasped. In addition, the communication message is an example of an in-vehicle message.

[0159] The vehicle log in the in-vehicle network can be used for detecting safety anomalies. For example, when the steering system is moved mechanically in the case where the driving mode is autonomous driving or the vehicle control function is automatic parking, the steering indication angle with a communication ID of "M4" is used. The steering system ECU 600c receives a communication message with a communication ID of "M4" via the Zone ECU 500c. And, when the steering indication is active (ON), the steering system ECU 600c operates the steering according to the steering indication angle. However, during the period when the steering indication is ON, in the case where a malicious attacker has improperly sent a communication message rewriting the steering indication angle to an abnormal value on the in-vehicle network, there is a possibility that the control side may perform an unintended and dangerous steering operation. In order to detect such an attack as an anomaly, the anomaly detection device 400 monitors the communication message with a communication ID of "M4" and monitors the difference in the steering indication angles included in two consecutive communication messages. When this difference is equal to or more than a predetermined value, there is a possibility that rewriting based on an attack has been performed, and thus, it is detected as an anomaly. For example, when the steering indication angle suddenly changes from 0 degrees to 90 degrees, the anomaly detection device 400 detects that there is a possibility that rewriting based on an attack has been performed, and thus, it is detected as an anomaly.

[0160] In addition, the vehicle log in the in-vehicle network can be used for analyzing the cause of an anomaly. The vehicle log in the in-vehicle network is used, for example, by the security incident response team of the security operation center. When the communication messages before and after the occurrence of an anomaly are communication messages with a communication ID of "M4", the vehicle log collection server 20 can obtain the time when the anomaly occurred from the log of this communication message, and can obtain the vehicle state at the time of anomaly detection from the communication messages with communication IDs of "M1", "M2", and "M3" immediately before the occurrence of the anomaly. And, for example, when the driving state at the time of anomaly detection is in motion and the Internet connection state is not connected (OFF), it is difficult for an attacker to be near the vehicle 10a during driving, and it is also difficult for an attack via the Internet. Therefore, it can be highly speculated that the cause is due to a device physically installed on the vehicle 10a by an attacker before driving or has been rewritten.

[0161] In addition, the anomaly detection device 400 can also use the log of communication messages with the communication ID "M4" before and after the anomaly occurs to obtain the vehicle state at the time of anomaly detection. In addition, a group of the time and payload data for each communication ID is an example of log information.

[0162] [An example of vehicle logs in the ECU]

[0163] Figure 7 is a diagram showing an example of vehicle logs in the ECU of the present embodiment.

[0164] In Figure 7 , the vehicle logs in the ECU are system logs output by the operating system or application processes of the ECU. A system log consists of a process ID, time, ECU name, and data. The vehicle logs are stored in the ECU connected to the ZoneECU or the ZoneECU.

[0165] The process ID is an identifier of the process that output the log, and the ECU name is the name of the ECU where the process that output the log operates. In the data, the start, result, end, etc. of the operation of the process are recorded. For example, the system log with the process ID "P1" is a process implemented on the vehicle navigation ECU 600a at the time "T21", and the content that the attempt to connect to the Internet failed is recorded in the data. In addition, for example, the system log with the process ID "P5" is a process implemented on the body ECU 600d at the time "T25", and the content that the Secure Boot was implemented and succeeded is recorded in the data.

[0166] The vehicle logs in the ECU can be used for detecting security anomalies. The anomaly detection device 400, for example, monitors the process log with the process ID "P7", and when it is determined that the Secure Boot has failed, it can detect an anomaly as being likely that unauthorized software rewriting has been performed on the central ECU 300.

[0167] In addition, the vehicle logs in the ECU can be used to analyze the causes of anomalies. The vehicle logs in the ECU are used, for example, by the security incident response team of the security operation center. The vehicle log collection server 20 can, for example, obtain from the vehicle logs with process IDs "P1", "P2", "P6", and "P7" the time when a secure boot startup failure was confirmed, and can obtain the situation where registration was performed from the vehicle navigation ECU 600a to the central ECU 300 shortly before that, and the vehicle navigation ECU 600a executed a software update despite not being connected to the network. Also, the security incident response team can highly suspect the following reason: an improper software was installed on the vehicle navigation ECU 600a, and an attempt was made to tamper with the software of the central ECU 300 via the vehicle navigation ECU 600a, but an anomaly was detected during the secure boot.

[0168] In addition, the set of the time, ECU name, and data for each process ID is an example of log information.

[0169] [An example of an exception log]

[0170] Figure 8 is a diagram showing an example of the exception log in the present embodiment. The exception log is the log (log information) extracted as being an anomaly from the vehicle logs by the anomaly detection unit 420 of the anomaly detection device 400.

[0171] In Figure 8 the exception log consists of an exception identifier, an anomaly detection time, a log category, a log ID, and data. The exception identifier is an identifier that corresponds one-to-one with one exception log, and for example, the hash value of the log category, log ID, and data of the exception log can be used. Also, the anomaly detection time is recorded with reference to the time of the vehicle log when the anomaly detection device 400 detected the anomaly. Also, the log category is recorded as in-vehicle network when the log in which the anomaly was detected is a vehicle log in the in-vehicle network, and is recorded as ECU when the log in which the anomaly was detected is a vehicle log in the ECU. Also, in the case of a vehicle log in the in-vehicle network, the data stores the payload data of the communication message, and in the case of a vehicle log in the ECU, the data stores the system log data.

[0172] For example, the anomaly detection time of the anomaly log with the anomaly identifier "A1" is "T14", the log category is "in-vehicle network", the log ID is "M4", and the data is "00 01 00 01 FF 00 00 00". Additionally, for example, the anomaly detection time of the anomaly log with the anomaly identifier "A2" is "T26", the log category is "ECU", the log ID is "P7", and the data is "Failed to start safely". That is, by referring to the data of the anomaly log, it is possible to grasp whether an anomaly has occurred, when, where, and what kind of anomaly it is. However, just with the anomaly log alone, it is difficult to even grasp the cause of the anomaly, and vehicle logs other than the anomaly log are also needed.

[0173] [An example of the associated vehicle log list]

[0174] Figure 9 This is a diagram showing an example of the associated vehicle log list in the present embodiment. The anomaly detection device 400, for example, acquires and stores in advance Figure 9 the associated vehicle log list shown.

[0175] In Figure 9 , the associated vehicle log list is composed of vehicle status, associated communication ID, associated process ID, vehicle status at the time of anomaly detection, and save priority. The vehicle status is an item of the vehicle status extracted from the vehicle log, and the associated communication ID and associated process ID record the communication ID and process ID that are highly relevant to the item according to the item of the vehicle status. The vehicle status at the time of anomaly detection indicates the vehicle status when the anomaly detection device 400 detects the anomaly log, and the save priority is the priority indicating whether to preferentially retain the vehicle logs of the associated communication ID and associated process ID. When the save priority is high, "high" is recorded, and when the save priority is low, "low" is recorded.

[0176] For example, the associated communication IDs of the associated vehicle log list with the vehicle status of "driving mode" are "M2, M4", and the associated process IDs are "P3, P4, P7". And when the vehicle status at the time of anomaly detection is "autopilot", the save priority is "high", and when the vehicle status at the time of anomaly detection is "manual driving", the save priority is "low". It can also be said that a save priority of "high" indicates a log with high importance related to the vehicle status at the time of anomaly detection (a log with high importance in the analysis of the cause of the anomaly), and a save priority of "low" indicates a log with low importance related to the vehicle status at the time of anomaly detection (a log with low importance in the analysis of the cause of the anomaly). By referring to the associated vehicle log list, it is possible to grasp the logs of communication messages and processes with high importance related to the vehicle status at the time of detecting the anomaly, and those logs are highly likely to be useful logs in the analysis of the cause of the anomaly.

[0177] The vehicle log storage priority change instruction unit 450 sets the changed storage priority based on Figure 9 the associated vehicle log list shown. The vehicle log storage priority change instruction unit 450 sets the changed storage priority, for example, based on the communication ID included in the in-vehicle message in the in-vehicle network of the vehicle 10a, the process ID of the operating system or application executed on the ECU group 500a, and the vehicle state (for example, the vehicle state at the time of abnormality detection). The vehicle log storage priority change instruction unit 450 sets the changed storage priority, for example, for each item of the vehicle state, based on the degree (storage priority) indicating whether to preferentially retain the log information corresponding to the communication ID associated with the vehicle state and the log information corresponding to the process ID associated with the vehicle state.

[0178] [An example of setting the vehicle log storage priority]

[0179] Figure 10 is a diagram showing an example of setting the vehicle log storage priority in the present embodiment.

[0180] In Figure 10 it, the vehicle log storage priority setting consists of a log ID, a storage priority, and a priority setting time. The log ID represents the communication ID or process ID included in the vehicle log. The storage priority represents the priority of storing the vehicle log, and one of "high", "medium", and "low" is recorded in descending order of priority. For example, "medium" is recorded in the initial state. The vehicle log (log information) with a low storage priority log ID is preferentially deleted when deleting the vehicle log in the ECU group 500a. The priority setting time records the time when the storage priority of the log ID is changed, and "―" is recorded when the storage priority is not changed.

[0181] For example, the storage priority of the vehicle log storage priority setting with the log ID of "M1" is "low", and the priority setting time is "T40". That is, it can be known that the storage priority of the vehicle log with the log ID of "M1" was changed to "low" at time T40. In addition, for example, the storage priority of the vehicle log storage priority setting with the log ID of "M3" is "medium", and the priority setting time is "―". That is, it can be known that the storage priority of the vehicle log with the log ID of M3 has not been changed from the initial state. In addition, for example, the storage priority of the vehicle log storage priority setting with the log ID of "P7" is "high", and the priority setting time is "T41". That is, it can be known that the storage priority of the vehicle log with the log ID of "P7" was changed to "high" at time T41.

[0182] By referring to the vehicle log save priority setting, it is possible to preferentially save (store without deletion) the logs required for analyzing the cause of an abnormality.

[0183] [Sequence of processing]

[0184] Figure 11 This is a diagram showing the sequence of the abnormality log notification process (a part of the vehicle log transmission method) in the present embodiment. Figure 11 It shows the sequence of processing from when the vehicle log transmission device 10 detects an abnormality in the vehicle log to when it transmits the abnormality log to the vehicle log collection server 20.

[0185] (S1101) The abnormality detection unit 420 of the abnormality detection device 400 obtains vehicle logs from the ECU group 500a via the internal network respectively, and detects abnormalities. That is, the abnormality detection unit 420 determines whether there is an abnormality based on one or more log information included in the obtained vehicle logs. And when the abnormality detection unit 420 detects an abnormality, it extracts the log information where the abnormality is detected as the abnormality log, stores the extracted abnormality log in the abnormality log storage unit 430, and sends the abnormality detection time and the vehicle log (log information) to the vehicle state extraction unit 440. Examples of the abnormality detection method are described in an example of the vehicle log in the in-vehicle network ( Figure 6 ) and an example of the vehicle log in the ECU ( Figure 7 ). In addition, the abnormality detection unit 420 can also store, for example, the Figure 8 shown abnormality log in the abnormality log storage unit 430 and send it to the vehicle state extraction unit 440. Step S1101 is an example of the abnormality detection step and the first transmission step.

[0186] (S1102) The vehicle state extraction unit 440 receives the vehicle log in step S1101 and extracts the vehicle state at the abnormality detection time. The vehicle state extraction unit 440 extracts the vehicle state at the abnormality detection time from the vehicle logs (log information) other than the vehicle log (log information) where the abnormality is detected in step S1101, for example. And the vehicle state extraction unit 440 sends the vehicle state to the vehicle log save priority change instruction unit 450. Examples of the vehicle state extraction method are described in an example of the vehicle log in the in-vehicle network ( Figure 6 ).

[0187] (S1103) The vehicle log save priority change instruction unit 450 refers to the associated vehicle log list stored in the associated vehicle log list storage unit 460 and determines the vehicle log (log information) for which the save priority needs to be changed.

[0188] (S1104) The vehicle log storage priority change instruction unit 450 sends an instruction to change the storage priority of the vehicle log determined in step S1103 to the ECU group 500a. For example, the vehicle log storage priority change instruction unit 450 sends an instruction indicating a change to a common storage priority to each of the multiple ZoneECUs 500a to 500d included in the ECU group 500a. That is, the storage priority of the vehicle log changed according to the change instruction is equal in each of the multiple ZoneECUs 500a to 500d. In addition, for example, the vehicle log storage priority change instruction unit 450 may also send an instruction indicating a change to different storage priorities to each of the multiple ZoneECUs 500a to 500d. Step S1104 is an example of the second sending step.

[0189] In addition, the vehicle log storage priority change instruction unit 450 may, in step S1104, send an instruction to change the storage priority to the ECU group 500a when the first time has elapsed since the anomaly detection time. That is, the vehicle log storage priority change instruction unit 450 may send an instruction to change the storage priority to the ECU group 500a even when no other anomaly has been detected since the detection of the previous anomaly until now.

[0190] (S1105) The ECU group 500a changes the priority setting of the vehicle log. The method for changing the priority setting of the vehicle log will be described later.

[0191] (S1106) The anomaly log notification unit 470 receives the anomaly log from the anomaly detection unit 420 and sends the anomaly log to the vehicle log collection server 20. The anomaly log notification unit 470 may further generate an identifier for the anomaly log that corresponds one-to-one with the anomaly log and send the anomaly detection time and the identifier of the anomaly log to the vehicle log collection server 20.

[0192] (S1107) The vehicle log collection server 20 receives the anomaly log and stores it in the anomaly log storage unit 230.

[0193] [Timing of Vehicle Log Request Processing]

[0194] Figure 12 It is a diagram showing the timing of the vehicle log request response processing (a part of the vehicle log sending method) in the present embodiment. Figure 12 It shows the processing timing from receiving the anomaly log from the vehicle log collection server 20 to requesting the vehicle log from the vehicle log sending device 10 (the anomaly detection device 400 in the present embodiment) and receiving the response (the vehicle log from the anomaly detection device 400).

[0195] (S1201) The vehicle log collection server 20 determines whether it has received abnormal logs more than a certain number of times. The vehicle log collection server 20 receives the abnormal logs in step S1107 and stores them in the abnormal log storage unit 230. The vehicle log collection server 20 can also determine whether it has received abnormal logs that are the same as the stored abnormal logs more than a certain number of times. Here, when the vehicle log necessity determination unit 240 determines that vehicle logs are needed, it requests the vehicle log request response unit 480 of the vehicle log collection server 20 to send vehicle logs. Details of the method for determining the necessity of vehicle logs will be described later.

[0196] (S1202) When the vehicle log necessity determination unit 240 has received abnormal logs more than a certain number of times, it requests the vehicle log request response unit 480 to send vehicle logs. That is, the vehicle log necessity determination unit 240 sends a vehicle log request. The vehicle log necessity determination unit 240 can also, for example, send a vehicle log request containing the identifier of the abnormal log to the vehicle log request response unit 480.

[0197] (S1203) The vehicle log request response unit 480 receives the vehicle log request in step S1202. The vehicle log request response unit 480, for example, receives a vehicle log request containing the identifier of the abnormal log from the vehicle log collection server 20.

[0198] (S1204) The vehicle log request response unit 480 refers to the abnormal log storage unit 430 and requests the vehicle log request response unit 550 of the ECU group 500a for the vehicle logs for one hour before and after the abnormal detection time corresponding to the identifier of the abnormal log. Here, one hour before and after is a value determined in advance and may not be one hour.

[0199] (S1205) The vehicle log request response unit 550 of the ECU group 500a receives the vehicle log request in step S1205.

[0200] (S1206) The vehicle log request response unit 550 of the ECU group 500a responds (sends) the vehicle logs for one hour before and after the abnormal detection time to the vehicle log request response unit 480. In addition, the vehicle log deletion unit 540 can also delete the sent vehicle logs after the vehicle log request response unit 550 sends the vehicle logs to the vehicle log request response unit 480 in step S1206.

[0201] (S1207) The vehicle log request response unit 480 receives the vehicle logs in step S1206 from the ECU group 500a.

[0202] (S1208) The vehicle log request response unit 480 responds (sends) the vehicle log to the vehicle log collection server 20. The vehicle log request response unit 480 can also be said to receive log information for a certain period before and after the anomaly detection time corresponding to the identifier of the anomaly log from the ECU group 500a, and send the vehicle log including the collected log information to the vehicle log collection server 20. Step S1208 is an example of the third sending step.

[0203] (S1209) The vehicle log collection server 20 receives the vehicle log of step S1208.

[0204] Thus, the vehicle log collection server 20 can obtain the vehicle log required for monitoring or analyzing anomalies from the anomaly detection device 400.

[0205] [Flowchart of vehicle log save priority change process]

[0206] Figure 13 This is the flowchart of the vehicle log save priority change process (a part of the vehicle log sending method) in the present embodiment. Figure 13 It represents the flowchart of the vehicle log save priority change process of the vehicle log save priority change instruction unit 450.

[0207] (S1301) The anomaly detection unit 420 extracts the anomaly log from the vehicle log. And, the vehicle state extraction unit 440 refers to the anomaly detection time included in the anomaly log, and extracts the vehicle state at the anomaly detection time. Then, step S1302 is implemented.

[0208] (S1302) The vehicle log save priority change instruction unit 450 determines whether the driving mode in the vehicle state is autonomous driving. When the driving mode is autonomous driving (in S1302, it is "yes"), the vehicle log save priority change instruction unit 450 implements step S1303. When the driving mode is manual driving (in S1302, it is "no"), the vehicle log save priority change instruction unit 450 implements step S1304.

[0209] (S1303) The vehicle log save priority change instruction unit 450 changes the save priority of the log of the autonomous driving function in the vehicle log to "high", and implements step S1305. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the process of step S1303, uniformly changes the save priority of the log of the autonomous driving function to "high".

[0210] (S1304) The vehicle log save priority change instruction unit 450 changes the save priority of the log of the autonomous driving function in the vehicle log to "low" and implements step S1305. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the processing of step S1304, uniformly changes the save priority of the log of the autonomous driving function to "low".

[0211] In this way, it can be said that the vehicle log save priority change instruction unit 450, in steps S1302 to S1304, changes the save priority for functions associated with autonomous driving to the second priority higher than the first priority when the driving mode is the autonomous driving mode, and changes the save priority for functions associated with autonomous driving to the third priority lower than the first priority when the driving mode is the manual driving mode.

[0212] (S1305) The vehicle log save priority change instruction unit 450 determines whether the driving condition in the vehicle state is stopped. When the driving condition is stopped (yes in S1305), the vehicle log save priority change instruction unit 450 implements step S1306, and when the driving condition is in motion (no in S1305), it implements step S1307.

[0213] (S1306) The vehicle log save priority change instruction unit 450 changes the save priority of the door locking function in the vehicle log to "high" and implements step S1308. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the processing of step S1306, uniformly changes the save priority of the door locking function to "high".

[0214] (S1307) The vehicle log save priority change instruction unit 450 changes the save priority of the door locking function in the vehicle log to "low" and implements step S1308. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the processing of step S1307, uniformly changes the save priority of the door locking function to "low".

[0215] In this way, the vehicle log save priority change instruction unit 450 can also, in steps S1305 to S1307, change the save priority for functions associated with the vehicle body control function including the door locking function to the fifth priority lower than the fourth priority when the vehicle 10a is in motion, and change the save priority for functions associated with the vehicle body control function to the sixth priority higher than the fourth priority when the vehicle 10a is stopped.

[0216] (S1308) The vehicle log save priority change instruction unit 450 determines whether the Internet connection status in the vehicle state is connected (ON). When the Internet connection status is ON (Yes in S1308), the vehicle log save priority change instruction unit 450 executes step S1309. When the Internet connection status is OFF (No in S1308), the vehicle log save priority change instruction unit 450 executes step S1309.

[0217] (S1309) The vehicle log save priority change instruction unit 450 changes the save priority of the logs of the functions that require Internet connection in the vehicle log to "high" and executes step S1311. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the processing of step S1309, uniformly changes the save priority of the logs of the functions that require Internet connection to "high".

[0218] (S1310) The vehicle log save priority change instruction unit 450 changes the save priority of the logs of the functions that require Internet connection in the vehicle log to "low" and executes step S1311. The vehicle log save priority change instruction unit 450, for example, regardless of the save priority before the processing of step S1310, uniformly changes the save priority of the logs of the functions that require Internet connection to "low".

[0219] In this way, the vehicle log save priority change instruction unit 450 can also, in steps S1308 to S1310, change the save priority for the functions using Internet connection to the 8th priority, which is higher than the 7th priority, when the Internet is connected, and change the save priority for the functions using Internet connection to the 8th priority, which is lower than the 7th priority, when the Internet is not connected.

[0220] (S1311) The vehicle log save priority change instruction unit 450 determines whether the vehicle control function in the vehicle state is started (ON). When the vehicle control function is ON (Yes in S1311), the vehicle log save priority change instruction unit 450 executes step S1312. When the vehicle control function is off (OFF) (No in S1311), the vehicle log save priority change instruction unit 450 executes step S1313. Here, for example, in an example of the vehicle log of the in-vehicle network (refer to Figure 6 ) automatic parking and CC are described as vehicle control functions. When the vehicle control function (automatic parking) is ON, the save priority of the log associated with the vehicle control function (automatic parking) is changed to "high". When the vehicle control function (CC) is ON, the save priority of the log associated with the vehicle control function (CC) is changed to "high".

[0221] (S1312) The vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the corresponding vehicle control function in the vehicle log to "high" and ends the process. For example, the vehicle log storage priority change instruction unit 450 changes the storage priority of the corresponding vehicle control function to "high" uniformly regardless of the storage priority before the process of step S1312.

[0222] (S1313) The vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the corresponding vehicle control function in the vehicle log to "low" and ends the process. For example, the vehicle log storage priority change instruction unit 450 changes the storage priority of the corresponding vehicle control function to "low" uniformly regardless of the storage priority before the process of step S1313.

[0223] In this way, in steps S1311 to S1313, when the automatic parking function is ON, the vehicle log storage priority change instruction unit 450 can change the storage priority of the first vehicle control function associated with the automatic parking function to the 10th priority, which is higher than the 9th priority, and when the automatic parking function is OFF, change the storage priority of the first vehicle control function associated with the automatic parking function to the 11th priority, which is lower than the 9th priority. In addition, in steps S1311 to S1313, when the cruise control function is ON, the vehicle log storage priority change instruction unit 450 can change the storage priority of the second vehicle control function associated with the cruise control function to the 13th priority, which is higher than the 12th priority, and when the cruise control function is OFF, change the storage priority of the second vehicle control function associated with the cruise control function to the 14th priority, which is lower than the 12th priority.

[0224] In addition, the vehicle control function may also include emergency braking. For example, when the vehicle control function (emergency braking) is activated (ON) (yes in S1311), the vehicle log storage priority change instruction unit 450 can change the storage priority of the log associated with the vehicle control function (emergency braking) to "high" (S1312), and when the vehicle control function (emergency braking) is deactivated (OFF) (no in S1311), change the storage priority of the log associated with the vehicle control function (emergency braking) to "low".

[0225] In this way, the vehicle log storage priority change instruction unit 450 can also change the storage priority of the third vehicle control function associated with the emergency braking function to the 16th priority higher than the 15th priority in steps S1311 to S1313 when the emergency braking function is ON, and change the storage priority of the third vehicle control function associated with the emergency braking function to the 18th priority lower than the 15th priority when the emergency braking function is OFF.

[0226] In addition, the vehicle log storage priority change instruction unit 450 only needs to perform at least one of the processes (change of storage priority) in steps S1302 to S1304, steps S1305 to S1307, steps S1308 to S1310, and steps S1311 to S1313. In other words, the vehicle log storage priority change instruction unit 450 only needs to instruct the ECU group 500a of this change of storage priority.

[0227] In addition, in Figure 13 the following situation may occur: the storage priority of the log (log information) whose storage priority is set to "high" in one determination process is reset to "low" in the determination process after that one determination process. The vehicle log storage priority change instruction unit 450 can also set the determination result of the higher storage priority as the storage priority of this log in such a case. That is, the vehicle log storage priority change instruction unit 450 can also set the "high" set in one determination result as the storage priority of this log in the above situation.

[0228] In this way, according to the abnormality detection device 400, by changing the storage priority of the vehicle log important for the vehicle state when the abnormality detection device 400 detects an abnormality (for example, setting the storage priority to "high"), important vehicle logs can be stored in the vehicle 10a for a long time. As a result, the abnormality detection device 400 can provide the logs to the external vehicle log collection server 20 without deleting important logs even without preparing resources in the vehicle 10a capable of storing a large amount of logs. The vehicle log collection server 20 can use the important logs to analyze the cause of the abnormality, and thus can contribute to the safety of the vehicle 10a.

[0229] [Flowchart of vehicle log deletion process]

[0230] Figure 14 is the flowchart of the determination of the necessity of the vehicle log request in the present embodiment (a part of the vehicle log sending method). Figure 14 It represents the flowchart of the vehicle log deletion process of the vehicle log deletion unit 540 of the ECU group 500a.

[0231] (S1401) The vehicle log deletion unit 540 waits for the passage of a pre-determined log deletion time, and after the log deletion time has passed, it executes step S1402. For example, the log deletion time is 24 hours from the acquisition of the log information. Additionally, for example, the log deletion time can also be the elapsed time from the most recent anomaly detection moment. The vehicle log deletion unit 540 can know that no vehicle log request has occurred for a long period since the anomaly occurred by confirming the difference between the anomaly detection moment and the current moment, and can determine that the priority of the vehicle log associated with this anomaly is not high. And the vehicle log deletion unit 540 preferentially deletes by setting the storage priority of the vehicle log associated with this anomaly to low (S1404 described later), and can leave more useful vehicle logs.

[0232] (S1402) The vehicle log deletion unit 540 determines whether the vehicle log unnecessary time has passed. The vehicle log deletion unit 540 refers to the vehicle log storage priority setting set by the vehicle log priority setting unit 520. If there is a log ID for which the pre-determined vehicle log unnecessary time has passed from the priority setting moment to the current moment (in S1402, it is "yes"), it executes step S1404. If there is no such log ID (in S1402, it is "no"), it executes step S1403. The vehicle log unnecessary time is a time longer than the log deletion time. For example, the vehicle log unnecessary time is 72 hours. The vehicle log unnecessary time is an example of the second time.

[0233] (S1403) The vehicle log deletion unit 540 refers to the vehicle log storage priority setting and deletes the log ID with the storage priority of "low" and the corresponding vehicle log (log information) in the vehicle log storage unit 530. Then, it executes step S1405.

[0234] (S1404) The vehicle log deletion unit 540 instructs the vehicle log priority setting unit 520 to change the storage priority of the log ID for which the pre-determined vehicle log unnecessary time has passed from the priority setting moment to the current moment to "low". Then, it executes step S1403.

[0235] In addition, the vehicle log deletion unit 540 can also execute the processing of step S1403 when the capacity of the vehicle logs stored in the vehicle log storage unit 530 is above a certain value. That is, the vehicle log deletion unit 540 can delete the log information with a low storage priority when the second time has passed or when the capacity of the stored vehicle logs is above a certain value.

[0236] (S1405) The vehicle log deletion unit 540 determines whether the current log size is below the allowable amount. When the data size of the current log is below the predetermined allowable amount (Yes in S1405), the vehicle log deletion unit 540 ends the process. When it exceeds the allowable amount (No in S1405), step S1406 is executed.

[0237] (S1406) The vehicle log deletion unit 540 refers to the vehicle log storage priority setting and deletes the vehicle logs corresponding to the log IDs with the storage priority among the vehicle logs stored in the vehicle log storage unit 530 in the order from the oldest to the newest, and ends the process.

[0238] In this way, when the capacity of the vehicle logs after deleting the log information with the storage priority of "low" is above a certain value, the vehicle log deletion unit 540 can further delete the log information with a storage priority higher than "low" (for example, the log information with the storage priority of "high") in the order from the oldest to the newest.

[0239] As described above, the vehicle log deletion unit 540 deletes the vehicle logs (log information) based on the changed storage priority along with the change instruction of the vehicle log storage priority change instruction unit 450. Thus, even if the vehicle 10a does not have abundant log storage resources, the anomaly detection device 400 can switch the preferentially stored logs according to the vehicle state when an anomaly is detected, so that even when the amount of stored vehicle log data exceeds the upper limit, the logs required for analyzing the cause of the anomaly in the vehicle log collection server 20 can be stored.

[0240] [Flowchart of vehicle log deletion process]

[0241] Figure 15 It is the flowchart of the vehicle log deletion process in this embodiment. Figure 15 It represents the flowchart of the vehicle log necessity determination process of the vehicle log necessity determination unit 240.

[0242] (S1501) The anomaly log reception unit 220 receives the anomaly log from the vehicle log collection server 20 and executes step S1502.

[0243] (S1502) The vehicle log necessity determination unit 240 determines whether the same abnormal log has been received in the past. If the same abnormal log has already been stored in the abnormal log storage unit 230 (Yes in S1502), step S1503 is executed. If the same abnormal log has not been stored (No in S1502), step S1504 is executed. Here, even if the same abnormal log has been received only once, it is determined that a vehicle log is required. However, it may also be determined that a vehicle log is required when the abnormal logs have been received more than a predetermined number of times, or it may be determined that a vehicle log is required based on the number of times generated during a predetermined period.

[0244] (S1503) The vehicle log necessity determination unit 240 determines that a vehicle log is required, and the process ends.

[0245] (S1504) The vehicle log necessity determination unit 240 determines that a vehicle log is not required, and the process ends.

[0246] (Other embodiments)

[0247] As described above, the embodiments have been described as examples of the technology related to the present disclosure. However, the technology related to the present disclosure is not limited thereto, and can also be applied to embodiments that have been appropriately changed, replaced, added, omitted, etc. For example, the following modification examples are also included in one embodiment of the present disclosure.

[0248] (1) In the above embodiment, it has been described as a safety measure for an automobile, but the application range is not limited thereto. It is not limited to automobiles, and can also be applied to mobile devices such as construction machinery, agricultural machinery, ships, railways, and airplanes. In addition, it can also be applied to communication networks used in industrial control systems such as factories and buildings, communication networks for controlling embedded devices, or home networks connecting devices within a home.

[0249] (2) In the above embodiment, it has been described that the abnormality detection device 400 is connected to the vehicle log collection server 20 via an external network, but it may also be that the central ECU 300 is connected to the vehicle log collection server 20 to mediate the communication between the abnormality detection device 400 and the vehicle log collection server 20.

[0250] (3) In the above embodiment, it has been described that the associated vehicle log list held by the abnormality detection device 400 is stored in advance, but it may also be changed according to a request from the vehicle log collection server 20.

[0251] (4) In the above-described embodiment, it has been described that the ECU group 500a holds the vehicle log at a certain time, and the vehicle log deletion unit 540 lowers the save priority when a certain period of time has elapsed or when the log size reaches a certain capacity. However, it is also possible that the abnormality detection unit 420 holds the abnormality detection time and gives an instruction to lower the save priority of the vehicle log that has elapsed a certain period of time since the abnormality detection time.

[0252] (5) In the above-described embodiment, it has been described that the vehicle log deletion unit 540 of the ECU group 500a lowers the save priority when a certain period of time has elapsed or when the log size reaches a certain capacity. However, it is also possible to delete the sent vehicle log after sending it to the abnormality detection device 400.

[0253] (6) In the above-described embodiment, the vehicle log save priority has been described in terms of levels of "high", "medium", and "low". However, it is also possible to represent the save priority by numerical values indicating high or low.

[0254] (7) In the above-described embodiment, several examples of vehicle states have been given for description. However, it is also possible to use conditions outside the vehicle 10a such as traffic congestion information or weather information, not just individual conditions such as the driving condition or traveling condition of the vehicle.

[0255] (8) In the above-described embodiment, it has been described that the vehicle log necessity determination unit 240 of the vehicle log collection server 20 determines whether a vehicle log is necessary based on whether the same abnormality log has been received in the past. However, it is not limited to this. The vehicle log necessity determination unit 240 can also determine that a vehicle log is necessary, for example, when the same abnormality log has been received a certain number of times or more, when the same abnormality log has been received from a certain number of vehicles, or when an abnormality log of an important module related to vehicle control has been received.

[0256] (9) Part or all of the constituent elements of each device in the above-described embodiments may also be configured by a single system LSI (Large Scale Integration). A system LSI is a super-multi-functional LSI manufactured by integrating multiple constituent parts on a single chip. Specifically, it is a computer system including a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program. In addition, each part of the constituent elements of each of the above devices may be individually made into a single chip, or may be made into a single chip in a manner including part or all of them. In addition, although it is assumed to be a system LSI here, depending on the degree of integration, it may also be referred to as an IC, LSI, super LSI, or ultra LSI. In addition, the method of integrating into an integrated circuit is not limited to LSI, and may also be implemented by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconstruct the connection and setting of circuit units inside the LSI may also be used. Further, if an integrated circuit technology that replaces the LSI appears due to the progress of semiconductor technology or other derived technologies, of course, this technology can also be used for the integration of functional blocks. The application of biotechnology, etc. is also possible.

[0257] (10) Part or all of the constituent elements of each of the above devices may also be configured by an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the module may also be configured to include the above-described super-multi-functional LSI. The IC card or the module achieves its functions by the microprocessor operating in accordance with the computer program. The IC card or the module may also have tamper resistance.

[0258] (11)As a technical solution of the present disclosure, it can be set as a program (computer program) for implementing the above vehicle log sending method by a computer, or can be set as a digital signal composed of a computer program. In addition, as a technical solution of the present disclosure, it can also be set as recording the computer program or digital signal on a computer-readable recording medium, such as a floppy disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (registered trademark) Disc), semiconductor memory, etc. In addition, it can also be set as a digital signal recorded on these recording media. In addition, as a technical solution of the present disclosure, it can also be set as transmitting the computer program or digital signal via a network represented by an electrical communication line, wireless or wired communication line, Internet, data broadcast, etc. In addition, as a technical solution of the present disclosure, it can also be set as a computer system having a microprocessor and a memory, the memory recording the above computer program, and the microprocessor operating according to the computer program. In addition, it can also be implemented by another independent computer system by transporting by recording the program or digital signal on a recording medium, or by transmitting the program or digital signal via a network, etc.

[0259] (12)In the above embodiment, an example in which the vehicle log sending device 10 is mounted on the vehicle 10a has been described, but it is not limited thereto. The vehicle log sending device 10 is not limited to being mounted on the vehicle 10a as long as it is communicably connected to the in-vehicle network and the vehicle log collection server 20 respectively.

[0260] (13)The abnormality detection device 400 (vehicle log sending device 10) in the above embodiment can also be implemented by a plurality of devices. In this case, each component of the abnormality detection device 400 can also be arbitrarily divided into a plurality of devices. In addition, the communication method between the plurality of devices is not particularly limited.

[0261] (14)In the above embodiment of Figure 9 an example in which the associated communication ID and the associated process ID are set according to the items of the vehicle state has been described, but it is sufficient to set at least one of the associated communication ID and the associated process ID.

[0262] (15)In the above embodiment of Figure 9 the saved priority after the change is shown as the saved priority, but it is not limited thereto. Figure 9 The saved priority in Figure 9The save priority in [the above] can also be associated with information indicating an increase in the save priority by one level from the current save priority when the vehicle state during anomaly detection is autonomous driving, and information indicating a decrease in the save priority by one level from the current save priority when the vehicle state during anomaly detection is manual driving.

[0263] (16) In the above-described embodiment, the description has been made on the security measures for the cyber-physical system with the vehicle as the object, but at least one of the judgment result and the output result of each process of the security function may be displayed as a user interface (UI) for visualizing an attack in the cyber-physical system.

[0264] (17) A mode implemented by arbitrarily combining the respective components and functions shown in the above-described embodiment and the above-described modification example is also included in the scope of the present disclosure.

[0265] Industrial applicability

[0266] The vehicle log transmission device and the like according to one aspect of the present disclosure are effective for a mobile device such as a vehicle that stores log information.

Claims

1. A vehicle log sending device that sends vehicle logs to a vehicle log collection server, where the vehicle logs are logs stored in one or more electronic control units mounted on a vehicle and containing one or more log information related to the vehicle, and the vehicle log sending device includes: An abnormality detection unit that obtains the vehicle logs from the one or more electronic control units, detects an abnormality based on the one or more log information included in the obtained vehicle logs, and extracts the log information detected as the abnormality as an abnormal log; An abnormality notification unit that sends the abnormal log to the vehicle log collection server; A change instruction unit that, based on the vehicle state extracted from the vehicle logs obtained from the one or more electronic control units, sends a change instruction for the storage priority indicating the priority of leaving the one or more log information included in the vehicle logs to the one or more electronic control units; And A vehicle log request response unit that, when receiving a vehicle log request for requesting the sending of vehicle logs from the vehicle log collection server, obtains the vehicle logs containing the log information stored based on the storage priority changed by the change instruction from the one or more electronic control units, and sends the obtained vehicle logs to the vehicle log collection server.

2. The vehicle log sending device according to claim 1, The abnormality detection unit further stores the abnormality detection time when an abnormality is detected, The change instruction unit further sends a change instruction for the storage priority to the one or more electronic control units based on the abnormality detection time.

3. The vehicle log sending device according to claim 2, The change instruction unit sends a change instruction for the storage priority to the one or more electronic control units when a first time has elapsed from the abnormality detection time.

4. The vehicle log sending device according to claim 2 or 3, The change instruction unit sets the changed storage priority based on the communication ID included in the in-vehicle message in the in-vehicle network of the vehicle, the process ID of the operating system or application executed on the one or more electronic control units, and the vehicle state.

5. The vehicle log sending device according to claim 4, The vehicle state includes multiple states in the vehicle, The change instruction unit sets the changed storage priority for each of the multiple states based on the degree of indicating whether to preferentially leave the log information corresponding to the communication ID associated with the vehicle state and the log information corresponding to the process ID associated with the vehicle state.

6. The vehicle log sending device according to any one of claims 2, 3, and 5, The change instruction unit uses a state including at least one of a driving mode indicating whether it is in an autonomous driving state or a manual driving state, a driving condition indicating whether the vehicle is in a driving state or a stopped state, an Internet connection condition indicating whether it is in an Internet-connected state or an Internet-disconnected state, a first vehicle control function condition indicating whether an automatic parking function is activated or deactivated, a second vehicle control function condition indicating whether a cruise control function is activated or deactivated, and a third vehicle control function condition indicating whether an emergency braking is activated or deactivated, as the vehicle state.

7. The vehicle log transmission device according to claim 6, The change instruction unit instructs at least one of the following changes to the one or more electronic control devices: when the driving mode is an autonomous driving mode, changing the storage priority for functions associated with autonomous driving to a second priority higher than a first priority; when the driving mode is a manual driving mode, changing the storage priority for functions associated with the autonomous driving to a third priority lower than the first priority; when the vehicle is in a driving state, changing the storage priority for functions associated with a vehicle body control function including a door locking function to a fifth priority lower than a fourth priority; when the vehicle is in a stopped state, changing the storage priority for functions associated with the vehicle body control function to a sixth priority higher than the fourth priority; when the Internet is connected, changing the storage priority for functions using the Internet connection to an eighth priority higher than a seventh priority; when the Internet is disconnected, changing the storage priority for functions using the Internet connection to an eighth priority lower than the seventh priority; when the automatic parking function is activated, changing the storage priority for the first vehicle control function associated with the automatic parking function to a tenth priority higher than a ninth priority; when the automatic parking function is deactivated, changing the storage priority for the first vehicle control function associated with the automatic parking function to an eleventh priority lower than the ninth priority; when the cruise control function is activated, changing the storage priority for the second vehicle control function associated with the cruise control function to a thirteenth priority higher than a twelfth priority; when the cruise control function is deactivated, changing the storage priority for the second vehicle control function associated with the cruise control function to a fourteenth priority lower than the twelfth priority; when the emergency braking function is activated, changing the storage priority for the third vehicle control function associated with the emergency braking function to a sixteenth priority higher than a fifteenth priority; and when the emergency braking function is deactivated, changing the storage priority for the third vehicle control function associated with the emergency braking function to an eighteenth priority lower than the fifteenth priority.

8. The vehicle log transmission device according to any one of claims 2, 3, 5, and 7, wherein the abnormality notification unit further generates an identifier of the abnormality log that corresponds one-to-one with the abnormality log, and sends the abnormality detection time and the identifier of the abnormality log to the vehicle log collection server; the vehicle log request response unit receives the identifier of the abnormality log from the vehicle log collection server, collects log information for a certain period before and after the abnormality detection time corresponding to the identifier of the abnormality log from the one or more electronic control devices, and sends the vehicle log including the collected log information to the vehicle log collection server.

9. A vehicle log collection system, comprising: the vehicle log transmission device according to any one of claims 1 to 3, 5, and 7; one or more electronic control devices mounted on the vehicle; and a vehicle log collection server, wherein each of the one or more electronic control devices has: a vehicle log priority setting unit that changes the storage priority of the vehicle log in accordance with the change instruction of the storage priority of the vehicle log received from the vehicle log transmission device; a vehicle log deletion unit that deletes log information corresponding to the storage priority from among the one or more pieces of log information included in the vehicle log according to the storage priority of the vehicle log; and a vehicle log request response unit that sends the vehicle log stored in the electronic control device to the vehicle log transmission device according to the vehicle log request received from the vehicle log transmission device, wherein the vehicle log collection server has: an abnormality log receiving unit that receives the abnormality log from the vehicle log transmission device; a vehicle log request unit that sends the vehicle log request to the vehicle log transmission device; and a vehicle log receiving unit that receives the vehicle log based on the vehicle log request from the vehicle log transmission device.

10. The vehicle log collection system according to claim 9, wherein the vehicle log deletion unit deletes the log information with a low storage priority when the second time has elapsed or when the capacity of the stored vehicle log is equal to or greater than a certain value.

11. The vehicle log collection system according to claim 10, wherein when the capacity of the vehicle log after deleting the log information with a low storage priority is equal to or greater than the certain value, the vehicle log deletion unit further deletes the log information with a high storage priority in the order from the oldest to the newest by time.

12. The vehicle log collection system according to any one of claims 9 to 11, wherein the vehicle log deletion unit deletes the sent vehicle log after the vehicle log request response unit sends the vehicle log to the vehicle log transmission device.

13. The vehicle log collection system according to any one of claims 9 to 11, wherein the vehicle log collection server further includes a vehicle log request determination unit that determines whether the vehicle log request is required based on the abnormality log.

14. The vehicle log collection system according to claim 13, wherein the vehicle log request determination unit determines whether a vehicle log request is required based on the reception count of the abnormal log.

15. A vehicle log transmission method for transmitting a vehicle log to a vehicle log collection server, the vehicle log being a log including one or more log information related to the vehicle and stored in one or more electronic control units mounted on the vehicle, the vehicle log transmission method comprising: an abnormality detection step of obtaining the vehicle log from the one or more electronic control units, detecting an abnormality based on the one or more log information included in the obtained vehicle log, and extracting the log information detected to be abnormal as an abnormal log; a first transmission step of transmitting the abnormal log to the vehicle log collection server; a second transmission step of transmitting, to the one or more electronic control units, an instruction to change a storage priority indicating a priority of leaving the one or more log information included in the vehicle log, based on a vehicle state extracted from the vehicle log obtained from the one or more electronic control units; and a third transmission step of, when a vehicle log request for requesting transmission of the vehicle log is received from the vehicle log collection server, obtaining the vehicle log including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control units, and transmitting the obtained vehicle log to the vehicle log collection server.

16. A storage priority change device comprising: an abnormality detection unit that obtains the vehicle log from one or more electronic control units mounted on the vehicle and storing the vehicle log including one or more log information related to the vehicle, detects an abnormality based on the one or more log information included in the obtained vehicle log, and extracts the log information detected to be abnormal as an abnormal log; an abnormality notification unit that transmits the abnormal log to the vehicle log collection server; and a change instruction unit that transmits, to the one or more electronic control units, an instruction to change a storage priority indicating a priority of leaving the one or more log information included in the vehicle log, based on a vehicle state extracted from the vehicle log obtained from the one or more electronic control units.

Images