Detection device, detection method, and computer program

Abstract

A device according to one aspect of the present disclosure is a device for detecting an illegal intrusion into a network, and is provided with: an acquisition unit for acquiring a communication frame from a plurality of objects to be monitored; and a monitoring execution unit that monitors the presence or absence of an abnormality relating to the communication frame for each of the plurality of monitoring objects. The monitoring execution unit executes at least one of a first time-division monitoring for switching the object to be monitored in a time-division manner and a second time-division monitoring for switching a monitoring program for the object to be monitored in a time-division manner.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a detection device, a detection method, and a computer program.

[0002] This application claims priority based on Japanese Application No. 2023-124460 filed on July 31, 2023, and incorporates by reference all the recitations in the above-mentioned Japanese application. BACKGROUND

[0003] Patent Literature 1 describes a technology of dividing a plurality of device operations into time intervals, creating an action model according to a time series order of the operations, and detecting an anomaly using the created model.

[0004] Patent Literature 2 describes a technology of calculating a credit score according to a kind of detected anomaly, and switching a control mode of a plurality of robots according to the calculated credit score.

[0005] Patent Literature 3 describes a technology of selecting a transfer device whose traffic size does not exceed resources of a defense device in order to improve a possibility of properly responding to attack traffic.

[0006] Patent Literature 4 describes a technology of allocating data packets transferred to a security device, and compressing payloads of the allocated data packets.

[0007] Patent Literature 5 and Patent Literature 6 describe a technology of transmitting sampled information at normal times and transmitting full logs in a case where a detector in a vehicle determines an anomaly in order to reduce transmitted monitoring data while maintaining a proper monitoring level.

[0008] Patent Literature 7 describes a technology of estimating a device suspected of being attacked among a plurality of devices connected to a CAN bus, and collecting logs from the device.

[0009] Patent Literature 8 describes a technology of detecting a vehicle in which there is a possibility of a reverse engineering activity by an attacker, and intensively monitoring an attack on the vehicle.

[0010] Patent Literature 9 describes a technology of changing at least one of a communication method, a defense method, and a log saving method according to an intrusion depth of an attack.

[0011] Prior Art Documents

[0012] Patent Literature

[0013] Patent Literature 1: Japanese Patent Application Publication No. 2019-101895

[0014] Patent Literature 2: International Publication No. 2022 / 049894

[0015] Patent Literature 3: Japanese Patent Application Laid-Open (JP A) No. 2020-14089

[0016] Patent Literature 4: Japanese Patent Application Laid-Open (JP A) No. 2020-17826

[0017] Patent Literature 5: International Publication No. 2018 / 105321

[0018] Patent Literature 6: International Publication No. 2018 / 105319

[0019] Patent Literature 7: International Publication No. 2022 / 091754

[0020] Patent Literature 8: International Publication No. 2021 / 038869

[0021] Patent Literature 9: Japanese Patent Application Laid-Open (JP A) No. 2019-125344 SUMMARY

[0022] SOLUTION TO THE PROBLEM

[0023] An aspect of the present disclosure relates to a detection device that detects an illegal intrusion against a network, the detection device including: an acquisition unit that acquires a communication frame from a plurality of monitoring targets; and a monitoring execution unit that monitors, for each of the plurality of monitoring targets, whether or not there is an anomaly related to the communication frame, the detection device performing at least one of a first time division monitoring that switches the monitoring targets in a time division manner and a second time division monitoring that switches a monitoring program for the monitoring targets in a time division manner.

[0024] Embodiments of the present disclosure can be realized by a device, a system, a method, an integrated circuit, a computer program, a non-transitory computer-readable recording medium, or any combination of them.

[0025] The recording medium can be either of a volatile and a non-volatile. The device can be composed of a plurality of devices independently. In the case of being composed of a plurality of devices independently, either of a structure in which they are arranged in one frame and a structure in which they are arranged separately in two or more frames can be adopted. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 is a network configuration diagram illustrating a structure example of an in-vehicle communication system.

[0027] Figure 2 is a block diagram illustrating a structure example of an IDS function.

[0028] Figure 3 is an explanatory diagram illustrating an example of first setting information.

[0029] Figure 4 is a diagram showing an example of second setting information.

[0030] Figure 5 is a diagram showing an example of third setting information.

[0031] Figure 6 is a diagram showing an example of fourth setting information.

[0032] Figure 7 is a diagram showing an example of fifth setting information.

[0033] Figure 8 is a diagram showing an example of sixth setting information.

[0034] Figure 9 is a network configuration diagram showing a modification example of the in-vehicle communication system.

[0035] Figure 10 is a block diagram showing a modification example of the IDS function. DETAILED DESCRIPTION

[0036] <Problem to be Solved by the Present Disclosure>

[0037] An in-vehicle communication system that detects illegal intrusion into a network by an electronic control unit (ECU) for an IDS (Intrusion Detection System) that takes a plurality of sub-networks as monitoring targets is considered. In this case, if IDS processing is performed simultaneously on all communication frames circulating in each monitoring target, the processing load of the ECU becomes too large, and it can be difficult to perform proper monitoring.

[0038] The present disclosure aims to provide a detection device that can properly monitor a plurality of monitoring targets, in view of such a conventional problem.

[0039] <Effects of the Present Disclosure>

[0040] According to the present disclosure, a plurality of monitoring targets can be properly monitored.

[0041] <Summary of Embodiments of the Present Disclosure>

[0042] Hereinafter, a summary of the embodiments of the present disclosure will be described.

[0043] (1) The detection device according to this embodiment detects illegal intrusion into a network. The detection device includes: an acquisition unit that acquires communication frames from a plurality of monitored objects; and a monitoring execution unit that monitors for any abnormality related to the communication frames for each of the plurality of monitored objects. The monitoring execution unit performs at least one of a first time-division monitoring that switches the monitored objects in a time-division manner and a second time-division monitoring that switches the monitoring program for the monitored objects in a time-division manner.

[0044] According to the detection apparatus of this embodiment, since the monitoring execution unit performs at least one of the first time-division monitoring and the second time-division monitoring, it is possible to appropriately monitor multiple monitoring objects while suppressing the processing load of the monitoring execution unit.

[0045] (2) In the detection device described in (1) above, the monitoring execution unit may perform the first time-division monitoring when there is no abnormality, and when the abnormality is detected by the first time-division monitoring, the monitoring execution unit may increase the execution frequency of the monitoring program for the monitored object that detected the abnormality, or execute the monitoring program separately.

[0046] In this case, since monitoring is enhanced after the anomaly is detected by the first time-division monitoring, the accuracy of monitoring can be improved compared to the case where only the first time-division monitoring is performed.

[0047] (3) In the detection device described in (1) or (2) above, the detection device may also include a bandwidth control unit, which equalizes the bandwidth of the communication frame acquired by the acquisition unit, and the monitoring execution unit performs equalization monitoring, which applies the monitoring program, which is determined to be used for the plurality of monitoring objects, to the communication frame after bandwidth equalization.

[0048] In this case, since the monitoring execution unit performs equalization monitoring, which applies monitoring programs for multiple monitoring objects to the bandwidth-equalized communication frames, it is possible to appropriately monitor multiple monitoring objects while suppressing the processing load of the monitoring execution unit.

[0049] (4) In the detection device described in (3) above, the monitoring execution unit may perform the equalization monitoring when there is no abnormality, and when the abnormality is detected by the equalization monitoring, the monitoring execution unit may de-equalize the bandwidth, increase the execution frequency of the monitoring program of the monitored object that detected the abnormality, or execute the monitoring program alone.

[0050] In this case, since the monitoring after the detection of the abnormality by the equalization monitoring is strengthened, the accuracy of the monitoring can be improved compared to the case where only the equalization monitoring is performed.

[0051] (5) In the detection device of any one of (1) to (4) above, the monitoring execution section can further switch the prescribed monitoring function as an opportunity of establishment of a prescribed trigger condition.

[0052] In this case, since the monitoring execution section switches the prescribed monitoring function, the accuracy of the monitoring can be further improved.

[0053] (6) In the detection device of (5) above, the trigger condition can be that the abnormality is detected by a usual monitoring function, the monitoring range of the monitoring function as a switching target is narrower than the usual monitoring function, and the detection accuracy of the abnormality is high.

[0054] In this case, since the monitoring function is higher than the usual function according to the establishment of the trigger condition, the accuracy of the monitoring can be improved.

[0055] (7) In the detection device of any one of (5) or (6) above, in a case where the network includes an internal network and an external network that are terminated in a gateway, the trigger condition can be that the abnormality is detected by a monitoring function applied to communication between the external network and the internal network, and the monitoring function as a switching target can be a monitoring function applied to the internal network.

[0056] In this case, since the monitoring function is shifted from the external network to the internal network according to the establishment of the trigger condition, an attack from the outside can be more effectively prevented compared to a case where the monitoring function is applied only to the external network.

[0057] (8) In the detection device of any one of (5) to (7) above, the trigger condition can be that an object event indicating a prescribed operation input by a user is detected, and the monitoring function as a switching target can be a monitoring function applied to the communication frame expected to increase due to the object event.

[0058] In this case, since the monitoring function is shifted to the communication frame expected to increase due to the object event according to the establishment of the trigger condition, appropriate monitoring that focuses on the object event can be performed.

[0059] (9) In the detection device of any one of (1) to (8) above, the detection device can be an ECU or a gateway mounted on a vehicle, and the plurality of monitoring objects can be a plurality of CAN buses connected to the gateway.

[0060] Thus, the plurality of CAN buses connected to the gateway can be appropriately monitored while suppressing the processing load of the monitoring execution section.

[0061] (10) In the detection device of (1) to (8) above, the detection device can be an ECU or a gateway mounted on a vehicle, and the plurality of monitoring targets can be a plurality of Ethernet communication networks connected to the gateway.

[0062] Thus, the plurality of Ethernet communication networks connected to the gateway can be appropriately monitored while suppressing the processing load of the monitoring execution section.

[0063] (11) The method according to the present embodiment is a detection method performed by the detection device of (1) to (10) above. Thus, the detection method according to the present embodiment has the same effects as the detection device of (1) to (10) above.

[0064] (12) The computer program according to the present embodiment is a computer program for causing a computer to function as the detection device of (1) to (10) above. Thus, the computer program according to the present embodiment has the same effects as the detection device of (1) to (10) above.

[0065] <Details of Embodiments of the Present Invention>

[0066] Details of embodiments of the present invention will be described below with reference to the drawings. Note that at least a part of the embodiments described below can be arbitrarily combined.

[0067] [Structure Example of In-Vehicle Communication System]

[0068] Figure 1 is a network structure diagram illustrating a structure example of an in-vehicle communication system 100.

[0069] As shown in Figure 1 , the in-vehicle communication system 100 according to the present embodiment is an in-vehicle LAN (Local Area Network) constructed inside a vehicle 1. The in-vehicle communication system 100 includes a gateway 10 as one type of in-vehicle relay device, an ECU 20 with IDS function as one type of illegal message detection device, and a plurality of ECUs 50 as communication nodes constituting a network.

[0070] The gateway 10 is, for example, a central gateway. Thus, the in-vehicle communication system 100 includes an internal network 120 terminated in the gateway 10 and an external network 130. The internal network 120 includes a plurality of sub-networks 110 connected to the gateway 10 in a tree shape.

[0071] Gateway 10 has the function of relaying communication between sub-networks 110 included in internal network 120, and the function of relaying communication between external network 130 and each sub-network 110.

[0072] Hereinafter, the communication between the communication nodes (ECU50) belonging to the internal network 120 and the communication between the communication node and the gateway 10 will be referred to as "internal communication".

[0073] In addition, the communication between the communication node (not shown) belonging to the external network 130 and the gateway 10 that is directly connected to the gateway 10 is referred to as "external communication".

[0074] Similarly, the communication protocol and communication frame used for internal communication are referred to as "internal protocol" and "internal frame," respectively.

[0075] In addition, the communication protocol and communication frame used for external communication are referred to as "external protocol" and "external frame", respectively.

[0076] For example, CAN (Control Area Network: registered trademark), CAN-FD (CAN with Flexible Data rate), LIN (Local Interconnect Network), or FlexRay (registered trademark) can be used as internal protocols.

[0077] In this embodiment, as an example, we assume that the internal protocol is "CAN". Hereinafter, communication following CAN will be referred to as "CAN communication", and communication frames following CAN will be referred to as "CAN frames".

[0078] Regarding the external protocol, the same protocol as described above can also be used. However, the external protocol can be different from or the same as the internal protocol. Alternatively, Ethernet (registered trademark) can be used as the external protocol to achieve higher transmission speeds.

[0079] For example, it can be used with Figure 1 Gateways of the same type as the gateway 10 (vehicle relay device), ECUs that control vehicle equipment, and TCUs (Telematics Control Units) used for mobile communication are communication nodes belonging to the external network 130.

[0080] ECU20 is an electronic control unit with IDS (Intrusion Detection System) functionality. In this embodiment, ECU20 monitors both the internal network 120 and the external network 130 to detect unauthorized access.

[0081] In a case where illegal access is detected, the ECU 20 notifies the result of the detection to a management server (not shown) of the vehicle 1 via a TCU or the like belonging to the external network 130. Note that details of the ECU 20 will be described later.

[0082] The ECU 50 is an electronic control unit that controls various in-vehicle devices such as sensors or actuators mounted on the vehicle 1.

[0083] The ECU 50 transmits a CAN frame including measurement information of a sensor (a speed sensor, an acceleration sensor, a temperature sensor, or the like) connected thereto to the CAN bus 60. In addition, the ECU 50 controls various actuators (electric motors, or the like) connected thereto on the basis of measurement information included in a CAN frame received from the CAN bus 60.

[0084] [Structure Example of Gateway]

[0085] As shown in FIG. 1, the gateway 10 includes a switch 11 and a protocol conversion section 12. In addition, the gateway 10 includes three kinds of communication ports Pi, Q, and R defined below. Figure 1 Communication port Pi: This is a port for CAN communication (for internal communication). Also referred to as "CAN port Pi". "i" is a port number, and is set to i = 1, 2,..., N.

[0086] Communication port Q: This is a port for transmitting a received frame of the protocol conversion section 12 to the ECU 20. Also referred to as "transmission port Q".

[0087] Communication port R: This is a communication port for external communication. Also referred to as "external port R".

[0088] The switch 11 is a switch device that relays communication including a first communication C11 and a second communication C12. Thus, each port of the switch 11 is electrically connected to a plurality of CAN ports Pi and a prescribed port of the protocol conversion section 12, respectively.

[0089] First communication C11: Communication between CAN buses 60

[0090] Second communication C12: Communication between the CAN bus 60 and the protocol conversion section 12

[0091] The switch 11, for example, holds a relay table in which a relay destination (transmission port) is specified for each value of a CAN ID. The switch 11 decides a transmission destination of a received CAN frame on the basis of a value of a CAN ID included in the received CAN frame and the relay table.

[0092]

[0093] ​The protocol conversion section 12 is a signal processing section that performs protocol conversion of communication frames, and performs, for example, the following processes RC1, RC2, RC3, RC4.

[0094] Process RC1: The CAN frame received from the switch 11 is converted into an external frame, and the converted external frame is sent out to the external port R.

[0095] Process RC2: The external frame received from the external port R is converted into a CAN frame, and the converted CAN frame is sent out to the switch 11.

[0096] Process RC3: The external frame received from the external port R is sent out to the transmission port Q.

[0097] Process RC4: The external frame received from the transmission port Q is sent out to the external port R.

[0098] At least one CAN bus 60 is connected to the CAN port Pi. The CAN bus 60 is a communication line composed of high and low lines.

[0099] At least one ECU 50 is connected to the CAN bus 60. If a plurality of ECUs 50 are connected to the CAN bus 60, the sub-network 110 becomes a bus-type network in which the plurality of ECUs 50 are lined up. The communication node connected to the CAN bus 60 can not only be the ECU 50, but also a sensor or an actuator that can perform CAN communication.

[0100] A plurality of ECUs 50 of the same or similar control system can be connected to each CAN bus 60 in a concentrated manner. In this case, the internal network 120 is divided into a plurality of sub-networks 110 that differ in the category of control system.

[0101] For example, a powertrain system, a chassis system, a body system, a driving assistance system (including automatic driving), and a multimedia system (including car navigation) can be employed as the category of control system of the sub-network 110.

[0102] The ECU 20 has two communication ports Si, T defined as follows.

[0103] The communication port Si is a port for listening to CAN communication (internal communication). It is also referred to as a "CAN port Si". The CAN bus 60 connected to the CAN port Pi of the gateway 10 is also connected to the CAN port Si of the ECU 20.

[0104] The communication port T is a communication port for external communication. It is also referred to as an "external port T". The external port T is connected to the transmission port Q through a communication cable for external communication.

[0105] Structure example of IDS function

[0106] Figure 2 is a block diagram showing a structure example of the IDS function. More specifically, Figure 2 is a block diagram showing an example of the internal structure of an ECU (hereinafter, also referred to as "detection device") 20 having the IDS function.

[0107] In Figure 2 , a solid arrow indicates a transmission direction of a communication frame within the detection device 20, and a dashed arrow indicates an input / output direction of a control signal generated within the detection device 20.

[0108] As shown in Figure 2 , the detection device 20 is provided with a transfer processing section 30 and an IDS processing section 40.

[0109] The transfer processing section 30 is constituted, for example, by an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), an ASSP (Application Specific Standard Product), or an integrated circuit selected from two or more of them.

[0110] The transfer processing section 30 is provided with a PHY (PHYsical layer) section 31, a limiter 32, a selector 33, and a bandwidth control section 34 as functional sections realized by the above-mentioned integrated circuit.

[0111] The PHY section 31 is a PHY device for CAN communication, and is provided in one-to-one correspondence with communication ports Si (i = 1, 2,..., N). The PHY section 31 decodes a differential signal input from the communication port Si into a digital signal and generates a CAN frame, and outputs the generated CAN frame to the limiter 32.

[0112] The limiter 32 is, for example, a bandwidth limiter of an input signal (CAN frame) from the PHY section 31, and is provided in one-to-one correspondence with the PHY section 31. Specifically, the limiter 32 limits the output bandwidth of the CAN frame to be below an upper limit bandwidth instructed by the bandwidth control section 34.

[0113] As a bandwidth limiting method of the limiter 32, a method of reducing the output cycle of a buffered CAN frame, and a method of outputting a category instructed by the bandwidth control section 34 among CAN frames allocated and buffered by categories, and the like can be adopted.

[0114] The selector 33 is, for example, an N-input 1 -output logic circuit. The input ports of the selector 33 are respectively connected to the output sides of the respective limiters 32, and the output signal of the selector 33 is supplied to an IDS execution section 46 to be described later.

[0115] The selector 33 is capable of switching the input signal from which of the N input ports to output, on the basis of a control signal from a bandwidth control section 34.

[0116] Note that, instead of the selector (e.g., multiplexer) 33 composed of a logic circuit, a selector 33 that decides the object on the basis of identification information such as a CAN ID can also be employed.

[0117] In addition, as in the modification to be described later, in the case where the monitoring object is an Ethernet frame, the object can also be selected on the basis of various identification information (destination address, transmission source address, connection, protocol, etc.) of the communication layer, and application-specific identification information.

[0118] The bandwidth control section 34 is a circuit that controls the operation of the limiters 32 and the selector 33.

[0119] The bandwidth control section 34 performs control of at least one of the upper limit bandwidth of each of the limiters 32, the switching order of the input ports of the selector 33, and the switching timing of the input ports, on the basis of a control signal CS2 from a function switching section 47 to be described later.

[0120] The bandwidth control section 34 can also perform bandwidth control on the basis of the above-mentioned identification information such as a CAN ID.

[0121] In this case, for example, a structure can be employed in which the selector 33 is provided with tables of several CAN IDs to be selected, and the function switching section 47 instructs the selector 33 which table to use via the bandwidth control section 34. Note that, in this case, for example, a circuit structure in which the limiters 32 are not provided can also be employed.

[0122] The IDS processing section 40 is composed of, for example, an integrated circuit including a central operation processing device (CPU), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like.

[0123] In addition to the CPU, the ROM, and the RAM, the IDS processing section 40 can also include an FPGA, a GPU, an ASIC, an ASSP, or a combination of integrated circuits selected from two or more of these.

[0124] The CPU expands the computer program stored in the ROM in the RAM, and implements the prescribed information processing in accordance with the computer program expanded in the RAM.

[0125] The ROM is, for example, a writable memory (e.g., a PROM), a rewritable memory (e.g., a flash memory), or a read-only dedicated memory.

[0126] The ROM stores a computer program that causes the CPU to execute prescribed information processing. The ROM is not limited to a single storage medium, but can be a collection of a plurality of storage media. A portion of the collection of the plurality of storage media can also be a detachable memory.

[0127] The RAM provides a job area that temporarily expands the computer program stored in the ROM at the time of startup. The RAM is not limited to a single storage medium, but can be a collection of a plurality of storage media.

[0128] The IDS processing section 40 has a PHY section 41, a first acquisition section 42, a second acquisition section 43, a first storage section 44, a second storage section 45, an IDS execution section 46, and a function switching section 47 as functional sections implemented by the above-mentioned integrated circuit.

[0129] The IDS execution section 46 of the present embodiment functions as a "monitoring execution section" that monitors, for each of a plurality of monitoring targets, the presence or absence of an abnormality related to a communication frame by a plurality of monitoring programs (specifically, a plurality of "IDS programs" that will be described below).

[0130] The first acquisition section 42 is an acquisition section of an internal frame (a CAN frame in the present embodiment).

[0131] Specifically, the input side of the first acquisition section 42 is connected with a branch line (refer to A section) that communicates with a communication line connected to the PHY section 31 and the limiter 32 in the communication transmission processing section 30.

[0132] Thus, the CAN frames input to the communication ports Si (i = 1, 2,..., N) are input to the first acquisition section 42, that is, the CAN frames being transmitted in all of the CAN buses 60 connected to the gateway 10.

[0133] The second acquisition section 43 is an acquisition section of an external frame.

[0134] Specifically, the second acquisition section 43 is connected to the PHY section 41 that is a PHY device for external communication, and the PHY section 41 is connected to the communication port T for external communication.

[0135] The PHY section 41 decodes the transmission signal input from the communication port T into a digital signal and outputs it to the second acquisition section 43. Note that the PHY section 41 modulates and sends the digital signal including the detection result output from the IDS execution section 46 to the communication port T.

[0136] The first storage section 44 is, for example, a ROM that stores a program that the IDS execution section 46 executes.

[0137] The program stored in the first storage section 44 includes a plurality of IDS programs. The plurality of IDS programs are programs that take at least one of the internal network 120 and the external network 130 as a monitoring object, and can employ, for example, a simple IDS, an IDS_A, an IDS_B, an IDS_C, and the like. The outlines of these programs are shown below.

[0138] Simple IDS: is a program for executing a simple IDS that has a small processing load, which can be executed simultaneously for all monitoring objects (for example, all CAN buses 60 in the connection).

[0139] For example, a method that determines a CAN bus 60 or a CAN frame in which the moving average of the communication load in a prescribed period exceeds a threshold as abnormal, and the like can be employed as the algorithm of the simple IDS.

[0140] IDS_A: Cycle abnormality monitoring

[0141] is a method that monitors the abnormality of the transmission cycle of a message (CAN frame).

[0142] Specifically, it is a method that judges as an attack in a case where the transmission interval of a message is different from usual. For example, the transmission cycle itself, the offset of the transmission cycle, and the cumulative sum of the transmission cycle, and the like can be employed as parameters of the monitored cycle.

[0143] IDS_B: Event abnormality monitoring

[0144] is a method that monitors the abnormality of the data content (event) of a message.

[0145] Specifically, it is a method that grasps the behavior of the message data of usual in advance, and judges as an attack if a message including data that performs a behavior different from usual is detected. Since it is monitoring based on the data content, it is suitable for monitoring of non-periodic messages.

[0146] IDS_C: Hybrid monitoring

[0147] is a method that performs both cycle abnormality monitoring and event abnormality monitoring in parallel.

[0148] Specifically, the following manner is adopted: with respect to the prescribed data, the periodicity and behavior of the data in normal times are grasped in advance, and if a message that differs from the grasped periodicity and behavior in normal times is detected, the message is judged to be an attack.

[0149] The IDS execution section 46 is, for example, an information processing device including a CPU and a RAM.

[0150] The IDS execution section 46 reads out the prescribed IDS program from the first storage section 44 and expands it in the RAM, and operates in accordance with the expanded IDS program.

[0151] The control signal CS1 of the function switching section 47 indicates which IDS program is to be expanded in the RAM. Note that, although the IDS execution section 46 and the function switching section 47 are drawn with different blocks in Figure 2 , both can be constituted by the same CPU.

[0152] The second storage section 45 is, for example, a ROM that stores a switching program 48 executed by the function switching section 47, and setting information 49 that defines the switching contents of the IDS.

[0153] The setting information 49 is, for example, constituted by table-form data that includes the contents of the condition for switching the IDS (hereinafter, referred to as "trigger condition"), and the contents of the IDS executed in the case where the trigger condition is established. For example, the first setting information 49A to the sixth setting information 49F (refer to Figures 3 to 8 ) to be described below, or the like, can be adopted as the setting information 49.

[0154] The function switching section 47 is, for example, an information processing device including a CPU and a RAM.

[0155] The function switching section 47 reads out the switching program 48 and the setting information 49 from the second storage section 45 and expands them in the RAM, and operates in accordance with the expanded switching program 48.

[0156] Specifically, the function switching section 47 generates the following two kinds of control signals CS1, CS2 corresponding to the contents of the IDS defined by the setting information 49, based on the input information from the first acquisition section 42 and the second acquisition section 43. The function switching section 47 outputs the generated control signals CS1, CS2 to the IDS execution section 46 and the bandwidth control section 34, respectively.

[0157] The control signal CS1: is a control signal for the IDS execution section 46. The control signal CS1 includes the category of the IDS program executed by the IDS execution section 46, and the like.

[0158] Control signal CS2: is a control signal for the bandwidth control section 34. The control signal CS2 includes the control contents (upper limit bandwidth of the limiter 32, switching timing of the selector 33, and the like) that the limiter 32 and the selector 33 execute.

[0159] 〔Example of first setting information〕

[0160] Figure 3 is a diagram showing an example of the first setting information 49A.

[0161] As Figure 3 indicated, the first setting information 49A includes "vehicle state" and "monitoring situation" as trigger conditions.

[0162] For example, although the "vehicle state" can be obtained from the CAN frame acquired by the first acquisition section 42, it can be acquired not only from the information of the CAN frame from the internal network (buses A, B, and C) but also from the state information inside the ECU and the external network.

[0163] For example, the information such as the safety function and the sensor information can be acquired from the internal network. In addition, the driving mode (manual / automatic driving) can be acquired from the external network. Here, the "vehicle state" is set to, for example, manual driving, automatic driving, or low-power consumption mode.

[0164] The "monitoring situation" indicates the detection situation of the abnormality in all the monitoring objects, and by default, it means the usual time when no abnormality is assumed.

[0165] The "monitoring situation" can be acquired not only from the state of the monitoring object (buses A, B, and C) in the IDS processing section but also from the HIDS, the sensor, and the external network. That is, as long as it is information that can specify the monitoring object that the IDS processing section needs to monitor, the information from where it comes from is not a problem.

[0166] In the first setting information 49A, the monitoring object of the IDS_A is set to one of the CAN buses 60 connected to the gateway 10 (hereinafter, referred to as "bus A").

[0167] Similarly, the monitoring object of the IDS_B is set to the other of the CAN buses 60 connected to the gateway 10 (hereinafter, referred to as "bus B"), and the monitoring object of the IDS_C is set to the other of the CAN buses 60 connected to the gateway 10 (hereinafter, referred to as "bus C").

[0168] As Figure 3 indicated, in the case where the monitoring situation is the default (usual time), the IDS execution section 46 executes the simple IDS regardless of which one of the bus A, the bus B, and the bus C is the monitoring object.

[0169] Further, the bandwidth control section 34 switches the monitoring target in a time-division manner in the order of bus A, bus B, bus C, bus A,... for example, on the occasion of a prescribed time (for example, two minutes) elapsing.

[0170] Thus, it is possible to comprehensively monitor all monitoring targets while suppressing the processing load of the IDS execution section 46. Note that the switching order of the monitoring target is arbitrary, and can be an order other than the above or random.

[0171] Next, in the process of monitoring the load of each of the buses A, B, C acquired by the first acquisition section 42, if, for example, a rise in the load in bus A is detected, the IDS execution section 46 executes, for example, only the IDS_A (period abnormality monitoring) for bus A. The bandwidth control section 34 switches the monitoring target to only bus A, sets the upper limit bandwidth of bus A to the maximum, and transmits the CAN frame.

[0172] Thus, if a slight abnormality is detected by the simple IDS, the resources for information processing are concentrated for the monitoring target, that is, bus A, in which the abnormality occurred, and the IDS_A dedicated for bus A is executed intensively.

[0173] The following aspects can be employed as an implementation aspect of intensive execution of a prescribed IDS function.

[0174] Aspect 1: Only a prescribed IDS function is executed (separate execution)

[0175] Aspect 2: The execution frequency of a prescribed IDS function is increased compared to other IDS functions (frequency increase)

[0176] Thus, in the present embodiment, "intensive execution" means either of the above Aspect 1 and Aspect 2.

[0177] Similarly, if a rise in the load in bus B is detected, the IDS execution section 46 executes the IDS_B (event abnormality monitoring) for bus B, and the bandwidth control section 34 switches the monitoring target to only bus B, sets the upper limit bandwidth of bus B to the maximum, and transmits the CAN frame.

[0178] Further, if a rise in the load in bus C is detected, the IDS execution section 46 executes the IDS_C (mixed monitoring) for bus C, and the bandwidth control section 34 switches the monitoring target to only bus C, sets the upper limit bandwidth of bus C to the maximum, and transmits the CAN frame.

[0179] In Figure 3In the default (normal) time-division monitoring, the monitoring target (bus) can not be switched, and the monitoring program can be switched in a time-division manner. Alternatively, both the monitoring target (bus) and the monitoring program can be switched in a time-division manner. That is, the following two types of time-division monitoring are included in the "time-division monitoring" of the present embodiment.

[0180] First time-division monitoring: monitoring in which the monitoring target is switched in a time-division manner

[0181] Second time-division monitoring: monitoring in which the monitoring program for the monitoring target is switched in a time-division manner

[0182] [Example of second setting information]

[0183] Figure 4 is a diagram illustrating an example of the second setting information 49B.

[0184] As shown in Figure 4 , the second setting information 49B includes "vehicle state" and "monitoring situation" as trigger conditions.

[0185] For example, although the "vehicle state" can be obtained from the CAN frame acquired by the first acquisition unit 42, it can be acquired not only from the information of the CAN frame from the internal network (buses A, B, and C) but also from the state information inside the ECU and the external network.

[0186] For example, the information such as the safety function and the sensor information can be acquired from the internal network. In addition, the driving mode (manual / automatic driving) can be acquired from the external network. Here, the "vehicle state" is set to, for example, manual driving, automatic driving, or low-power consumption mode.

[0187] The "monitoring situation" indicates the detection situation of the abnormality in all the monitoring targets, and the default means normal time.

[0188] The "monitoring situation" can be acquired not only from the state of the monitoring target (bus A, B, and C) in the IDS processing unit but also from the HIDS, the sensor, and the external network. That is, as long as it is information that can specify the monitoring target that the IDS processing unit needs to monitor, the information from where it comes does not matter.

[0189] In the second setting information 49B, the monitoring target of the IDS_A is set to the bus A, the monitoring target of the IDS_B is set to the bus B, and the monitoring target of the IDS_C is set to the bus C.

[0190] As shown in Figure 4 , in the case where the monitoring situation is default (normal time), the IDS execution unit 46 executes the simple IDS regardless of which one of the bus A, the bus B, and the bus C is the monitoring target.

[0191] In addition, the bandwidth control section 34 equalizes the upper limit bandwidths of all of the buses A, B, and C to be normally 1 / 3 (equalization monitoring). Thus, it is possible to comprehensively monitor all of the monitoring targets while suppressing the processing load of the IDS execution section 46. Note that the upper limit bandwidth is not uniformly limited for all of the monitoring targets, but can also differ depending on the monitoring target.

[0192] Next, for example, if an increase in load in the bus A is detected, the IDS execution section 46 executes the IDS_A (periodic abnormality monitoring) for the bus A, and the bandwidth control section 34 switches the monitoring target to only the bus A, sets the upper limit bandwidth of the bus A to be the maximum, and transmits the CAN frame.

[0193] Thus, if a slight abnormality is detected by the simple IDS, the resources for information processing are concentrated for the monitoring target in which the abnormality has occurred, that is, the bus A, and the bus A-specific IDS_A is executed in concentration.

[0194] Similarly, if an increase in load in the bus B is detected, the IDS execution section 46 executes the IDS_B (event abnormality monitoring) for the bus B, and the bandwidth control section 34 switches the monitoring target to only the bus B, sets the upper limit bandwidth of the bus B to be the maximum, and transmits the CAN frame.

[0195] In addition, if an increase in load in the bus C is detected, the IDS execution section 46 executes the IDS_C (hybrid monitoring) for the bus C, and the bandwidth control section 34 switches the monitoring target to only the bus C, sets the upper limit bandwidth of the bus C to be the maximum, and transmits the CAN frame.

[0196] [Example of Third Setting Information]

[0197] Figure 5 is a diagram illustrating an example of the third setting information 49C.

[0198] As shown in Figure 5 , the third setting information 49C includes "vehicle state" and "monitoring situation" as trigger conditions.

[0199] For example, although the "vehicle state" can be obtained from the CAN frame acquired by the first acquisition section 42, it can be acquired not only from the information of the CAN frame from the internal network (buses A, B, and C), but also from the state information inside the ECU and the external network.

[0200] For example, it is possible to acquire information such as safety function and sensor information from the internal network. In addition, it is possible to acquire the driving mode (manual / automatic driving) from the external network. Here, the "vehicle state" is set to be in engine operation (IG on), for example.

[0201] "Monitoring Status" indicates the detection status of anomalies among all monitored objects, and the default value is considered to be normal and without anomalies.

[0202] The "monitoring status" can be obtained not only from the status of the monitored objects (buses A, B, and C) in the IDS processing unit, but also from HIDS, sensors, and external networks. In other words, information from any source is acceptable as long as it clearly identifies the monitored objects that the IDS processing unit needs to monitor.

[0203] exist Figure 5 In the example, based on the control signal CS2 from the function switching unit 47, the bandwidth control unit 34 instructs the selector 33 to select either the CANID or the table, and the selector 33 outputs the CAN frame of the indicated CANID (table). Additionally, time-division monitoring or equalization monitoring is performed normally.

[0204] In the third setting information 49C, the default (normal) monitoring objects are divided into CANID units instead of CAN bus 60 units. For example, it is set to perform simple IDS on all CANIDs.

[0205] That is, when the monitoring status is in the default (normal) state, the IDS execution unit 46 performs simplified IDS on all CAN frames through time-division monitoring or equalization monitoring.

[0206] Under the aforementioned monitoring conditions, if an anomaly is detected in the CAN frame of a specific CANID (hereinafter referred to as "specific ID") in the CAN frame acquired by the first acquisition unit 42, the function switching unit 47 outputs control signals CS1 and CS2 to the IDS execution unit 46 and the bandwidth control unit 34 respectively, and performs a higher-function IDS for that specific ID.

[0207] Therefore, if a minor anomaly is detected by a simplified IDS, a higher-function IDS will be executed centrally for the detected IDS that caused the anomaly.

[0208] It should be noted that if an anomaly is detected in a CAN frame with a specific ID, the default simple IDS will stop. Additionally, a high-function IDS can be either signature-based or anomaly-based.

[0209] [Example of the fourth setting information]

[0210] Figure 6 This is an explanatory diagram showing an example of the fourth setting information 49D.

[0211] like Figure 6 As shown, the fourth setting information 49D includes "vehicle status" and "monitoring status" as trigger conditions.

[0212] For example, although it is possible to obtain "vehicle state" from the CAN frame acquired by the first acquisition section 42, it is possible to acquire not only from the information of the CAN frame from the internal network (buses A, B, C) but also from the state information inside the ECU, the external network, and the sensor.

[0213] For example, it is possible to acquire information such as security function and sensor information from the internal network. In addition, it is possible to acquire driving mode (manual / automatic driving) from the external network. Here, "vehicle state" is set to, for example, engine operation (IG on).

[0214] "Monitoring situation" indicates the state at the current time point among all monitoring objects, and by default, it indicates the usual time when no abnormality is assumed.

[0215] "Monitoring situation" is also possible to acquire not only from the state of the monitoring object (buses A, B, C) in the IDS processing section but also from the HIDS, the sensor, and the external network. That is, as long as it is possible to acquire information of the monitoring object that the IDS processing section needs to monitor, it is possible to acquire from where. Note that in the case of Figure 6 "Monitoring situation" is also possible to acquire not only from the state of the monitoring object (buses A, B, C) in the IDS processing section but also from the HIDS, the sensor, and the external network. That is, as long as it is possible to acquire information of the monitoring object that the IDS processing section needs to monitor, it is possible to acquire from where. Note that in the case of

[0216] In the example of Figure 6 , also according to the control signal CS2 of the function switching section 47, the bandwidth control section 34 instructs the selector 33 to select the CANID or table to be selected, and the selector 33 outputs the CAN frame of the instructed CANID (table). In addition, in the usual time, time division monitoring or equalization monitoring is performed.

[0217] In the fourth setting information 49D, in the case where the monitoring situation is default (usual time) and the monitoring object is not the CAN frame but the external frame, it is set to, for example, that the prescribed NIDS1 is being executed against the external network 130.

[0218] That is, in the case where the monitoring situation is default (usual time), the IDS execution section 46 monitors the attack action 1 from the outside of the gateway 10 by the NIDS1.

[0219] In the above monitoring situation, if an abnormality is detected by the NIDS1, the IDS execution section 46 selects, for example, the frame of a specific bus that flows in from the communication of the external network 130. In addition, the IDS execution section 46 switches the IDS executed to the NIDS2 for the internal network 120, and monitors the attack action 2 against the internal network 120.

[0220] In the above monitoring situation, if an abnormality is detected by the NIDS2, the IDS execution section 46 notifies the gateway 10 of the request for activation of the HIDS of the ECU 50, and prepares for the attack action 3 against the ECU 50.

[0221] Specifically, the IDS execution section 46 notifies the gateway 10 of the CAN ID of the communication frame in which an anomaly is detected by the NIDS 2. The gateway 10 that receives the notification instructs the ECU 50 of the notified CAN ID to start the HIDS.

[0222] Thus, if the fourth setting information 49D is adopted, the monitoring target is changed in the order of the external network 130, the internal network 120, and the ECU 50, and thus it is possible to appropriately cope with an attack from the outside while suppressing the processing load as much as possible.

[0223] [Example of fifth setting information]

[0224] Figure 7 is a diagram illustrating an example of the fifth setting information 49E.

[0225] As shown in Figure 7 , the fifth setting information 49E includes "vehicle state" and "target event" as trigger conditions.

[0226] Although it is possible to obtain the "vehicle state" from the CAN frame acquired by the first acquisition section 42, for example, it is possible to acquire it not only from the information of the CAN frame from the internal network (buses A, B, and C) but also from the state information inside the ECU and the external network.

[0227] For example, it is possible to acquire information such as safety function and sensor information from the internal network. In addition, it is possible to acquire a driving mode (manual / automatic driving) from the external network. Here, the "vehicle state" is set to be in engine operation (IG on), for example.

[0228] The "target event" indicates an event related to a prescribed operation input by a user (driver in the case of a vehicle), a change in vehicle state, or a change in monitoring situation, and by default, it refers to a normal time when there is no such target event.

[0229] In addition to the illustrated pedal operation, the target event can also correspond to notification of an abnormal state based on safety function and sensor information, a change in operation mode, and the like. The switching of the operation mode can correspond to, for example, a sleep or low-power consumption mode switch, an IG on or off, an OTA / OBD installation, and the like.

[0230] In the example of Figure 7 , the bandwidth control section 34 also instructs the selector 33 to select the CAN ID or table that should be selected according to the control signal CS2 of the function switching section 47, and the selector 33 outputs the CAN frame of the instructed CAN ID (table). In addition, the time division monitoring or the equalization monitoring is performed in the normal time.

[0231] In the fifth setting information 49E, the object event is set to the operation of the accelerator pedal and the brake pedal, and in the case where the object event is the default (normal time), it is set not to execute the IDS or to execute the minimum IDS.

[0232] That is, in the case where the object event is the default (normal time), the IDS execution section 46 does not execute the IDS or executes the simple IDS or the like.

[0233] In the above monitoring condition, for example, if the object event of the accelerator pedal operation is detected from the CAN frame acquired by the first acquisition section 42, the communication traffic of the acceleration control system is changed to be the monitoring object. Specifically, the IDS execution section 46 executes the IDS on the CAN frame including the CAN ID of the acceleration control system.

[0234] In the above monitoring condition, for example, if the object event of the brake pedal operation is detected from the CAN frame acquired by the first acquisition section 42, the communication traffic of the brake control system is changed to be the monitoring object. Specifically, the IDS execution section 46 executes the IDS on the CAN frame including the CAN ID of the brake control system.

[0235] [Example of sixth setting information]

[0236] Figure 8 is a explanatory diagram showing an example of the sixth setting information 49F.

[0237] As shown in Figure 8 , the sixth setting information 49F includes "vehicle state" and "object event" as trigger conditions.

[0238] For example, although the "vehicle state" can be obtained from the CAN frame acquired by the first acquisition section 42, it can be acquired not only from the information of the CAN frame from the internal network (buses A, B, C) but also from the state information inside the ECU or the external network.

[0239] For example, the information such as the safety function and the sensor information can be acquired from the internal network. In addition, the driving mode (manual / automatic driving) can be acquired from the external network. Here, it is premised that the "vehicle state" is in the engine stop (IG off) or the engine operation (IG on).

[0240] The meaning of the "object event" is as described above, and the default means the normal time without the object event.

[0241] In the example of Figure 8 , also according to the control signal CS2 of the function switching section 47, the bandwidth control section 34 instructs the selector 33 to select the CAN ID or the table to be selected, and the selector 33 outputs the CAN frame of the instructed CAN ID (table). In addition, the time division monitoring or the equalization monitoring is executed in the normal time.

[0242] In the sixth setting information 49F, in a case where the object event in the engine stop (IG off) is the default (normal time), it is set that the IDS execution section 46 does not execute the IDS, or executes the minimum IDS such as the simple IDS.

[0243] In the above monitoring state, if the object event of the IG on is detected from the CAN frame acquired by the first acquisition section 42, the IDS execution section 46 executes the monitoring of the infotainment system.

[0244] Further, if the object event of the signal recognition of the remote key or the sensor detection is detected from the CAN frame acquired by the first acquisition section 42, the IDS execution section 46 monitors the wireless communication utilized for the authentication of the remote key.

[0245] In the above monitoring state, if the object event of the abnormal detection based on the other safety function is detected from the CAN frame acquired by the first acquisition section 42, the IDS execution section 46 activates all of the IDS functions associated with the other safety function.

[0246] Further, if the object event of the start of the OTA (Over The Air) occurs from the CAN frame acquired by the first acquisition section 42, the IDS execution section 46 monitors the communication associated with the program update. If the object event of the installation of the on-board diagnostic device (OBD) occurs from the CAN frame acquired by the first acquisition section 42, the IDS execution section 46 monitors the diagnostic function and the communication from the communication port for diagnosis.

[0247] In the sixth setting information 49F, in a case where the object event in the engine operation (IG on) is the default (normal time), the IDS execution section 46 executes the monitoring of the infotainment system.

[0248] Then, if the object event of the IG off occurs, the IDS is not executed, or the minimum IDS such as the simple IDS is executed.

[0249] In the above monitoring state, if the object event of the start of the travel of the vehicle 1 occurs, the IDS execution section 46 executes the monitoring of the infotainment system and the monitoring of the control data of the vehicle 1.

[0250] In the above monitoring state, if the object event of the abnormal detection based on the other safety function occurs, the IDS execution section 46 continues the monitoring of the infotainment system, and activates all of the IDS functions associated with the other safety function. Further, if the object event of the start of the OTA or the installation of the on-board diagnostic device occurs, the IDS execution section 46 activates all of the IDS.

[0251] [First Modified Example]

[0252] Figure 9 Fig. 9 is a network configuration diagram showing a modification of the in-vehicle communication system 100.

[0253] Figure 9 The modification of the in-vehicle communication system 100 differs from the configuration example of the in-vehicle communication system 100 shown in Fig. 1 in the following points. Figure 1 Point A1: The internal network 120 complies with Ethernet.

[0254] Point A2: The switch 11 of the gateway 10 is an Ethernet switch.

[0255] Point A3: The sub-network 110 connected to the gateway 10 is composed of an Ethernet switch 60E and an ECU 50E connected to the Ethernet switch 60E and performing Ethernet communication.

[0256] Point A4: The communication port Si of the ECU 20 is connected to the mirror port M of the Ethernet switch 60E.

[0257] As shown in the modification (first modification) of the in-vehicle communication system 100 (Fig. 9), the sub-network 110 of the monitoring target can also be a network of Ethernet communication.

[0258] Figure 9 [Second Modification]

[0259] Fig. 10 is a block diagram showing a modification of the IDS function.

[0260] Figure 10 The modification of the IDS function differs from the configuration example of the IDS function shown in Fig. 5 in the following points.

[0261] Figure 10 Point B1: The transfer processing section 30 is mounted on the gateway 10 instead of the ECU 20. Figure 2 Point B2: The monitoring section 35 that monitors the communication state, the type of the communication frame, and the like of each communication port Pi is provided in the transfer processing section 30.

[0262] Point B3: The mirror port M of each PHY section 31 and the Ethernet switch 11 is connected to the monitoring section 35. The monitoring result of the monitoring section 35 is input to the first acquisition section 42.

[0263] As shown in the modification (second modification) of the IDS function (Fig. 10), the transfer processing section 30 can also be mounted on the gateway 10.

[0264] Note that in the modification of the IDS function (Fig. 10), the IDS function can be realized by the transfer processing section 30 mounted on the gateway 10.

[0265] Figure 10 Note that in the modification of the IDS function (Fig. 10), the IDS function can be realized by the transfer processing section 30 mounted on the gateway 10.

[0266] Note that in the modification of the IDS function (Fig. 10), the IDS function can be realized by the transfer processing section 30 mounted on the gateway 10. Figure 10 ​​In a modification (second modification) of the above-described embodiment, a CAN bus is connected to the communication port Pi in the case where the gateway 10 is used for CAN communication, and an Ethernet cable is connected to the communication port Pi in the case where the gateway 10 is used for Ethernet communication.

[0267] In Figure 10 In the second modification of the above-described embodiment, the IDS processing section 40 can also be a processing section that executes a program in a cloud server (omitted from the drawing) rather than the ECU 20.

[0268] In this case, a communication processing section that relays communication between the cloud server (IDS processing section 40) and the gateway 10 (transmission processing section 30) can be provided in place of the IDS processing section 40 in the ECU 20.

[0269] 〔Other Modifications〕

[0270] The embodiments disclosed this time are illustrative in all aspects and are not limited to the embodiments described above. The scope of the invention is not limited to the above-described embodiments but includes all modifications within the scope of the structure equivalent to the recited structure of the claims.

[0271] For example, in the above-described embodiment, the ECU (detection device) 20 can also be a device that is integrated with the gateway 10 by being housed in the frame of the gateway 10. In this case, the communication port Pi and the communication port Si can be made common.

[0272] In the above-described embodiment, the monitoring target of the detection device 20 is not limited to the in-vehicle LAN.

[0273] For example, the monitoring target of the detection device 20 can also be a monitoring network that has a plurality of monitoring cameras as communication nodes, an in-factory LAN that has a plurality of manufacturing machines as communication nodes, or an in-company LAN that constructs a sub-network on a plurality of floors, or the like.

[0274] Explanation of Reference Signs

[0275] 1 vehicle; 10 gateway (detection device); 11 switch; 12 protocol conversion section; 20 IDS-use ECU (detection device); 30 transmission processing section; 31 PHY section; 32 limiter; 33 selector; 34 bandwidth control section; 40 IDS processing section; 41 PHY section; 42 first acquisition section (acquisition section); 43 second acquisition section (acquisition section); 44 first storage section; 45 second storage section; 46 IDS execution section (monitoring execution section); 47 function switching section; 48 computer program; 49 setting information; 49A first setting information; 49B second setting information; 49C third setting information; 49D fourth setting information; 49E fifth setting information; 49F sixth setting information; 50 ECU; 60 CAN bus; 100 in-vehicle communication system; 110 sub-network; 120 internal network; 130 external network; Pi CAN port (communication port); Q transmission port (communication port); R external port (communication port); Si CAN port (communication port); T external port (communication port).

Claims

1. A detection device that detects an illegal intrusion against a network, the detection device comprising: an acquisition section that acquires a communication frame from a plurality of monitoring targets; and a monitoring execution section that monitors, for each of the plurality of monitoring targets, whether or not there is an anomaly related to the communication frame, wherein the monitoring execution section executes at least one of a first time division monitoring that switches the monitoring targets in a time division manner, and a second time division monitoring that switches a monitoring program for the monitoring targets in a time division manner.

2. The detection device according to claim 1, wherein the monitoring execution section executes the first time division monitoring in ordinary times in which the anomaly is not present, and in a case where the anomaly is detected by the first time division monitoring, the monitoring execution section increases a frequency of execution of the monitoring program for the monitoring target in which the anomaly is detected, or executes the monitoring program alone.

3. The detection device according to claim 1, wherein the detection device further comprises a bandwidth control section that equalizes a bandwidth of the communication frame acquired by the acquisition section, and the monitoring execution section executes equalization monitoring that applies a monitoring program determined for each of the plurality of monitoring targets to the communication frame after the equalization of the bandwidth.

4. The detection device according to claim 3, wherein the monitoring execution section executes the equalization monitoring in ordinary times in which the anomaly is not present, and in a case where the anomaly is detected by the equalization monitoring, the monitoring execution section releases the equalization of the bandwidth, increases a frequency of execution of the monitoring program for the monitoring target in which the anomaly is detected, or executes the monitoring program alone.

5. The detection device according to any one of claims 1 to 4, wherein the monitoring execution section further switches a prescribed monitoring function as an opportunity of a prescribed trigger condition being satisfied.

6. The detection device according to claim 5, wherein the trigger condition is detection of the anomaly by an ordinary monitoring function, the monitoring range of the monitoring function that is a switching target is narrower than that of the ordinary monitoring function, and the detection accuracy of the anomaly is higher.

7. The detection device according to claim 5, wherein the network includes an internal network and an external network that are terminated in a gateway, the trigger condition is detection of the anomaly by a monitoring function applied to communication between the external network and the internal network, and the monitoring function that is a switching target is a monitoring function applied to the internal network.

8. The detection device according to claim 5, wherein the trigger condition is detection of an object event that indicates a prescribed operation input by a user, and the monitoring function that is a switching target is a monitoring function applied to the communication frame expected to increase due to the object event.

9. The detection device according to any one of claims 1 to 4, wherein the detection device is an ECU or a gateway mounted on a vehicle, and the plurality of monitoring targets are a plurality of CAN buses connected to the gateway.

10. The detection device according to any one of claims 1 to 4, wherein ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The detection device is an ECU or a gateway mounted on a vehicle, The plurality of monitoring targets are a plurality of Ethernet communication networks connected to the gateway.

11. A detection method performed by a device that detects illegal intrusion into a network, the detection method comprising: a first step of acquiring a communication frame from a plurality of monitoring targets; and a second step of monitoring, for each of the plurality of monitoring targets, the presence or absence of an abnormality related to the communication frame, The second step includes performing at least one of first time division monitoring that switches the monitoring targets in a time division manner, and second time division monitoring that switches a monitoring program for the monitoring targets in a time division manner.

12. A computer program for causing a computer to function as a device that detects illegal intrusion into a network, The computer program causes the computer to function as an acquisition unit and a monitoring execution unit, The acquisition unit acquires a communication frame from a plurality of monitoring targets, The monitoring execution unit monitors, for each of the plurality of monitoring targets, the presence or absence of an abnormality related to the communication frame, The monitoring execution unit performs at least one of first time division monitoring that switches the monitoring targets in a time division manner, and second time division monitoring that switches a monitoring program for the monitoring targets in a time division manner.

Images