Attack detection method, attack detection system, and program recording medium

Abstract

An attack detection method is an attack detection method for detecting attacks on sensor data sent and received inside a moving body, comprising: a step (S101) of determining a sampling policy including a sampling interval and a sampling time based on at least one of a statistical value representing a deviation of a sensor value of the sensor data and event information of the moving body representing the timing of a change in the sensor value; a step (S102) of generating sampling data including two or more sensor values ​​extracted from the sensor data and first and second sequence information based on the sampling interval and the sampling time; a step (S103) of calculating a first abnormality score representing the degree of abnormality of the evaluation object data and a second abnormality score representing the degree of abnormality of the evaluation object data, and determining whether the evaluation object data is data that has been attacked based on the calculated first abnormality score and second abnormality score, and outputting a determination result.

Description

Technical Field

[0001] The present disclosure relates to an attack detection method, an attack detection system, and a program recording medium for detecting an attack on sensor data. Background Art

[0002] A system that monitors a car (monitoring system) is required to detect attacks on vehicle sensor data that is sent and received for the purpose of vehicle control (attack detection). The monitoring system also has the characteristic that the monitoring object is large-scale. Therefore, it is necessary to suppress the monitoring cost such as the communication cost between the car and the system or the computing cost of attack detection. As a monitoring system in which the computing cost is suppressed, the following technology is disclosed, that is, by extracting feature quantities such as peak values ​​from the sensor data that is the monitoring object based on the results of frequency analysis, a sampling log with a reduced data volume is sent to the monitoring system (for example, refer to Patent Document 1).

[0003] Prior art literature

[0004] Patent Document 1: Japanese Patent Application Publication No. 2018-164159

[0005] Patent Document 2: International Publication No. 2019 / 187350

[0006] Non-patent literature 1: P.Malhotra, "Long Short Term Memory Networks for AnomalyDetection in Time Series", 23rd European Symposium on Artificial NeuralNetworks, Computational Intelligence and Machine Learning, ESANN 2015. Summary of the invention

[0007] Problem that the invention aims to solve

[0008] However, in the technique described in Patent Document 1, the data to be sampled is data at a unique time interval determined by the monitoring system in order to reduce the amount of data. Therefore, there is a possibility that the sampled data does not include an attack message and an attack is missed.

[0009] In addition, there is known a technique for detecting attacks (attack messages) from sampled messages using deviations of sensor data from a normal cycle (for example, see Patent Document 2). However, even in such a technique, it is difficult to accurately detect attacks based on the intervals at which attack messages are acquired.

[0010] Therefore, it is desired to achieve both data volume reduction and attack detection performance. However, as described above, in the prior art, it is difficult to achieve both data volume reduction and attack detection performance.

[0011] Therefore, the present disclosure provides an attack detection method, an attack detection system, and a program recording medium that can achieve both data volume reduction and attack detection performance.

[0012] Means used to solve problems

[0013] An attack detection method according to a technical solution of the present disclosure is an attack detection method for detecting attacks on sensor data transmitted and received inside a mobile body for controlling the mobile body, comprising: a sampling policy determination step of determining, for each identifier of a sensor value included in the sensor data, a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each sampling interval based on a statistical value indicating a deviation of the sensor value in the sensor data and event information of the mobile body indicating a timing of a change in the sensor value; a sampling data generation step of generating sampling data based on the sampling interval and the sampling time, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating a temporal sequence of the two or more sensor values ​​in the sampling time, and A second sequence information indicating the temporal sequence of the two or more sensor values ​​at each sampling interval; an attack determination step, calculating a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data contained in the sampling data, the first sequence information, and a short-term sensor stream indicating time series data of past sensor values ​​at the sampling time when the evaluation object data was obtained; calculating a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating changes in sensor values ​​obtained at the sampling interval in the past compared to the sampling interval when the evaluation object data was obtained; determining whether the evaluation object data is data that has been attacked based on the calculated first and second abnormality scores, and outputting a determination result.

[0014] In addition, an attack detection system according to a technical solution of the present disclosure is an attack detection system for detecting attacks on sensor data transmitted and received inside a mobile body for controlling the mobile body, and comprises: a sampling policy determination unit for determining, for each identifier of a sensor value included in the sensor data, a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each of the sampling intervals based on a statistical value of a deviation of the sensor value in the sensor data and at least one of event information of the mobile body indicating the timing of a change in the sensor value; and a sampling data generation unit for generating sampling data based on the sampling intervals and the sampling time, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating the temporal order of the two or more sensor values ​​in the sampling time, and first sequence information indicating the temporal order of each of the two or more sensor values. an attack determination unit that calculates a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data contained in the sampling data, the first sequence information, and a short-term sensor stream indicating time series data of past sensor values ​​compared with the evaluation object data at the sampling time when the evaluation object data was obtained; calculates a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating changes in sensor values ​​obtained at the sampling interval in the past compared with the sampling interval when the evaluation object data was obtained; determines whether the evaluation object data is data that has been attacked based on the calculated first abnormality score and the second abnormality score, and outputs a determination result.

[0015] In addition, a program recording medium according to one technical aspect of the present disclosure is a program recording medium for causing a computer to execute the above-mentioned attack detection method.

[0016] Effects of the Invention

[0017] According to a technical solution of the present disclosure, it is possible to provide an attack detection method, an attack detection system, and a program recording medium that can take into account both data volume reduction and attack detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a block diagram showing the configuration of a monitoring system according to an embodiment.

[0019] Figure 2 This is a flowchart showing an overview of the operation of the monitoring system according to the embodiment.

[0020] Figure 3This is a block diagram showing the configuration of a sampling policy generating unit according to the embodiment.

[0021] Figure 4 : is a flowchart showing the sampling policy generation process according to the embodiment.

[0022] Figure 5 It is a diagram showing an example of vehicle sensor data according to the embodiment.

[0023] Figure 6 It is a diagram for explaining a sampling of the embodiment.

[0024] Figure 7 This is a diagram showing an example of sampling policy data according to the embodiment.

[0025] Figure 8 This is a block diagram showing the configuration of a sampling data generating unit according to the embodiment.

[0026] Fig. 9 Detailed Description of the Invention It is a flowchart showing the sampling data generation process according to the embodiment.

[0027] Fig.10 This is a diagram showing an example of sampling data according to the embodiment.

[0028] Fig.11 It is a block diagram showing the structure of the attack detection unit according to the embodiment.

[0029] Fig.12 Detailed description of the invention is given in the following figure: FIG.

[0030] Fig.13 This is a diagram showing an example of base point data according to the embodiment.

[0031] Fig.14 It is a diagram showing an example of the detection result of the embodiment.

[0032] Fig.15 This is a block diagram showing the structure of a base point data updating unit according to the embodiment.

[0033] Fig.16 Detailed Description of the Invention It is a flowchart showing the base point data update process according to the embodiment.

[0034] Fig.17 It is a schematic diagram showing the configuration of a monitoring system according to an embodiment.

[0035] Fig.18 It is a schematic diagram showing the configuration of a vehicle-mounted device according to an embodiment. DETAILED DESCRIPTION

[0036] (Insights that form the basis of this disclosure)

[0037] In order to realize a monitoring system that can be implemented at low monitoring costs, it is necessary to construct both appropriate sampling methods and attack detection methods.

[0038] In order to reduce the monitoring cost in the monitoring system, Patent Document 1 extracts representative values ​​such as peak values ​​at sampling intervals based on the results of frequency analysis of periodic sensor data to generate low-density data. Therefore, it is assumed that sensor values ​​can be obtained periodically or with regularity.

[0039] However, sometimes the regularity of the acquired period or sensor value is seriously disrupted by the attacker. In Patent Document 1, since the representative value is simply extracted, the attack value injected by the attacker is sometimes missing when sampling the periodic sensor data, making it difficult to detect the attack. In other words, the attack value injected by the attacker is sometimes not sampled when sampling. Therefore, it is sought to construct a further sampling method suitable for attack detection.

[0040] In Patent Document 2, as an attack detection method, the normal cycle of sensor data is calculated in advance, and when the actually observed cycle is not within the range of the normal cycle plus the tolerance (margin), it is determined to be an attack message. The tolerance is the range of delays allowed by the collision between normal messages and attack messages. This method is robust as a method that can detect additional attack messages, etc.

[0041] However, in Patent Document 2, since the presence or absence of an attack is determined based on the time at which a message is acquired, it is difficult to apply to data in which the acquisition interval of one sensor value becomes the sampling interval by sampling sensor data.

[0042] In addition, in non-patent document 1, as an attack detection method, the following technology is disclosed, that is, the normal behavior of sensor values ​​is learned in advance, and when the result of predicting the next sensor value based on the list of actually observed sensor values ​​deviates from the normal behavior, it is determined to be an attack message. This method can also be applied to time series data with a time interval longer than a period such as a sampling interval.

[0043] However, the list of actually observed sensor values ​​in order to predict the next sensor value must be sufficient in such a way that attack messages cannot be mixed in.

[0044] Therefore, in order to solve the above technical problems, in conjunction with the construction of the sampling method, the attack detection method also needs to be further improved. In other words, it is expected to take into account both data volume reduction and attack detection performance. Therefore, the inventors of this application have conducted in-depth research on attack detection methods that can take into account both data volume reduction and attack detection performance, and proposed the attack detection method described below.

[0045] An attack detection method according to a technical solution of the present disclosure is an attack detection method for detecting an attack on sensor data transmitted and received inside a mobile body for controlling the mobile body, comprising: a sampling policy determination step, for each identifier of a sensor value included in the sensor data, based on at least one of a statistical value indicating a deviation of the sensor value of the sensor data and event information of the mobile body indicating a timing of a change in the sensor value, determining a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each sampling interval; a sampling data generation step, based on the sampling interval and the sampling time, generating sampling data, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating a temporal sequence of the two or more sensor values ​​in the sampling time, and A second sequence information indicating the temporal sequence of the two or more sensor values ​​at each sampling interval; an attack determination step, calculating a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data contained in the sampling data, the first sequence information, and a short-term sensor stream indicating time series data of past sensor values ​​at the sampling time when the evaluation object data was obtained; calculating a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating changes in sensor values ​​obtained at the sampling interval in the past compared to the sampling interval when the evaluation object data was obtained; determining whether the evaluation object data is data that has been attacked based on the calculated first and second abnormality scores, and outputting a determination result.

[0046] Thus, the sampling interval and the sampling time are adjusted in accordance with the characteristics of the sensor data that is the object of the attack detection process, and the sampling data is generated. Furthermore, based on the sampling data including two kinds of sequence information (e.g., index) indicating the temporal order of the sensor values ​​in the sampling time (short term) and the sampling interval (long term), two kinds of abnormality scores are calculated, thereby determining the attack. For example, by setting at least one of the sampling interval and the sampling time to be long, the amount of data can be reduced. In addition, by calculating two kinds of abnormality scores, attacks can be detected with high accuracy compared to the case where only one abnormality score is calculated. Thus, it is possible to perform attack detection with high accuracy while suppressing the monitoring cost. Thus, it is possible to take into account both data volume reduction and attack detection performance.

[0047] In addition, for example, the statistical value may include a variance value representing the deviation of the sensor value of each of the identifiers, the event information may include tag information representing whether a change in the sensor value has occurred, and in the sampling policy determination step, the sampling interval and the sampling time are determined based on the variance value and the tag information.

[0048] Thus, since both the variance value of the sensor value and the label information are used, the sampling interval and the sampling time can be determined more accurately.

[0049] Furthermore, for example, in the sampling policy determination step, the sampling time and the sampling interval may be determined based on a combination of a determination result of whether the variance value is greater than or equal to a first threshold value and whether the flag information indicates that no change in the sensor value has occurred.

[0050] Thus, the sampling interval and sampling time can be determined by combining the determination result of the variance value of the sensor data and the content of the event information. Thus, the appropriate sampling interval and sampling time can be determined by the determination result. For example, when the variance value is not greater than the first threshold value, since the sensor value is stable, at least one of the sampling interval and sampling time can be determined to be a long time. Thus, the amount of data of the extracted sensor data can be appropriately reduced.

[0051] Furthermore, for example, the flag information may include information indicating whether at least one of switching of the driving unit of the moving body between ON and OFF, switching of the shift lever, and switching of the automatic driving mode between ON and OFF has occurred.

[0052] Thus, the sampling interval and sampling time corresponding to the switching of the driving unit, the shift lever, and the automatic driving mode of the mobile body can be determined. For example, at least one of the sampling interval and the sampling time after a predetermined time has passed since the switching occurs can be determined to be a longer time. Thus, the amount of sensor data can be reduced more appropriately.

[0053] Furthermore, for example, in the sampling data generating step, the number of sensor data to be extracted within the sampling time may be determined based on the number of normal received data to be observed within the sampling time, and the determined number of sensor data may be extracted.

[0054] This makes it possible to more appropriately reduce the amount of sensor data based on the number of observed sensor data.

[0055] In addition, for example, in the sampling data generation step, it is determined whether the number of sensor values ​​observed during the sampling time is greater than the number of normal received data. If it is greater than the number of normal received data, a predetermined number of sensor values ​​are extracted; if it is not greater than the number of normal received data, all the sensor values ​​contained in the sensor data are extracted.

[0056] Thus, when the sensor data includes attack data, sampling can be performed while suppressing the lack of attack data. Thus, attack detection can be performed on the sampled data with high accuracy.

[0057] In addition, for example, the first sequence information may be a first index indicating the order in which the two or more sensor values ​​are obtained during the sampling time, and the second sequence information may be a second index indicating the order of the sampling intervals in which the two or more sensor values ​​are obtained. In the attack determination step, when the first index associated with the evaluation object data is lower than a third threshold value and the second index associated with the evaluation object data is lower than a fourth threshold value, it is determined that it is unclear whether the evaluation object data is data that has been attacked. When a third abnormality score based on the first abnormality score and the second abnormality score is higher than a fifth threshold value, it is determined that the evaluation object data is data that has been attacked. When the third abnormality score is lower than the fifth threshold value, it is determined that the evaluation object data is normal, and the determination result associated with the evaluation object data indicating the determined result is output.

[0058] This makes it possible to reduce the evaluation target data for which attack detection is difficult in the sampled data, and to make an integrated determination based on short-term and long-term changes in sensor values. This makes it possible to perform attack detection on the sampled data with high accuracy.

[0059] In addition, for example, an updating step may be further included, in which the short-term sensor stream and the long-term sensor stream are updated based on the determination result associated with the evaluation target data, the first sequence information, and the second sequence information.

[0060] This makes it possible to update the short-term sensor flow and the long-term sensor flow used in the attack detection determination. By using the updated short-term sensor flow and the long-term sensor flow, the attack detection performance can be improved.

[0061] In addition, for example, in the updating step, when the judgment result associated with the evaluation object data is an attack, at least one of the short-term sensor stream and the long-term sensor stream is used to infer the sensor value that the evaluation object data should be able to take, and the short-term sensor stream and the long-term sensor stream are updated based on the inferred sensor value, the first sequence information, and the second sequence information; when the judgment result associated with the evaluation object data is normal or unclear, the short-term sensor stream and the long-term sensor stream are updated based on the sensor value of the evaluation object data, the first sequence information, and the second sequence information.

[0062] Thus, even if the sampled data contains attack data, the attack data can be removed and updated to appropriate short-term sensor streams and long-term sensor streams. In other words, it is possible to suppress the inclusion of attack data in short-term sensor streams and long-term sensor streams. Thus, it is possible to perform more accurate attack detection on the sampled data.

[0063] In addition, for example, the sensor data may also be stored in a device mounted on the moving body, and is the result of decoding network data represented by bytes sent and received at arbitrary driving time intervals in compliance with at least one of the protocols including CAN (Controller Area Network: registered trademark), CAN FD (CAN with Flexible Data-rate), FlexRay (registered trademark), and EtherNet (registered trademark).

[0064] As a result, in a network that performs communication in accordance with at least one of CAN, CAN FD, FlexRay, and EtherNet protocols, it is possible to achieve both data volume reduction and attack detection performance.

[0065] In addition, for example, the moving object may be a vehicle.

[0066] This makes it possible to reduce the amount of data in a vehicle with limited computing resources, and suppress a decrease in attack detection performance against the vehicle.

[0067] In addition, an attack detection system according to a technical solution of the present disclosure is an attack detection system for detecting attacks on sensor data transmitted and received inside a mobile body for controlling the mobile body, and comprises: a sampling policy determination unit for determining, for each identifier of a sensor value included in the sensor data, a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each of the sampling intervals based on a statistical value of a deviation of the sensor value in the sensor data and at least one of event information of the mobile body indicating the timing of a change in the sensor value; and a sampling data generation unit for generating sampling data based on the sampling intervals and the sampling time, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating the temporal order of the two or more sensor values ​​in the sampling time, and first sequence information indicating the temporal order of each of the two or more sensor values. The attack determination unit calculates a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data included in the sampling data, the first sequence information, and a short-term sensor stream indicating the time series data of the sensor value of the evaluation object data in the sampling time compared with the past of the evaluation object data, calculates a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating the change of the sensor value obtained at the sampling interval compared with the past of the sampling interval when the evaluation object data was obtained, and determines whether the evaluation object data is the data subjected to the attack based on the calculated first abnormality score and the second abnormality score, and outputs the determination result. In addition, a program recording medium of a technical solution of the present disclosure is a program recording medium for causing a computer to execute the above-mentioned attack detection method.

[0068] Thereby, the same effect as the above-mentioned attack detection method is achieved.

[0069] In addition, these overall or specific technical solutions can also be implemented by systems, methods, integrated circuits, computer programs or computer-readable CD-ROMs and other recording media, or by any combination of systems, methods, integrated circuits, computer programs or recording media.

[0070] The following describes the monitoring method (an example of an attack detection method) according to the embodiment, while referring to the attached Figure 1The embodiments shown here all represent general or specific examples. Therefore, the numerical values, constituent elements, configurations of constituent elements and connection methods, as well as steps and the order of steps shown in the following embodiments are examples and do not limit the invention disclosed herein. In addition, the constituent elements of the following embodiments that are not described in the independent claims are constituent elements that can be added arbitrarily. In addition, each figure is a schematic diagram and is not a strict illustration.

[0071] (Implementation Method)

[0072] First, the configuration of the monitoring system of the present embodiment is described. In the present embodiment, an example is described in which the monitoring system 100 is an information processing system for detecting attacks on sensor data (vehicle sensor data) sent and received inside a vehicle for vehicle control. The vehicle is an example of a mobile object (mobility) that is an object for the monitoring system 100 to detect attacks. In addition, the monitoring system 100 is an example of an attack detection system.

[0073] [1-1. Configuration of monitoring system]

[0074] Figure 1 It is a block diagram showing the configuration of the monitoring system 100 according to the present embodiment.

[0075] The monitoring system 100 is used to monitor the vehicle sensor data (see Figure 5 ) is a system for determining whether the evaluation object data in the monitoring system 100 is attacked. The monitoring system 100 determines whether the evaluation object data is the data under attack. In addition, the data for determining whether the evaluation object data is the data under attack is also recorded as whether it is attack data. The evaluation object data can also be said to be the sensor value of the object for determining whether it is attack data.

[0076] In addition, vehicle sensor data is stored in a device mounted on the vehicle, and is the result of decoding network data represented by bytes that is sent and received at arbitrary driving time intervals (an example of moving time intervals) in compliance with at least one of the protocols including CAN (Controller Area Network: registered trademark), CAN FD (CAN with Flexible Data-rate), FlexRay (registered trademark), and EtherNet (registered trademark).

[0077] The monitoring system 100 includes a sampling unit 101 and a sampling data monitoring unit 102. The sampling unit 101 is, for example, mounted on a vehicle, and the sampling data monitoring unit 102 is, for example, located at a location different from the vehicle (for example, a monitoring center located at a remote location). The sampling unit 101 and the sampling data monitoring unit 102 are connected in a manner that allows communication with each other (for example, wireless communication is possible).

[0078] The sampling unit 101 accumulates vehicle sensor data sent and received for vehicle control of the vehicle, extracts sensor values ​​used in monitoring by the sampling data monitoring unit 102 from the accumulated multiple sensor values ​​(vehicle sensor data) based on a sampling policy, and sends sampling data including the extracted sensor values ​​to the sampling data monitoring unit 102. The sampling policy is dynamically determined by the sampling unit 101. The sampling unit 101 determines the sampling policy based on at least one of a statistical value indicating a deviation of the sensor value of the vehicle sensor data and vehicle event information indicating the timing of a change in a feature of the sensor value (e.g., a change in the sensor value), for each identifier of the sensor value included in the vehicle sensor data (hereinafter also referred to as a sensor identifier). The sampling data includes, for example, more than two sensor values. In addition, the sensor identifier will be described later, but it is information for uniquely identifying vehicle sensor data such as "vehicle speed" and "gear position".

[0079] The vehicle sensor data includes the sensor values ​​of various sensors installed in the vehicle (for example, the sensing results of vehicle speed, acceleration, steering angle, etc.). In addition, the sampling policy will be described later (see Figure 6 ), but the sampling policy includes the sampling interval and the sampling time of each sampling interval.

[0080] The vehicle event information includes information related to non-periodic vehicle events, such as flag information indicating whether a change in sensor value has occurred. The flag information includes, for example, information indicating whether at least one of the switching of the vehicle's engine (an example of a driving unit of a mobile body) ON and OFF, the switching of a shift lever, and the switching of an automatic driving mode ON and OFF has occurred. For example, the flag information may include "1" indicating "yes" when a vehicle event has occurred, and "0" indicating "no" when no vehicle event has occurred. In addition, monitoring includes detection processing of cyber attacks on the vehicle. In addition, the switching of the vehicle's engine ON and OFF may also be, for example, the restarting of the engine.

[0081] The sampling unit 101 includes a sampling policy generating unit 110 , a sampling data generating unit 111 , a vehicle sensor data storing unit 112 , a sampling policy storing unit 113 , a vehicle information storing unit 114 , and a communication unit 115 .

[0082] The sampling policy generation unit 110 is a processing unit that determines a sampling policy for generating sampling data based on at least one of the vehicle sensor data and the vehicle event. In the present embodiment, the sampling policy generation unit 110 determines the sampling policy based on both the vehicle sensor data and the vehicle event. The sampling policy generation unit 110 determines the sampling policy based on, for example, a statistical value indicating a deviation of a sensor value of the vehicle sensor data and the timing of occurrence of the vehicle event. The sampling policy generation unit 110 is an example of a sampling policy determination unit.

[0083] In addition, the statistical value of the sensor value may use any index indicating the deviation of the sensor value. In the present embodiment, the statistical value of the sensor value uses the variance value (data variance) indicating the deviation of the sensor value for each identifier. The variance value is a value indicating the degree of dispersion of the sensor value, and is calculated by squaring the deviation (the difference between each sensor value and the average value) and averaging it. The variance value is, for example, the standard deviation.

[0084] The timing of the occurrence of a vehicle event indicates the timing when the vehicle event occurs, and for example, it can also be said that it indicates the timing of the change in the characteristic of the sensor value. In addition, the timing of the occurrence of a vehicle event can also be said to indicate whether the vehicle event occurs.

[0085] The sampling policy generation unit 110 is, for example, a processing unit that determines a sampling policy for each sensor identifier of the sensor value included in the vehicle sensor data. The sampling policy generation unit 110 determines a sampling policy for a sensor identifier based on a plurality of sensor values ​​corresponding to the sensor identifier, for example. The sampling policy is a sampling policy for generating sampling data based on the plurality of sensor values ​​corresponding to the sensor identifier.

[0086] The sampling data generating unit 111 is a processing unit that generates sampling data to be sent to the sampling data monitoring unit 102 based on the sampling policy determined by the sampling policy generating unit 110. For example, the sampling data generating unit 111 extracts two or more sensor values ​​from a plurality of sensor values ​​stored in the vehicle sensor data storage unit 112 based on the determined sampling policy, thereby generating sampling data including the extracted two or more sensor values.

[0087] The sampling data generating unit 111 generates sampling data including two or more sensor values ​​extracted from a plurality of sensor values ​​(vehicle sensor data), a first index indicating the temporal order of the two or more sensor values ​​in the sampling time, and a second index indicating the temporal order of the two or more sensor values ​​in each sampling interval, based on a sampling interval and a sampling time, for example. The first index and the second index are assigned to each sensor value.

[0088] The first index indicates the order in which two or more sensor values ​​are obtained (observed) during the sampling time, or the order in which the short-term sensor value activity (change) is obtained during the sampling time. The second index indicates the order in which the sampling intervals are obtained (observed) during the two or more sensor values, or the order in which the long-term sensor value activity (change) is obtained during the sampling intervals. The first index is an example of first order information, and the second index is an example of second order information.

[0089] The vehicle sensor data storage unit 112 is a storage device that stores a plurality of sensor values ​​(vehicle sensor data) transmitted and received for vehicle control of the vehicle. The vehicle sensor data storage unit 112 accumulates a plurality of sensor values.

[0090] The sampling policy storage unit 113 is a storage device that stores the sampling policy determined by the sampling policy generation unit 110 .

[0091] The vehicle information storage unit 114 is a storage device for storing vehicle events. The vehicle information storage unit 114 stores, for example, the content of the vehicle event and vehicle event information associated with the time when the vehicle event occurred.

[0092] The communication unit 115 is a processing unit having a function of communicating with the sampling data monitoring unit 102 via a public communication network such as the Internet. The communication unit 115 is configured to include, for example, a communication circuit (communication module).

[0093] Next, the sampling data monitoring unit 102 monitors the vehicle based on the sampling data obtained from the sampling unit 101. Specifically, the sampling data monitoring unit 102 calculates a first abnormality score indicating a short-term abnormality and a second abnormality score indicating a long-term abnormality based on the sampling data, and determines whether the sensor value that becomes the evaluation object (hereinafter also recorded as evaluation object data) is attacked data based on the calculated two abnormality scores. In other words, the sampling data monitoring unit 102 determines whether the evaluation object data is attack data. The sampling data monitoring unit 102 can also be said to determine whether the vehicle is attacked by a network attack. The sampling data monitoring unit 102 has the feature of performing attack detection based on two abnormality scores.

[0094] In addition, a short-term abnormality indicates an abnormality detected based on vehicle sensor data acquired in a short period, for example, an abnormality detected based on vehicle sensor data acquired within one sampling time. In addition, a long-term abnormality indicates an abnormality detected based on vehicle sensor data acquired in a long period longer than a short period, for example, an abnormality detected based on vehicle sensor data acquired at each of a plurality of sampling intervals.

[0095] The sampling data monitoring unit 102 includes an attack detection unit 120 , a base point data update unit 121 , a detector storage unit 122 , a detection result storage unit 123 , a base point data storage unit 124 , and a sampling data storage unit 125 .

[0096] The attack detection unit 120 is a processing unit that determines whether the evaluation target data is attack data based on the sampled data obtained from the sampling unit 101. The attack detection unit 120 calculates a first abnormality score and a second abnormality score, determines whether the evaluation target data is attacked based on the calculated first abnormality score and second abnormality score, and outputs a determination result. The calculation of the first abnormality score and the second abnormality score will be described later.

[0097] The base point data updating unit 121 is a processing unit that updates the short-term sensor stream and the long-term sensor stream based on the detection result information indicating the detection result of the attack detection unit 120 associated with the evaluation target data and the first index and the second index in the extracted vehicle sensor data.

[0098] A short-term sensor stream is a time series data of sensor values ​​used to detect short-term anomalies, and is generated based on sensor values ​​acquired within one sampling time, for example. A short-term sensor stream is generated based on sensor values ​​within the sampling time when the evaluation object data is acquired. A short-term sensor stream can also be said to represent the movement of sensor values ​​that are determined to be normal or estimated to be normal and are short-term.

[0099] The long-term sensor flow is time series data of sensor values ​​used to detect long-term abnormalities longer than the short-term sensor flow, and is generated based on sensor values ​​at each of a plurality of sampling intervals, for example. The long-term sensor flow can also be said to represent the activity of sensor values ​​that are determined to be normal or estimated to be normal over a long period of time.

[0100] In addition, data including short-term sensor flows and long-term sensor flows are also recorded as base point data. The base point data does not include sensor values ​​determined to be abnormal (attack) by the attack detection unit 120. The base point data can also be said to represent time series data of sensor values ​​determined to be normal or estimated to be normal.

[0101] The detector storage unit 122 is a storage device for storing a first detector for calculating a first abnormality score indicating the degree of deviation between a short-term sensor flow and the evaluation object data, and a second detector for calculating a second abnormality score for the degree of deviation between a long-term sensor flow and the evaluation object data. The first detector is implemented, for example, by a learning model that has been machine-learned in a manner that takes a short-term sensor flow and the evaluation object data as inputs and calculates the first abnormality score. In addition, the second detector is implemented, for example, by a learning model that has been machine-learned in a manner that takes a long-term sensor flow and the evaluation object data as inputs and calculates the second abnormality score. In addition, storing the learning model means storing information such as network parameters and calculation algorithms (machine learning algorithms) in the machine learning model.

[0102] The detection result storage unit 123 is a storage device that stores the detection result of the attack detection unit 120 .

[0103] The base point data storage unit 124 is a storage device that stores short-term sensor streams and long-term sensor streams (base point data) used by the attack detection unit 120 to determine whether an attack is present.

[0104] The sampling data storage unit 125 is a storage device that stores the sampling data acquired from the sampling unit 101 .

[0105] The communication unit 126 is a processing unit having a function of communicating with the sampling unit 101 via a public communication network such as the Internet. The communication unit 126 is configured to include, for example, a communication circuit (communication module).

[0106] The vehicle sensor data storage unit 112, the sampling policy storage unit 113, the vehicle information storage unit 114, the detector storage unit 122, the detection result storage unit 123, the base point data storage unit 124, and the sampling data storage unit 125 are composed of a rewritable non-volatile memory such as a hard disk drive or a solid state drive.

[0107] The sampling policy generation unit 110, the sampling data generation unit 111, the communication unit 115, the attack detection unit 120, the base point data update unit 121, and the communication unit 126 are composed of a processor such as a CPU, an ASIC, or an FPGA (Field Programmable Gate Array). In addition, each functional block of the monitoring system 100 is implemented by a processor such as a CPU executing a computer-readable program stored in a computer.

[0108] In addition, the communication method of the sampling unit 101 and the sampling data monitoring unit 102 is not particularly limited. In the case where the communication method is wireless communication, the communication between the sampling unit 101 and the sampling data monitoring unit 102 may be performed by infrared communication or radio wave communication. Radio wave communication may also be communication based on Wi-Fi (registered trademark) (Wireless Fidelity) or Bluetooth (registered trademark). In addition, for example, the communication between the sampling unit 101 and the sampling data monitoring unit 102 may also be performed by wired communication.

[0109] Furthermore, when the sampler 101 and the sampled data monitoring unit 102 are integrally configured, the communication between the sampler 101 and the sampled data monitoring unit 102 may not be performed via the communication unit 115 and the communication unit 126. In this case, the communication unit 115 and the communication unit 126 are not required.

[0110] [1-2. Overview of monitoring system operation]

[0111] Next, the operation of the monitoring system 100 configured as described above will be described. Figure 2 This is a flowchart showing an overview of the operation (attack detection method) of the monitoring system 100 according to the present embodiment. Figure 2 Steps S101 and S102 shown are processes executed in the sampling unit 101 , for example, and steps S103 and S104 are processes executed in the sampling data monitoring unit 102 , for example.

[0112] First, the monitoring system 100 performs a sampling policy generation process (S101) of generating a sampling policy indicating a sampling interval and a sampling time using the vehicle sensor data of the scheduled driving time in the vehicle stored in the vehicle sensor data storage unit 112. The process of step S101 is implemented by the sampling policy generation unit 110. The scheduled driving time may be set in advance, for example, or may be set by a monitor who monitors the vehicle through the monitoring system 100. In addition, step S101 is an example of a sampling policy determination step.

[0113] Next, the monitoring system 100 performs a sampling data generation process of generating sampling data from the vehicle sensor data based on the determined sampling policy (S102). The process of step S102 is performed by the sampling data generation unit 111. In addition, step S102 is an example of a sampling data generation step.

[0114] The sampling data generating unit 111 extracts a portion of vehicle sensor data (sensor values) from the vehicle sensor data based on the sampling policy, and adds a first index and a second index to each extracted vehicle sensor data (sensor value) to generate sampling data. In other words, the sampling data includes the extracted vehicle sensor data, the first index, and the second index.

[0115] Then, the sampling data generation unit 111 transmits the generated sampling data to the communication unit 126 via the communication unit 115. That is, the sampling data generation unit 111 transmits the generated sampling data to the sampling data monitoring unit 102.

[0116] Next, the monitoring system 100 performs an attack detection process (S103) of calculating an abnormality score for the vehicle sensor data (evaluation target data) of the sampled data. The process of step S103 is performed by the attack detection unit 120. Step S103 is an example of an attack determination step.

[0117] The attack detection unit 120 implements the following attack determination processing, namely, using the base point data stored in the base point data storage unit 124, calculates an abnormality score representing the degree of abnormality of the sensor value of the evaluation object data using two calculation methods, and uses the two calculated abnormality scores to determine whether the sensor value of the evaluation object data is (under) an attack.

[0118] Next, the monitoring system 100 performs the following base point data update processing, that is, using the first index and the second index of the evaluation object data and the result (determination result) of the attack detection processing, the base point data is updated for the purpose of performing the attack detection processing in the next evaluation object data (S104). The processing of step S104 is performed by the base point data update unit 121. Step S104 is an example of an update step.

[0119] Hereinafter, the detailed configuration of each processing unit and the detailed operation of each step of the flowchart will be described.

[0120] [2-1. Configuration of the sampling policy generation unit]

[0121] Figure 3 is a block diagram showing the configuration of the sampling policy generating unit 110 of this embodiment. Figure 3 As shown, the sampling policy generating unit 110 includes a vehicle sensor data acquiring unit 130 , a sensor data stability calculating unit 131 , and a sampling policy determining unit 132 .

[0122] The vehicle sensor data acquisition unit 130 is a processing unit that acquires the vehicle sampling data from the vehicle sensor data storage unit 112. The vehicle sensor data acquisition unit 130 reads the vehicle sensor data stored in the vehicle sensor data storage unit 112.

[0123] The sensor data stability calculation unit 131 is a processing unit that calculates information used in the sampling policy determination unit 132 based on the vehicle sensor data. For example, the sensor data stability calculation unit 131 calculates a statistical value of the sensor value for each sensor identifier. In the present embodiment, the sensor data stability calculation unit 131 calculates a variance value of the sensor value for each sensor identifier.

[0124] The sensor identifier includes a periodic identifier that transmits and receives information such as vehicle speed periodically, and an event identifier that occurs in response to a driver's operation such as a shifting of a gear.

[0125] The sampling policy determination unit 132 determines the sampling policy using at least one of the statistical value and the vehicle event information for each sensor identifier included in the vehicle sensor data. In the present embodiment, the sampling policy determination unit 132 determines the sampling policy using both the statistical value and the vehicle event information.

[0126] [2-2. Operation of the sampling policy generation unit]

[0127] Figure 4 This is a flowchart showing the sampling policy generation process ( S101 ) according to the present embodiment.

[0128] First, the sampling policy generation unit 110 obtains vehicle sensor data of a predetermined driving time in the vehicle stored in the vehicle sensor data storage unit 112 (S111). The process of step S111 is performed by the vehicle sensor data acquisition unit 130. The vehicle sensor data acquisition unit 130 obtains the vehicle sensor data from the vehicle sensor data storage unit 112, for example.

[0129] Here, vehicle sensor data will be described. Figure 5 FIG. 2 is a diagram showing an example of vehicle sensor data of the present embodiment. The vehicle sensor data is data obtained by extracting information that may become an input for attack detection processing from vehicle network data represented in binary form. Figure 5 As shown, the vehicle sensor data includes a sensor identifier 142 , a data ID 143 , an acquisition time 144 , and a sensor value 145 .

[0130] The sensor identifier 142 is an identifier for uniquely identifying a vehicle control target of one sensor data included in the vehicle sensor data. For example, the sensor identifier 142 includes “vehicle speed”, “gear position”, and the like.

[0131] The data ID 143 is an identifier for uniquely identifying one vehicle sensor data 141 based on the sensor identifier included in the vehicle sensor data. For example, as the data ID 143, a numerical value assigned sequentially from 1 is included. The data ID 143 is assigned sequentially from 1, for example, based on the sensor identifier. In addition, the data ID 143 is assigned, for example, in the order of acquisition time.

[0132] The acquisition time 144 is time data indicating the time when the vehicle sensor data is received from the vehicle network. The acquisition time 144 indicates a periodic time when the sensor identifier 142 is "vehicle speed", for example. It may also be a non-periodic time when the sensor identifier 142 is an identifier for which an event such as "gear position" may occur. The acquisition time 144 can be obtained, for example, based on the timestamp of the message that sends the vehicle sensor data.

[0133] The acquisition time 144 may be the time when the sampling unit 101 receives the vehicle sensor data from the vehicle network. In addition, although the acquisition time 144 is an example of the elapsed time (relative time) from the reference time, it is not limited thereto and may be an absolute time.

[0134] The sensor value 145 is numerical data indicating the content of vehicle control associated with the sensor identifier 142. The vehicle sensor data includes a plurality of sensor values.

[0135] exist Figure 5 For example, when the sensor identifier 142 is "vehicle speed", the sensor value 145 is "22.11 km / h" when the acquisition time 144 is "25.00 ms", and the sensor value 145 is "22.50 km / h" when the next acquisition time 144 is "50.01 ms", and the reception cycle of the vehicle speed is about 25 ms. The following describes an example in which the reception cycle of the vehicle speed is about 25 ms, but the reception cycle is not limited to this.

[0136] Refer to Figure 4 , returning to the description of the sampling policy generation process. The sampling policy generation unit 110 calculates the data variance (e.g., variance value) indicating the deviation of the sensor value 145 and the vehicle event information (e.g., tag information) indicating whether the vehicle event of the event-type sensor identifier 142 contained in the vehicle sensor data has occurred (S112) for each sensor identifier 142 contained in the vehicle sensor data. The event-type sensor identifier 142 includes, for example, switching of the engine ON and OFF and switching of the gear position. The process of step S112 is implemented by the sensor data stability calculation unit 131.

[0137] Next, the sampling policy generation unit 110 determines whether the vehicle event information (flag information) is “yes” or whether the data variance is equal to or greater than a first threshold value ( S113 ). The process of step S113 is performed by the sampling policy determination unit 132 .

[0138] The sampling policy determination unit 132 sets the sampling policy to high-density sampling (high-density sampling) (S114) when the data variance is above the first threshold value, or when the vehicle event tag information is "yes", that is, when a vehicle event has occurred (yes in S113). For example, when the data variance is above the first threshold value, high-density sampling is performed because the stability of the vehicle sensor data is small (for example, the deviation is large). The reason is that when the data variance is above the first threshold value, the reproducibility of the determination result of the presence or absence of an attack after sampling is low. In addition, for example, since it is assumed that the stability of the vehicle sensor data is small for a certain period of time after the vehicle event has just occurred, high-density sampling is performed. The reason is that when the long-term sensor stream is initialized (reset) by the occurrence of a vehicle event, the sensor values ​​in the long-term sensor stream are not sufficient (sufficient).

[0139] In addition, the sampling policy determination unit 132 sets the sampling policy to low-density sampling (low-density sampling) (S115) in other cases (No in S113), that is, when the data variance is lower than the first threshold and the vehicle event information is "none". For example, when the data variance is lower than the first threshold, low-density sampling is performed because the stability of the vehicle sensor data is large (for example, the deviation is small). The reason is that in other cases, the reproducibility of the determination result of the presence or absence of an attack after sampling is high. In addition, for example, assuming that the stability of the vehicle sensor data is large outside a certain period of time after the vehicle event has just occurred, low-density sampling is performed. The reason is that if it is outside this certain period of time, the sensor value in the long-term sensor stream is sufficient (sufficient).

[0140] In addition, low density and high density are relative in meaning, and high density sampling means that the sampling density is higher than that of low density sampling. In addition, the sampling density is achieved by increasing or decreasing at least one of the sampling time and the sampling interval. For example, compared with low density sampling, high density sampling satisfies at least one of the sampling time being longer and the sampling interval being shorter. For example, it can also be that the sampling time of high density sampling is longer and the sampling interval is shorter than that of low density sampling.

[0141] Next, the sampling policy determination unit 132 stores the set sampling policy in the sampling policy storage unit 113 ( S116 ).

[0142] As described above, the sampling policy generation unit 110 determines the sampling interval and the sampling time based on, for example, the variance value and the flag information. For example, the sampling policy generation unit 110 may determine the sampling time and the sampling interval based on a combination of a determination result of whether the variance value is greater than or equal to the first threshold value and whether the flag information indicates that the sensor value has not changed.

[0143] Here, the details of sampling are described. Figure 6 It is a diagram for explaining sampling in this embodiment. Figure 6 The "0" shown indicates that the vehicle sensor data has been obtained. Figure 6 The horizontal axis represents time. Figure 6 , an example in which 10 pieces of vehicle sensor data (sensor values) are acquired at a sampling interval of T seconds is shown.

[0144] like Figure 6 As shown, the sampling interval is the interval for sampling vehicle sensor data, and the sampling time is the time for continuous sampling in the sampling interval. The sampling time is a time that is continuous in time, for example, does not include discrete time. That is, the vehicle sensor data sampled in the sampling time becomes data that is continuous in time. The sampling start time is the time when the sampling of vehicle sensor data starts, for example, it can also be the public (start) time of the sampling time. In addition, the sampling start time is not limited to the start time of the sampling interval (for example, the time when the time of the sampling interval starts to be measured), as long as it is (T-S) seconds before the start time of the sampling interval. That is to say, if the sampling start time is set to N, N can be determined to satisfy the following formula.

[0145] 0≦N<T-S (Formula 1)

[0146] The sampling of the vehicle sensor data is performed within a sampling interval of T seconds and within a range of a sampling time of S seconds from the sampling start time of N seconds.

[0147] The vehicle sensor data between the sampling time S seconds from the sampling start time N seconds in the sampling interval T seconds is regarded as the sampling data. Figure 6 , an example is shown in which 10 vehicle sensor data are obtained in the sampling interval T seconds, but 3 of the vehicle sensor data are extracted as sampling data. In other words, among the 10 vehicle sensor data obtained in the sampling interval T seconds, 7 vehicle sensor data are not sent to the sampling data monitoring unit 102. Here, high-density sampling and low-density sampling are achieved by adjusting the sampling interval and the sampling time. The specific example of sampling will be described later.

[0148] Figure 7 FIG. 1 is a diagram showing an example of sampling policy data according to the present embodiment. Figure 7In the example, the sampling interval in high-density sampling is 200.00 ms and the sampling time is 75.00 ms, and the sampling interval in low-density sampling is 1000.00 ms and the sampling time is 55.00 ms. Thus, for example, the sampling interval in high-density sampling is shorter than the sampling interval in low-density sampling, for example, it is about 1 / 5 of the sampling interval in low-density sampling. In addition, for example, the sampling time in high-density sampling is longer than the sampling time in low-density sampling, for example, it is about 1.35 times the sampling interval in low-density sampling. In addition, the sampling interval and sampling time in high-density sampling, and the sampling interval and sampling time in low-density sampling are not limited to the above.

[0149] like Figure 7 As shown, the sampling policy data includes a sensor identifier 152, a file number 153, a data variance 154, a vehicle event mark 155, a sampling interval 156, and a sampling time 157. The sampling policy data is stored in the sampling policy storage unit 113, and is a history record obtained by associating the sensor identifier 152, the information used in the determination of the sampling policy determination unit 132 (the data variance 154 and the vehicle event mark 155), and the sampling policy (the sampling interval 156 and the sampling time 157).

[0150] The sensor identifier 152 is associated with the sensor identifier 142 of the vehicle sensor data, and is an identifier for uniquely identifying a vehicle control object.

[0151] The file number 153 is a file identifier for identifying one file unit transmitted by the communication unit 115. For example, the file number is incremented according to the vehicle sensor data acquired at each predetermined driving time, and a different sampling policy is calculated.

[0152] The data variance 154 is numerical data indicating, in file units, the deviation of the sensor value within the predetermined travel time calculated for each sensor identifier 152 .

[0153] The vehicle event flag 155 is flag information indicating whether a vehicle event of the sensor identifier 142 , which is different from the sensor identifier 152 and indicates event-type switching of the engine ON and OFF and switching of the gear position, has occurred.

[0154] The sampling interval 156 indicates the density of sampling calculated for each sensor identifier 152 in file units.

[0155] The sampling time 157 indicates the density of sampling calculated for each sensor identifier 152 in the file.

[0156] In addition, the sampling policy generation unit 110 repeatedly executes the processing of steps S111 to S115 every time the vehicle sensor data to be processed is updated.

[0157] For example, in Figure 7 In the case where the file number is "2" and the sensor identifier 152 is "vehicle speed", the data variance is 0.22 and the vehicle event flag is "none". When the threshold of the data variance is set to 10, 0.22 is below the threshold. Therefore, in the above case, it becomes a policy to perform low-density sampling, for example, the sampling interval is set to "1000ms" in a manner that is longer than the above-mentioned period "about 25ms", and the sampling time is set to "55ms" in a manner that is about twice the above-mentioned period, thereby significantly reducing the amount of data to be sent.

[0158] The sampling policy determination unit 132 may set different sampling densities when the data variance is equal to or greater than the first threshold and when the vehicle event marker information is “yes.” That is, a plurality of sampling densities may be set in high-density sampling.

[0159] [3-1. Configuration of sampling data generation unit]

[0160] Figure 8 1 is a block diagram showing the configuration of the sampling data generating unit 111 of this embodiment. Figure 8 As shown, the sampling data generating unit 111 includes a vehicle sensor data acquiring unit 130 , a sampling information acquiring unit 160 , a data extracting unit 161 , and an index assigning unit 162 .

[0161] The vehicle sensor data acquisition unit 130 is a processing unit that acquires vehicle sampling data from the vehicle sensor data storage unit 112. The vehicle sensor data acquisition unit 130 reads the vehicle sampling data stored in the vehicle sensor data storage unit 112. The vehicle sensor data acquisition unit 130 may be a common component with the vehicle sensor data acquisition unit 130 of the sampling policy generation unit 110, or may be a different component from each other.

[0162] The sampling information acquisition unit 160 is a processing unit that acquires the sampling policy determined by the sampling policy generation unit 110 from the sampling policy storage unit 113 .

[0163] The data extraction unit 161 is a processing unit that extracts vehicle sensor data obtained based on the sampling policy acquired by the sampling policy storage unit 113 from the vehicle sensor data acquired by the vehicle sensor data acquisition unit 130 .

[0164] The index assigning unit 162 is a processing unit that associates an index indicating a temporal order with a sensor value to the vehicle sensor data extracted by the data extracting unit 161. The index assigning unit 162 assigns both a first index and a second index to each vehicle sensor data (sensor value).

[0165] [3-2. Operation of sampling data generation unit]

[0166] Fig. 9 This is a flowchart showing the sampling data generation process ( S102 ) according to the present embodiment.

[0167] First, the sampling data generation unit 111 obtains the sampling policy data 151 including the sampling interval and the sampling time and the vehicle information for each sensor identifier (S121). The processing of step S121 is implemented by the sampling information acquisition unit 160. The sampling information acquisition unit 160 obtains the sampling policy data 151 from the sampling policy storage unit 113 and obtains the vehicle information from the vehicle information storage unit 114, for example.

[0168] The sampling policy data 151 includes a vehicle number (not shown) that uniquely indicates the architecture of the vehicle and a cycle (sampling interval and sampling time) indicating the acquisition cycle of each sensor identifier included in the vehicle sensor data. In addition, the vehicle information includes, for example, vehicle event information.

[0169] Next, the sampling data generation unit 111 acquires the vehicle sensor data of the predetermined travel time contained in the vehicle sensor data storage unit 112 (S122). The process of step S121 is performed by the vehicle sensor data acquisition unit 130. The vehicle sensor data acquisition unit 130 acquires, for example, Figure 5 Vehicle sensor data shown.

[0170] Next, the sampling data generating unit 111 calculates the number of received data in the sampling time for each sampling interval based on the vehicle sensor data and the sampling time included in the sampling policy data (S123). The processing of step S123 is implemented by the data extracting unit 161. Steps S123 and thereafter are executed for each sampling time.

[0171] Next, the sampling data generation unit 111 determines whether the number of received data is greater than the second threshold value (S124). The processing of step S124 is implemented by the data extraction unit 161. When the number of received data is greater than the value obtained by adding the predetermined tolerance to the normal number of received data in the sampling time (an example of the second threshold value) ("Yes" in S124), the data extraction unit 161 extracts the predetermined number of data in the sampling time, which is continuous in time. In the case of "Yes" in step S124, it is possible that a lot of attacked data is included in the received data (sensor value). In such a case, if all the data is extracted, the number of data becomes larger, resulting in an increase in the amount of data. Therefore, when the data extraction unit 161 is "Yes" in step S124, only the predetermined number of received data is extracted (S125). As a result, since the predetermined number of received data including the attacked data can be extracted, the amount of data can be reduced, and sampling data capable of attack detection can be generated.

[0172] In addition, the predetermined number of data is, for example, a number greater than the number of normal received data. In addition, the second threshold is not limited to a value obtained by adding a predetermined tolerance to the number of normal received data, but may be the number of normal received data or a fixed value pre-set according to each sensor identifier. In addition, the predetermined tolerance may be, for example, set according to the number of normal received data or a fixed value.

[0173] When the number of received data is equal to or less than the normal number of received data in the sampling time plus a predetermined margin (No in S124), the data extractor 161 extracts the normal number of received data (S126). For example, the data extractor 161 extracts all received data (sensor values) in the sampling time.

[0174] Thus, in steps S124 to S126, the number of vehicle sensor data to be extracted within the sampling time is determined based on the number of normal received data to be observed within the sampling time, and the determined number of sensor data is extracted. For example, it is determined whether the number of sensor values ​​observed within the sampling time is greater than the number of normal received data. If it is greater than the number of normal received data, a predetermined number of sensor values ​​are extracted. If it is not greater than the number of normal received data, all sensor values ​​included in the vehicle sensor data are extracted.

[0175] Here, the number of normal received data indicates the number of normal received data within the above-mentioned sampling time, and is calculated in advance based on the above-mentioned cycle for each sensor identifier. Figure 7 As shown, when the sampling time is set to "55 ms" when the sensor identifier is "vehicle speed", the cycle is "about 25 ms", and therefore the number of normal received data is "2".

[0176] Next, the sampling data generating unit 111 assigns a first index indicating the data order of the short-term sensor value activity during the sampling time and a second index indicating the order of the long-term sensor value activity at the sampling interval to the above-mentioned extracted data. That is, the sampling data generating unit 111 assigns two types of indexes to each of the sensor values ​​included in the extracted data (S127). The processing of step S127 is implemented by the index assigning unit 162.

[0177] For example, when the sampling time is set to "55 ms", the index assigning unit 162 assigns first indices 1, 2, 3, etc. to the plurality of data extracted in the sampling time "55 ms" in order from the beginning. For example, the index assigning unit 162 assigns first indices to the plurality of data extracted in order from the data with the oldest acquisition time.

[0178] The index assigning unit 162 also assigns a unique second index each time the above step S125 or S126 is executed. For example, the index assigning unit 162 assigns the second index to the extracted multiple data in order from the data with the oldest sampling time. Here, when the sampling interval is set to "1000ms", the second index changes when processing data after about "1000ms".

[0179] Next, the sampling data generation unit 111 determines whether an index is assigned to each extracted sensor value (S128). The process of step S128 is implemented by the index assignment unit 162. The index assignment unit 162 determines whether the processes of steps S123 to S127 have been performed in all sampling times of each of two or more sampling intervals included in the predetermined travel time.

[0180] If the index assigning unit 162 does not assign an index to each extracted sensor value (No in S128), the process returns to step S123 and executes the process after step S123 for the next sampling time. In other words, the process of steps S123 to S127 is repeatedly executed for each sampling interval for the vehicle sensor data to be processed.

[0181] When the sampling data generating unit 111 assigns an index to each sensor value extracted by the index assigning unit 162 (Yes in S128), the sampling data generating unit 111 transmits the extracted data as sampling data to the communication unit 126 via the communication unit 115. That is, the sampling data generating unit 111 transmits the extracted data (sampling data) assigned with the index to the sampling data monitoring unit 102 (S129).

[0182] Here, the sampling data (extracted data) sent by the sampling data generating unit 111 is referred to. Fig.10Provide explanation. Fig.10 This is a diagram showing an example of sampling data according to this embodiment.

[0183] like Fig.10 As shown, the sampling data includes: a sensor identifier 172 , an evaluation ID 173 , a sensor value 174 , a first index 175 , and a second index 176 .

[0184] The sensor identifier 172 and the sensor value 174 are identical to the sensor identifier 142 and the sensor value 145 in the vehicle sensor data (see Figure 5 The evaluation ID 173 is an identifier for uniquely identifying one sensor data 171 from each sensor identifier 172 included in the sampling data.

[0185] As described above, the first index 175 indicates the order of activity of the short-term sensor value, and the second index 176 indicates the order of activity of the long-term sensor value.

[0186] For example, the sensor values ​​represented by evaluation IDs "1" and "2" are both obtained at the same sampling time because their second indexes are both "1". In addition, since the sensor value represented by evaluation ID "1" has a first index of "1" and the sensor value represented by evaluation ID "2" has a first index of "2", it means that the sensor value represented by evaluation ID "2" was obtained after the sensor value represented by evaluation ID "1" was obtained.

[0187] In addition, although the number of sensor values ​​when the second index is "1" and "2" is 2, the number of sensor values ​​when the second index is "3" is greater than 3. Since the sampling policy is determined according to each sampling time, the number of sensor values ​​can be changed according to each sampling time, that is, according to each second index.

[0188] For example, Fig.10 The sampling data shown is sent to the sampling data monitoring unit 102 .

[0189] [4-1. Configuration of the attack detection unit]

[0190] Fig.11 is a block diagram showing the structure of the attack detection unit 120 of this embodiment. Fig.11 As shown, the attack detection unit 120 includes a sampling data acquisition unit 181 , a base point data acquisition unit 182 , a first abnormality score calculation unit 183 , a second abnormality score calculation unit 184 , and an attack determination unit 185 .

[0191] The sampling data acquisition unit 181 is a processing unit that acquires sampling data from the sampling data storage unit 125. For example, the sampling data acquisition unit 181 acquires Fig.10 Sample data shown.

[0192] The base point data acquisition unit 182 is a processing unit that acquires base point data used for determination by the attack determination unit 185 from the base point data storage unit 124. The base point data acquisition unit 182 acquires a short-term sensor stream and a long-term sensor stream as base point data.

[0193] The first abnormality score calculation unit 183 is a processing unit that calculates a first abnormality score indicating the degree of deviation between the evaluation object data 191 and the short-term sensor flow based on the evaluation object data 191 and the short-term sensor flow. That is, the first abnormality score calculation unit 183 calculates the first abnormality score for the evaluation object data 191 using other data acquired at the sampling time when the evaluation object data 191 is acquired. The first abnormality score calculation unit 183 calculates the abnormality score for the change in the sensor value within a short period such as one sampling time. The short period refers to, for example, a time period less than one sampling interval (for example, one sampling time).

[0194] The first abnormality score calculation unit 183 can also be said to calculate the first abnormality score indicating the degree of abnormality of the evaluation object data based on, for example, the sensor value of the evaluation object data contained in the sampling data, the first index, and a short-term sensor stream of time series data indicating a sensor value that is closer to the past than the evaluation object data in the sampling time when the evaluation object data was obtained.

[0195] The second abnormality score calculation unit 184 is a processing unit that calculates a second abnormality score indicating the degree of deviation between the evaluation object data 191 and the long-term sensor flow based on the evaluation object data 191 and the long-term sensor flow. That is, the second abnormality score calculation unit 184 calculates the second abnormality score for the evaluation object data 191 using data of a plurality of sampling intervals including the sampling interval at which the evaluation object data 191 was acquired. The second abnormality score calculation unit 184 calculates the abnormality score for the change in the sensor value over a long period such as a plurality of sampling intervals. A long period refers to a time period longer than a short period, for example, longer than one sampling interval.

[0196] The second abnormality score calculation unit 184 can also be said to calculate the second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second index, and the long-term sensor stream indicating the change of the sensor value obtained at a sampling interval closer to the sampling interval at which the evaluation object data was obtained, for example.

[0197] The attack determination unit 185 is a processing unit that determines whether the evaluation object data 191 is data that has been attacked, that is, whether the vehicle has been attacked by a network attack, based on the calculated first abnormality score and the second abnormality score, and outputs the determination result. In this embodiment, the attack determination unit 185 calculates a third abnormality score based on the first abnormality score and the second abnormality score, compares the calculated third abnormality score with a predetermined threshold value (fifth threshold value), and determines whether the evaluation object data 191 is data that has been attacked based on the comparison result. In addition, the attack determination unit 185 may not be limited to calculating the third abnormality score, but may compare each of the first abnormality score and the second abnormality score with the corresponding threshold value, and determine whether the evaluation object data 191 is data that has been attacked based on the comparison result.

[0198] [4-2. Operation of the attack detection unit]

[0199] Fig.12 : is a flowchart showing the attack detection process (S103) of this embodiment. Fig.12 The attack detection process shown in the figure can be performed on any sensor value included in the sampled data, or on all sensor values ​​included in the sampled data. When the attack detection process is performed on all sensor values, for example, the attack detection process can be performed in order from the oldest sensor value at the time of acquisition. Fig.12 Processing shown.

[0200] First, the attack detection unit 120 obtains sample data and extracts evaluation target data (see Fig.13 The process of step S131 is performed by the sampling data acquisition unit 181 .

[0201] Next, the attack detection unit 120 acquires the base point data associated with the evaluation target data 191 ( S132 ). The process of step S132 is performed by the base point data acquisition unit 182 .

[0202] Fig.13 This is a diagram showing an example of base point data according to this embodiment.

[0203] like Fig.13 As shown, the base point data includes: a sensor identifier 192 , an evaluation ID 193 , a sensor value 194 , a first index 195 , a second index 196 , a short-term sensor stream 197 , and a long-term sensor stream 198 .

[0204] The sensor identifier 192, evaluation ID 193, sensor value 194, first index 195, and second index 196 are associated with the sensor identifier 172, evaluation ID 173, sensor value 174, first index 175, and second index 176 in the sampled data (see Fig.10 )same.

[0205] The short-term sensor stream 197 has the same second index as the evaluation target data 191 , and is a list of past sensor values ​​in which a unique sensor value is identified using the index before the first index of the evaluation target data 191 as a reference key.

[0206] For example, in Fig.13 In the case of the evaluation object data with evaluation ID "82", the second index has "3", and the first index "1" before "2" is used as a reference key, and the representative value of the sensor value of the evaluation object data with evaluation ID 81 is saved as a short-term sensor stream. In addition, the calculation method of the above representative value will be described later.

[0207] On the other hand, the long-term sensor stream 198 is a representative value list of past sensor values ​​having unique values, using the indexes before the second index of the evaluation target data 191 as reference keys.

[0208] For example, in Fig.13 In the case of the evaluation object data with the evaluation ID "82", the second index "1" and "2" before "3" are used as reference keys, and the representative value of the sensor value of the evaluation object data is saved as a long-term sensor stream. In addition, the calculation method of the above representative value will be described later.

[0209] Fig.14 It is a diagram showing an example of the detection result information according to the present embodiment.

[0210] like Fig.14 As shown, the detection result information includes a sensor identifier 202, an evaluation ID 203, a sensor value 204, a first abnormality score 205, a second abnormality score 206, a third abnormality score 207, and a detection result 208. The detection result 208 is an example of a determination result associated with the evaluation target data.

[0211] The sensor identifier 202, the evaluation ID 203, and the sensor value 204 are the same as the sensor identifier 172, the evaluation ID 173, and the sensor value 174 in the sampled data (see Fig.10 )same.

[0212] The first abnormality score 205 , the second abnormality score 206 , the third abnormality score 207 , and the detection result 208 will be described later.

[0213] Refer to Fig.12 Then, the attack detection unit 120 determines whether at least one of the first index and the second index is greater than a predetermined value (S133). The predetermined value is preset and stored in the storage unit. The predetermined value in the first index and the predetermined value in the second index can be the same value or different values ​​from each other.

[0214] When at least one of the first index and the second index of the evaluation object data is greater than a predetermined value ("Yes" in S133), the attack detection unit 120 calculates the abnormality score (at least one of the first abnormality score and the second abnormality score) described later, and when the first index and the second index are both lower than the predetermined value ("No" in S133), the detection result is set to "unknown" (S134). When the attack detection unit 120 is "Yes" in step S133, it determines whether the first index is greater than the predetermined value (S135). The predetermined value is pre-set and stored in the storage unit. The predetermined value used in step S135 is an example of a third threshold value. The third threshold value is set to a value that can accurately calculate the first abnormality score, for example.

[0215] For example, in Fig.13 In the case where the data of the evaluation ID "1" is the evaluation object data, the first index is "1" and the second index is "1". Therefore, for example, when the predetermined value is 2, Fig.14 As shown, the detection result of the above data is “unclear.” In addition, when it is determined to be “unclear,” the first abnormality score, the second abnormality score, and the third abnormality score may be “0.”

[0216] Next, when at least one of the first index and the second index of the evaluation object data is greater than or equal to a predetermined value ("Yes" in S133) and the first index is greater than or equal to a predetermined value ("Yes" in S135), the attack detection unit 120 reads out the first detector that calculates the first abnormality score indicating the degree of deviation between the evaluation object data and the normal flow of the short-term sensor value (short-term sensor flow), and calculates the first abnormality score based on the above-mentioned evaluation object data 191 and the short-term sensor flow (S136). The processing of step S136 is implemented by the first abnormality score calculation unit 183.

[0217] When the answer is "yes" in steps S133 and S135, the first abnormality score calculation unit 183 reads the first detector from the detector storage unit 122. The first detector can also be implemented by a learning completion model that has been learned in a manner that takes the evaluation object data 191 and the short-term sensor flow as input and outputs a first abnormality score that represents the degree of deviation between the evaluation object data 191 and the short-term sensor flow. The first detector is learned in a manner that outputs a first abnormality score with a larger value as the degree of deviation increases, but is not limited to this. In addition, the first abnormality score is, for example, a value of 0 to 100 (for example, a standardized value), but it can also be a level ("high", "medium", "low", etc.).

[0218] For example, in Fig.13 In the case of the evaluation object data whose evaluation ID is "82", the first index is "2", "35.11" is included in the short-term sensor stream, and the sensor value is "100.50". In this case, Fig.14 As shown, the first abnormality score output by the first detector is, for example, “95.” That the first abnormality score is 95 is calculated by the first abnormality score calculation unit 183 .

[0219] In addition, the first detector may also use a deviation value detector implemented by a machine learning model such as OC-SVM (One Class-Support Vector Machine) based on the difference between the sensor value of the evaluation object data and the sensor value between the short-term sensor flow. In addition, the first detector may also use a detector that uses the acquisition time instead of the sensor value to determine whether the difference between the acquisition time between the short-term sensor flow and the evaluation object data is based on the cycle. In addition, the above detectors may also be used in an integrated manner.

[0220] In addition, the first abnormality score calculation unit 183 is not limited to calculating the first abnormality score using a machine learning model. The first abnormality score calculation unit 183 may also calculate the first abnormality score using a table (lookup table) that associates the evaluation object data 191 and the short-term sensor flow with the first abnormality score, or may calculate the first abnormality score by performing a predetermined operation using the evaluation object data 191 and the short-term sensor flow.

[0221] In addition, the attack detection unit 120 enters step S137 when at least one of the first index and the second index of the evaluation object data is greater than the predetermined value ("Yes" in S133) and the first index is less than the predetermined value ("No" in S135). In the case of "No" in step S135, the number of vehicle sensor data obtained before the evaluation object data within the sampling time when the evaluation object data is obtained is small, and it is difficult to accurately determine whether the evaluation object data is abnormal. Therefore, the attack detection unit 120 may not calculate the first abnormality score when the answer is "No" in step S135. In addition, the attack detection unit 120 may also set the first abnormality score to "0" when the answer is "No" in step S135.

[0222] Next, the attack detection unit 120 determines whether the second index is greater than a predetermined value (S137). The predetermined value is preset and stored in the storage unit. The predetermined value used in step S137 may be the same as the predetermined value used in step S133, or may be different. The predetermined value used in step S137 is an example of a fourth threshold value. The fourth threshold value is set to a value that can accurately calculate the second anomaly score, for example.

[0223] Next, when the second index is greater than or equal to the predetermined value ("Yes" in S137), the attack detection unit 120 reads out the second detector that calculates the second abnormality score indicating the degree of deviation between the evaluation object data and the normal flow of the long-term sensor value (long-term sensor flow), and calculates the second abnormality score based on the above-mentioned evaluation object data 191 and the long-term sensor flow (S138). The processing of step S138 is implemented by the second abnormality score calculation unit 184.

[0224] When the second abnormality score calculation unit 184 is "yes" in step S137, the second detector is read out from the detector storage unit 122. The second detector can also be implemented by a learning completion model that has been learned in a manner that takes the evaluation object data 191 and the long-term sensor flow as input and outputs a second abnormality score that represents the degree of deviation between the evaluation object data 191 and the long-term sensor flow. The second detector is learned in a manner that outputs a second abnormality score with a larger value as the degree of deviation increases, but is not limited to this. In addition, the second abnormality score is, for example, a value of 0 to 100 (for example, a standardized value), but it can also be a level ("high", "medium", "low", etc.).

[0225] For example, in Fig.13 In the case where the data of the evaluation ID "82" is the evaluation object data, the second index is "3", "22.50" and "33.50" are included in the long-term sensor stream, and the sensor value is "100.50". In this case, Fig.14As shown, the second abnormality score output by the second detector is “80.” The fact that the second abnormality score is 80 is calculated by the second abnormality score calculation unit 184 .

[0226] Alternatively, the second detector may use a change point detector that uses a recurrent neural network model (RNN: Recurrent Neural Network) or an autoregressive integrated moving average model (ARIMA: Auto Regressive Integrated Moving Average) to predict the behavior of normal sensor values ​​and determine an abnormality based on the error from the actual measured value.

[0227] In addition, the attack detection unit 120 proceeds to step S139 when the second index of the evaluation object data is lower than the predetermined value ("No" in S137). In the case of "No" in step S137, there is little vehicle sensor data acquired before the evaluation object data in the sampling interval in which the evaluation object data is acquired, and it is difficult to accurately determine whether the evaluation object data is abnormal. Therefore, the attack detection unit 120 may not calculate the second abnormality score when the answer is "No" in step S137. In addition, the attack detection unit 120 may also set the second abnormality score to "0" when the answer is "No" in step S137.

[0228] In addition, the first detector and the second detector may be different detectors from each other or may be a single detector.

[0229] Next, the attack detection unit 120 calculates a third abnormality score based on the first abnormality score and the second abnormality score ( S139 ). The process of step S139 is performed by the attack determination unit 185 .

[0230] In addition, the third abnormality score is an abnormality score based on the first abnormality score and the second abnormality score. The third abnormality score may be, for example, the first abnormality score, the second abnormality score, or a statistical value based on the first abnormality score and the second abnormality score. The statistical value may be, for example, an average value (for example, a weighted average), but may also be any one of a median value, a most frequent value, a maximum value, and a minimum value.

[0231] Furthermore, calculating the third anomaly score is not essential.

[0232] Next, the attack detection unit 120 uses the third abnormality score to determine whether there is an attack (S140). The processing of step S139 is implemented by the attack determination unit 185. In other words, the attack determination unit 185 determines whether the evaluation object data is data that has been attacked. For example, when the third abnormality score is greater than the fifth threshold value, the attack determination unit 185 determines that it is an "attack" (there is an attack), and when it is less than the fifth threshold value, it determines that it is "normal" (there is no attack).

[0233] For example, in Fig.14 In the case where the evaluation ID is "82", the first abnormality score "95" and the second abnormality score "80" of the data are both calculated (when S135 is "Yes" and S137 is "Yes"), and the average value is calculated as the third abnormality score "87". In this case, when the attack determination unit 185 sets the fifth threshold value to "60", the sensor value of the evaluation ID "82" is determined as "attack". That is, the attack determination unit 185 determines that the sensor value "100.50" is data that has been attacked.

[0234] In addition, Fig.14 In the case where the evaluation ID is "81", only the second abnormality score "6" of the data is calculated (when S135 is "No" and S137 is "Yes"), and "6" is calculated as the third abnormality score. In this case, the attack determination unit 185 determines that it is "normal" when the fifth threshold is set to "60". That is, the attack determination unit 185 determines that the sensor value "35.11" is not attacked.

[0235] The case where step S135 is "No" and step S137 is "Yes" is, for example, assumed to be a case where the second index is greater than a predetermined value and immediately after the start time of the sampling interval. In this case, although it is a state where all vehicle sensor data within the sampling time in the sampling interval has not yet been obtained (for example, a state at the beginning of the sampling time), the vehicle sensor data for each sampling interval only has a number that can determine whether there is an attack. In other words, the case where step S135 is "No" and step S137 is "Yes" means that the attack detection using the first detector cannot be performed, and the attack detection using the second detector can be performed.

[0236] At this time, the attack detection unit 120 can determine whether the evaluation target data is data that has been attacked, using the second abnormality score obtained by the second detector.

[0237] In addition, the case where step S135 is "yes" and step S137 is "no" means, for example, that although the sampling intervals that have passed are small, all the vehicle sensor data within the sampling time in the sampling intervals that have passed have been acquired. In this case, although the number of vehicle sensor data per sampling interval is small, the vehicle sensor data within the sampling time only has a number that can determine whether there is an attack. In other words, the case where step S135 is "yes" and step S137 is "no" means that the attack detection using the first detector can be performed, and the attack detection using the second detector cannot be performed.

[0238] At this time, the attack detection unit 120 can determine whether the evaluation target data is data that has been attacked, using the first abnormality score obtained by the first detector.

[0239] In this way, the first detector and the second detector can complement each other in detecting attacks during the time when they cannot detect each other. In other words, the attack detection unit 120 can reduce the time when it cannot detect attacks. Thus, the attack detection performance of the attack detection unit 120 can be improved.

[0240] Next, the attack detection unit 120 stores the determination result of step S134 or S140 in the detection result storage unit 123 ( S141 ). It can also be said that the attack detection unit 120 outputs the determination result to the detection result storage unit 123 .

[0241] Thus, when the first index associated with the evaluation object data is lower than the third threshold value, and the second index associated with the evaluation object data is lower than the fourth threshold value, the attack detection unit 120 determines that it is unclear whether the evaluation object data is data under attack (S134). In addition, when the third abnormality score based on the first abnormality score and the second abnormality score is higher than the fifth threshold value, the attack detection unit 120 determines that the evaluation object data is data under attack, and when the third abnormality score is lower than the fifth threshold value, the evaluation object data is determined to be normal (S140), and the detection result indicating the determined result is output.

[0242] In addition, Fig.12In the example, the attack detection unit 120 may also use the vehicle event information to calculate the abnormality score. For example, the attack detection unit 120 may also initialize (reset) the sensor value included in the long-term sensor stream when the vehicle event information indicates that at least one of the switching of the vehicle's engine ON and OFF, the switching of the shift lever, and the switching of the automatic driving mode ON and OFF has occurred. That is, the attack detection unit 120 may also calculate the second abnormality score based on the sensor value obtained after the moment when the at least one of the above occurs. In this case, since the sensor values ​​included in the long-term sensor stream need to be accumulated, the second abnormality score cannot be calculated during the accumulation period (for example, a period equivalent to more than two sampling intervals), but the first abnormality score can be calculated when the first index is greater than a predetermined value.

[0243] Thus, when at least one of the above occurs, the attack detection unit 120 detects the attack based on the first abnormality score, thereby reducing the time during which the attack cannot be detected. Thus, the attack detection performance of the attack detection unit 120 can be further improved.

[0244] [5-1. Configuration of base point data updating unit]

[0245] Fig.15 1 is a block diagram showing the structure of the base point data updating unit 121 of this embodiment. Fig.15 As shown, the base point data updating unit 121 includes a base point data acquiring unit 182 , a detection result acquiring unit 201 , and a base point data adding unit 302 .

[0246] The base point data acquisition unit 182 is a processing unit that acquires the base point data from the base point data storage unit 124 .

[0247] The detection result acquisition unit 201 is a processing unit that acquires the detection result of the attack detection unit 120 from the detection result storage unit 123 .

[0248] The base point data adding unit 302 is a processing unit that adds data corresponding to the detection result acquired by the detection result acquiring unit 201 to the base point data acquired by the base point data acquiring unit 182. It can be said that the base point data adding unit 302 updates the base point data.

[0249] [5-2. Operation of the base point data updating unit]

[0250] Fig.16 104 is a flowchart showing the base point data updating process ( S104 ) according to the present embodiment. The base point data updating process is performed by the base point data updating unit 121 .

[0251] First, the base point data updating unit 121 initializes the base point data based on the evaluation object data obtained by the base point data obtaining unit 182 (S151). The base point data updating unit 121 obtains the base point data associated with the evaluation object data 191, and when the first index of the evaluation object data 191 is 1, initializes the short-term sensor stream in the base point data, and when the second index of the evaluation object data 191 is 1, initializes the long-term sensor stream in the base point data. In addition, the initialization here means that the sensor value is not included in the short-term sensor stream or the long-term sensor stream. For example, Fig.13 The short-term sensor flow 197 and the long-term sensor flow when the evaluation ID is "1", and the short-term sensor flow 197 when the evaluation ID is "81" ( Fig.13 The []) shown indicates that it is initialized.

[0252] Next, the base point data updating unit 121 obtains the detection result associated with the evaluation object data (step S152). The process of step S152 is implemented by the detection result obtaining unit 201. The detection result obtaining unit 201 reads the detection result associated with the evaluation object data 191 from the detection result storage unit 123. The detection result obtaining unit 201 reads, for example, Fig.14 The test results are shown.

[0253] Next, the base point data updating unit 121 determines whether the acquired detection result is "attack" (S153). The processing of steps S153 to S157 is implemented by the base point data adding unit 302. The base point data adding unit 302 performs the determination of step S153 based on the detection result 208 corresponding to the evaluation ID 203 of the evaluation object data, for example.

[0254] Next, when the detection result is "attack" ("Yes" in S153), the base point data adding unit 302 sets the estimated sensor value as the additional data (S154) as the value used to complete the sensor value; when the detection result is "normal" or "unclear" ("No" in S153), the sensor value (actual measured value) of the evaluation object data is set as the additional data (S155).

[0255] Furthermore, the estimated sensor value may be a value added at the end of the short-term sensor flow associated with the evaluation object data, or an average value of the short-term sensor flow. Furthermore, the estimated sensor value may be a predicted value of the sensor value of the evaluation object data calculated by the second detector based on the above-mentioned long-term sensor flow.

[0256] The base point data adding unit 302, for example, Fig.13In the case where the evaluation ID is "82", since the detection result is "attack", "35.11" is set as the estimated sensor value to be added at the end of the short-term sensor flow associated with the evaluation target data.

[0257] Next, the base point data adding unit 302 updates the short-term sensor flow (Formula 1) used for the judgment of the next evaluation target data according to the following (Formula 2) (S156).

[0258]

Number 1

[0259] S = {s1, s2, s3, s i ,.........} (Formula 2)

[0260]

Number 2

[0261]

[0262] Here, si represents a sensor value included in the short-term sensor stream, i represents the first index of the evaluation object data, and j represents the second index of the evaluation object data. When the above-mentioned detection result labeli-j is "Attack", the base point data adding unit 302 updates si with the above-mentioned estimated sensor value pi-j. In addition, when labeli-j is "Normal" or "Unknown", the base point data adding unit 302 updates si with the above-mentioned sensor value xi-j of the evaluation object data. In addition, si is an example of a representative value.

[0263] Next, the base point data adding unit 302 updates the long-term sensor stream (Formula 3) as follows (Formula 4) (S157).

[0264]

Number 3

[0265] H = {h1, h2, h3, h j , ...} (Formula 4)

[0266]

Number 4

[0267]

[0268] Here, hj represents a sensor value included in the long-term sensor flow. When the detection result labeli-j is "Attack", the base point data adding unit 302 updates hj with the estimated sensor value pi-j. In addition, when labeli-j is "Normal" or "Unknown", the base point data adding unit 302 updates hj with the sensor value xi-j of the evaluation object data. In addition, hj is an example of a representative value.

[0269] In this way, the base point data adding unit 302 updates the two types of base point data every time it determines whether or not an attack occurs, and uses them for the next determination.

[0270] Furthermore, in the above description, an example is shown in which the sampling process and the attack detection process are performed by different devices in the monitoring system 100 , but they may be performed by the same device (for example, one device).

[0271] As described above, the sampling interval and sampling time are adjusted according to the characteristics of the vehicle sensor data that is the object of the monitoring process (for example, the attack detection process), and the sampling data is generated. Furthermore, based on the sampling data containing two types of indexes representing the activities of the short-term and long-term sensor values, two types of abnormality scores are calculated, thereby determining the attack. In this way, the monitoring cost can be suppressed and the attack detection can be performed with high accuracy.

[0272] In addition, when the detection result associated with the evaluation object data is an attack, the base point data updating unit 121 uses at least one of the short-term sensor stream and the long-term sensor stream to estimate the sensor value that the evaluation object data should take, and updates the short-term sensor stream and the long-term sensor stream based on the estimated estimated sensor value, the first index, and the second index. In addition, when the detection result associated with the evaluation object data is normal or unclear, the base point data updating unit 121 updates the short-term sensor stream and the long-term sensor stream based on the sensor value (measured value) of the evaluation object data, the first index, and the second index.

[0273] This can prevent the presence of outliers such as attacks in the base point list. This can prevent monitoring costs and detect attacks with high accuracy by using such a base point list.

[0274] Hereinafter, a method of utilizing the monitoring system 100 described above will be described.

[0275] Fig.17 It is a schematic diagram showing the configuration of the monitoring system 100 according to the present embodiment. Fig.17 This is a block diagram showing the configuration of a monitoring system 100 including a sampling unit 401 and a sampling data monitoring unit 501. The monitoring system 100 includes a server 500 existing on the cloud and an in-vehicle device 400. The monitoring system 100 can obtain extracted vehicle sensor data (sampling data) via the in-vehicle device 400 and detect attacks based on the obtained vehicle sensor data.

[0276] The vehicle-mounted device 400 and the server 500 can be connected to each other in a communicative manner via a public communication network such as the Internet, for example. The vehicle-mounted device 400 is a safety protection ECU (Electronic Control Unit) or a car navigation system.

[0277] The vehicle-mounted device 400 includes a sampling unit 401 and an attack notification device 402 .

[0278] The sampling unit 401 is a device that sends the result (sampling data) obtained by sampling the vehicle network data to the sampling data monitoring unit 501. The sampling unit 401 converts the CAN data expressed in binary into a sensor value and then into sampling data at each predetermined driving time. The sampling unit 401 sends the sampling data to the sampling data monitoring unit 501.

[0279] The attack notification device 402 is a device for notifying the driver of the occurrence of an attack on the vehicle network received from the server 500. The attack notification device 402, for example, notifies the occurrence of the attack and outputs it through a sound or a screen indicating that the vehicle is driving in a safe mode disconnected from the network. The attack notification device 402 is implemented by a display device, a speaker device, etc.

[0280] The sampling data monitoring unit 501 determines whether there is an attack on the vehicle network data (for example, sampling data) received from the vehicle-mounted device 400 , and transmits the result of attack detection to the attack notification device 402 if there is an attack.

[0281] The configuration of the sampling unit 401 may be the same as that of the sampling unit 101. The configuration of the sampling data monitoring unit 501 may be the same as that of the sampling data monitoring unit 102.

[0282] Fig.18 It is a schematic diagram showing the configuration of the vehicle-mounted device 600 according to the present embodiment. Fig.18 1 is a block diagram showing the configuration of a vehicle-mounted device 600 including a monitoring device 601. The vehicle-mounted device 600 includes the monitoring device 601 and an attack notification device 602.

[0283] The monitoring device 601 determines whether there is an attack based on the result obtained by sampling the vehicle network data only inside the vehicle, and sends the result of attack detection to the attack notification device 602 if there is an attack. In addition, the monitoring device 601 is configured to have the functions of the sampling unit 101 and the sampled data monitoring unit 102. In this way, the functions of the sampling unit 101 and the sampled data monitoring unit 102 can also be realized by one device (for example, a device mounted on the vehicle). The monitoring device 601 is an example of an attack detection system.

[0284] The attack notification device 602 is a device for notifying the driver of the occurrence of an attack on the vehicle network received from the monitoring device 601. The attack notification device 602 is realized by a display device, a speaker device, or the like.

[0285] In this way, Fig.17 The monitoring system 100 and Fig.18 In the monitoring device 601, it is appropriately determined whether there is an attack based on the result obtained by sampling the vehicle network, thereby realizing attack detection at a low monitoring cost. In addition, in the monitoring system 100 and the monitoring device 601, since the detection of the attack can be notified to the driver through the notification of the detection result, the occurrence of accidents caused by the attack can be reduced.

[0286] (Other embodiments)

[0287] As mentioned above, although the monitoring device of embodiment was demonstrated, this disclosure is not limited to this embodiment.

[0288] For example, in the above embodiments, the security protection measures in the vehicle network installed in vehicles such as automobiles are described, but the scope of application is not limited to this. For example, in addition to vehicles such as automobiles, it can also be applied to mobile objects such as construction machinery, agricultural machinery, ships, railways, and airplanes. In other words, it can be applied as a network security protection measure in mobile networks and mobile network systems.

[0289] In addition, each processing unit included in the monitoring device of the above embodiment is typically implemented as an LSI which is an integrated circuit. They may be individually implemented as a single chip, or part or all of them may be implemented as a single chip.

[0290] In addition, the integration of circuits is not limited to LSIs, and can also be realized by dedicated circuits or general-purpose processors. FPGAs that can be programmed after LSI manufacturing or reconfigurable processors that can reconfigure the connections and / or settings of circuit cells inside LSIs can also be used.

[0291] In addition, the present disclosure may also be implemented as a monitoring method (e.g., an attack detection method) executed by a monitoring system. For example, a technical solution of the present disclosure may also be a computer program that enables a computer to execute each step of the features included in the monitoring method. In addition, a technical solution of the present disclosure may also be a computer-readable non-transient recording medium such as a DVD that records such a program. For example, such a program may also be recorded on a recording medium and published or circulated. For example, such a program and a digital signal composed of the program may also be transmitted via a network represented by an electrical communication line, a wireless or wired communication line, the Internet, data broadcasting, etc. For example, the published program may also be installed in a device having another processor so that the processor executes the program, thereby enabling the device to perform the above-mentioned processing.

[0292] In addition, in the above embodiment, an example in which the first sequence information is a first index is described, but it is not limited to this, and the first sequence information may be, for example, an absolute time. In addition, in the above embodiment, an example in which the second sequence information is a second index is described, but it is not limited to this, and the second sequence information may be, for example, an absolute time at which the sampling interval starts.

[0293] In addition, in the above-mentioned embodiments, each component can be formed by dedicated hardware, or can be implemented by executing a software program suitable for each component. Each component can also be implemented by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0294] In addition, the division of the functional blocks in the block diagram is an example, and multiple functional blocks can also be implemented as one functional block, one functional block can be divided into multiple blocks, or a part of the function can be moved to other functional blocks. In addition, the functions of multiple functional blocks with similar functions can also be processed in parallel or in time-sharing by a single hardware or software.

[0295] Furthermore, when the monitoring system is realized by a plurality of devices, the functions of the sampling unit and the functions of the sampled data monitoring unit may be arbitrarily distributed among the plurality of devices.

[0296] In addition, the order in which each step in the flowchart is executed is an example order for specifically explaining the present disclosure, and may be an order other than the above. In addition, part of the above steps may be executed simultaneously (in parallel) with other steps.

[0297] The monitoring system of one or more technical solutions is described above based on the implementation mode, but the present disclosure is not limited to the implementation mode. As long as it does not deviate from the main purpose of the present disclosure, various modifications that can be thought of by those skilled in the art can be implemented on the present embodiment, and the method of combining the constituent elements in different implementation modes can also be included in the scope of one or more technical solutions.

[0298] Industrial Applicability

[0299] The present disclosure can be applied to a monitoring device for vehicle sensor data, for example, it can appropriately determine whether the vehicle control data contained in the vehicle sensor data is attacked. For example, the present disclosure can be used in a monitoring device or monitoring system such as a vehicle-mounted device such as a security ECU or a SIEM (Security Information and Event Management) in a remote monitoring server.

[0300] Description of symbols

[0301] 100 Monitoring System

[0302] 101, 401 Sampling Department

[0303] 102, 501 Sampling data monitoring unit

[0304] 110 Sampling policy generation department

[0305] 111 Sampling data generation unit

[0306] 112 Vehicle sensor data storage unit

[0307] 113 Sampling policy storage unit

[0308] 114 Vehicle information storage unit

[0309] 115, 126 Ministry of Communications

[0310] 120 Attack Detection Department

[0311] 121 Base point data update department

[0312] 122 Detector storage unit

[0313] 123 Test result storage unit

[0314] 124 Base point data storage unit

[0315] 125 Sampling data storage unit

[0316] 130 Vehicle sensor data acquisition unit

[0317] 131 Sensor data stability calculation unit

[0318] 132 Sampling Policy Determination Department

[0319] 141 Vehicle sensor data

[0320] 142, 152, 172, 192, 202 Sensor identifier

[0321] 143 Data ID

[0322] 144 Get time

[0323] 145, 174, 194, 204 sensor values

[0324] 151 Sampling policy data

[0325] 153 Document number

[0326] 154 Data Variance

[0327] 155 Vehicle event marker

[0328] 156 Sampling interval

[0329] 157 Sampling time

[0330] 160 Sampling information acquisition unit

[0331] 161 Data Extraction Department

[0332] 162 Indexing section

[0333] 173, 193, 203 Evaluation ID

[0334] 175, 195 First Index

[0335] 176, 196 Second Index

[0336] 181 Sampling data acquisition unit

[0337] 182 Base point data acquisition department

[0338] 183 First abnormality score calculation unit

[0339] 184 Second abnormality score calculation unit

[0340] 185 Attack Detection Department

[0341] 191 Evaluation object data

[0342] 197 Short-term sensor flow

[0343] 198 Long-term sensor flow

[0344] 201 Test result acquisition department

[0345] 205 First abnormality score

[0346] 206 Second abnormal score

[0347] 207 Third abnormal score

[0348] 208 Test Results

[0349] 302 Base point data addition

[0350] 400, 600 vehicle mounted device

[0351] 402, 602 Attack Notification Device

[0352] 500 Server

[0353] 601 Monitoring device.

Claims

1. An attack detection method is an attack detection method for detecting an attack on sensor data sent and received inside a moving body for controlling the moving body, comprising: a sampling policy determining step of determining, for each identifier of a sensor value included in the sensor data, a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each sampling interval based on at least one of a statistical value indicating a deviation of the sensor value of the sensor data and event information of the mobile body indicating a timing of a change in the sensor value; a sampling data generating step of generating sampling data based on the sampling interval and the sampling time, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating a temporal sequence of the two or more sensor values ​​in the sampling time, and second sequence information indicating a temporal sequence of the two or more sensor values ​​at each of the sampling intervals; An attack determination step, calculating a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data included in the sampling data, the first sequence information, and a short-term sensor stream indicating time series data of past sensor values ​​compared to the evaluation object data at the sampling time when the evaluation object data was obtained; calculating a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating changes in sensor values ​​obtained at the sampling interval in the past compared to the sampling interval when the evaluation object data was obtained; determining whether the evaluation object data is data that has been attacked based on the calculated first abnormality score and the second abnormality score, and outputting a determination result.

2. The attack detection method according to claim 1, The statistical value includes a variance value representing a deviation of the sensor value of each of the identifiers, The event information includes flag information indicating whether a change in the sensor value has occurred. In the sampling policy determination step, the sampling interval and the sampling time are determined based on the variance value and the flag information.

3. The attack detection method according to claim 2, In the sampling policy determination step, the sampling time and the sampling interval are determined based on a combination of a determination result of whether the variance value is equal to or greater than a first threshold value and whether the flag information indicates that no change in the sensor value has occurred.

4. The attack detection method according to claim 2 or 3, The flag information includes information indicating whether at least one of switching of the driving unit of the moving body between ON and OFF, switching of the shift lever, and switching of the automatic driving mode between ON and OFF has occurred.

5. The attack detection method according to any one of claims 1 to 3, In the sampling data generating step, the number of sensor data to be extracted within the sampling time is determined based on the number of normal received data to be observed within the sampling time, and the determined number of sensor data is extracted.

6. The attack detection method according to claim 5, In the sampling data generation step, it is determined whether the number of sensor values ​​observed during the sampling time is greater than the number of normal received data. If it is greater than the number of normal received data, a predetermined number of sensor values ​​are extracted. If it is not greater than the number of normal received data, all the sensor values ​​contained in the sensor data are extracted.

7. The attack detection method according to any one of claims 1 to 3 and 6, The first order information is a first index indicating the order in which the two or more sensor values ​​are acquired during the sampling time. The second order information is a second index indicating the order of the sampling intervals at which the two or more sensor values ​​are acquired. In the attack determination step, when the first index associated with the evaluation object data is lower than a third threshold value and the second index associated with the evaluation object data is lower than a fourth threshold value, it is determined that it is unclear whether the evaluation object data is data that has been attacked; when a third abnormality score based on the first abnormality score and the second abnormality score is greater than a fifth threshold value, it is determined that the evaluation object data is data that has been attacked; and when the third abnormality score is lower than the fifth threshold value, it is determined that the evaluation object data is normal, and the determination result associated with the evaluation object data indicating the determined result is output.

8. The attack detection method according to any one of claims 1 to 3 and 6, It also includes an updating step, in which: The short-term sensor stream and the long-term sensor stream are updated based on the determination result associated with the evaluation target data, the first order information, and the second order information.

9. The attack detection method according to claim 8, In the updating step, when the judgment result associated with the evaluation object data is an attack, at least one of the short-term sensor stream and the long-term sensor stream is used to infer the sensor value that the evaluation object data should be able to take, and the short-term sensor stream and the long-term sensor stream are updated based on the inferred sensor value, the first sequence information, and the second sequence information. When the judgment result associated with the evaluation object data is normal or unclear, the short-term sensor stream and the long-term sensor stream are updated based on the sensor value of the evaluation object data, the first sequence information, and the second sequence information.

10. The attack detection method according to any one of claims 1 to 3, 6 and 9, The sensor data is stored in a device mounted on the mobile body and is obtained by decoding network data represented by bytes sent and received at arbitrary driving time intervals in compliance with at least one of the protocols including CAN (Controller Area Network), CAN FD (Controller Area Network with Flexible Data Rate), FlexRay, and EtherNet (Ethernet).

11. The attack detection method according to any one of claims 1 to 3, 6 and 9, The moving object is a vehicle.

12. An attack detection system for detecting an attack on sensor data transmitted and received inside a moving body for controlling the moving body, comprising: a sampling policy determining unit that determines, for each identifier of a sensor value included in the sensor data, a sampling policy including a sampling interval for extracting the sensor value for detecting the attack from the sensor data and a sampling time for each sampling interval based on at least one of a statistical value indicating a deviation of the sensor value of the sensor data and event information of the mobile object indicating a timing of a change in the sensor value; a sampling data generating unit that generates sampling data based on the sampling interval and the sampling time, the sampling data including: two or more sensor values ​​extracted from the sensor data, first sequence information indicating a temporal sequence of the two or more sensor values ​​in the sampling time, and second sequence information indicating a temporal sequence of the two or more sensor values ​​at each of the sampling intervals; An attack determination unit calculates a first abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data included in the sampling data, the first sequence information, and a short-term sensor stream indicating time series data of past sensor values ​​at the sampling time when the evaluation object data was obtained; calculates a second abnormality score indicating the degree of abnormality of the evaluation object data based on the sensor value of the evaluation object data, the second sequence information, and a long-term sensor stream indicating changes in sensor values ​​obtained at the sampling interval in the past compared to the sampling interval when the evaluation object data was obtained; determines whether the evaluation object data is data that has been attacked based on the calculated first abnormality score and the second abnormality score, and outputs a determination result.

13. A program recording medium for causing a computer to execute the attack detection method according to any one of claims 1 to 11.

14. A computer program product, comprising a computer program, wherein the computer program is used to cause a computer to execute the attack detection method according to any one of claims 1 to 11.

Images