Determination device, determination program and determination method

Abstract

A control unit of a determination device obtains a plurality of first data and second data sent from a plurality of on-vehicle ECUs, derives determination data based on the first data, determines a legitimate determination combination of identifiers including legitimate first data and second data and an illegitimate determination combination of identifiers including illegitimate first data or second data among a plurality of combinations of identifiers identifying the first data and identifiers identifying the second data based on the second data and the determination data, and determines whether the first data or the second data is illegitimate based on a plurality of identifiers included in the determined illegitimate determination combination and a plurality of identifiers included in the legitimate determination combination.

Description

Technical Field

[0001] The present disclosure relates to a determination device, a determination program, and a determination method.

[0002] This application claims the priority based on Japanese application No. 2019-221517 for which it applied on December 6, 2019, and cites all the contents described in the said Japanese application. Background Art

[0003] In the past, the CAN communication protocol was widely used in the communication between multiple on-board ECUs (Electronic Control Units) installed in a vehicle. As vehicles become more multifunctional and advanced, the number of on-board ECUs installed tends to increase, but the on-board ECUs are divided into groups (segments) to form a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to send and receive data to each other, and the sending and receiving of data between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (for example, Patent Document 1).

[0004] In the vehicle network of Patent Document 1, in addition to the vehicle-mounted relay device (gateway), a vehicle network monitoring device is provided which is connected to each segment of the vehicle network and detects illegal data (messages) flowing into the vehicle network. When the vehicle network monitoring device detects illegal data (messages), it sends a warning message (message code) to the vehicle-mounted control device (vehicle-mounted ECU).

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: Japanese Patent Application Publication No. 2013-131907 Summary of the invention

[0008] A determination device according to one embodiment of the present disclosure is mounted on a vehicle and is connected to a plurality of on-vehicle ECUs in a communicable manner, wherein the determination device includes a control unit that controls determination of legitimacy of data sent from the plurality of on-vehicle ECUs, the data including first data and second data, the control unit obtaining a plurality of the first data and the second data sent from the plurality of on-vehicle ECUs, deriving determination data based on the first data, determining a legitimate determination combination including identifiers of legitimate first data and second data and an illegitimate determination combination including identifiers of illegitimate first data or second data among a plurality of combinations of identifiers identifying the first data and identifiers identifying the second data based on the second data and the determination data, and determining which identifier included in the determined illegitimate determination combination has illegitimate first data or second data based on the plurality of identifiers included in the determined illegitimate determination combination and the plurality of identifiers included in the legitimate determination combination. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 It is a schematic diagram illustrating the system configuration including the determination device of the first embodiment.

[0010] Figure 2 is a block diagram illustrating the internal structure of the determination device.

[0011] Figure 3 This is an explanatory diagram illustrating the correlation between a plurality of identifiers.

[0012] Figure 4 This is an explanatory diagram regarding a plurality of combinations (combination table) based on identifiers that respectively identify first data and second data.

[0013] Figure 5 This is a functional block diagram illustrating functional units included in the control unit of the determination device.

[0014] Figure 6 This is a flowchart illustrating the processing of the control unit of the determination device. DETAILED DESCRIPTION

[0015] [Problems to be Solved by the Present Disclosure]

[0016] The vehicle network monitoring device of Patent Document 1 does not take into consideration that, when an attack is made on any one of a plurality of mutually related data, it is determined that the data is malicious due to the attack.

[0017] The present disclosure provides a determination device and the like which can determine, when an attack is made on any one of a plurality of mutually related data, that the data has become malicious due to the attack.

[0018] [Effects of the present disclosure]

[0019] According to one aspect of the present disclosure, it is possible to provide a determination device or the like that determines, when an attack is made on any one of a plurality of mutually related data, that the data becomes malicious data due to the attack.

[0020] [Description of Embodiments of the Present Disclosure]

[0021] First, the embodiments of the present disclosure will be described by way of example. In addition, at least a part of the embodiments described below may be arbitrarily combined.

[0022] (1) A determination device according to one embodiment of the present disclosure is mounted on a vehicle and connected to a plurality of on-vehicle ECUs in a manner capable of communicating with each other, wherein the determination device includes a control unit that controls determination of legitimacy of data sent from the plurality of on-vehicle ECUs, the data including first data and second data, the control unit obtaining a plurality of the first data and the second data sent from the plurality of on-vehicle ECUs, deriving determination data based on the first data, and determining, based on the second data and the determination data, a legitimate determination combination including identifiers of legitimate first data and second data and an illegitimate determination combination including identifiers of illegitimate first data or second data among a plurality of combinations of identifiers identifying the first data and identifiers identifying the second data, and determining, based on the second data and the determination data, which identifier included in the determined illegitimate determination combination has the first data or the second data that is illegitimate.

[0023] In this method, the determination device determines, based on the first data, the second data, and the determination data, a legitimate determination combination of identifiers containing only legitimate first data and second data and an illegitimate determination combination of identifiers containing illegitimate first data or second data among multiple combinations based on identifiers identifying multiple first data and second data. Therefore, the determination device can determine legitimate data among multiple data that are related to each other. The determination device determines which of the first data or second data of the identifier contained in the illegitimate determination combination is illegitimate based on the first data or second data of the identifier contained in the illegitimate determination combination and the determined legitimate data (the first data and second data of the identifier contained in the legitimate determination combination). Therefore, even in the case where an attack is carried out on one of the multiple data that are related to each other, it is possible to determine the data that has become illegitimate due to the attack.

[0024] (2) Regarding the determination device of one aspect of the present disclosure, the plurality of combinations each include a plurality of identifiers for respectively identifying a plurality of first data and an identifier of the second data, and the same identifier is repeatedly included in two or more of the combinations.

[0025] In this method, the combination is constituted by a data set based on a plurality of identifiers representing each of a plurality of first data and an identifier of a single second data, and the same identifier is repeatedly included in two or more combinations. Therefore, based on a certain identifier, these combinations can be linked to each other in a series, and the identifier of the first data or the second data included in the combination determined as a legitimate determination combination can be used to efficiently determine the first data and the second data of the identifier included in other combinations.

[0026] (3) Regarding a judgment device of one mode of the present invention, the control unit determines that one of the multiple combinations is a legitimate judgment combination when the difference between the judgment data derived based on the first data of the identifier included in the one of the multiple combinations and the second data of the identifier included in the one of the combinations is within a specified value.

[0027] In this method, the determination device determines that, in each of the plurality of combinations, when the difference between the determination data derived based on the plurality of first data included in a certain combination and the second data included in the combination is within a prescribed value, the combination is determined to be a legitimate determination combination. In this way, in each of the plurality of combinations, it is determined whether the first data and the second data included in the combination are legitimate, so that determination can be made efficiently for each combination. The prescribed value is a threshold value used to determine that the determination data and the second data are substantially the same value in terms of the accuracy of the determination processing based on the determination device when comparing the determination data and the second data.

[0028] (4) Regarding a judgment device of one mode of the present invention, the control unit determines that one of the multiple combinations is an improper judgment combination when the difference between the judgment data derived based on the first data of the identifier included in the one of the multiple combinations and the second data of the identifier included in the one of the combinations is greater than a specified value.

[0029] In this mode, the judging device determines that, in each of the plurality of combinations, when the difference between the judgment data derived based on the plurality of first data included in the combination and the second data included in the combination is greater than a predetermined value, the combination is an improper judgment combination. In this way, in each of the plurality of combinations, it is judged whether the first data and the second data included in the combination are proper or not, so that the judgment of each combination can be performed efficiently.

[0030] (5) In the determination device according to one aspect of the present disclosure, the control unit determines that the first data or the second data having an identifier different from the identifier included in the legitimate determination combination among the identifiers included in the fraudulent determination combination is fraudulent data.

[0031] In this method, the first data and the second data of the identifier included in the legitimate determination combination have been determined to be legitimate data. In contrast, it is presumed that one of the first data and the second data of the identifier included in the illegitimate determination combination is illegitimate data. Here, even if the first data or the second data of the identifier included in the illegitimate determination combination is the same as the first data and the second data of the identifier included in the legitimate determination combination, it can be determined to be legitimate data. Therefore, by determining, among the first data and the second data of the identifier included in the illegitimate determination combination, data that is different from the first data or the second data of the identifier included in the legitimate determination combination as illegitimate data, it is possible to efficiently determine which of the first data and the second data of the identifier included in the illegitimate determination combination is illegitimate.

[0032] (6) Regarding a judgment device of one embodiment of the present invention, the control unit derives judgment data based on first data of identifiers after removing identifiers of data judged to be improper in other improper judgment combinations from among multiple identifiers of first data included in the improper judgment combination, and judges whether the first data and the second data included in the improper judgment combination are legitimate or not based on the judgment data and second data of the identifiers included in the improper judgment combination.

[0033] In this method, among the multiple first data of the identifier included in a certain improper determination combination, the determination data is derived based on the first data after the identifier of the data determined to be improper in other improper determination combinations is removed. Then, the determination device determines whether the first data and the second data are legitimate or not based on the first data after the identifier of the data determined to be improper is removed, the determination data, and the second data of the identifier included in the improper determination combination. The first data used to derive the determination data is the first data after the identifier of the data determined to be improper is removed in other improper determination combinations, so it is highly likely to be legitimate data. Therefore, based on the determination data and the second data derived using the first data after the data determined to be improper is removed, the legitimacy of the first data and the second data can be efficiently determined.

[0034] (7) In the determination device according to one aspect of the present disclosure, information on the plurality of combinations is stored in a predetermined storage area accessible from the device, and the control unit acquires the information on the plurality of combinations by referring to the predetermined storage area.

[0035] In this method, information about multiple combinations is not only stored in a storage unit included in the determination device, but also stored in a specified storage area accessible from the determination device, such as an external server connected to the determination device in a manner that can communicate with the determination device, so the information about the combinations can be efficiently obtained.

[0036] (8) In the determination device according to one aspect of the present disclosure, the first data and the second data corresponding to the identifier constituting the combination have a correlation relationship, and an absolute value of a correlation coefficient between the first data and the second data is greater than or equal to 0.7.

[0037] In this method, the first data corresponding to the identifier constituting the combination and the second data have a correlation relationship. By setting the specified value of the absolute value of the correlation coefficient between the first data and the second data to 0.7, the second data whose absolute value of the correlation coefficient with the first data is greater than 0.7 can be used to determine whether the data is legitimate, thereby improving the accuracy of the determination result.

[0038] (9) A determination program in one aspect of the present disclosure causes a computer to perform the following processing: obtaining a plurality of first data and second data sent from a plurality of on-vehicle ECUs, deriving determination data based on the first data, obtaining information about a plurality of combinations based on identifiers that respectively identify the first data and the second data, and determining, from among the plurality of combinations, a legitimate determination combination of identifiers that include legitimate first data and second data and an illegitimate determination combination of identifiers that include illegitimate first data or second data, based on the obtained second data and the derived determination data, and determining, based on the plurality of identifiers included in the determined illegitimate determination combination and the plurality of identifiers included in the determined legitimate determination combination, which of the first data or second data of the identifier included in the determined illegitimate determination combination is illegitimate.

[0039] In this aspect, a computer can be made to function as a determination device.

[0040] (10) A judgment method according to one aspect of the present disclosure causes a computer to perform the following processing: obtaining a plurality of first data and second data sent from a plurality of on-vehicle ECUs, deriving judgment data based on the first data, obtaining information about a plurality of combinations based on identifiers that respectively identify the first data and the second data, and determining, from among the plurality of combinations, a legitimate judgment combination of identifiers that include legitimate first data and second data and an illegitimate judgment combination of identifiers that include illegitimate first data or second data, based on the obtained second data and the derived judgment data, and determining, based on the plurality of identifiers included in the determined illegitimate judgment combination and the plurality of identifiers included in the determined legitimate judgment combination, which of the first data or second data of the identifier included in the determined illegitimate judgment combination is illegitimate.

[0041] This aspect can provide a determination method for determining, when an attack is made on any one of a plurality of mutually related data, that the data has become malicious due to the attack.

[0042] [Details of the embodiments of the present disclosure]

[0043] The present disclosure is specifically described based on the drawings showing its embodiments. Below, the determination device 2 of the embodiment of the present disclosure is described with reference to the drawings. In addition, the present disclosure is not limited to these examples, and is represented by the scope of the request for protection, and is intended to include all changes within the meaning and scope equivalent to the scope of the request for protection.

[0044] (Implementation Method 1)

[0045] Hereinafter, embodiments will be described based on the drawings. Figure 1 It is a schematic diagram illustrating the system configuration including the determination device 2 according to the first embodiment. Figure 2 2 is a block diagram illustrating an internal structure of the determination device 2, etc. The vehicle C is equipped with an external communication device 1, a determination device 2, and a plurality of vehicle-mounted ECUs 3 connected to the determination device 2 in a communicable manner.

[0046] The determination device 2 determines whether the data such as messages output (sent) by these multiple on-board ECUs 3 are legitimate or not. The determination device 2 functions as an on-board relay device such as a CAN gateway or an Ethernet switch (registered trademark) that relays data sent and received between these multiple on-board ECUs 3. In addition, the determination device 2 can also function as an on-board relay device that communicates with an external server S1 (program providing device) connected to an off-board network N via an off-board communication device 1. The determination device 2 can also function as a reprogramming host that sends programs or data obtained from the external server S1 to the on-board ECU 3 (Electronic Control Unit) mounted on the vehicle C. The determination device 2 can also cooperate with the external server S1 to perform a series of determination processes described later.

[0047] The external server S1 is a computer such as a server connected to an external vehicle network N such as the Internet or a public line network, and has a storage unit S11 based on RAM (Random Access Memory), ROM (Read Only Memory) or a hard disk. In the external server S1, a program or data for controlling the vehicle-mounted ECU3 produced by the manufacturer of the vehicle-mounted ECU3 is stored in the storage unit S11. The program or data can also be sent to the vehicle C as an update program and used to update the program or data of the vehicle-mounted ECU3 installed in the vehicle C. The external server S1 (program providing device) thus constructed is also called an OTA (Over The Air) server. The vehicle-mounted ECU3 installed in the vehicle obtains the update program sent from the external server S1 via wireless communication, and applies the update program as the executed program, so that the program executed by this ECU can be updated (reprogrammed). Furthermore, in the storage unit S11 of the external server S1, a program or data for cooperating with the determination device 2 to perform a series of determination processing can also be stored.

[0048] The vehicle C is equipped with an off-vehicle communication device 1, a determination device 2, a display device 5, and a plurality of on-vehicle ECUs 3 for controlling various on-vehicle devices. The off-vehicle communication device 1 and the determination device 2 are connected to each other in a communicative manner, for example, by a wiring harness such as a serial cable. The determination device 2 and the on-vehicle ECUs 3 are connected to each other in a communicative manner via an in-vehicle LAN 4 corresponding to a communication protocol such as CAN (Controller Area Network, registered trademark) or TCP / IP.

[0049] The vehicle external communication device 1 includes a vehicle external communication unit 11 and an input / output I / F (interface) 12 for communicating with the determination device 2. The vehicle external communication unit 11 is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, WiFi, etc., and transmits and receives data with an external server S1 via an antenna 13 connected to the vehicle external communication unit 11. The communication between the vehicle external communication device 1 and the external server S1 is performed via an external network such as a public line network or the Internet.

[0050] The input / output I / F 12 is a communication interface for performing serial communication with the determination device 2, for example. The vehicle-external communication device 1 and the determination device 2 communicate with each other via the input / output I / F 12 and a wiring harness such as a serial cable connected to the input / output I / F 12. In the present embodiment, the vehicle-external communication device 1 is provided as a device independent of the determination device 2, and these devices are connected in a manner capable of communication by the input / output I / F 12, etc., but the present invention is not limited thereto. The vehicle-external communication device 1 may also be built into the determination device 2 as a component of the determination device 2.

[0051] The determination device 2 includes a control unit 20, a storage unit 21, an in-vehicle communication unit 23, and an input / output I / F 24. The determination device 2 is, for example, a vehicle-mounted relay device such as a gateway or an Ethernet switch that summarizes the segments of multiple systems such as the vehicle-mounted ECU 3 of the control system, the vehicle-mounted ECU 3 of the safety system, and the vehicle-mounted ECU 3 of the body system based on the communication line 41 (CAN bus, Ethernet (registered trademark) cable) and relays the communication between the vehicle-mounted ECU 3 between these segments. Alternatively, the determination device 2 can also be configured as a functional unit of the body ECU that controls the entire vehicle C. Alternatively, the determination device 2 can also be configured as a device independent of the vehicle-mounted relay device and connected to the vehicle-mounted relay device in a manner that allows communication. The determination device 2 can also obtain data such as messages output by the vehicle-mounted ECU 3 via the vehicle-mounted relay device to determine whether the data is legitimate.

[0052] The storage unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM) or flash memory, and pre-stores control programs and data referenced during processing. The control program stored in the storage unit 21 can also store the control program read from the recording medium 22 readable by the determination device 2. In addition, the control program can also be downloaded from an external computer not shown in the figure connected to a communication network not shown in the figure and stored in the storage unit 21. In the storage unit 21, the configuration information of all vehicle-mounted ECUs 3 installed in the vehicle C and the path information (routing table) used when performing relay processing are stored. In the storage unit 21, information about the combination table described later is also stored.

[0053] The in-vehicle communication unit 23 is, for example, an input / output interface (CAN transceiver) using a communication protocol such as CAN (Controller Area Network) or TCP / IP. The control unit 20 communicates with the in-vehicle ECU 3 or other in-vehicle devices such as relay devices connected to the in-vehicle LAN 4 via the in-vehicle communication unit 23. There are multiple in-vehicle communication units 23 (three in the attached figure), and each of the in-vehicle communication units 23 is connected to a communication line 41 constituting the in-vehicle LAN 4. By providing multiple in-vehicle communication units 23 in this way, the in-vehicle LAN 4 is divided into multiple segments, and the in-vehicle ECU is connected to each segment according to the function of the in-vehicle ECU (control system function, safety system function, body system function).

[0054] When the in-vehicle communication unit 23 uses the CAN communication protocol, the data obtained by the determination device from the vehicle-mounted ECU is a CAN message. When the in-vehicle communication unit 23 uses the TCP / IP communication protocol, the data obtained by the determination device from the vehicle-mounted ECU is an IP packet.

[0055] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (MicroProcessing Unit), and performs various control processes and calculation processes by reading out control programs and data pre-stored in the storage unit 21. The control unit 20 receives data such as messages sent from the vehicle-mounted ECU 3 connected to the communication line 41, or sends data such as messages to the vehicle-mounted ECU 3, and functions as a CAN controller, for example. In addition, the control unit 20 refers to a message identifier such as CAN-ID included in the received message, and determines the in-vehicle communication unit 23 corresponding to the segment that becomes the destination of transmission based on the referenced message identifier (CAN-ID) and the path information (routing table) stored in the storage unit 21. Then, the control unit 20 functions as a CAN gateway that relays the message by sending the received message from the determined in-vehicle communication unit 23. The control unit 20 functions as a CAN controller, but is not limited to this. The in-vehicle communication unit 23 may also function as a CAN transceiver and a CAN controller. Alternatively, the control unit 20 may function as a layer 2 or layer 3 Ethernet switch that receives and relays data such as IP packets transmitted from the vehicle-mounted ECU 3 .

[0056] The control unit 20 determines whether the data is legitimate by analyzing the data such as messages obtained (received) from the vehicle-mounted ECU 3. In the determination of the legitimacy of data, the illegitimate data refers to, for example, data such as messages sent from an illegitimate vehicle-mounted ECU 3 such as a vehicle-mounted ECU 3 that has become abnormal due to a virus that has invaded from the outside of the vehicle via the vehicle-external communication device 1 or an illegitimate vehicle-mounted ECU 3 that has been exchanged illegitimately. The details will be described later. The control unit 20 determines whether the received data is legitimate by analyzing the data such as messages. For example, it can determine that a message sent from an illegitimate (abnormal) vehicle-mounted ECU 3 that pretends to be a legitimate (normal) vehicle-mounted ECU 3 or a vehicle-mounted ECU 3 that has become abnormal due to an attack from the outside is an illegitimate message. The control unit 20 determines the identifier (message identifier of CAN-ID, etc.) contained in the data such as messages determined to be illegitimate, and performs defense processing such as prohibiting the relay processing of data containing the determined identifier.

[0057] The vehicle-mounted ECU 3 includes a control unit 30, a storage unit 31, and an in-vehicle communication unit 32. The storage unit 31 is composed of a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores programs or data of the vehicle-mounted ECU 3.

[0058] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a display of a car navigation. The display device 5 is connected to the input / output I / F 24 of the determination device 2 in a manner that enables communication via a wiring harness such as a serial cable. The display device 5 displays data or information output from the control unit 20 of the determination device 2 via the input / output I / F 24. As described above, when the determination device 2 determines that the received message is an improper message, it may also send information such as an identifier contained in the improper message to the display device 5 so that the display device 5 displays the information. By causing the display device 5 to display the information, the operator of the vehicle C can be notified of the detection of an improper message. The connection method between the display device 5 and the determination device 2 is not limited to a connection method based on the input / output I / F 24, etc. The display device 5 and the determination device 2 may also be connected via the in-vehicle LAN 4.

[0059] Figure 3 This is an explanatory diagram illustrating the correlation between a plurality of identifiers. Figure 4 It is an explanatory diagram regarding a plurality of combinations (combination table 211 ) based on identifiers that respectively identify first data and second data.

[0060] The data output (sent) from the vehicle-mounted ECU 3 includes an identifier for identifying the data. When the data output from the vehicle-mounted ECU 3 is, for example, a CAN message, the message identifier (CAN-ID number) stored in the CAN-ID field included in the frame of the CAN message is equivalent to the identifier. The data of multiple identifiers are correlated with each other. Having a correlation means that the absolute value of the correlation coefficient of these data in the data of two certain identifiers is greater than a specified value. The correlation coefficient can also be calculated based on information about the value or content stored in the payload of a CAN message or an IP data packet, for example.

[0061] The prescribed value is, for example, 0.7. By setting the prescribed value to 0.7, it is possible to extract multiple data of state quantities that are highly correlated from the data group output from the acquisition unit 201. When further improving the estimation accuracy, it is desirable to set the prescribed value to 0.9. More preferably, the prescribed value is preferably set to 0.97. The correlation coefficient can be calculated, for example, by using the formula (correlation coefficient = covariance of the value of the first data included in the multiple data and the value of the second data other than the first data included in the multiple data / (standard deviation of the value of the first data × standard deviation of the value of the second data)). By setting the absolute value of each correlation coefficient to be greater than the prescribed value, it is possible to extract multiple data of state quantities that are highly correlated with each other in positive or negative correlation. In the case where the second data is negatively correlated with respect to the first data, the correlation coefficient is a negative (negative) value, but by multiplying the value by -1, it can be used as the second data that is positively correlated.

[0062] In the diagram of this embodiment, for example, the correlation among 8 identifiers is shown. Figure 3 and 4 In the example, the correlation relationship between messages (data) whose CAN-IDs are 100, 110, 120, 130, 140, 150, 160, and 170 is illustrated when the identifier is set as CAN-ID. Figure 3 As shown, a message of a certain identifier has a correlation relationship with messages of other multiple identifiers. That is, the messages of these multiple identifiers have a correlation relationship in a manner of being connected in a series via other messages.

[0063] For example, for an identifier whose CAN-ID is 170, at least two paths based on a path returning to the identifier (170) via 160 and 140 and a path returning to the identifier (170) via 120, 150, and 110 have a correlation relationship connected in series via other messages. Therefore, even if an attack is carried out on a certain identifier, by using the relationship with other multiple identifiers connected in series on the multiple paths, it is possible to determine which identifier's data is improper data and identify the improper identifier.

[0064] Figure 4 The combination of the correlation relationships among these multiple identifiers is shown in a table form (combination table 211). Figure 4 In the above, based on each of these combinations, matters regarding the legitimacy of the data of the identifier (first identifier or second identifier) ​​included in the combination are noted, and these matters will be described later.

[0065] The combination table 211 includes, as management items (metadata), for example, a combination No., a plurality of first identifiers, and a second identifier. In the item (field) of the combination No., a management number for identifying the combination is stored. In the present embodiment, as an example, a combination table 211 is formed of 8 identifiers (100, 110, 120, 130, 140, 150, 160, 170, and 180) in 8 combinations (No. 1 to No. 8). In this way, the number of combinations can also be set to the same number as the number of identifiers of the data to be determined. In the item (field) of the second identifier, an identifier (second identifier) ​​of data to be compared with the determination data described later is stored. In each item (field) of the plurality of first identifiers, each of the identifiers (first identifiers) of data having a correlation with the data of the second identifier is stored. The data containing each of the first identifiers is data for deriving determination data for comparison with the data of the second identifier.

[0066] As described above, the message of a certain identifier has a correlation with the messages of other multiple identifiers, and as illustrated in the combination table 211, all identifiers are included in at least two or more combinations. For example, the identifier whose CAN-ID is 100 is included in the combination of No. 1 as the second identifier, and is included in the combinations of No. 1, 2, and 7 as the first identifier. That is, the combinations of identifiers are respectively constituted by a data set based on multiple identifiers representing each of the multiple first data and an identifier of a single second data. On this basis, each combination is constituted in a manner that the same identifier is repeatedly included in at least two or more combinations.

[0067] The combination table 211 may further include the absolute value of the correlation coefficient between each first identifier and the second identifier. In the item (field) of the absolute value of the correlation coefficient, the correlation coefficient or the absolute value of the correlation coefficient between the corresponding first identifier and the second identifier is stored.

[0068] In the present embodiment, the identifier recorded as being used to identify data is a message identifier based on CAN-ID, but is not limited thereto. When the communication protocol used by the vehicle-mounted ECU 3 and the determination device 2 is, for example, TCP / IP, the identifier used to identify the data may also be based on an identifier of a source address, a destination address, a port number, or a combination thereof contained in an IP data packet.

[0069] Figure 52 is a functional block diagram illustrating the functional units included in the control unit 20 of the determination device 2. The control unit 20 of the determination device 2 functions as an acquisition unit 201, an output unit 202, and a relay processing unit 203 by executing the control program stored in the storage unit 21, and the determination device 2 operates as an in-vehicle relay device. Furthermore, the control unit 20 of the determination device 2 functions as a data classification unit 204, a determination data derivation unit 205, a comparison unit 206, a determination unit 207, and a determination unit 208 by executing the control program stored in the storage unit 21, and determines whether the acquired data is legitimate or not, and determines legitimate identifiers and illegitimate identifiers among the identifiers included in the data.

[0070] The acquisition unit 201 acquires a plurality of data such as messages output (sent) from the vehicle-mounted ECU 3 via the in-vehicle communication unit 23. The acquisition unit 201 outputs the acquired data to the relay processing unit 203 and the data classification unit 204.

[0071] The relay processing unit 203 refers to the path information stored in the storage unit 21 to identify the in-vehicle communication unit 23 as the relay destination of the data based on the CAN-ID or the destination address included in the acquired message data, and outputs the data to the output unit 202 .

[0072] The output unit 202 outputs the data output from the relay processing unit 203 via the in-vehicle communication unit 23 determined as the relay destination. The acquisition unit 201 , the relay processing unit 203 , and the output unit 202 perform data relay processing.

[0073] The data classification unit 204 obtains a plurality of data such as messages output (sent) from the vehicle-mounted ECU 3 via the acquisition unit 201. The data classification unit 204 refers to the combination table 211 stored in the storage unit 21, and classifies (differentiates) the obtained plurality of data into data (first data) containing the first identifier in each combination and data (second data) containing the second identifier based on the first identifier and the second identifier contained in each combination. As described above, the data classification unit 204 uses, for example, the CAN-ID contained in the CAN message or the destination address contained in the IP data packet as an identifier (first identifier or second identifier). By using the CAN-ID (CAN message) or the destination address (IP data packet) used in the relay process as an identifier for identifying data, the data can be identified as a process attached to the relay process, and the increase in the processing load of the determination device 2 can be suppressed.

[0074] The data classification unit 204 classifies (separates) the first data and the second data for each combination. That is, the data classification unit 204 generates a data set consisting of a plurality of first data and second data for each combination.

[0075] The data classification unit 204 outputs the first data of the plurality of first identifiers included in each combination (one combination) to the determination data derivation unit 205, and outputs the second data of the second identifier included in each combination (one combination) to the comparison unit 206. That is, the data classification unit 204 sequentially or repeatedly outputs the first data of the first identifier included in one combination to the determination data derivation unit 205 and outputs the second data of the second identifier included in the one combination to the comparison unit 206, in accordance with the number of combinations, in a plurality of combinations.

[0076] The determination data deriving unit 205 derives determination data based on the first data of each combination output from the data classification unit 204. That is, the determination data deriving unit 205 derives determination data corresponding to the second data of the second identifier (100) included in the combination of No. 1, for example, by using a conversion function that takes the first data of the plurality of first identifiers (120, 130, 140) included in the combination of No. 1 as input values ​​and outputs the determination data as an output value. Alternatively, the determination data deriving unit 205 may be configured, for example, by a learning model such as a DNN (deep neural network) that is learned in a manner that outputs determination data when a plurality of first data are input. The determination data deriving unit 205 may also include a learning model such as a DNN, input a plurality of first data into the learning model, obtain the determination data output from the learning model, and thereby derive the determination data. The first data of the first identifier having such a correlation and the second data of the second identifier are in a corresponding relationship via the determination data, and when the second identifier is set as a protected CANID as a protected object from attack, the first identifier is equivalent to the associated CANID associated with the second identifier when estimating the data of the second identifier. The determination data derivation unit 205 outputs the derived determination data to the comparison unit 206.

[0077] The comparison unit 206 compares the determination data obtained from the determination data derivation unit 205 with the second data output from the data classification unit 204 in all the respective combinations. The comparison unit 206 outputs information on whether the determination data and the second data match or whether the difference between the determination data and the second data is within a prescribed range, etc., to the determination unit 207 as a comparison result.

[0078] The determination unit 207 determines that the plurality of first data and second data, which are the original data of the determination data, are legitimate (normal) data, when the determination data and the second data are consistent, and the difference between the determination data and the second data is within a predetermined value, and determines the combination of the first identifier of the first data and the second identifier of the second data as a legitimate determination combination. The predetermined value is a threshold value for determining that the determination data and the second data are substantially the same value in terms of the accuracy of the determination process by the determination device 2 when comparing the determination data and the second data.

[0079] When the determination data and the second data are inconsistent, or the difference between the determination data and the second data is greater than a predetermined value, the determination unit 207 determines that the plurality of first data or the second data as the original data of the determination data are improper (abnormal) data, and determines the combination of the first identifier of the first data and the second identifier of the second data as an improper determination combination. The determination unit 207 outputs the determination result of each of the plurality of combinations, i.e., the result of determining whether each combination is a proper determination combination or an improper determination combination, to the determination unit 208.

[0080] The determination unit 208 obtains the determination result of each of the plurality of combinations output from the determination unit 207. The determination unit 208 obtains information about the first identifier and the second identifier included in each of the plurality of combinations by referring to the combination table 211. The determination unit 208 determines that the first identifier and the second identifier included in the legitimate determination combination are legitimate (normal) identifiers, and the data including the identifiers are legitimate (normal) data.

[0081] As in this embodiment Figure 3 As exemplified in FIG. 1 , for example, when the data of the identifiers 100 and 140 are attacked and become illegal data, in the combination of the identifiers (100, 140) that does not include the illegal data, that is, combination No. 6, the difference between the determination data and the second data is within the prescribed value. That is, the data of the first identifiers (120, 130) and the second identifier (150) included in the combination No. 6 is determined to be legitimate (normal) data.

[0082] On the other hand, in other combinations (No. 1, 2, 3, 4, 5, 7, and 8) including the identifiers 100 and 140 as the first identifier or the second identifier, the difference between the determination data and the second data is greater than the prescribed value, and the data of the first identifier or the second identifier is temporarily determined to be illegal (abnormal) data. As described above, these other combinations are determined to be illegal determination combinations.

[0083] When a single identifier remains after removing the identifiers that have been determined to be legitimate (normal) as the first identifiers and second identifiers included in the legitimate determination combination from the first identifiers and second identifiers included in the legitimate determination combination, the determination unit 208 determines (determines) the remaining identifier as an illegitimate identifier. In the present embodiment, for example, among the first identifiers (120, 140) and the second identifier (130) included in combination No. 4, the identifiers 120 and 130 are identifiers that are also included in combination No. 6 as the legitimate determination combination and have been determined to be legitimate (normal). Therefore, the identifier 140 is equivalent to the single identifier that remains after removing the identifiers that have been determined to be legitimate (normal). That is, since the identifier 140 is illegitimate, the difference between the determination data in combination No. 4 and the second data of the second identifier is not within the prescribed value, and the combination No. 4 is determined to be an illegitimate determination combination.

[0084] When a single identifier remains after removing the identifier that has been determined to be legitimate from the illegitimate determination combination, the determination unit 208 determines that the remaining identifier is an illegitimate identifier and that the data including the illegitimate identifier is illegitimate data. In this way, the determination unit 208 can efficiently determine which first data or second data of an identifier included in the illegitimate determination combination is illegitimate based on the plurality of identifiers included in the legitimate determination combination.

[0085] The determination unit 208 performs a loop process by outputting information about the illegal determination combination and the identifier determined to be illegal to the determination data derivation unit 205. That is, the information about the illegal determination combination and the identifier determined to be illegal is fed back from the determination unit 208 to the determination data derivation unit 205, and the process of deriving the determination data by the determination data derivation unit 205 is executed again.

[0086] The determination data deriving unit 205 obtains information on the illegal determination combination and the identifier determined to be illegal, which is output from the determination unit 208. The determination data deriving unit 205 derives determination data based on first data including a first identifier obtained by removing the identifier determined to be illegal from a plurality of first identifiers of the illegal determination combination for each illegal determination combination.

[0087] In this embodiment, for example, among the first identifiers (110, 140) included in combination No. 8, the identifier 140 has been determined to be an unauthorized identifier, and the determination data is derived based on the first identifier (110) after removing the unauthorized identifier (140). In this way, based on the first data of the first identifier after removing the identifier determined to be unauthorized, determination data with a high probability of a difference with the second data of the second identifier being within a specified value can be derived.

[0088] The comparison unit 206, the determination unit 207, and the determination unit 208 perform the same processing as the previous processing based on the determination data derived again by the determination data derivation unit 205, and determine the legitimacy of the first identifier and the second identifier after removing the identifier determined to be improper in each improper determination combination. The comparison unit 206 compares the determination data derived based on the first identifier after removing the identifier determined to be improper with the second data of the second identifier, and outputs information about the difference between the determination data and the second data of the second identifier, such as whether the difference between the determination data and the second data of the second identifier is within a specified value, to the determination unit 208 as a comparison result.

[0089] When the difference between the judgment data derived based on the first identifier after removing the identifier determined to be illegal and the second data of the second identifier is consistent and within a specified value, the judgment unit 208 judges that the first identifier and the second identifier after removing the identifier determined to be illegal are legitimate identifiers, and the data containing the legitimate identifier is legitimate data. The judgment unit 208 can add identifiers determined to be legitimate by recursively repeating such judgment processing, so that the number of legitimate identifiers, i.e., reliable identifiers, increases. When a single identifier remains after removing the identifier determined to be legitimate from the illegal judgment combination, the judgment unit 208 again judges that the remaining identifier is an illegal identifier, and the data containing the illegal identifier is illegal data. The judgment unit 208, etc., repeats this processing on the data of all identifiers included in multiple combinations, thereby judging whether all these identifiers are legitimate or not.

[0090] The determination unit 208 outputs information on the determination result of the identifier to the display device 5. By outputting the information on the determination result to the display device 5, for example, the situation that the data of a certain identifier is attacked and becomes illegal (abnormal) can be notified to the operator of the vehicle C. The determination unit 208 outputs information on the identifier determined to be illegal or a signal (relay prohibition signal) for prohibiting the relay of the data of the identifier determined to be illegal to the relay processing unit 203. By outputting the relay prohibition signal and the like to the relay processing unit 203, the relay of the data of the identifier that is attacked and becomes illegal (abnormal) can be prohibited, and the defense against the illegal data can be carried out.

[0091] The data classification unit 204, the determination data derivation unit 205, the comparison unit 206, the determination unit 207, and the determination unit 208 are described as functional units in the control unit 20 of the determination device 2, but are not limited thereto. Some of these functional units may be configured as a cloud server such as an external server S1 or a functional unit of an onboard computer mounted on the vehicle C that is connected to the determination device 2 in a manner that allows communication, and the determination device 2 cooperates with the external server S1 or the onboard computer to perform a series of processes in these functional units.

[0092] Figure 6 2 is a flowchart illustrating the processing of the control unit 20 of the determination device 2. The control unit 20 of the determination device 2 always performs the following processing when the vehicle CC is in the start state (IG switch is on) or the stop state (IG switch is off).

[0093] The control unit 20 of the determination device 2 obtains a plurality of data (first data and second data) transmitted from the vehicle-mounted ECU 3 (S101). The control unit 20 obtains a plurality of data transmitted from the vehicle-mounted ECU 3. The data obtained by the control unit 20 is data classified into the first data of the first identifier or the second data of the second identifier included in each combination based on a plurality of combinations of identifiers. Therefore, the data obtained by the control unit 20 includes the first data and the second data in each combination.

[0094] The control unit 20 of the determination device 2 obtains information about a plurality of combinations based on identifiers that respectively identify the first data and the second data (S102). The control unit 20 refers to the storage unit 21 and obtains the information about the plurality of combinations stored in the storage unit 21. The information about the plurality of combinations may be stored in a predetermined storage area accessible to the control unit 20 of the determination device 2, such as the storage unit 21 of the external server S1, and the control unit 20 communicates with the external server S1 via the vehicle-external communication device 1, thereby obtaining the information about the plurality of combinations from the external server S1.

[0095] The control unit 20 of the determination device 2 derives determination data corresponding to the second data in each of the plurality of combinations based on the first data in each of the plurality of combinations (S103). The control unit 20 derives the determination data based on the first data of the first identifier contained in each of the plurality of combinations. The control unit 20 extracts identifiers such as CAN-ID contained in the acquired data, and determines data whose extracted identifier is the same as the first identifier contained in the combination as the first data. The control unit 20 extracts identifiers such as CAN-ID contained in the acquired data, and determines data whose extracted identifier is the same as the second identifier contained in the combination as the second data.

[0096] Since each combination includes a plurality of first identifiers, the control unit 20 determines a plurality of first data based on the plurality of first identifiers. The control unit 20 inputs the determined plurality of first data into, for example, a conversion function, and derives determination data corresponding to the second data. The control unit 20 derives determination data corresponding to the second data in each of the plurality of combinations.

[0097] The control unit 20 of the determination device 2 determines whether the difference between the second data and the determination data in each of the multiple combinations is within a specified value (S104). The control unit 20 determines whether the second data is consistent with the determination data, or whether the difference between the second data and the determination data is within a specified value in each of the multiple combinations. The specified value is a threshold value used to determine whether the determination data and the second data are substantially the same value based on the accuracy of the determination processing of the determination device 2 when comparing the determination data and the second data. Alternatively, the control unit 20 may also use the consistency between the determination data and the second data as a reference, and if the consistency is above the specified value, it is determined that the determination data and the second data are substantially the same value.

[0098] When the difference is less than the prescribed value (S104: Yes), the control unit 20 of the determination device 2 determines a legitimate determination combination of identifiers including legitimate first data and second data (S105). When the difference is less than the prescribed value, the control unit 20 determines a combination of a first identifier representing a plurality of first data and a second identifier representing second data, which includes raw data as determination data, as a legitimate determination combination. That is, it is determined that the first identifier and the second identifier included in the legitimate determination combination are legitimate identifiers, and the data including the legitimate identifier is legitimate data.

[0099] When the difference is not less than the prescribed value (S104: No), that is, when the difference is greater than the prescribed value, the control unit 20 of the determination device 2 determines an illegal determination combination of identifiers including illegal first data or second data (S1051). When the difference is greater than the prescribed value, the control unit 20 determines a combination of a first identifier representing a plurality of first data and a second identifier representing second data, which includes raw data as determination data, as an illegal determination combination. That is, it is determined that one of the first identifier and the second identifier included in the illegal determination combination is an illegal identifier, and the illegal identifier data is illegal data.

[0100] The control unit 20 of the determination device 2 extracts the identifier of the first data or the second data determined to be legitimate or illegitimate (S106). The control unit 20 determines (determines) the identifier representing the first data and the second data included in the legitimate determination combination as a legitimate identifier and extracts it. When a single identifier remains after removing the identifier that has been determined to be normal from the identifiers representing the first data and the second data included in the illegitimate determination combination, the control unit 20 determines (determines) the remaining identifier as an illegitimate identifier and extracts it. Therefore, based on the multiple identifiers included in the legitimate determination combination, it is possible to determine which identifier included in the determined illegitimate determination combination has illegitimate first data or second data and extract it.

[0101] The control unit 20 of the determination device 2 derives determination data based on the first data obtained by removing the identifiers of the data determined to be improper in other improper determination combinations from the identifiers of the plurality of first data included in the improper determination combination (S107). The control unit 20 derives determination data again based on the data including the first identifier obtained by removing the identifier determined to be improper from the first identifier of the improper determination combination in each improper determination combination. By using the data based on the first identifier removed from the identifier determined to be improper, the control unit 20 can derive determination data with a high probability that the difference with the data of the second identifier is within a specified value.

[0102] The control unit 20 of the determination device 2 determines whether the difference between the second data included in the fraudulent determination combination and the derived determination data is within a specified value (S108). The control unit 20 compares the second data included in the fraudulent determination combination with the determination data derived based on the data of the first identifier after removing the identifier determined to be fraudulent, and determines whether the difference between the second data and the determination data is within a specified value, similarly to the above-mentioned process S104.

[0103] When the difference is less than the specified value (S108: Yes), the control unit 20 of the determination device 2 determines that the identifiers of the first data and the second data are legitimate (S109). The control unit 20 determines that the first identifier and the second identifier excluding the identifier that has been determined to be illegitimate in each illegitimate determination combination are legitimate identifiers, and the data including the legitimate identifier is legitimate data. The control unit 20 can add the identifiers determined to be legitimate by recursively repeating such determination processing, thereby increasing the number of legitimate identifiers, that is, trustworthy identifiers.

[0104] When the difference is not less than the prescribed value (S108: No), that is, when the difference is greater than the prescribed value, the control unit 20 of the determination device 2 determines that the identifier of the first data or the second data is invalid (S1091). The control unit 20 determines that one of the first identifier and the second identifier, excluding the identifier that has been determined to be invalid, is an invalid identifier in each invalid determination combination, and the data of the invalid identifier is invalid data.

[0105] The control unit 20 of the determination device 2 determines whether determination has been made for all identifiers (S110). The control unit 20 stores the determination results of legitimacy of data of all identifiers included in a plurality of combinations in the storage unit 21, and determines whether determination has been made for all identifiers by referring to the determination results.

[0106] When all identifiers have not been determined (S110: No), the control unit 20 performs the processing from S107 again, and performs a loop processing from S107 to S110. The control unit 20 can add identifiers determined to be legitimate by recursively repeating the determination processing such as S107 and S108, thereby increasing the number of legitimate identifiers, i.e., reliable identifiers. In each illegitimate determination combination, when a single identifier remains after removing the identifiers that have been determined to be legitimate (normal), the control unit 20 determines the remaining identifier as an illegitimate identifier, thereby being able to reliably determine the illegitimate identifier, thereby increasing the number of determined illegitimate identifiers.

[0107] When all the identifiers are determined (S110: Yes), the control unit 20 outputs the determination result to the display device 5 or the like (S111). By outputting information about the determination result to the display device 5, the operator of the vehicle C can be informed of the legitimate status of each of the multiple identifiers having a correlation, for example, or the fact that the data of a certain identifier has been attacked and become illegal (abnormal). The control unit 20 may also output a signal (relay prohibition signal) to prohibit the relay of the data of the identifier determined to be illegal to the relay processing unit 203. By outputting the relay prohibition signal or the like to the relay processing unit 203, the relay of the data of the identifier that has been attacked and become illegal (abnormal) is prohibited, and a defensive measure against the attack due to the illegal data can be taken.

[0108] According to the present embodiment, the determination device 2 determines which of the first data or the second data of the identifier included in the illegal determination combination is illegal based on the first data of the first identifier and the second data of the second identifier included in the determined illegal determination combination and the first data of the first identifier and the second data of the second identifier included in the determined legal determination combination. Therefore, even if an attack is carried out on a certain data, it is possible to determine the identifier of the data that has become illegal due to the attack among the data including a plurality of identifiers that are associated with each other.

[0109] According to the present embodiment, the combination is composed of a data set based on a plurality of first identifiers representing each of the plurality of first data and a second identifier representing a single second data, and the same identifier is repeatedly included in more than two combinations. Based on a certain identifier, these combinations can be linked to each other in a series, and the first identifier of the first data or the second identifier of the second data included in the combination determined as a legitimate determination combination can be used to efficiently determine the first identifier and the second identifier of the identifier included in other combinations.

[0110] According to the present embodiment, based on the first data of the first identifier after removing the identifier of the data determined to be improper in other improper determination combinations from the first identifier included in a certain improper determination combination, the determination data is derived again. Then, the determination device 2 again repeats the process of determining whether the first identifier and the second identifier after removing the identifier of the data determined to be improper are legitimate or not based on the difference between the derived determination data and the second data of the second identifier included in the certain improper determination combination. Therefore, the legitimacy determination of all identifiers included in multiple combinations can be efficiently performed, and which identifier is improper among multiple identifiers that have a correlation relationship with each other can be determined.

[0111] The embodiments disclosed herein are illustrative in all aspects and should not be construed as restrictive. The scope of the present invention is indicated by the scope of claims rather than the above meaning, and is intended to include all modifications within the meaning and scope equivalent to the scope of claims.

[0112] Description of symbols

[0113] C. Vehicle;

[0114] S1 external server;

[0115] S11 storage unit;

[0116] 1. External vehicle communication device;

[0117] 11. External communication unit;

[0118] 12 Input and output I / F;

[0119] 13 Antenna;

[0120] 2. Determination device (vehicle-mounted relay device);

[0121] 20. Control Department;

[0122] 201 Acquisition Department;

[0123] 202 output unit;

[0124] 203 Relay Processing Department;

[0125] 204 Data Classification Department;

[0126] 205 determination data export unit;

[0127] 206 Comparative Department;

[0128] 207 Determination Department;

[0129] 208 Judgment Department;

[0130] 21 Storage Department;

[0131] 211 Combination Form;

[0132] 22 Recording medium;

[0133] 23 In-vehicle communication unit;

[0134] 24 Input and output I / F;

[0135] 3. Vehicle ECU;

[0136] 30 Control Department;

[0137] 31 Storage Department;

[0138] 32 In-vehicle communication unit;

[0139] 4 In-car LAN;

[0140] 41 communication lines;

[0141] 5 Display device.

Claims

1. A determination device, mounted on a vehicle and connected to a plurality of vehicle-mounted ECUs in a communicable manner, wherein: The determination device includes a control unit that performs control on determining whether the data transmitted from the plurality of vehicle-mounted ECUs is legitimate or not. The data includes first data and second data, The control unit obtains a plurality of the first data and the second data transmitted from the plurality of vehicle-mounted ECUs, deriving determination data based on the first data, Among a plurality of combinations of an identifier identifying the first data and an identifier identifying the second data, determining a legitimate judgment combination including identifiers of legitimate first data and second data and an illegitimate judgment combination including identifiers of illegitimate first data or second data based on the second data and the judgment data, Based on the plurality of identifiers included in the determined fraudulent determination combination and the plurality of identifiers included in the determined legitimate determination combination, determining which of the first data or the second data of the identifier included in the determined fraudulent determination combination is fraudulent, The first data and the second data corresponding to the identifier constituting the combination have a correlation relationship, An absolute value of a correlation coefficient between the first data and the second data is greater than or equal to 0.

7.

2. The determination device according to claim 1, wherein: The plurality of combinations respectively include a plurality of identifiers for respectively identifying a plurality of the first data and an identifier of the second data, The same identifier is repeatedly included in two or more of the combinations.

3. The determination device according to claim 1 or 2, wherein: The control unit determines that one of the plurality of combinations is a valid determination combination when a difference between determination data derived based on first data of an identifier included in the one combination and second data of the identifier included in the one combination is within a specified value.

4. The determination device according to claim 3, wherein: The control unit determines that one of the plurality of combinations is an unauthorized determination combination when a difference between determination data derived based on first data of an identifier included in the one combination and second data of the identifier included in the one combination is greater than a predetermined value.

5. The determination device according to claim 1 or 2, wherein: The control unit determines, as illegal data, first data or second data having an identifier different from an identifier included in the legitimate determination combination among the identifiers included in the fraudulent determination combination.

6. The determination device according to claim 5, wherein: The control unit selects, from among the identifiers of the plurality of first data included in the fraud determination combination, deriving the determination data based on the first data of the identifiers after removing the identifiers of the data determined to be fraudulent in the other fraud determination combinations, Based on the determination data and the second data of the identifier included in the fraud determination combination, it is determined whether the first data and the second data included in the fraud determination combination are legitimate or not.

7. The determination device according to claim 1 or 2, wherein: Information about the plurality of combinations is stored in a predetermined storage area accessible from the device. The control unit acquires information on a plurality of combinations by referring to a predetermined storage area.

8. A determination program product, The method comprises a determination program which causes a computer to execute the following processing: Acquire a plurality of first data and second data sent from a plurality of vehicle-mounted ECUs, Based on the first data, deriving determination data, obtaining information about a plurality of combinations based on identifiers that respectively identify the first data and the second data, Based on the acquired second data and the derived judgment data, determine, from among the plurality of combinations, a legitimate judgment combination including identifiers of legitimate first data and second data and an illegitimate judgment combination including identifiers of illegitimate first data or second data, Based on the plurality of identifiers included in the determined fraudulent determination combination and the plurality of identifiers included in the determined legitimate determination combination, determining which of the first data or the second data of the identifier included in the determined fraudulent determination combination is fraudulent, The first data and the second data corresponding to the identifier constituting the combination have a correlation relationship, An absolute value of a correlation coefficient between the first data and the second data is greater than or equal to 0.

7.

9. A determination method, Make the computer execute the following processing: Acquire a plurality of first data and second data sent from a plurality of vehicle-mounted ECUs, Based on the first data, deriving determination data, obtaining information about a plurality of combinations based on identifiers that respectively identify the first data and the second data, Based on the acquired second data and the derived judgment data, determine, from among the plurality of combinations, a legitimate judgment combination including identifiers of legitimate first data and second data and an illegitimate judgment combination including identifiers of illegitimate first data or second data, Based on the plurality of identifiers included in the determined fraudulent determination combination and the plurality of identifiers included in the determined legitimate determination combination, determining which of the first data or the second data of the identifier included in the determined fraudulent determination combination is fraudulent, The first data and the second data corresponding to the identifier constituting the combination have a correlation relationship, An absolute value of a correlation coefficient between the first data and the second data is greater than or equal to 0.7.

Images