Device and method for detecting an attack in a network

Abstract

Attack detection device, comprising: a transceiver configured to receive a message from a communication device in a network; and a computer configured to calculate, based on the reception time of an initial message in periodic messages that are periodically sent in a specified transmission cycle on the network, a reception range for a destination message in the periodic messages received by the transceiver after the initial message, wherein If the transceiver receives a second message associated with information indicating that the second message will be sent outside the receive range in a shorter time interval than the transmit cycle after the first message has been received, the computer updates the receive range for a target message in the periodic messages received by the transceiver after the second message, based on the receive time of the second message and the transmit cycle.

Description

AREA

[0001] The present invention relates to a device, a method and a program for detecting an attack in a network. BACKGROUND

[0002] A network technology called CAN (controller area network) can be used to send and receive data or control information between devices used in a vehicle's onboard network or for factory automation. A system using CAN includes multiple ECUs (electronic control units). The ECUs communicate with each other by sending a data frame (message). In CAN, a data frame used for communication contains identification information (ID) used to identify the data frame. Each ECU also stores the ID of the data frame it is to receive. In CAN, a data frame is broadcast, so that multiple data frames arrive simultaneously at the ECUs connected to the CAN network.If the transmission timings of multiple data frames are the same, the priority of a data frame is determined by the value of an ID contained within that data frame, and a data frame with priority is transmitted first. A data frame with low priority is broadcast after the data frame with high priority has been transmitted. When data frames are broadcast, each ECU receives a data frame containing an ID that it is configured to receive, but discards any data frame containing an ID that it is not configured to receive.

[0003] Based on this scheme, if an attack has been carried out on a network using a data frame containing an ID that has been configured to be received by an ECU, the ECU will receive the frame used for the attack. The ECU receiving the frame used for an attack may take an action that it would not normally take, simply because of the frame received. Therefore, attempts have been made to identify a frame sent for an attack. For example, a method for deciding whether a data frame has been sent for an attack has been proposed, which involves verifying, when a data frame is received that does not conform to a specified rule for a data frame transmission cycle, a specific identifier within the data frame (for example, International Publication Pamphlet No. WO2015 / 170451).

[0004] However, identifying a frame used for an attack in a system where both periodically and non-periodically transmitted data frames are sent can be difficult. In the technology described above, if a certain message is sent outside of a specified transmission cycle, and a message is then periodically transmitted within the specified transmission cycle using the transmission time of the non-periodically transmitted message as a reference, the periodically transmitted message may be erroneously identified as a frame used for an attack. One objective of the present invention is to improve the accuracy of attack detection in a network.

[0005] Furthermore, DE 10 2004 040 229 A1 discloses a method for carrying out secure data communication, in particular a method for carrying out secure data communication between participants of a non-time-synchronized data bus, which essentially access the data bus cyclically within bus access intervals requested by the respective participant, in which the time interval of a bus access interval to be requested by a participant to the previous bus access interval of the same participant is adjusted relative to a fixed participant cycle time depending on the position of the previous bus access interval of the participant in a reference time interval, which is limited by the bus access interval of another participant immediately preceding the previous bus access interval of the participant and the bus access interval of another participant immediately following the previous bus access interval of the participant.

[0006] Furthermore, a method for detecting fraudulent frames transmitted via an onboard network system is known from US 2016 / 0205194. SUMMARY

[0007] According to one aspect of the invention, an attack detection device comprises: a transceiver configured to receive a message from a communication device in a network; and a computer configured to calculate, based on the reception time of a first message in periodic messages that are periodically sent in a specified transmission cycle in the network, a reception range for a target message in the periodic messages received by the transceiver after the first message.If the transceiver receives a second message associated with information indicating that the second message will be sent outside the receive range in a shorter time interval than the transmit cycle after the first message has been received, the computer updates the receive range for a target message in the periodic messages received by the transceiver after the second message, based on the second message's receive time and the transmit cycle. BRIEF DESCRIPTION OF DRAWINGS Fig. Figure 1 illustrates an example of an attack detection method; Fig. Figure 2 illustrates an example of an attack detection device; Fig. 3 illustrates an example of a transmitting device; Fig. 4 illustrates an example of a hardware configuration; Fig.5 illustrates an example of a network configuration and operation; Fig. Figure 6 illustrates examples of frame formats; Fig. Figure 7 illustrates an example of information held by the transmitting device; Fig. Figure 8 is a flowchart illustrating an example of a transmission processing operation; Fig. Figure 9 illustrates an example of information held by an attack detection device; Fig. Figure 10 illustrates an example of an attack detection method according to a first embodiment; Fig. Figure 11 is a flowchart illustrating an example of processing performed in the attack detection device; Fig. Figure 12 illustrates a problem that occurs when a margin is not adequate; Fig. Figure 13 illustrates another example of the attack detection device; Fig. Figure 14 illustrates an example of an attack detection method according to a second embodiment; Fig. Figure 15 illustrates an example of information held by the attack detection device; Fig. Figure 16 illustrates an example of an attack detection method according to the second embodiment; Fig. Figure 17 is a flowchart illustrating an example of processing carried out in the attack detection device according to the second embodiment; and Fig. Figure 18 is a flowchart illustrating another example of the processing carried out in the attack detection device according to the second embodiment. DESCRIPTION OF EXECUTION FORMS

[0008] Fig. Figure 1 illustrates an example of an attack detection method according to the embodiments. Fig.1 represents a black triangle (▲) representing a time at which an attack detection device receives a data frame (a periodic message) that is transmitted periodically, and a white triangle (Δ) represents a time at which the attack detection device receives a data frame (an aperiodic message) that is transmitted independently of the transmission cycle. In case C1, aperiodic messages M2 and M3 are transmitted between periodic messages M1 and M4, and then periodic messages M5 and M6 are transmitted. In this case, the transmission time of message M1 remains a reference for a transmission cycle. On the other hand, in case C2, an aperiodic message M13 is transmitted after the periodic messages M11 and M12, and then periodic messages M14 and M15 are transmitted, with the transmission time of message M13 being used as a reference for a transmission cycle.

[0009] In the method according to the embodiments, a communication device (a transmitting device) that sends a data frame performs processing that causes the attack detection device to know whether a message to be sent has been transmitted when a time period shorter than a transmission cycle has elapsed since the transmission time of the most recent previous message. This processing is performed regardless of whether a message is sent periodically or aperiodically. For example, the transmitting device may include a flag (a short-interval flag) in a frame to be sent, which is used to decide whether the transmitted frame is a message sent at a time interval shorter than a transmission cycle. Fig.1. It is assumed that “short interval flag = 1” is set in a message sent at a shorter time interval than a transmission cycle, and “short interval flag = 0” is set in a message sent in the transmission cycle.

[0010] For example, in case C2, if a transmission cycle is T, the transmitting device sends message M13 before the transmission cycle has elapsed, starting from the transmission time of message M12. Thus, the transmitting device sets the short-interval flag in message M13 to 1. Conversely, the transmitting device sends message M14 when the transmission cycle has elapsed, starting from the transmission time of message M13, and sends message M15 when the transmission cycle has elapsed, starting from the transmission time of message M14. Thus, the short-interval flag in messages M14 and M15 is set to 0. Similarly, the short-interval flag in message M12 is also set to 0.

[0011] If a received message is one that is sent before a transmission cycle has elapsed since the transmission time of the most recent previous message, the attack detection device predicts the reception time of the next message, assuming the next message is transmitted periodically, using the received message as a reference. Conversely, if the received message is one that is sent after a transmission cycle has elapsed since the transmission time of the most recent previous message, the attack detection device decides that the next message is not a frame to be used for the attack if its reception time falls within the predicted reception range.

[0012] For example, the attack detection device receives message M13 after receiving message M12. "Short Interval Flag = 1" is set in message M13, so the attack detection device calculates a time period as the reception range for a message received next after message M13. This time period includes the time interval T of sending a message that has elapsed since the time of receiving message M13. Here, the reception range for the message received next after message M13 is indicated by an arrow Px.

[0013] The attack detection device receives message M14, in which "short-interval flag = 0" is set, after message M13. In the example of case C2, the reception time of message M14 is contained within a receive range predicted for message M14 (arrow Px). Thus, the attack detection device decides that message M14 is not a frame for attack. The attack detection device then calculates a receive range for a message that will be received next after message M14, using the reception time of message M14 and the transmit cycle T. Here, the receive range for the message that will be received next after message M14 is indicated by an arrow Py. The attack detection device receives message M15, in which "short-interval flag = 0" is set within a predicted receive range (the arrow Py).Thus, the attack detection device decides that message M15 is not a framework for attack.

[0014] As described above, in the method according to the embodiments, the attack detection device can decide whether a received message is one sent from the transmitting device in a shorter time interval than a transmission cycle, for example, using a short-interval flag. Thus, it is possible to determine whether a periodic message is a frame for attack, even if the periodic message is sent using an aperiodic message as a reference after the aperiodic message has been sent, as in case C2. It is often the case that in a system relating to, for example, a CAN bus provided in a vehicle, a periodic message is sent with an aperiodic message used as a reference, as in case C2, so the method according to the embodiments can be easily applied to, for example, a CAN bus provided in a vehicle.

[0015] The method according to the embodiments makes it possible to decide whether a periodic message is a framework for attack, not only in case C2, but also in case C1, in which an aperiodic message is sent between transmissions of periodic messages.

[0016] For example, in case C1, when a transmission cycle is T, the transmitting device sends messages M2, M3, and M4 before the transmission cycle has elapsed since the transmission time of the most recent previous message. Thus, the transmitting device sets the short-interval flag to 1 in messages M2, M3, and M4. Conversely, the transmitting device sends message M5 when the transmission cycle has elapsed since the transmission time of message M4, and sends message M6 when the transmission cycle has elapsed since the transmission time of message M5. Thus, the short-interval flag is set to 0 in messages M5 and M6.

[0017] The attack detection device receives message M2 after receiving message M1. "Short-interval flag = 1" is set in message M2, allowing the attack detection device to calculate a receive range for a message that will be received next after message M2, using the reception time of message M2 and a time interval T for sending a message. The attack detection device then receives message M3 next after receiving message M2 and calculates a receive range for a message that will be received next after message M3, because "Short-interval flag = 1" is also set in message M3.The attack detection device receives message M4 after receiving message M3 and calculates a reception range for a message that will be received next after message M4, because "short interval flag = 1" is also set in message M4. Here, the reception range for the message received after message M4 is indicated by an arrow Pa.

[0018] Next, after receiving message M4, the attack detection device receives message M5, in which the "short-interval flag = 0" is set. In the example of case C1, the reception time of message M5 is within the receive range (arrow Pa) predicted for message M5, so the attack detection device decides that message M5 is not a frame for attack. The attack detection device then calculates a receive range for a message that will be received next after message M5, using the reception time of message M5 and the transmit cycle T. The receive range for the message that will be received next after message M5 is indicated by an arrow Pb.It is assumed that in the predicted reception area (arrow Pb), the attack detection device receives message M6, in which "short interval flag = 0" is set next after receiving message M5. In this case, the attack detection device decides that message M6 is not a frame for attack.

[0019] As described above, the method according to the embodiments can be applied to both a system in which a time used as a reference for a transmission cycle of a periodic message is modified by a transmission time of an aperiodic message, and a system in which a time used as a reference for a transmission cycle of a periodic message is not modified by an aperiodic message. This leads to an improvement in the accuracy of attack detection performed in a system in which both a periodically transmitted and a non-periodically transmitted data frame are sent. In particular, the method according to the embodiments allows for an improvement in the accuracy of detecting an attack that spoofs a periodic message. Example of device configuration and network

[0020] Fig. Figure 2 illustrates an example configuration of an attack detection device 10. The attack detection device 10 includes a transceiver 11, a controller 20, and a memory 30. The controller 20 includes a computer 21 and a decision unit 22. The memory 30 holds a transmit condition 31, receive status information 32, and a receive prediction 33.

[0021] An ID contained in a periodic message received by the attack detection device 10 is associated with a transmission cycle for a periodic message identified by the ID in the transmission condition 31. The reception time of the most recent message received by the attack detection device 10 is recorded in the reception status information 32. Examples of the transmission condition 31 and the reception status information 32 are described later.

[0022] Computer 21 calculates a reception prediction for a periodic message for each ID using the transmit condition 31 and the receive status information 32. Computer 21 stores the calculated result as the reception prediction 33. Thus, the reception prediction 33 is generated for each ID. An example of the reception prediction 33 will be described later. Using a short-interval flag in a received message and the reception prediction 33, the decision unit 22 decides whether an attack against a network has occurred.

[0023] Fig. Figure 3 illustrates an example of a configuration of a transmitting device 40. The transmitting device 40 includes the transceiver 11, a controller 50, and a memory 60. The controller 50 includes a data generator 51, a flag setting unit 52, and a frame generator 53. The memory 60 holds a transmit condition 61 and a flag setting condition 62.

[0024] An ID contained in a periodic message, transmitted by the transmitting device 40, is associated with a transmission cycle for the periodic message identified by the ID in the transmission condition 61. The flag setting condition 62 specifies a setting condition for a short-interval flag. Here, the short-interval flag indicates whether the time period from the transmission time of a previous frame, which has the same identification as a target frame, until the transmission time of the target frame is shorter than the transmission cycle.

[0025] The data generator 51 generates data that is contained in the transmit frame. The flag setting unit 52 sets a short-interval flag based on the flag setting condition 62. The frame generator 53 generates a frame to be transmitted using the data generated by the data generator 51 and the result of the short-interval flag being set by the flag setting unit 52. The transceiver 11 transmits / receives a frame to / from the other devices.

[0026] Fig. Figure 4 illustrates an example of a hardware configuration of the attack detection device 10 and the transmitting device 40. In the example of Fig. The attack detection device 10 and the transmitting device 40 are each implemented by an ECU 100. The ECU 100 includes a CAN transceiver 101, a CAN controller 102, and a processing circuit 103. The processing circuit 103 includes a processor 104 and a memory 105.

[0027] The CAN transceiver 101 performs processing, such as adjusting the bus voltage as needed, to enable the ECU 100 to communicate with other devices on the CAN bus. The CAN controller 102 performs processing, such as a CRC (cyclic redundancy check) and bit stuffing of a received frame to extract data. The CAN controller 102 outputs the extracted data to the processor 104. The processor 104 can be any processing circuit and could, for example, be a CPU (central processing unit). The processor reads a program stored in the memory 105 and performs processing. The ECU 100 can contain a device that reads a program or data from a storage medium. In this case, the program can be recorded on any storage medium and is read from the storage medium by the ECU 100 as needed.

[0028] In the attack detection device 10, the transceiver 11 is implemented by the CAN transceiver 101 and the CAN controller 102. The processor 104 operates as the controller 20. The memory 105 operates as memory 30. In the transmitting device 40, the transceiver 11 is implemented by the CAN transceiver 101 and the CAN controller 102. The processor 104 operates as the controller 50. The memory 105 operates as memory 60. Examples of network and framework

[0029] Fig. Figure 5 illustrates an example of a network. In one in Fig. In the illustrated network N1, a plurality of ECUs 100 (ECU 0 to ECU k) are interconnected via a bus such that a frame can be sent and received between the ECUs 100. It is assumed that one or more ECUs 100 contained in the network are controlled by Fig.5, as the attack detection device 10 operates. For example, an attack detection device 10 can detect attacks against all of the periodic messages sent in the network. Alternatively, a detection target can be assigned to a corresponding attack detection device 10 such that attacks against all of the periodic messages are detected using a plurality of attack detection devices 10. One or more ECUs 100, which are in the network of Fig. 5 are included, operating as the transmitting device 40.

[0030] Fig. Figure 5 also illustrates examples of a transmit timing and a periodic message and a receive timing of the periodic message at the attack detection device 10. In the example of Fig.In section 5, it is assumed that ECU 0 operates as the attack detection device 10 to detect attacks related to periodic messages containing ID=A, ID=B, and ID=C, respectively. In this case, ECU 0, acting as the attack detection device 10, receives the periodic messages containing ID=A, ID=B, and ID=C as a detection target. It is assumed that ECU 1 sends the periodic message containing ID=A, ECU 2 sends the periodic message containing ID=B, and ECU 3 sends the periodic message containing ID=C.

[0031] As shown in the timing diagram of Fig.Figure 5 illustrates that each of the periodic messages containing ID=A, ID=B, or ID=C is received by ECU 0 at almost the same timing as its transmission timing. ECU 0 analyzes the reception timing of a received message in relation to an ID contained within the received message in order to detect an attack. The detection of an attack will be described in detail later.

[0032] Fig. Figure 6 illustrates examples of data frame formats. F11 of Fig. 6 is an example of a data frame format of a standard configuration and F12 is an example of a data frame format of an extended configuration.

[0033] A standard configuration frame contains a SOF (start of frame), an arbitration field, a control field, a data field, a CRC field, an ACK field, and an EOF (end of frame). The arbitration field contains an ID and an RTR (remote transmission request). Here, the ID is identification information used to identify a data frame. The control field contains an IDE (identifier extension), a reservation bit, and a DLC (data length code). The CRC field contains a CRC sequence and a CRC separator. The ACK field contains an ACK slot and an ACK separator. The bit length of an information element contained in each field is as specified in the last line of F11. For example, the ID is 11 bits long, and the data field is a variable length between 0 and 64 bits.

[0034] The data frame of an extended configuration (F12) also includes a SOF, an arbitration field, a control field, a data field, a CRC field, an ACK field, and an EOF. The arbitration field in the extended configuration includes an ID base, an SRR (substitute remote request bit), an IDE, an ID extension, and an RTR. In the extended configuration, identification (ID) information for a data frame is represented by a bit string obtained by placing a bit string stored as an ID extension after a bit string stored as an ID base. From the control field to the EOF, the format of an extended configuration is similar to that of a standard configuration. Furthermore, the bit length of an information element contained in each field is specified in the last line of F12.Thus, a 29-bit bit string, obtained by combining 11 bits of the ID base and 18 bits of the ID extension, is used as identification information for a transmitting source.

[0035] A short-interval flag is contained in the data field if the format of a frame sent in a system is F11 or F12. It is further assumed that the transmitting device 40 and the attack detection device 10 both contain information indicating a region where a short-interval flag is recorded in the data field. For example, the setting position of a short-interval flag may be contained in, for example, transmit condition 31 and transmit condition 61, or flag setting condition 62.

[0036] An example of processing performed in each embodiment is described below using the case in which a data frame having the format of F11 in Fig.6 is used, and the processing is similar if a data frame used for communication is an extended configuration data frame. First embodiment

[0037] A first embodiment is now described, subdivided into a transmission of a frame from the transmitting device 40 and decision processing, which is carried out in the attack detection device 10. (1) Sending a frame from the sending device 40

[0038] Fig.Figure 7 illustrates an example of information held by the transmitting device 40. The transmit condition 61 includes an ID contained in a message sent by the transmitting device 40, a transmit cycle, and the position of a short-interval flag. The transmit cycle is a specific cycle in which a periodic message, identified by an ID in the corresponding entry, is sent. The position of a short-interval flag is information that specifies a region in the data field used for a short-interval flag of a message identified by the ID in a corresponding entry. For example, the transmit condition 61 of Fig. 7. Information indicating that a periodic message, in which ID=0x123, is sent in a 100 ms cycle, and information indicating that in the message, in which ID=0x123, a leading bit of the data field is used for a short interval flag.

[0039] In flag setting condition 62, a short-interval flag value is associated with a condition when the value is set. In the example of Fig.7. With respect to a message identified by a certain ID, if the time period from the transmission time of the last message to the transmission time of the current message is equal to the transmission cycle, information indicating that "Short Interval Flag = 0" is set is recorded in flag setting condition 62. Conversely, with respect to the message identified by a certain ID, if the time period from the transmission time of the last message to the transmission time of the current message is shorter than the transmission cycle, "Short Interval Flag = 1" is set. For example, flag setting unit 52 contains a timer for measuring the transmission time interval of a frame for each ID of a frame on which transmission processing is performed, and can determine a setting value of a short interval flag using a count value from the timer.

[0040] Fig.Figure 8 is a flowchart illustrating an example of a transmission process. In the example of Fig. 8. It is assumed that the timer is set to run in a transmission cycle associated with an ID contained in a message (a data frame), for which a transmission interval is measured by the timer. For example, if the transmitting device 40 contains the in Fig. If the illustrated transmission condition 61 is shown, the timer used to process the message, in which ID=0x123 is set to expire in 100 ms.

[0041] Flag setting unit 52 initializes the timer (step S1). Then, flag setting unit 52 decides whether the timer has expired (step S2). If the timer has not expired, flag setting unit 52 decides whether an event requiring a message to be sent has occurred (no in step S2, step S3). If the event requiring a message to be sent has not occurred, flag setting unit 52 increments the timer count and the process returns to step S2 (no in step S3, step S4).

[0042] If, on the other hand, the event for which a message is to be sent has occurred, the processing of sending an aperiodic message is carried out (yes, in step S3). The flag setting unit 52 sets the short-interval flag to 1 (step S5). The flag setting unit 52 reports the value of the short-interval flag to the frame generator 53. The frame generator 53 generates a send message using data generated by the data generator 51, the value of the short-interval flag determined by the flag setting unit 52, and information about the position of the short-interval flag (step S7). The transceiver 11 sends the generated message, and the process returns to step S1 (step S8).

[0043] When the timer in step S2 expires, the processing of sending a periodic message is carried out (yes, in step S2). The flag setting unit 52 sets the short-interval flag to 0 (step S6). Afterwards, the flag setting unit 52 reports the value of the short-interval flag to the frame generator 53. Thus, the processes of steps S7 and S8 are also carried out after the process of step S6.

[0044] Fig. Figure 8 is merely an example of the processing carried out in the transmitting device 40, and modifications can be made to it depending on the implementation. For example, as in case C1 of Fig. Figure 1 illustrates that in a system in which an aperiodic message is sent without changing a reference for a periodic message, the processing carried out in the sending device 40 is modified such that the process returns to step S2 after the process of step S8. (2) Decision processing carried out in the attack detection device 10

[0045] Fig.Figure 9 illustrates an example of information held by the attack detection device 10. The attack detection device 10 stores the transmit condition 31. The transmit condition 31 includes an ID contained in a message received by the attack detection device 10, a transmit cycle, a margin, or the position of a short-interval flag. The transmit cycle is a specified cycle in which a periodic message, identified by an ID in the corresponding entry, is sent. The margin is a value used as an acceptable value when predicting a receive range for the periodic message identified by the ID in the corresponding entry, indicating the extent to which the receive range may lie outside the transmit cycle range.The position of a short interval flag is information that specifies a region in the data field that is used as a short interval flag in a message identified by the ID of a corresponding entry.

[0046] The transmission condition 31 of Fig. Condition 9 contains information indicating that a periodic message with ID=0x123 is sent in a 100 ms cycle, and information indicating that a 10 ms margin is used for predicting a receive range for the periodic message with ID=0x123. Transmission condition 31 further contains information indicating that a leading bit of the data field is used as a short-interval flag in the message with ID=0x123.

[0047] A message's reception time, which can be used to calculate a reception area, and an ID contained in the message are associated and recorded in the reception status information 32. Here, a periodic message, which has been decided not to be used for an attack, and a message sent at a time interval shorter than the transmission cycle can be used as the message that can be used to calculate a reception area. The decision unit 22 records in the reception status information 32 the reception time of a target message among the messages that can be used to calculate a reception area. It should be noted that the target message is the most recently received message among the messages that can be used to calculate a reception area. Fig.Figure 9 illustrates an example of the received status information 32. In the example of Fig. 9 is the time at which the attack detection device 10 receives the message containing ID=0x123 (as a message that can be used to calculate a reception area) 50 ms. The decision processing carried out in the decision unit 22 is described with reference to Fig. 10 described.

[0048] When the receive status information 32 has been updated, the computer 21 generates the receive prediction 33 for each ID using the transmit cycle and margin recorded in the transmit condition 31. Fig.Figure 9 illustrates an example of the receive prediction 33 generated for the periodic message in which ID=0x123. The message, which can be used to calculate a receive range, is received at 50 ms, so that a time period (i.e., the receive range) in which a message sent in the transmit cycle T can be received is calculated as "50 ms + 100 ms ± 10 ms". Thus, when the message in which ID=0x123 and "short interval flag = 0" is set is received next, it is predicted that the received message will be received within the receive range, i.e., between 140 ms and 160 ms, if the received message is not a frame for attack.

[0049] Fig. Figure 10 illustrates an example of an attack detection method according to the first embodiment. Fig.10 represents a black triangle (▼) representing a time at which the attack detection device 10 receives a message in which "short-interval flag = 0" is set, and a white triangle (V) represents a timing at which the attack detection device 10 receives a message in which "short-interval flag = 1" is set. Fig. 10. It is assumed that the messages M21 to M23 and a frame AT1, which is used for an attack, are all identified by ID=0x123.

[0050] It is assumed that at 0 ms in case C11, the attack detection device 10 has not received any messages that can be used to calculate a receive area. In this case, data is not recorded in the receive state information 32 or the receive prediction 33.

[0051] It is assumed that the message M21, containing ID=0x123, arrives at the attack detection device 10 at 50 ms. At this time, the receive prediction 33 is not prepared, so the decision unit 22 decides that the message M21 is not a framework for an attack. The decision unit 22 records the reception time of message M21 in the receive status information 32 (from Fig. 9) on.

[0052] When the receive status information 32 has been updated, the computer 21 calculates a time period (receive range) in which a message sent in the receive cycle T can be received using the transmit cycle and margin recorded in the transmit condition 31 ( Fig.9) The message sent in transmission period T contains "short-term period flag = 0". Computer 21 performs a calculation to determine "between 140 ms and 160 ms" as a reception range for the message containing "short-term period flag = 0" by performing the calculation with reference to Fig. The processing described in section 9. The reception area calculated by computer 21 for a message received next after message M21 is indicated by an arrow P1.

[0053] It is assumed that message M22, identified by ID=0x123, arrives at attack detection device 10 at 148 ms. Decision unit 22 decides whether the reception time of message M22 matches the information in reception prediction 33. As indicated by arrow P1, reception prediction 33 is "between 140 ms and 160 ms," so the reception time of message M22 matches the information in reception prediction 33. Thus, decision unit 22 decides that message M22 is not a framework for attack. Decision unit 22 updates the reception status information 32 using the reception time of message M22.

[0054] When the receive state information 32 has been updated, the computer 21 calculates a receive range for a message that will be received next if the message contains "short-term period flag = 0", using the transmit cycle and margin. It is assumed that the computer 21 calculates "148 ms + 100 ms ± 10 ms = between 238 ms and 258 ms" to determine a receive range for the message containing "short-term period flag = 0" because the receive time of message M22 is 148 ms. The receive range calculated by the computer 21 for the message that will be received next after message M22 is indicated by an arrow P2. The computer 21 updates the receive prediction 33 using a determined result of the calculation.

[0055] In case C12, message M23 arrives at attack detection device 10 after case C11. It is assumed that message M23, identified by ID=0x123, arrives at attack detection device 10 at 200 ms. Decision unit 22 decides whether the reception time of message M23 matches the information in reception prediction 33. As indicated by arrow P2, reception prediction 33 is "between 238 ms and 258 ms", so the reception time of message M23 does not match the information in reception prediction 33.

[0056] The decision unit 22 then detects the value of a short-interval flag contained in message M23. Here, the decision unit 22 uses information in the transmit condition 31, which specifies the position of a short-interval flag. In this example, the short-interval flag is set to a leading bit of the data field of message M23. It is assumed here that the value of the leading bit of the data field of message M23 is 1. In this case, the value of the short-interval flag is 1, so message M23 is sent before 100 ms, which is the transmit cycle, has elapsed since the transmission of message M22. Thus, the decision unit 22 decides that message M23 is not a frame used for an attack. The decision unit 22 updates the receive state information 32 using the receive time of message M23.In other words, the decision unit 22 knows from the receipt of message M23 that a message in the “short interval flag = 0” is not received in a time period indicated by a dashed arrow P2.

[0057] When the receive state information 32 has been updated, the computer 21 calculates a receive range for a message that will be received next if the message contains "short-period flag = 0", using the transmit cycle and margin. It is assumed that the computer 21 calculates "200 ms + 100 ms ± 10 ms = between 290 ms and 310 ms" to determine a receive range for the message containing "short-interval flag = 0" because the receive time of message M23 is 200 ms. The receive range calculated by the computer 21 for the message that will be received next after message M23 is indicated by an arrow P3. The computer 21 updates the receive prediction 33 using a determined result of the calculation.

[0058] In case C13, frame AT1 arrives at attack detection device 10 after case C12. Frame AT1, identified by ID=0x123, is assumed to arrive at attack detection device 10 at 250 ms. Decision unit 22 decides whether the reception time of frame AT1 matches the information in reception prediction 33. As indicated by arrow P3, reception prediction 33 is "between 290 ms and 310 ms," so the reception time of frame AT1 does not match the information in reception prediction 33.

[0059] The decision unit 22 then detects the value of a short-interval flag contained in frame AT1. It is assumed that the value of a leading bit of the data field of frame AT1 is 0. In this case, the value of the short-interval flag is 0, so it is understood that frame AT1 was sent if 100 ms, which is the transmit cycle T, has elapsed since the transmission of message M23, but the receive time of frame AT1 does not match the receive prediction 33. Thus, the decision unit 22 decides that frame AT1 is a frame used for an attack.

[0060] Fig. Figure 11 is a flowchart illustrating an example of processing performed in the attack detection device. Fig. Step 11 is merely an example, and the order of the processes can be changed depending on the implementation. For example, step S16 can be performed before step S15.

[0061] Transceiver 11 receives a message (step S11). Using the message's reception time, decision unit 22 decides whether the message was received within a time period predicted as reception prediction 33 (step S12). If the message was not received within the time period predicted as reception prediction 33, decision unit 22 decides whether the value of a short-interval flag in the message is set to 1 (no in step S12, step S13). If the value of the message's short-interval flag is not set to 1, decision unit 22 decides that the message is a framework for attack and discards the message (no in step S13, step S14).

[0062] If, on the other hand, the value of the short-interval flag of the message is set to 1, computer 21 predicts a reception time of a message that will be received in the next cycle, using the reception time of the message received in step S11 (yes, in steps S13 and S15). In this case, decision unit 22 decides that the message was successfully received (step S16). The processes of steps S15 and S16 are also carried out if it was decided in step S12 that the message was received in the time period predicted by reception prediction 33.

[0063] Fig.Figure 11 is merely an example of the processing performed in the attack detection device 10, and modifications can be made to the processing depending on the implementation. For example, the decision unit 22 can be configured to decide whether the value of a short-interval flag of a received message is set to 0 when it detects that the message was received in a time period predicted as the receive prediction 33 (yes in step S12).

[0064] As described above, in the method according to the first embodiment, the attack detection device 10 can decide, using a short-interval flag, whether a received message is a message sent from the transmitting device in a shorter time interval than a transmission cycle. The attack detection device 10 predicts the reception time of a message received in the next cycle, using either a message received in a time period predicted as the receive prediction 33 or a message that has been confirmed with a short-interval flag as being a message sent in a shorter time interval than the transmission cycle.Thus, the method according to the first embodiment can be applied both to a system in which a time used as a reference for a transmission cycle of a periodic message is modified according to a transmission time of an aperiodic message, and to a system in which a time used as a reference for a transmission cycle of a periodic message is not modified according to an aperiodic message. This leads to an improvement in the accuracy of attack detection performed in a system in which both a periodically transmitted message and a non-periodically transmitted message are used. Second embodiment

[0065] In a second embodiment, a processing procedure is described that is carried out when a margin is set to be wider in order to prevent erroneous detection from occurring when the transmission time of a periodic message is changed due to, for example, transmission timings of overlapping frames.

[0066] Fig.Figure 12 illustrates an example of a problem that occurs when a margin is inappropriate. In case C21, it is assumed that each frame contains ID=0x123. In case C21, a periodic message is sent in a 100 ms cycle, and a margin is set to 10 ms. The attack detection device 10 is assumed to receive the first periodic message M31 at 0 ms. Then, using the margin, the attack detection device 10 prepares a time period (Z1) between 90 ms and 110 ms with respect to the reception time of the periodic message M31. The second periodic message M32 is assumed to be received at 101 ms.Then the difference in reception time between periodic message M31 and periodic message M32 is 101 ms and is included in the calculation result determined using the margin, so the attack detection device 10 decides that periodic message M32 is not an attack. Based on the reception time of periodic message M32, the attack detection device 10 predicts that the time period for receiving the third periodic message is a time period (Z2) between 191 ms and 211 ms.

[0067] Next, it is assumed that the transmission timing of the third periodic message M33 is delayed, for example, due to the transmission of other messages. It is assumed that, due to this delay, the attack detection device 10 receives the third periodic message M33 at 240 ms. In this case, the difference in the receive time between the periodic message M32 and the periodic message M33 is 139 ms, and this is not within an acceptable range (Z2) when a calculation is performed using the margin of ±10 ms. Thus, the attack detection device 10 incorrectly detects that the periodic message M33 is an attack. Furthermore, the attack detection device 10 calculates a receive interval with respect to the receive time of the periodic message M33, which is used as a reference.As stated in case C21, if the fourth periodic message is received at 301 ms, the difference in the reception time between periodic message M33 and periodic message M34 is 61 ms. Therefore, the attack detection device 10 decides that this difference is outside the acceptable range when performing a calculation using the margin. Thus, the attack detection device 10 incorrectly detects that periodic message M34 is also an attack.

[0068] To avoid false detection in case C21, the margin can be set to be wider. However, if the margin is set wider, an attack may go undetected. In case C22, it is assumed that a periodic message M41, a periodic message M42, an attack frame AT2, a periodic message M43, and a periodic message M44 are sent as a single frame containing ID=0x123. It is assumed that in the attack detection device 10, the send cycle is set to 100 ms, the margin is set to 40 ms, and the frames are received at the following times. Periodic message M41: 0 ms Periodic message M42: 101 ms AT2 framework for attack: 161 ms Periodic message M43: 240 ms Periodic message M44: 301 ms

[0069] In case C22, the attack detection device 10 decides that an attack has not occurred if the difference in the receive time between two consecutive frames is contained within a time period of "transmit cycle ± margin". The "transmit cycle ± margin" is between 60 ms and 140 ms. When the periodic message M41 is received, the attack detection device 10 predicts the time period P11 as a receive range for the periodic message M42. The receive time of the periodic message M42 is 101 ms from the receive time of the periodic message M41, and this is contained within the time period (P11) between 60 ms and 140 ms. Thus, the attack detection device 10 decides that an attack has not occurred.

[0070] Next, the attack detection device 10 predicts a time period (P12) between 60 ms and 140 ms as the reception range for the periodic message M43. These times represent the elapsed time since the reception of the periodic message M42. When the attack frame AT2 is received, the attack detection device 10 determines that a frame was received within the time period P12 because frame AT2 was received when 60 ms had elapsed since the reception of the periodic message M42. Thus, the attack detection device 10 determines that no attack occurred.

[0071] The attack detection device 10 predicts a time period (P13) between 60 ms and 140 ms as the reception range for the periodic message M44. These times represent the elapsed time since the reception time of frame AT2 for the attack. When the periodic message M43 is received, the attack detection device 10 determines that a frame was received within the time period P13 because the periodic message M43 was received when 79 ms have elapsed since the reception of frame AT2 for the attack. Thus, the attack detection device 10 determines that no attack has occurred.

[0072] Similarly, the attack detection device 10 predicts a time period (P14) between 60 ms and 140 ms as the reception range for the periodic message M45. These times represent the elapsed time since the reception of the periodic message M43. When the periodic message M44 is received, the attack detection device 10 decides that a frame was received within the time period P14 because the periodic message M44 was received when 61 ms have elapsed since the reception of the periodic message M43. Thus, the attack detection device 10 decides that no attack has occurred. As described above, in the detection procedure of case C22, the margin is set wider so that the occurrence of an attack by frame AT2 goes undetected.

[0073] Thus, in the second embodiment, an attack detection method is described which can prevent a frame used for an attack from going unnoticed and can prevent a false detection of an attack, even if the margin is made wider.

[0074] Fig. Figure 13 illustrates an example of a configuration of an attack detection device 70 according to the second embodiment. The attack detection device 70 includes the transceiver 11, a controller 71, and a memory 75. The controller 71 contains a computer 72, a decision unit 73, and a reference update unit 74. The memory 75 holds a reference time 76, a receive prediction 77, and the transmit condition 31, and optionally receives the receive status information 32.

[0075] The reference update unit 74 selects a message to be used as a reference for calculating the receive prediction 77. A message sent at a shorter time interval than a transmission cycle is used as the reference for calculating the receive prediction 77. Furthermore, the reference update unit 74 can select the reference message from periodic messages to regularly overcome the accumulation of errors by updating the reference message. The reference update unit 74 stores the receive time of a message selected as a reference message in memory 75 as the reference time 76.

[0076] Computer 72 calculates reception predictions for a plurality of periodic messages for each ID using the reference time 76 and the transmission condition 31. Computer 72 stores the calculation results in the reception prediction 77. Thus, the reception prediction 77 is also generated for each ID. An example of the reception prediction 77 is described later.

[0077] Fig.Figure 14 illustrates an example of an attack detection method according to the second embodiment. The reference update unit 74 selects as a reference message either a message chosen from periodic messages or a message in which the "short-interval flag" = 1 (step S21). The reference message is used as a reference for predicting receive ranges for other messages that contain the same ID as the reference message. The attack detection device 70 calculates receive ranges for a plurality of messages that are identified by the same ID as the reference message and in which the "short-interval flag" = 0, and associates the receive range with a sequence starting from the reference message (step S22). A transmit cycle associated with the ID contained in the reference message and a receive time of the reference message are used for the calculation in step S22.

[0078] The transceiver 11 then receives the nth message, which has the same ID as the reference message (step S23). The decision unit 73 decides whether the short-interval flag of the nth message is set to 1 (step S24). If the short-interval flag of the nth message is set to 1, the reference update unit 74 sets the nth message to be a new reference message, and the process returns to step S22 (yes in steps S24 and S25). If the short-interval flag of the nth message is not set to 1, the decision unit 73 decides whether the reception time of the nth message falls within a time period predicted to be a reception range for the nth periodic message (no in steps S24 and S26).If the reception time of the nth periodic message is not included in the time period predicted as the reception range for the nth periodic message, the decision unit 73 decides that an attack has been detected (no in step S26, step S27).

[0079] On the other hand, if the reception time of the nth periodic message is included in the time period predicted as the reception range for the nth periodic message, the decision unit 73 decides that an attack has not been detected and the process is terminated (yes in step S26).

[0080] As in the case of Fig. 12 illustrated Fig.14. Consider a case in which messages M41 to M43 and frame AT2 are sent for the attack. Here, it is assumed that the reference update unit 74 selects message M41 as a reference message. The computer 72 then calculates receive ranges for a plurality of messages in which "short-period flag" = 0, using the receive time (0 ms) of message M41, the transmit cycle (100 ms), and the margin. For example, if the first message contains "short-period flag = 0", the first message from message M41 onward is predicted to be received in a time period specified by an arrow P21.Similarly, the second message is predicted to be received in a time period indicated by arrow P22, starting from message M41, if the second message contains "short period flag = 0", and the third message is predicted to be received in a time period indicated by arrow P23, starting from message M41, if the third message contains "short period flag = 0".

[0081] After receiving message M41, transceiver 11 receives message M42. Decision unit 73 treats message M42 as the first message received since reference message M41. Decision unit 73 does not detect an attack because message M42 was received within the time period indicated by arrow P21. Transceiver 11 then receives frame AT2 for the attack. Decision unit 73 treats frame AT2 for the attack as the second message received since reference message M41. Decision unit 73 does not detect an attack at this point because frame AT2 for the attack was received within the time period indicated by arrow P22. Transceiver 11 then receives message M43. Decision unit 73 treats message M43 as the third message received since reference message M41.Decision unit 73 detects an attack because message M43 was not received within the time period specified by arrow P23.

[0082] As described above, in the methods according to the second embodiment, a reception range for a target message, which is received after a plurality of cycles have elapsed since the receipt of a message used as a reference, is predicted, and the number of messages that have occurred between the reference message and the target message of the predicted reception range is taken into account to determine whether an attack has occurred. Thus, it is possible to detect an attack even if the margin is set wider to accommodate message delays.

[0083] An example of the processing performed in the attack detection device 70 is described in detail below using a specific example of information held by the attack detection device 70.

[0084] Fig. Figure 15 illustrates an example of information held by the attack detection device 70. The attack detection device 70 has stored the transmit condition 31. The transmit condition 31 is the same as the transmit condition 31 held by the attack detection device 10 and includes an ID contained in a message to be received, a transmit cycle, a margin, and the position of a short-interval flag. The transmit condition 31 of Fig.Item 15 contains information indicating that a periodic message with ID=0x123 is sent in a 100 ms cycle, and information indicating that a 40 ms margin is used for predicting a receive range for the periodic message with ID=0x123. The transmit condition 31 further contains information indicating that a leading bit of the data field in the message with ID=0x123 is used as a short-interval flag.

[0085] The reception time of a message selected as a reference message, associated with an ID contained in the reference message, is recorded as reference time 76. The reference message is a message selected from messages sent in a transmit cycle by the reference update unit 74 as a reference message for calculating a receive range or for a message sent at a shorter time interval than the transmit cycle.

[0086] When the reference time 76 has been updated, the computer 72 calculates the reception prediction 77 for each ID using the transmit cycle and margin recorded in the transmit condition 31. Fig.Figure 15 illustrates an example of the reception prediction generated for the periodic message with ID=0x123. The reference message is received at 50 ms, so if the reference message is the 0th message, the time period (i.e., the reception range) in which the nth received periodic message after the reference message can be received is determined by "50 + 100 x n ± 40 (ms)". Thus, the reception range for the periodic message with ID=0x123, which is received next after the reference message, is between 110 ms and 190 ms. Similarly, the reception range for the second periodic message after the reference message is between 210 ms and 290 ms, and the reception range for the third periodic message after the reference message is between 310 ms and 390 ms.For each periodic message, the computer 72 associates a reception sequence starting from a reference message, if the reference message is the 0th message, and a reception range together and records them in the reception forecast 77.

[0087] Fig. Figure 16 illustrates an example of an attack detection method according to the second embodiment. An example in which the attack detection device 70 performs the function described in Figure 16 is shown. Fig. The information presented in the 15 illustrated sections is described below. Fig.16 represents a black triangle (▼) in which "Short-interval flag = 0" is set, and a white triangle (V) represents a frame in which "Short-interval flag = 1" is set. It is further assumed that the reference update unit 74 is configured to change the reference message when ten messages in which "Short-interval flag" = 0 are received without changing the reference message, in addition to when one message in which "Short-interval flag" = 1 is received.

[0088] Case C31 is an example in which the attack detection unit 70 receives a message M51 at 50 ms and the message M51 is selected as a reference message. The controller 71 calculates in the case with reference to Fig.The procedure described in section 15 defines a reception area for the message in which "short-interval flag" = 0 when message M51 is used as a reference, and stores the calculated reception area as the reception prediction. The calculated reception area values ​​for the first to third messages starting from message M51 are represented in case C31. An arrow P52 indicates the reception area for the first message starting from message M51, an arrow P53 indicates the reception area for the second message starting from message M51, and an arrow P54 indicates the reception area for the third message starting from message M51.

[0089] Transceiver 11 receives a message M52 at 148 ms. Once decision unit 73 has confirmed that the short-interval flag of message M52 is set to 0, it decides whether message M52 was received within a predicted time period for the first message. In this example, the reception time of message M52 is 148 ms, and the reception range for a message that is the first message after message M51, and in which the short-interval flag is 0, is between 110 ms and 190 ms. Thus, decision unit 73 decides that message M52 was received within the predicted time period and does not detect an attack. Message M52 is the first message after message M51, and with a short-interval flag of 0, so computer 52 does not update the reception ranges for messages received after message M52.

[0090] In case C32, transceiver 11 receives a message M53 at 200 ms. The decision unit 73 detects that the short-interval flag of message M53 is set to 1. Then, the reference update unit 74 inserts message M53 as a new reference message and discards the receive range that was calculated when message M51 was used as a reference. That is, the receive ranges indicated by arrows P53 and P54, which are calculated in case C31 when message M51 is used as a reference, are discarded. The reference update unit 74 sets the receive time of message M53 to be the reference time 76, with arrows P53 and P54 illustrated using dashed arrows in case C32.The reference time 76 has been updated, so that the computer 72 updates the reception prediction 77 with a reception range that is calculated when the message M53 is used as a reference. The reception time of message M53 is 200 ms, so using the transmit condition 31 (from . Fig. 15) Computer 72 calculates “200 + 1 × 100 ± 40 (ms) = between 260 ms and 340 ms” to determine a receive range for a message, which is the first message received after message M53 and in which the “short-interval flag” is 0. Computer 72 also calculates receive ranges for subsequent messages using similar processing. An example of the receive range calculated when message M53 is used as a new reference message is indicated by arrow 53a.

[0091] In case C33, it is assumed that transceiver 11 receives an attack frame AT3 at 250 ms. If decision unit 73 detects that the short-interval flag of attack frame AT3 is set to 0, it decides whether the attack frame AT3 was received within a predicted time period. Decision unit 73 treats attack frame AT3 as the first message after the reference message M53. In this case, the reception time of attack frame AT3 is 250 ms, and the reception range for a message that is the first message after message M53 and has a short-interval flag of 0 is between 260 ms and 340 ms. Therefore, decision unit 73 decides that attack frame AT3 was not received within the predicted time period and determines that an attack has been detected.

[0092] Fig.Figure 17 is a flowchart illustrating an example of the processing carried out in the attack detection device 70. Fig. 17. A variable k is used to count the number of messages on which processing is performed without changing a reference message.

[0093] Computer 72 determines a transmission cycle T, a margin M, and the number of predictions n (step S31). Here, computer 72 reads the transmission cycle T and the margin M from transmission condition 31. The number of predictions n is a maximum number of messages in which the "short-interval flag" = 0, and on which decision processing is performed without modifying a reference message. Afterward, transceiver 11 receives a message. If a message is received after the attack detection device 70 has been started, the reference update unit 74 sets the first received message to be a reference message and sets the reception time of the first received message to t0 (step S32).

[0094] In step S33, using the receive time t0 and the information determined in step S31, computer 72 calculates receive ranges for n messages, assuming all n messages are sent in the transmit cycle. Here, a receive range for the xth message is calculated using "r(x) = t0 + x T ± M". The reference update unit 74 then sets the variable k to 1.

[0095] Transceiver 11 continues to receive a message. Decision unit 73 sets the message reception time to t(k) (step S34). Decision unit 73 decides whether the short-interval flag of the received message is set to 1 (step S35). The received message is transmitted in the transmit cycle if the short-interval flag of the received message is not set to 1, so decision unit 73 decides whether t(k) is contained in r(k) (no in step S35, step S36). If t(k) is not contained in r(k), decision unit 73 decides that an attack has occurred (no in step S36, step S40).

[0096] If, on the other hand, t(k) is contained within r(k), the reference update unit 74 decides whether the variable k is equal to the number of predictions n (yes in step S36, step S37). It should be noted that the variable kn becomes equal to n if n periodic messages are sent consecutively and the reception times of each are contained within corresponding receive ranges. If the variable k is less than the number of predictions n, the variable k is not equal to the number of predictions n (no in step S37). In this case, the reference update unit 74 increments the variable k by 1, and the process returns to step S34 (step S38).When the variable k becomes equal to the number of predictions n as a result of repeatedly performing the processes in steps S34 to S38, the reference update unit 74 updates the reference message with the received message and sets the receive time t(k) to be a receive time t(0) of the reference message (yes in step S37, step S39). Here, the reference update unit 74 updates the reference time 76. Then the process from step S33 is carried out. In other words, using the updated reference time 76, the computer 72 calculates receive ranges for n messages to be sent in a transmit cycle after the new reference message. The reference update unit 74 then updates the variable k to 1.

[0097] When the short-interval flag of the received message is set to 1, the reference update unit 74 updates the reference message to the received message and sets the receive time t(k) to be a receive time t(0) of the reference message (yes in step S35, step S39). The process then moves to step S33.

[0098] Fig. Figure 18 is a flowchart illustrating a variation of the processing carried out in the attack detection device 70 according to the second embodiment. Fig. 18. The decision as to whether the reception time of a message is contained within a reception range is made before the value of a short interval flag is detected.

[0099] The processes of steps S41 to S44 are essentially the same as the processes of steps S31 to S34, which are described with reference to Fig.17 are described. In step S45, decision unit 73 decides whether t(k) is contained in r(k). If t(k) is not contained in r(k), decision unit 73 decides whether the short-interval flag of the received message is set to 1 (no in step S45, step S49). If the short-interval flag of the received message is not set to 1, decision unit 73 decides that an attack has occurred (no in step S49, step S51).

[0100] If, on the other hand, the short-interval flag of the received message is set to 1, the decision unit 73 updates the reference message to the received message and sets the reception time t(k) to be a reception time t(0) of the reference message (yes in step S49, step S50). Here, the reference update unit 74 updates the reference time 76 and the process moves to step S43.

[0101] If decision unit 73 has decided in step S45 that t(k) is contained in r(k), decision unit 73 also decides whether the short-interval flag of the received message is set to 1 (yes in step S45, step S46). If the short-interval flag of the received message is set to 1, decision unit 73 updates the reference message to the received message and sets the receive time t(k) to be a receive time t(0) of the reference message (yes in step S46, step S50).

[0102] Once it has been determined that t(k) is contained in r(k) and that the short-interval flag of the received message is not set to 1, the reference update unit 74 decides whether the variable k is equal to the number of predictions n (no in step S46, step S47). If the variable k is less than the number of predictions n, the variable k is not equal to the number of predictions n (no in step S47). In this case, the reference update unit 74 increments the variable k by 1 and the process returns to step S44 (step S48). When the variable k has become equal to the number of predictions n, as a result of performing the processes from steps S44 to S48 repeatedly, the reference update unit 74 updates the reference message to the received message and sets the receive time t(k) to be a receive time t(0) of the reference message (yes in step S47, step S50).After the process from step S50, the process moves to step S43.

[0103] As described above, in the method according to the second embodiment, the attack detection device 70 can also decide, using a short-interval flag, whether a received message is a message sent from the transmitting device at a time interval shorter than a transmission cycle. Furthermore, the attack detection device 70 predicts the reception time of a message received in the next cycle, using a message selected from messages that will be received in a predicted reception range, or a message that has been confirmed as being sent at a time interval shorter than the transmission cycle.Thus, the method according to the second embodiment can also be applied to both a system in which a time used as a reference for a transmission cycle for a periodic message is changed to an aperiodic message based on a transmission time, and a system in which a time used as a reference for a transmission cycle for a periodic message is not changed based on an aperiodic message.

[0104] Furthermore, in the second embodiment, erroneous detection can be prevented by setting a wider margin. Here, reception ranges for a plurality of messages sent in a transmission cycle after the transmission of a message used as a reference are predicted, and the reception order of the plurality of messages in the predicted reception ranges, starting from the reference message, is taken into account, so that the attack detection device 70 can prevent an attack from going undetected. Thus, the second embodiment improves the accuracy of attack detection performed in a system by transmitting both a periodically transmitted and a non-periodically transmitted data frame. Other

[0105] The embodiments are not limited to the examples described above, and various modifications can be made. Some other examples are described below.

[0106] The examples where a value of a leading bit of data is used have been described above, and the position of information used as a short-interval flag is any position in the data field. Furthermore, a plurality of bits can be used as a short-interval flag. In this case, the transmitting device 40 can increment the value of a region used as a short-interval flag when it sends a frame at a time interval shorter than a transmission cycle. Likewise, the transmitting device 40 can decrement the value of a region used as a short-interval flag when it sends a frame at a time interval shorter than a transmission cycle. Furthermore, the transmitting device 40 can modify the value of a region used as a short-interval flag when it sends a frame at a time interval shorter than a transmission cycle.In this case, the transmitting device 40 does not change the value of a region used as a short-interval flag if the transmitting device 40 sends the frame at the same time interval as the transmit cycle. For example, the decision unit 22 in the attack detection device 10 and the decision unit 73 in the attack detection device 70 have stored a short-interval flag value in a previously received message and decide whether a newly received message was sent in a transmit cycle by comparing the value of a short-interval flag in the newly received message with the value of the short-interval flag in the previously received message. In this example, it is decided that the newly received message was sent in a transmit cycle if the two values ​​are equal.

[0107] Furthermore, decision unit 73 can use a short-interval flag to indicate that the transmission cycle is modified in a specified sequence with a pre-associated ID. For example, if a message containing ID=0x123 is always received after a certain time period has elapsed since receiving a message containing ID=0x110, decision unit 73 can determine that transmission occurred within a short time interval if the message containing ID=0x123 is received at a timing outside the range of "certain time period ± margin" after receiving the message containing ID=0x110. Here, it is assumed that decision unit 73 monitors the transmission cycle for the message containing ID=0x110.In this case, decision unit 73 can decide that the message containing ID=0x123, which is being received, is being received just after a change in the transmission cycle for the message containing ID=0x110, which was sent at a shorter time interval than the transmission cycle. Furthermore, if a specific region in the data of the message containing ID=0x110 is used as a short interval flag and "short interval flag = 1" is set in the message containing ID=0x110, decision unit 73 can decide that the message containing ID=0x123 was sent at a shorter time interval than the transmission cycle.

[0108] Furthermore, the decision unit 73 can use a state of, for example, a vehicle equipped with a CAN, or a state of a connection between the CAN and an external device, as a replacement for a short-interval flag.

[0109] Multiple conditions can be used simultaneously. In this case, multiple different AND conditions or a single OR condition can be used.

[0110] The examples in which the attack detection device (10, 70) and the transmission device 40 are different devices have been described, but a device can function as the attack detection device 10, 70 for one ID and as the transmission device 40 for another ID. In this case, a device that detects an attack and sends a message serves as both the attack detection device 10 and the transmission device 40, so that the device includes the transceiver 11, the controller 20, the memory 30, the controller 40, and the memory 60. Furthermore, the device that functions as both the attack detection device 70 and the transmission device 40 includes the transceiver 11, the controller 71, the memory 75, the controller 50, and the memory 60.The methods disclosed in the present invention can be applied to an extended configuration called a CAN-FD (flexible data rate CAN).

Claims

[1] An attack detection device comprising: a transceiver configured to receive a message from a communication device in a network; and a computer configured to calculate, based on a reception time of a first message in periodic messages periodically transmitted in a specified transmission cycle in the network, a reception range for a target message in the periodic messages received by the transceiver after the first message, wherein when the transceiver receives a second message associated with information indicating that the second message is transmitted in a shorter time interval than the transmission cycle outside the reception range after the reception time of the first message, the computer updates the reception range for a target message in the periodic messages received by the transceiver after the second message based on a reception time of the second message and the transmission cycle. [2] Attack detection device according to claim 1, further comprising, a decision unit configured to decide whether an attack on the network has occurred, where each message sent from the communication device contains a flag indicating whether the message is sent in a shorter time interval than the transmission cycle, or the message is sent in a time interval equal to the transmission cycle, and the decision unit is configured to decide that an attack on the network has occurred when the flag contained in a target message indicates that the target message is sent in the time interval equal to the transmission cycle, and a reception time of the target message is not included in the reception range. [3] An attack detection device according to claim 2, further comprising: a decision unit configured to decide whether an attack on the network has occurred, where the computer is configured to calculate reception ranges respectively in association with a plurality of periodic messages sent after the second message, using the reception time of the second message as a reference, and the decision unit is configured to decide that an attack on the network has occurred when a reception time of a target message in the plurality of periodic messages sent after the second message is not included in the reception range calculated in association with the target message. [4] An attack detection method performed by an attack detection device, the method comprising: Receiving a message from a communication device in a network; Calculating, based on a reception time of a first message in periodic messages periodically transmitted in a predetermined transmission cycle in the network, a reception range for a target message in the periodic messages received after the first message; and when a second message associated with information indicating that the second message is sent at a time interval shorter than the transmission cycle is received outside the reception range after the reception time of the first message, updating the reception range for a target message in the periodic messages received after the second message based on a reception time of the second message and the transmission cycle. [5] The attack detection method according to claim 4, wherein each message sent from the communication device includes a flag indicating whether the message is sent at a time interval shorter than the transmission cycle or the message is sent at a time interval equal to the transmission cycle, and the attack detection device decides that an attack on the network has occurred when the flag included in a target message indicates that the target message is sent at the time interval equal to the transmission cycle and a reception time of the target message is not included in the reception range. [6] An attack detection method according to claim 5, wherein the attack detection device calculates a reception range in association with a plurality of periodic messages sent after the second message, using the second message as a reference, and decides that an attack on the network has occurred when a reception time of a target message in the plurality of periodic messages sent after the second message is not included in the reception range calculated in association with the target message. [7] An attack detection program that causes a processor implemented in an attack detection device to execute an attack detection process, the process comprising: Receiving a message from a communication device in a network via a transceiver implemented in the attack detection device; Calculating, based on a reception time of a first message in periodic messages periodically transmitted in a predetermined transmission cycle in the network, a reception range for a target message in the periodic messages received after the first message; and when a second message associated with information indicating that the second message is sent at a time interval shorter than the transmission cycle is received outside the reception range after the reception time of the first message, updating the reception range for a target message in the periodic messages received after the second message based on a reception time of the second message and the transmission cycle. [8] An attack detection program according to claim 7, wherein each message sent from the communication device contains a flag indicating whether the message is sent in a time interval shorter than the transmission cycle, or the message is sent in a time interval equal to the transmission cycle, and the process decides that an attack on the network has occurred if the flag contained in a target message indicates that the target message is sent in the time interval equal to the transmission cycle and a reception time of the target message is not included in the reception range. [9] An attack detection program according to claim 8, wherein the process calculates a reception range in association with a plurality of periodic messages sent after the second message, using the second message as a reference, and decides that an attack on the network has occurred when a reception time of a target message in the plurality of periodic messages sent after the second message is not included in the reception range calculated in association with the target message.

Images