Intrusion detection device and intrusion detection method

Abstract

The invention provides an intrusion detection device and a detection method capable of more accurately detecting illegal communication. The intrusion detection device is provided with: a communication unit that transmits and receives a frame to and from an in-vehicle electronic device; an attribute acquisition unit that acquires an attribute of the frame; a state acquisition unit that acquires communication control state information indicating a communication control state of the frame based on the in-vehicle electronic device; and an abnormality detection unit that detects an abnormality of the in-vehicle electronic device on the basis of the attribute and the communication control state. Even if the number of frames transmitted per unit time is within a predetermined value, the abnormality of the in-vehicle electronic device can be detected on the basis of the communication control state of the ECU (20), which is the transmission source of the frames, and the attributes of the frames.

Description

Technical Field

[0001] The present disclosure relates to an intrusion detection device and an intrusion detection method. Background Art

[0002] Conventionally, a plurality of ECUs (Electronic Control Units) composed of microcomputers etc. are mounted on automobiles. The plurality of ECUs are connected to an in-vehicle network such as CAN (Controller Area Network) to communicate with each other and with external devices.

[0003] In recent years, due to illegal communication from outside, ECUs have been attacked by hackers and others, resulting in the threat of vehicle control being hijacked. For this threat, there is a known technology, IDS (Intrusion Detection System), which detects the occurrence of such attack activities by monitoring network communications and notifies managers and others. For example, Patent Document 1 discloses counting the count value per unit time of messages periodically sent from a communication device, and when the count value exceeds a threshold, it is determined that an attack activity has occurred.

[0004] However, in the technology disclosed in the above-mentioned patent document 1, there may be a situation where attack activities that should be judged as abnormal cannot be detected. For example, when an attack device (spoofed, software tampered ECU, external device, etc.) sends illegal frames at a specified period, the number of frames sent per unit time is controlled below the threshold, so the sending of the illegal frame cannot be detected as illegal communication. Therefore, in the technology disclosed in patent document 1, it is sometimes impossible to accurately perform the detection of illegal communication. Prior art literature Patent Literature

[0005] Patent Document 1: Japanese Patent No. 6891671 Summary of the invention Problem that the invention aims to solve

[0006] In view of the above problems, the present invention provides an intrusion detection device and a detection method that can more accurately perform illegal communication detection. Technical means of solving problems

[0007] The intrusion detection device of the first mode of the present invention comprises: a communication unit, which sends and receives frames to and from a vehicle-mounted electronic device; an attribute acquisition unit, which acquires attributes of the frame; a status acquisition unit, which acquires communication control status information, wherein the communication control status information indicates a communication control status of the frame based on the vehicle-mounted electronic device; and an abnormality detection unit, which detects abnormalities of the vehicle-mounted electronic device based on the attributes and the communication control status.

[0008] In addition, the intrusion detection device of the second mode of the present invention comprises: a communication unit, which sends and receives frames with a vehicle-mounted electronic device; an attribute acquisition unit, which acquires the attributes of the frame; a status acquisition unit, which acquires communication control status information, wherein the communication control status information indicates the communication control status of the frame based on the vehicle-mounted electronic device; an abnormality judgment unit, which detects abnormalities of the vehicle-mounted electronic device; and a sending unit, which, when the abnormality judgment unit detects an abnormality of the vehicle-mounted electronic device, adds the attributes and the communication control status information to the abnormality information indicating the abnormality and sends the information. Effects of the Invention

[0009] According to the intrusion detection device of the present invention, it is possible to more accurately perform detection of illegal communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is a block diagram showing an example of the configuration of the intrusion detection device 100 according to the first embodiment. Figure 2 This is a block diagram illustrating the structure of the intrusion detection device 100 in detail. Figure 3 An example of the communication control status table included in the status acquisition unit 103 is shown. Figure 4 This is an example of a determination table used by the frame transmission determination unit 104 to determine whether the ECU 20 is normal or abnormal. Figure 5 An example of the communication control group table included in the state determination unit 105 is shown. Figure 6 This is a flowchart showing the operation of the first embodiment. Figure 7 This is a flowchart showing the operation of the first embodiment. Figure 8 It is a block diagram showing an example of the configuration of an intrusion detection device 100 ′ according to the second embodiment. DETAILED DESCRIPTION

[0011] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be represented by the same numerals. In addition, the accompanying drawings show embodiments and implementation examples according to the principles of the present invention, but these are for understanding the present invention rather than for limiting the present invention. The description of this specification is merely a typical example and does not limit the claims or application examples of the present invention in any way.

[0012] In the present embodiment, a sufficiently detailed description is provided so that those skilled in the art can implement the present disclosure, but other installation / modes are also possible, and it is necessary to understand that the configuration / structure can be changed and various elements can be replaced without departing from the scope and spirit of the technical idea of ​​the present disclosure. Therefore, the following description cannot be interpreted as limited to this. The control lines and information lines shown in the drawings represent the lines that are considered necessary when explaining the invention, and do not represent all the control lines and information lines in the actual product.

[0013] [First embodiment] First, refer to Figure 1 A block diagram of the intrusion detection device 100 according to the first embodiment is illustrated. Figure 1 1 is a block diagram showing an example of the configuration of the intrusion detection device 100 according to the first embodiment. The vehicle-mounted network 1 is configured by connecting the intrusion detection device 100 and a plurality of ECUs 20a to 20e (vehicle-mounted electronic devices) to a network 10. Figure 1 In FIG. 1 , for convenience of explanation, five ECUs 20 a to 20 e are shown, but the present invention is not limited to this.

[0014] The network 10 is a network that connects the intrusion detection device 100 and the plurality of ECUs 20 and is used for data communication. The communication standard may be CAN, Ethernet, SPI, etc., and is not limited to a specific standard. In addition, the plurality of ECUs 20a to 20e may be collectively referred to as "ECU 20" below.

[0015] ECU20 is a calculation control device for performing calculations for performing various controls related to the vehicle. Multiple ECU20 use the network 10 to exchange messages (hereinafter also referred to as "frames" or "data") with each other. In the frame, the transmission source and the transmission destination are predefined by identification information such as ID, and ECU20 can receive the frame based on the identification information. In addition, ECU20 can be any information processing device connected to the network 10, for example, it can be an external device such as a diagnostic machine connected through an interface such as OBD (On-Board Diagnostics).

[0016] The intrusion detection device 100 is an information processing device that monitors the network 10 and detects illegal communication from the outside (intrusion or attack activity on the ECU 20). In addition, the intrusion detection device 100 may also be an information processing device that realizes the function of the ECU 20 at the same time.

[0017] Figure 2 1 is a block diagram showing an example of the configuration of the intrusion detection device 100 according to the first embodiment. As an example, the intrusion detection device 100 includes a communication unit 101, an attribute acquisition unit 102, a state acquisition unit 103, a frame transmission determination unit 104, a state determination unit 105, and an abnormality detection unit 106.

[0018] The communication unit 101 transmits and receives frames to the network 10. The frames received by the communication unit 101 are output to the attribute acquisition unit 102. When the frames transmitted and received by the communication unit 101 are frames related to the communication control state described later, the frames are output to the state acquisition unit 103.

[0019] The attribute acquisition unit 102 acquires attribute information related to the attribute of the frame based on the frame acquired by the communication unit 101. The acquired attribute information of the frame is previously defined in the vehicle network 1, and as an example, includes: an ID included in the frame, a timing for transmitting the frame, and a payload (actual data portion) of the frame. The attribute acquisition unit 102 outputs the acquired attribute and information of the ECU 20 as the transmission source of the frame to the frame transmission determination unit 104.

[0020] The state acquisition unit 103 acquires communication control state information related to the state of communication control performed by the ECU 20 in the frame received by the communication unit 101. The communication control state information is predefined in the vehicle network 1 to indicate one of a plurality of states. The state of communication control of the ECU 20 changes according to the main factors inside and outside the ECU 20. The communication control state information is information indicating the current state of the ECU 20.

[0021] An example of a protocol that specifies a communication control state is AUTOSAR CAN Network Management (CanNm). CanNm is a protocol related to communication control specified by AUTOSAR, and is a protocol used to communicate in the startup state of a group of ECUs (PN cluster) that need to communicate simultaneously, regardless of the state of the vehicle's ignition power supply. In CanNm, five communication control states are defined, and the communication control state of the ECU changes due to main factors called internal requests and external requests.

[0022] An internal request is a request by the ECU to continue its own operation when it determines that it needs to continue starting due to its own internal main factors. In contrast, an external request is represented by an NM frame sent in three communication control states called network modes. Specifically, there is an area allocated to each PN cluster in the NM frame, and by confirming the area when receiving the NM frame, it is determined whether there is a communication request from the same PN cluster. In the vehicle network 1 using CanNm, the types and attributes of frames that can be sent and received in each of multiple communication control states are sometimes specified. The intrusion detection device 100 of this embodiment uses the situation where the attributes of the frames that can be sent and received are specified by the communication control state, determines the combination of the communication control state and the attributes of the frames being sent, and detects illegal communications based on the judgment result.

[0023] In the state acquisition unit 103, one method of acquiring the communication control state information indicating the communication control state of the ECU 20 is to directly receive the communication control state information from the ECU 20. In addition, the state acquisition unit 103 may determine the communication control state based on the communication status of the frame sent and received with the target ECU, and acquire the information including the determination content as the communication control state information.

[0024] In the above-mentioned CanNm example, the communication control state of each ECU 20 can be estimated based on the content of the NM frame circulating on the network 10 and the information of the PN cluster of each ECU 20. That is, the NM frame and the PN cluster can function as communication control state information in an integrated manner. In the state acquisition unit 103, the communication control state information acquired by the state acquisition unit 103 is Figure 3 The communication control status table shown as an example is managed for each ECU 20a to 20e and is output to the frame transmission determination unit 104 and the status determination unit 105. Figure 3 In the communication control state information, state 1, state 2, and state 3 are defined as the communication control states of the ECUs 20a to 20e, and the communication control state information indicates which state the communication control state of each of the ECUs 20a to 20e is in.

[0025] The frame transmission determination unit 104 determines whether the ECU 20 as the transmission source of the frame received by the communication unit 101 is allowed to send the frame and whether the ECU 20 is normal or abnormal based on the combination of the attribute information obtained from the attribute acquisition unit 102 and the communication control state information obtained from the state acquisition unit 103. Figure 4 This is an example of a determination table used by the frame transmission determination unit 104 to determine whether the ECU 20 is normal or abnormal.

[0026] The judgment table is a table for making the following judgments: for each of the nine combinations of states 1 to 3 represented by the communication control state information and attributes 1 to 3 represented by the attribute signal, it is judged whether the ECU 20 is normal or abnormal. If it is judged to be normal, the ECU 20 can send frames (can send), and if it is judged to be abnormal, it cannot send frames (cannot send). For example, assuming that the communication control state of each ECU 20a to 20e is Figure 3 In this case, for example, if the attribute of the frame received from ECU 20c is attribute 2, the state 1 of ECU 20a and 20b, the state 2 of ECU 20d and 20e, and the state 3 of ECU 20c are shown. Figure 4 The judgment table of the frame transmission judgment unit 104 determines that the ECU 20 c is abnormal and cannot be sent. The judgment result of the frame transmission judgment unit 104 is output to the abnormality detection unit 106.

[0027] The state determination unit 105 determines the communication control state information acquired from the state acquisition unit 103 and Figure 5 The communication control group table shown determines whether the ECU 20 is normal or abnormal. The communication control group is a group of ECUs 20 that always share the same communication control state at any time. In the above example of CanNm, the communication control group corresponds to the PN cluster.

[0028] As an example, Figure 5 As shown, ECU20a, 20b are classified as group 1 as a communication control group, and ECU20c-20e are classified as group 2 as a communication group. In this case, for example, when the communication control state information of ECU20d, 20e indicates state 1, and the communication control state of ECU20c belonging to group 2 indicates state 2, the state determination unit 105 can determine that ECU20c is abnormal. The determination result of the state determination unit 105 is output to the abnormality detection unit 106.

[0029] The abnormality detection unit 106 has the following function: using one or both of the judgment results of the frame transmission judgment unit 104 and the judgment results of the state judgment unit 105, it is finally determined whether the ECU 20 is abnormal (detecting abnormality). In the case of using the judgment results of both to determine the normality / abnormality of the ECU 20, the normality / abnormality of the ECU 20 can be determined with higher accuracy than the case of using the judgment results of one of them.

[0030] Even when the normality / abnormality of ECU20 is judged only based on the judgment result of the frame transmission judgment unit 104, the normality / abnormality of ECU20 can be judged with sufficient accuracy. For example, even when an illegal message is sent in a manner that the number of messages sent from ECU20 per unit time is controlled below a threshold, the frame transmission judgment unit 104 can judge whether the frame is normal or abnormal by combining the communication control state information indicating the state of the frame and the attribute information indicating the attribute of the frame. That is, the abnormality detection unit 106 can judge the normality / abnormality of ECU20 only by using the judgment result of the frame transmission judgment unit 104, and even in this case, illegal communication can be detected more accurately than when judging based on the number of messages from ECU20 per unit time.

[0031] However, regardless of whether the communication control state information acquired by the state acquisition unit 103 is actually related to illegal communication, sometimes an illegal situation is not reflected in the communication control state information. Specifically, it is assumed that the attack device pretending to be ECU20 performs data manipulation to make the frame of its own illegal message be judged as a legitimate message in order to disguise the sending of illegal messages as the sending of legitimate messages. In order to cope with such a situation, the abnormality detection unit 106 can use both the judgment result of the frame transmission judgment unit 104 and the judgment result of the state judgment unit 105 to judge the normality / abnormality of ECU20. The state judgment unit 105 can judge the normality / abnormality of ECU20 by focusing on the communication control group that is always shared by the communication control state at any time. That is, even if the attack device forges a frame related to its own communication control state, the abnormality detection unit 106 can accurately judge whether the ECU20 is normal or abnormal by confirming the communication control state of the ECU20 belonging to the communication control group shared with the attack device.

[0032] The abnormality detection unit 106 is not limited to a specific time, and the abnormality detection unit 106 can perform the abnormality judgment appropriately at the time when the abnormality detection unit 106 receives the judgment result from the frame transmission judgment unit 104 and the state judgment unit 105, or can perform the abnormality judgment at a certain period regardless of the reception time. In addition, the abnormality judgment of the abnormality detection unit 106 can also take into account the hysteresis of the judgment result of the frame transmission judgment unit 104 and the state judgment unit 105.

[0033] Reference Figure 6 The flowchart of FIG. 1 illustrates an example of the operation for determining normality / abnormality of the ECU 20 in the intrusion detection device 100 according to the first embodiment. Figure 6The abnormality detection unit 106 determines the normal / abnormal operation of the ECU 20 using only the judgment result of the frame transmission judgment unit 104. First, the communication unit 101 acquires (receives) the frame (received frame) transmitted from the ECU 20 (step S101). Next, when the received frame is a frame indicating the communication control state, the state acquisition unit 103 acquires the transmission communication control state information from the frame (step S102). Figure 3 As shown, the acquired communication control state information is updated and stored as the latest communication control state information of the ECU 20. Next, the attribute acquisition unit 102 acquires attribute information indicating the attribute of the received frame (step S103).

[0034] The frame transmission determination unit 104 acquires the attribute information of the frame acquired from the attribute acquisition unit 102 and the communication control state information held as internal information in the state acquisition unit 103, and refers to the determination table ( Figure 4 ), it is judged whether the frame can be sent (step S104). When the judgment table indicates that the frame related to the combination of the attribute information and the communication control status information can be sent ("Yes" in step S105), the frame sending judgment unit 104 sends the information to the abnormality detection unit 106. The abnormality detection unit 106 judges that the ECU20 as the sending source of the frame is normal based on the information (step S106). On the other hand, when the judgment table indicates that the frame related to the combination of the attribute information and the communication control status information cannot be sent ("No" in step S105), the frame sending judgment unit 104 sends the information to the abnormality detection unit 106. The abnormality detection unit 106 judges that the ECU20 as the sending source of the frame is abnormal based on the information (step S107).

[0035] Reference Figure 7 The flowchart of FIG. 1 illustrates another example of the operation for determining normality / abnormality of the ECU 20 in the intrusion detection device 100 according to the first embodiment. Figure 7 This shows the operation of the abnormality detection unit 106 to determine whether the ECU 20 is normal or abnormal, using only the determination result of the state determination unit 105 .

[0036] First, the communication unit 101 obtains a frame from each ECU 20a to 20e (step S201), and obtains the communication control state information related to the ECU 20a to 20e that sent the frame (step S202). Then, the state judgment unit 105 confirms the communication control state of the ECU 20 belonging to the same communication control group (step S203). For example, when the ECU 20a to 20e are divided into Figure 5In the case of the groups shown, the communication control state information of the frames transmitted by the ECUs 20a and 20b belonging to group 1 is collectively confirmed. Similarly, the communication control state information of the frames transmitted by the ECUs 20c to 20e belonging to group 2 may also be collectively confirmed.

[0037] In step S204, based on the result of the confirmation in step S203, it is determined whether the ECU 20 of the same communication control group is in the same communication control state. If the result of the determination is positive, the process is transferred to step S205, and the ECU 20 of the same communication control group is determined to be normal. On the other hand, if the result of the determination is negative, the process is transferred to step S206, and the ECU 20 of the same communication control group is determined to be in an abnormal state. In this way, the above-mentioned actions are repeated until the confirmation of all communication control groups is completed (step S207).

[0038] In addition, in the above flowchart, the case where the communication control states of the ECUs 20 belonging to the same communication control group are the same is described as an example, but this is only an example, and the abnormal state of the ECU 20 can also be predefined based on the distribution of the communication control states of the ECUs 20 belonging to the same communication control group, and the distribution of the obtained communication control state information can be specified to determine whether the ECU 20 is normal or abnormal. That is, when the communication control states of the ECUs 20 in the same communication control group have a certain relationship, it can be determined that the communication is normal.

[0039] The obtained signal related to the distribution may be added to the output signal output by the abnormality detection unit 106 and output from the abnormality detection unit 106. For example, when the communication control state of only one ECU 20 in the same communication control group is different, the abnormality of the ECU 20 can be output to the abnormality detection unit 106 as the first abnormal state. In addition, when the communication control states of the ECUs 20 in the same communication control group are different, the abnormality of all the ECUs 20 in the same communication control group can be output to the abnormality detection unit 106 as the second abnormal state. In addition, the abnormality detection unit 106 may also adopt a form of implementing the final abnormality judgment based on the abnormal state output from the state judgment unit 105.

[0040] As mentioned above, Figure 6 The flowchart shows the operation of the abnormality detection unit 106 to determine the normality / abnormality of the ECU 20 using only the determination result of the frame transmission determination unit 104. Figure 7 The flowchart shows the operation of the abnormality detection unit 106 to determine the normality / abnormality of the ECU 20 using only the determination result of the state determination unit 105. When the abnormality detection unit 106 determines the normality / abnormality of the ECU 20 based on both the determination result of the frame transmission determination unit 104 and the determination result of the state determination unit 105, as long as the Figure 6 Steps and Figure 7 Just follow the steps.

[0041] As described above, according to the first embodiment, the detection of illegal communication can be performed more accurately. Specifically, according to the attribute information and communication control state information of the frame sent, it is possible to determine whether the ECU20 as the source of the frame is normal or abnormal. In addition, in the state judgment unit 105, according to the provisions of the communication control group and the communication control state information, it is determined whether the ECU20 as the source of the frame is normal or abnormal. The abnormality detection unit 106 can determine whether the ECU20 as the source of the frame is normal or abnormal based on one or both of the judgment results of the frame transmission judgment unit 104 and the judgment results of the state judgment unit 105. Therefore, according to the first embodiment, even if the number of frames sent per unit time is within the specified value, the abnormality of the ECU20 can be determined based on the combination of the communication control state of the ECU20 as the source of the frame and the attributes of the frame, and the sameness of the communication control group.

[0042] [Second Embodiment] Next, refer to Figure 8 The intrusion detection device 100' of the second embodiment is described. Like the intrusion detection device 100 of the first embodiment, the intrusion detection device 100' of the second embodiment is connected to the ECU 20 via a network. Figure 8 As shown, the intrusion detection device 100 ′ has a configuration different from that of the intrusion detection device 100 in part.

[0043] like Figure 8 As shown in FIG. 1 , compared with the structure of the intrusion detection device 100 of the first embodiment, the intrusion detection device 100 of the second embodiment further includes a sending unit 107 and a sending information generating unit 108. The other structures are the same as those of the intrusion detection device 100 of the first embodiment. Figure 8 The same reference numerals are used throughout.

[0044] When the abnormality detection unit 106 detects an abnormality of ECU20 in the same manner as in the first embodiment, the sending unit 107 sends the abnormality information to the outside. Specifically, the abnormality information is information indicating that ECU20 is abnormal, which is determined by the frame transmission judgment unit 104 or the state judgment unit 105. The destination of the abnormal information is, for example, an external device, a server, etc., but is not limited to a specific device. As another example, a security operation center (SOC) can be considered. By sending the abnormal information by the sending unit 107, the occurrence of threats and attacks can be grasped externally and associated with the response.

[0045] The transmission information generation unit 108 has a function of generating transmission information assigned to the abnormal information sent from the transmission unit 107. As an example, the transmission information includes the attributes of the frame obtained in the attribute acquisition unit 102 and the communication control state information of the ECU20 obtained in the state acquisition unit 103. The communication control state information of multiple ECUs 20a to 20e can also be assigned to one abnormal information. For example, the communication control state information of other ECUs 20 belonging to the same communication control group as the ECU 20 that sent the abnormal frame can also be assigned. In the case of assigning the communication control state information about multiple ECUs 20 to one abnormal information, the transmission amount of the transmission unit 107 increases, but it is easier to grasp the situation when the abnormality occurs. For example, when it has been sent to the SOC, it can be used for analysts to identify and classify the abnormality and conduct secondary analysis.

[0046] In addition, the present invention is not limited to the above-mentioned embodiments, and includes various modified examples. The above-mentioned embodiments are contents described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to having all the structures described. In addition, a part of the structure of some embodiments can be replaced by the structure of other embodiments, and the structure of other embodiments can be added to the structure of some embodiments. In addition, for a part of the structure of each embodiment, other structures can be added, deleted, or replaced.

[0047] In addition, the above-mentioned structures, functions, processing units, and processing methods can be implemented by hardware by designing a part or all of them by integrated circuits. In addition, the above-mentioned structures and functions can also be implemented by software by interpreting and executing programs that implement their respective functions by a processor. Information such as programs, tables, and files that implement each function can be stored in a memory, a hard disk, or a SSD recording device, or a recording medium such as an IC card, an SD card, or a DVD. Explanation of symbols

[0048] 1…In-vehicle network, 10…Network, 20a~20e…ECU, 100…Intrusion detection device, 101…Communication unit, 102…Attribute acquisition unit, 103…Status acquisition unit, 104…Frame transmission judgment unit, 105…Status judgment unit, 106…Abnormality detection unit, 107…Transmission unit, 108…Transmission information generation unit.

Claims

1. An intrusion detection device, characterized in that: have: a communication unit that sends and receives frames between the onboard electronic devices; An attribute acquisition unit, which acquires the attribute of the frame; a state acquisition unit that acquires communication control state information, the communication control state information indicating a communication control state based on the frame of the in-vehicle electronic device; as well as An abnormality detection unit detects an abnormality of the vehicle-mounted electronic device based on the attribute and the communication control state.

2. The intrusion detection device according to claim 1, characterized in that: further comprising a frame transmission determination unit for determining whether to permit transmission of the frame based on the attribute and the communication control state, The abnormality detection unit detects an abnormality based on a determination result of the frame transmission determination unit.

3. The intrusion detection device according to claim 1 or 2, characterized in that: The device further comprises a state determination unit for determining whether the vehicle-mounted electronic devices belonging to the same group are in the same communication control state. The abnormality detection unit detects an abnormality based on a determination result of the state determination unit.

4. The intrusion detection device according to claim 1, characterized in that: Also available: a frame transmission determination unit configured to determine whether to permit transmission of the frame based on the attribute and the communication control state; and a state determination unit for determining whether the communication control states of the vehicle-mounted electronic devices belonging to the same group have a predetermined relationship, The abnormality detection unit detects abnormality of the vehicle-mounted electronic device based on either a determination result of the frame transmission determination unit or a determination result of the state determination unit.

5. An intrusion detection device, characterized in that: have: A communication unit that sends and receives frames with the vehicle-mounted electronic device; An attribute acquisition unit, which acquires the attribute of the frame; a state acquisition unit that acquires communication control state information, the communication control state information indicating a communication control state based on the frame of the in-vehicle electronic device; an abnormality determination unit for detecting abnormalities of the vehicle-mounted electronic device; as well as A transmitting unit is configured to add the attribute and the communication control state information to abnormality information indicating the abnormality and transmit the abnormality information when the abnormality determining unit detects an abnormality in the vehicle-mounted electronic device.

6. An intrusion detection method, characterized in that: have: The step of sending and receiving frames with the vehicle-mounted electronic device; A step of obtaining attributes of the frame; a step of acquiring communication control state information, wherein the communication control state information indicates a communication control state based on the frame of the vehicle-mounted electronic device; as well as A step of detecting an abnormality of the in-vehicle electronic device based on the attribute and the communication control state.

7. The intrusion detection method according to claim 6, characterized in that: The method further comprises a first step of determining whether to permit transmission of the frame based on the attribute and the communication control state, and the abnormality detection step of detecting an abnormality based on a result of the determination in the first step.

8. The intrusion detection method according to claim 6 or 7, characterized in that: The method further comprises a second step of determining whether the communication control states of the vehicle-mounted electronic devices belonging to the same group have a predetermined relationship. The abnormality detection step detects abnormality based on the determination result of the second step.

9. The intrusion detection method according to claim 6, characterized in that: Also available: The first step is to determine whether to allow the frame to be sent based on the attribute and the communication control state; and The second step is to determine whether the communication control states of the vehicle-mounted electronic devices belonging to the same group have a prescribed relationship. The abnormality detection step detects the abnormality based on either the determination result of the first step or the determination result of the second step.

Images