Analysis system and analysis method

Abstract

To provide an analysis system that improves the accuracy in analyzing unauthorized accesses.SOLUTION: In an analysis system in which communication is performed between a vehicle 1 and a server 2 to analyze unauthorized accesses to the vehicle 1 from outside, the vehicle 1 includes: a monitoring unit 12 that monitors accesses from outside; a location information acquisition unit 11 that acquires location information on the vehicle; and a communication unit that transmits vehicle data including monitoring result information indicating the monitoring result by the monitoring unit and the location information to the server 2. The server 2 includes an analysis unit that determines a possibility of unauthorized access based on the monitoring result information and the location information and analyzes the access according to the possibility of unauthorized access.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an analysis system and an analysis method. [Background technology]

[0002] Conventionally, there have been known in-vehicle communication systems equipped with a detection means for detecting unauthorized access to the system. For example, the in-vehicle communication system described in Patent Document 1 performs authentication by determining whether or not the diagnostic terminal device connected to a connector exposed inside or outside the vehicle is different from a known one based on authentication information from the diagnostic terminal device, and detects that unauthorized access has occurred if it is different. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-113002 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned conventional in-vehicle communication system has a problem that if an access is made to the vehicle by someone masquerading as an authenticated diagnostic terminal device, and the diagnostic terminal device determines that the access is known, the access will be mistakenly detected as legitimate, resulting in low accuracy in analyzing unauthorized access.

[0005] An object of the present invention is to provide an analysis system and an analysis method that improve the accuracy of analyzing unauthorized access. [Means for solving the problem]

[0006] The present invention solves the above problem by monitoring access from outside the vehicle, acquiring vehicle location information, generating vehicle data including monitoring result information indicating the results of the access monitoring and location information, determining the possibility of the access being fraudulent based on the monitoring result information and the location information, and analyzing the access according to the possibility of fraud. Effect of the Invention

[0007] The present invention can improve the accuracy of analyzing unauthorized access. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of an analysis system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a flowchart of the vehicle-side analysis method. [Diagram 3] FIG. 3 is a flow chart of a server-side analysis method. [Figure 4] FIG. 4 is a flowchart of a sub-flow of step S30 in FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of the analysis system and analysis method according to the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram of an analysis system according to an embodiment of the present invention. The analysis system performs communication between a vehicle 1 and a server 2, and analyzes unauthorized access to the vehicle 1 from outside. Access to the vehicle 1 from outside corresponds to a worker connecting a dedicated terminal to the vehicle 1 for inspection and maintenance of the vehicle at a vehicle-related location where the vehicle 1 is maintained, sold, and / or managed. The worker inspects and maintains the vehicle by operating the terminal while the dedicated terminal is connected to the vehicle. The inspection and maintenance include checking the operation of various systems in the vehicle and rewriting the software of the ECU included in the vehicle 1. When the worker performs a regular operation required for inspection, etc. using the dedicated terminal, the access to the vehicle 1 is considered to be a regular access. On the other hand, for example, when an unauthorized user accesses the vehicle 1 using a terminal other than the dedicated terminal, accesses the vehicle 1 using a dedicated terminal from a location other than the vehicle-related location, accesses the vehicle 1 by masquerading as a dedicated terminal, or operates the terminal with an operation that is not regular (non-regular operation), it corresponds to unauthorized access. In order to detect such unauthorized access, the analysis system according to this embodiment determines the possibility of unauthorized access from outside the vehicle and analyzes the access according to the possibility of unauthorized access. The analysis system then issues an alert (warning) according to the results of the access analysis. Note that the unauthorized access described above is merely an example, and the analysis system may detect other unauthorized accesses.

[0010] The analysis system includes a vehicle-side monitoring system 10 provided in a vehicle 1, and a server-side monitoring system 20 provided in a server 2. The vehicle-side monitoring system 10 is a system that monitors access from the outside, and includes a location information acquisition unit 11, a monitoring unit 12, a whitelist database (whitelist DB) 13, and a vehicle communication unit 14. In addition to the vehicle-side monitoring system 10, the vehicle 1 also includes an ECU 15. In addition to the vehicle-side monitoring system 10 and the ECU 15, the vehicle 1 also includes, for example, a drive motor, a battery, etc.

[0011] The position information acquisition unit 11 acquires the position information of the vehicle 1. The position information of the vehicle 1 is information indicating the current position of the vehicle 1. The vehicle 1 has a receiver of a global position system (GPS system) and measures the current position (vehicle position) of the vehicle 1 based on a signal received by the receiver. The position information acquisition unit 11 acquires the vehicle position measured by the global position system as position information. The position information acquisition unit 11 may acquire the vehicle-related place as position information by referring to map information. The map information is used in a navigation system and is recorded in a database of the vehicle 1. The vehicle-related place is a place where the vehicle 1 is maintained, sold, and / or managed. For example, when the vehicle-side monitoring system 10 is accessed from the outside, the position information acquisition unit 11 acquires position information indicating the current position of the vehicle 1 from the GPS system. When the vehicle is accessed and the vehicle is parked at the vehicle-related place, the position information acquisition unit 11 may acquire the vehicle-related place as position information in addition to the current position of the vehicle 1. The position information acquisition unit 11 may acquire time information in addition to the position information. The time information indicates the time when the position information of the vehicle 1 was acquired.

[0012] The monitoring unit 12 monitors access from the outside. When an access is made to the vehicle 1 from an external terminal, the monitoring unit 12 performs authentication processing. For example, information on a dedicated terminal that can be connected to the vehicle 1 for inspection of the vehicle 1 or the like is registered in advance in the vehicle 1. When the dedicated terminal is connected to the vehicle 1, it transmits authentication information to the monitoring unit 12. The monitoring unit 12 checks the acquired authentication information against the registered authentication information and determines whether the access is possible. The monitoring unit 12 also monitors access and commands such as diagnostic communication of the vehicle 1 in real time. When diagnosing the vehicle 1 or rewriting software, a command with a code is transmitted to the vehicle 1 from a dedicated terminal, and the monitoring unit 12 identifies the code of the input command. The monitoring unit 12 checks against a whitelist recorded in the whitelist DB 13 to determine whether the identified code is legitimate or not. When the identified code is not legitimate, the monitoring unit 12 determines that there is a possibility of unauthorized access. The monitoring unit 12 may also determine the possibility of unauthorized access from the input sequence of the code. For example, if the input sequence of the codes is different from the normal input sequence indicated in the whitelist, the monitoring unit 12 may determine that there is a possibility of unauthorized access.

[0013] The whitelist DB 13 records a list of codes (whitelist) for diagnosing and monitoring the vehicle. The whitelist is a list of legitimate codes. The whitelist DB 13 also records the order in which the codes are entered. For example, when writing software to the ECU 15, commands to reset, boot, write data, etc., of the ECU 15 are entered into the vehicle 1 from a dedicated terminal. Each command is assigned a code, and the software is written when the legitimate codes for writing the software are entered in the legitimate order. The whitelist lists the legitimate codes and the legitimate order of the commands to be entered for writing the software.

[0014] The monitoring unit 12 may determine the possibility of unauthorized access based on the number of accesses. The number of accesses is the number of accesses that are determined to be possibly unauthorized accesses. The possibility of unauthorized access is the possibility that a certain access is unauthorized access. A certain access does not necessarily have to be a single access, but may be multiple accesses made to a certain vehicle. For example, the monitoring unit 12 may determine unauthorized access such that the greater the number of accesses, the higher the possibility of unauthorized access.

[0015] When the monitoring unit 12 determines that there is a possibility of unauthorized access, the monitoring unit 12 may determine an alert level according to the stage of access to the ECU 15. The stage of access corresponds to a process (degree of progress) during inspection or maintenance of the vehicle 1. For example, when writing to the ECU, an alert level is determined according to the stage of resetting the ECU 15, booting the ECU 15, writing data to the memory of the ECU 15, etc. The alert level indicates the degree of influence (seriousness) on the vehicle caused by the unauthorized access, and the higher the alert level, the higher the influence on the vehicle 1. For example, the alert level is divided into four stages from "0 to 3". The alert level "3" is the highest level and corresponds to "emergency". The alert levels decrease in order from "2", "1", and "0", and correspond to "warning", "caution", and "normal state", respectively.

[0016] When accessed from outside, the monitoring unit 12 determines an alert level for the access based on the traveling state of the vehicle 1. The monitoring unit 12 acquires vehicle speed information from a vehicle speed sensor of the vehicle 1 and determines whether the vehicle is traveling. When the monitoring unit 12 receives access from outside for inspection or the like of the vehicle 1 while the vehicle is traveling, it determines the alert level to "3." Inspection or the like of the vehicle 1 is performed when the vehicle 1 is stopped. Therefore, when access for inspection of the vehicle 1 is received while the vehicle 1 is traveling, there is a high possibility that the access is fraudulent, and the monitoring unit 12 determines the alert level to "3."

[0017] The monitoring unit 12 may also determine the alert level according to the driving state of the vehicle 1 and the stage of the access. For example, when the monitoring unit 12 receives an access for booting the ECU 15 while the vehicle is running, the monitoring unit 12 determines the alert level to be "3." Since booting of the ECU 15 is not performed while the vehicle is running and there is a high possibility of such access being unauthorized, the monitoring unit 12 determines the highest alert level.

[0018] The monitoring unit 12 may determine the alert level according to the number of accesses and the stage of the access. For example, when an unauthorized user tampers with the software of the ECU 15, the unauthorized user accesses the ECU 15 many times at the authentication stage, or accesses the ECU 15 many times by adding an unspecified code to the command. The monitoring unit 12 has a function of blocking unauthorized accesses, but if the unauthorized accesses are received many times and pass the blocking function, there is a risk that authentication or writing of the software of the ECU 15 will be performed. For example, when there is a predetermined number of accesses or more per predetermined time, the monitoring unit 12 determines the alert level according to the state of the ECU 15 at the time of the access. For example, when there is a predetermined number of accesses or more per predetermined time and the ECU 15 is booted, the monitoring unit 12 determines the alert level to "2". Also, when there is a predetermined number of accesses or more per predetermined time and the ECU 15 is not booted but a code for resetting or writing the ECU 15 is identified, the monitoring unit 12 determines the alert level to "1". That is, when the ECU 15 is booted, the monitoring unit 12 sets the alert level to be higher than when the ECU 15 is not booted.

[0019] When there is less than a predetermined number of accesses per predetermined time period and the boot of the ECU 15 is not being executed, the monitoring unit 12 determines the alert level to be "0." For example, reading of data managed by the ECU 15, such as reading of the failure history of the ECU 15, is performed at a relatively early stage of access, so that the monitoring unit 12 lowers the alert level when the number of unauthorized accesses is low.

[0020] If the monitoring unit 12 determines that there is a possibility of unauthorized access, the monitoring unit 12 may determine the alert level according to the state of the ECU 15, regardless of the number of accesses. The state of the ECU 15 for determining the alert level is classified according to whether or not booting has been performed and whether or not a code required for writing software has been input. For example, if it is determined that there is a possibility of unauthorized access, and booting has been performed (booting has been performed), the alert level is "2". If it is determined that there is a possibility of unauthorized access, and booting has not been performed (booting has not been performed) and a code required for writing software has been input, the alert level is "1". The input of a command required for writing software is, for example, an input of a command to which a reset code for the ECU or a writing code has been added. If it is determined that there is a possibility of unauthorized access, and booting has not been performed (booting has not been performed) and a code required for writing software has not been input, the alert level is "0". The monitoring unit 12 may correlate the possibility of unauthorized access with the alert level. For example, if it determines that there is a possibility of unauthorized access equivalent to the alert level "3", the monitoring unit 12 may increase the possibility of unauthorized access. That is, the monitor 12 may determine the possibility of unauthorized access such that the higher the alert level when it is determined that there is a possibility of unauthorized access, the higher the possibility of unauthorized access.

[0021] The monitoring unit 12 generates vehicle data including the monitoring result information and the position information of the vehicle 1 in order to send the monitoring result information indicating the monitoring result to the server. The monitoring result information is information indicating the result of the determination of the possibility of unauthorized access and the result of the comparison in the authentication. When the monitoring unit 12 determines that there is a possibility of unauthorized use in response to an access from outside, the monitoring unit 12 acquires the position information at the time of the determination from the position information acquisition unit 11. The position information is information indicating the current position of the vehicle. Then, the monitoring unit 12 adds the position information of the vehicle 1 to the determination result of the possibility of unauthorized access (monitoring result). For example, when the vehicle 1 is accessed for writing software while the vehicle 1 is traveling, the monitoring unit 12 determines that there is a possibility of unauthorized access, and adds the position information (GPS information) of the vehicle 1 while traveling to the monitoring result. The position information identifies the vehicle position at the time of unauthorized access as being clearly different from the vehicle-related location, and it can be determined that the possibility of unauthorized access is higher. For example, when an access for inspection or the like is received at a vehicle-related location, and that access differs from a pre-registered legitimate access (for example, when a new code is entered in an order different from the legitimate order, or when a new legitimate code is entered), the monitoring unit 12 determines that there is a possibility of unauthorized access, but adds the location information of the vehicle 1 to the monitoring result. The vehicle location at the time when the possibility of unauthorized access is determined indicates the vehicle-related location. Therefore, although the vehicle-side monitoring system 10 determines that there is a possibility of unauthorized access, the location information indicates that it is not unauthorized access, and the possibility of unauthorized access is corrected by the server-side monitoring system 20.

[0022] The monitoring unit 12 may add location information of the vehicle-related place to the determination result of the possibility of unauthorized access (monitoring result) instead of or in addition to the vehicle location. For example, if the vehicle location when the possibility of unauthorized access is determined is a vehicle-related place, the monitoring unit 12 may add information indicating that it is a vehicle-related place to the monitoring result. Also, if the vehicle location when the possibility of unauthorized access is determined is not a vehicle-related place, the monitoring unit 12 may add information indicating that it is not a vehicle-related place to the monitoring result. The monitoring unit 12 generates vehicle data including at least the monitoring result information and location information. The vehicle data may include alert information indicating an alert level. The vehicle data may also include, for example, information such as the time when the possibility of unauthorized access is determined and the number of determinations, and identification information (VIN) of the vehicle 1. Note that the vehicle identification information is preferably encrypted since it is personal information.

[0023] The vehicle communication unit 14 is a communication device that communicates with the server 2, and transmits vehicle data to the server 2 via a mobile line or the like. The ECU 15 is a control unit that controls the vehicle 1.

[0024] Next, the configuration of the server 2 will be described. The server 2 includes a server-side monitoring system 20. The server-side monitoring system 20 records the vehicle data transmitted from the vehicle 1 in an analysis database 23, and analyzes unauthorized access by analyzing a data group of the vehicle data recorded in the analysis database 23. The server-side monitoring system 20 has a server communication unit 21, an analysis unit 22, and an analysis database (analysis DB) 23. The analysis database 23 records at least the vehicle data, and may also record the analysis results of the analysis unit 22.

[0025] The server communication unit 21 is a communication device that communicates with the vehicle 1 and receives vehicle data from the vehicle 1. The analysis unit 22 determines the possibility of unauthorized access based on the monitoring result information and location information included in the vehicle data, and analyzes the access according to the possibility of unauthorized access. The analysis unit 22 determines the possibility of unauthorized access depending on whether the location information added to the monitoring result information indicates a vehicle-related location. For example, the analysis unit 22 reduces the possibility of unauthorized access determined by the monitoring unit 12 when the location indicated by the location information matches the vehicle-related location. On the other hand, the analysis unit 22 maintains or increases the possibility of unauthorized access determined by the monitoring unit 12 when the vehicle location indicated by the location information does not match the vehicle-related location. Note that when the vehicle location is located within a predetermined range including the vehicle-related location, the analysis unit 22 may reduce the possibility of unauthorized access determined by the monitoring unit 12, and when the vehicle location is located outside the predetermined range including the vehicle-related location, the analysis unit 22 may maintain or increase the possibility of unauthorized access determined by the monitoring unit 12.

[0026] The analysis unit 22 may adjust the alert level given by the monitoring unit 12 based on the monitoring result information and the location information included in the vehicle data. The analysis unit 22 identifies that the vehicle side has determined that there is a possibility of unauthorized access from the monitoring result information included in the received vehicle data. The analysis unit 22 identifies the alert level of the access to be determined. Then, the analysis unit 22 may lower the alert level when the location indicated by the location information matches the vehicle-related location. On the other hand, the analysis unit 22 may maintain or raise the alert level when the vehicle location indicated by the location information does not match the vehicle-related location. The analysis unit 22 may adjust the alert level depending on whether the vehicle location is located within a predetermined range including the vehicle-related location. The analysis unit 22 does not need to adjust the alert level based on the location information of the vehicle 1 for all alert levels, and may adjust only some levels, such as levels "1" to "3".

[0027] The analysis unit 22 may adjust the alert level based on time information included in the vehicle data. For example, if the time when the vehicle 1 is accessed is within the business hours of a dealer, factory, or other vehicle-related location, the analysis unit 22 may lower the alert level. On the other hand, if the time when the vehicle 1 is accessed is outside the business hours of a dealer, factory, or other vehicle-related location, the analysis unit 22 may maintain or raise the alert level.

[0028] The analysis unit 22 records the unauthorized access determination result in the analysis DB 23. When an alert level is assigned to the determination target, the analysis unit 22 may record the determination result including the alert level in the analysis DB 23. The analysis unit 22 analyzes the access based on the data of the determination result recorded in the analysis DB 23. For example, the analysis unit 22 may analyze that unauthorized access has been made to the vehicle 1 (unauthorized access has occurred) when the number of accesses that is highly likely to be unauthorized access is equal to or greater than a predetermined number threshold. The analysis unit 22 may analyze the access according to the alert level. The analysis unit 22 may set the number threshold according to the alert level. For example, the higher the alert level, the lower the number threshold is set. When an access with a high alert level is made, it is analyzed that unauthorized access has been made at a stage when the number of accesses is small. Then, when it is analyzed that unauthorized access has occurred, the analysis unit 22 issues an alert. The alert is issued by notifying the vehicle 1 that is the target of unauthorized access, or by notifying the user terminal of the vehicle 1 or the user terminal of the monitor of the server 2.

[0029] The analysis unit 22 may exclude from the analysis an access whose unauthorized possibility is less than a predetermined value. For example, if the number of unauthorized accesses with a low alert level is small, the analysis unit 22 excludes the access from the analysis. This can improve the accuracy of the analysis.

[0030] The analysis unit 22 may analyze the access based on the identification information of the vehicle 1 included in the vehicle data. The analysis unit 22 acquires vehicle data having the same identification information from the analysis database 23, and determines the possibility of the access being unauthorized based on the monitoring result information and location information included in the acquired vehicle data. This makes it possible to analyze whether the access to a specific vehicle is unauthorized.

[0031] Next, the control flow of the analysis method by the analysis system will be described with reference to Figures 2 to 4. Figure 2 is a flowchart of the analysis method on the vehicle side, and Figure 3 is a flowchart of the analysis method on the server side. Figure 4 is a subflow of step S30 shown in Figure 3. Note that the analysis system does not need to execute all of the control flows in Figures 2 to 4, and the order of the control flows is not limited to the order shown in Figures 2 to 4.

[0032] 2, in step S1, the monitoring unit 12 monitors access from outside the vehicle 1. In the process in step S1, the monitoring unit 12 needs to perform at least an authentication process. If the access passes the authentication process (if the access is determined to be normal at the authentication process stage), the monitoring unit 12 identifies the code of the command entered at the time of the access. Note that if it is determined at the authentication stage that there is a possibility of unauthorized access, the monitoring unit 12 may execute step S6 without executing the control flow of steps S2 to S5.

[0033] In step S2, the monitoring unit 12 reads the whitelist from the whitelist DB 13. In step S3, the monitoring unit 12 determines whether or not the monitoring command matches a command included in the whitelist. The monitoring command is a command identified in the control flow of step S1. If the monitoring command does not match a command in the whitelist, the monitoring unit 12 determines that there is a possibility of unauthorized access, and determines an alert level according to the stage of the access that is the subject of the determination. On the other hand, if the monitoring command matches a command in the whitelist, the monitoring unit 12 determines that the access is not unauthorized, and determines the alert level to "0" (step S5). The control flow from step S3 to step S5 is a flow for access monitoring executed by the monitoring unit 12 after the authentication process.

[0034] In step S6, the location information acquisition unit 11 acquires location information of the vehicle 1 at the time of the access determination, and outputs the location information to the monitoring unit 12. In step S7, the monitoring unit 12 generates vehicle data including the monitoring result information and the location information. In step S8, the vehicle communication unit 14 transmits the vehicle data to the server 2. Then, the control flow on the vehicle side ends.

[0035] 3, in step S10, the server communication unit 21 receives vehicle data. In step S20, the analysis unit 22 determines whether the alert level indicated in the monitoring result information is "0". If the alert level is "0", the analysis unit 22 does not analyze the access, and the control flow on the server side ends. If the alert level is "0", this corresponds to a case where the possibility of the access being unauthorized is less than a predetermined value, and the analysis unit 22 excludes the access from the analysis.

[0036] If the alert level is not "0", the analysis unit 22 executes fraud possibility determination processing in step S30. The fraud possibility determination processing is processing for determining the fraud possibility of access based on the monitoring result information and the location information, and corresponds to the subflow shown in FIG.

[0037] In step S31, the analysis unit 22 performs a matching process based on the location information. The analysis unit 22 identifies the vehicle location from the location information included in the vehicle data. The analysis unit 22 determines whether the vehicle location matches the vehicle-related location or is located within a predetermined range including the vehicle-related location. If the vehicle location matches the vehicle-related location or is located within a predetermined range including the vehicle-related location, the analysis unit 22 determines that matching is possible. On the other hand, if the vehicle location does not match the vehicle-related location, the analysis unit 22 may determine that matching is not possible. Alternatively, if the vehicle location is outside the predetermined range including the vehicle-related location, the analysis unit 22 may determine that matching is not possible.

[0038] In step S32, it is determined whether the alert level is "1". If the alert level is other than "1", the analysis unit 22 determines whether to lower the alert level based on the result of matching. If matching is "possible", the analysis unit 22 determines to lower the alert level, and lowers the alert level by one level from the current level. If it is determined that there is a possibility of unauthorized access, and if the location of the vehicle 1 at the time of the access is a vehicle management location, there is also a possibility that the access is based on normal operation, for example, when the code has not been newly registered. Therefore, the analysis unit 22 lowers the alert level to reduce the possibility of unauthorized access. On the other hand, if matching is "not possible", the vehicle location information is not a factor that reduces the possibility of access, so the analysis unit 22 maintains the alert level. In this way, the analysis unit 22 may reflect the result of the determination of the possibility of unauthorized access based on the location information in the alert level.

[0039] In step S35, the analysis unit 22 records the alert level as the determination result in the analysis DB 23. Then, the subflow of step S30 ends.

[0040] In step S40, the analysis unit 22 analyzes the access based on the data of the judgment result stored in the analysis DB 23. The analysis unit 22 may issue an alert if the analysis result indicates that unauthorized access has occurred. Then, the control flow on the server side ends.

[0041] As described above, the analysis system or analysis method according to the present embodiment monitors access from outside the vehicle, acquires the location information of the vehicle 1, generates vehicle data including monitoring result information indicating the monitoring result of the access and the location information, judges the possibility of the access being unauthorized based on the monitoring result information and the location information, and analyzes the access according to the possibility of unauthorized access. For example, when a worker accesses a vehicle to perform non-standard maintenance at a vehicle-related location such as a dealer or a factory, if the code used is not recorded in the database or the sequence of the codes transmitted is not recorded in the database, there is a possibility that the access may be erroneously detected as unauthorized access. In the present embodiment, the possibility of unauthorized access is judged based on the location information of the vehicle 1, so that such erroneous detection can be prevented. As a result, the accuracy of analysis of unauthorized access can be improved.

[0042] In this embodiment, the location information acquisition unit 11 acquires the vehicle location measured by the global position system as location information, and the analysis unit 22 reduces the possibility of unauthorized access when the vehicle location indicates a vehicle-related location, thereby improving the accuracy of analysis of unauthorized access.

[0043] In this embodiment, the location information acquisition unit 11 acquires a vehicle-related location as location information, and the analysis unit 22 reduces the possibility of unauthorized access if the location of the vehicle 1 at the time of access is a vehicle-related location. This makes it possible to improve the accuracy of analysis of unauthorized access.

[0044] In this embodiment, the analysis unit 22 excludes accesses whose unauthorized access probability is less than a predetermined value from the analysis target. This allows the target of data analysis to be expanded as the unauthorized access probability increases, thereby improving the accuracy of the analysis of unauthorized accesses.

[0045] Furthermore, in this embodiment, the analysis unit 22 analyzes the access based on the identification information of the vehicle 1. This can improve the accuracy of analyzing unauthorized access.

[0046] Furthermore, in this embodiment, the vehicle communication unit 14 transmits the encrypted identification information of the vehicle 1 to the server 2, including the vehicle data. This makes it possible to protect personal information.

[0047] In this embodiment, the monitoring unit 22 determines an alert level according to the stage of access to the ECU 15, the communication unit includes the alert level in the monitoring result and transmits it to the server 2, and the analysis unit 22 analyzes the access according to the alert level. This makes it possible to improve the accuracy of analysis of unauthorized access.

[0048] The vehicle communication unit 14 in this embodiment corresponds to the "communication unit" of the present invention. The above-described embodiment has been described to facilitate understanding of the present invention, and is not described to limit the present invention. Therefore, each element disclosed in the above embodiment is intended to include all design modifications and equivalents that fall within the technical scope of the present invention. [Explanation of symbols]

[0049] 1 vehicle 2 Server 10 Vehicle side monitoring system 11 Location information acquisition section 12 Monitoring Department 13 Whitelist Database (Whitelist DB) 14 Vehicle Communication Unit 20 Server-side monitoring system 21 Server Communication Department 22 Analysis Department 23 Analysis Database (Analysis DB)

Claims

1. An analysis system for analyzing unauthorized access to a vehicle from an external source by communicating with a server, comprising: The vehicle is A monitoring unit that monitors external access; a location information acquisition unit that acquires location information of the vehicle; a communication unit configured to transmit to the server vehicle data including monitoring result information indicating a monitoring result by the monitoring unit and the location information; The server, An analysis system comprising an analysis unit that determines the possibility of the access being fraudulent based on the monitoring result information and the location information, and analyzes the access in accordance with the possibility of the access being fraudulent.

2. 2. The analysis system according to claim 1, The position information acquisition unit acquires a vehicle position measured by a global position system as position information, The analysis unit is an analysis system that reduces the possibility of fraud when the vehicle location indicates a vehicle-related location where the vehicle is maintained, sold, and / or managed.

3. 2. The analysis system according to claim 1, The location information acquisition unit acquires, as the location information, a vehicle-related location where maintenance, sales, and / or management of the vehicle is performed; The analysis unit is an analysis system that reduces the possibility of fraud if the location of the vehicle at the time of the access is the vehicle-related location.

4. 3. The analysis system according to claim 1, The analysis system includes an analysis unit that excludes the access whose fraudulent possibility is less than a predetermined value from the analysis.

5. 3. The analysis system according to claim 1, The vehicle data includes identification information of the vehicle, The analysis unit is an analysis system that analyzes the access based on the identification information.

6. 6. The analysis system according to claim 5, The communication unit is an analysis system that includes the encrypted identification information in the vehicle data and transmits the vehicle data to the server.

7. 3. The analysis system according to claim 1, The monitoring unit determines an alert level according to a stage of the access to the ECU, The communication unit includes the alert level in the monitoring result and transmits the result to the server, The analysis unit is an analysis system that analyzes the access according to the alert level.

8. 1. An analysis method for analyzing unauthorized access to a vehicle from an external source by communicating between a vehicle and a server, comprising: The vehicle is Monitor external access, Acquire location information of the vehicle; Transmitting monitoring result information indicating the access monitoring result and vehicle data including the location information to the server; The server, An analysis method for determining the possibility of the access being fraudulent based on the monitoring result information and location information, and analyzing the access in accordance with the possibility of the access being fraudulent.

Images