Abnormality detecting device and abnormality detecting method

Abstract

To provide an abnormality detecting device capable of reducing influence due to attacks affecting vehicle driving control other than cyber attacks.SOLUTION: An abnormality detecting device 230 includes: an acquisition unit 231 acquiring a first object detection result generated by a first object detection device (object detection device 220) provided on a first device (vehicle 200), which is a vehicle, for detecting objects around the first device and a second object detection result generated by a second object detection device provided on a second device (another vehicle 200) around the first device, for detecting objects around the second device; a determination unit 232 that determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result; and an output unit 233 that outputs a result determined by the determination unit 232.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to an anomaly detection device and an anomaly detection method. [Background technology]

[0002] Patent Document 1 discloses a technology for detecting cyber attacks by comparing information about the surroundings of a vehicle observed by other vehicles with the driving state of the vehicle. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-129529 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the technology disclosed in Patent Document 1 may not be able to reduce the effects of attacks that affect vehicle driving control, other than cyber attacks.

[0005] The present disclosure provides an anomaly detection device that can reduce the effects of attacks that affect vehicle driving control, other than cyber attacks. [Means for solving the problem]

[0006] An anomaly detection device according to one embodiment of the present disclosure includes an acquisition unit that acquires a first object detection result generated by a first object detection device provided in a first device, which is a vehicle, and which detects objects in the vicinity of the first device, and a second object detection result generated by a second object detection device provided in a second device around the first device, and which detects objects in the vicinity of the second device, a determination unit that determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result, and an output unit that outputs the determination result made by the determination unit.

[0007] In addition, an anomaly detection method according to one embodiment of the present disclosure includes a first object detection device provided in a first device, which is a vehicle, which acquires a first object detection result generated by the first object detection device that detects objects in the vicinity of the first device, and a second object detection device provided in a second device around the first device which acquires a second object detection result generated by the second object detection device that detects objects in the vicinity of the second device, and by comparing the first object detection result with the second object detection result, determines whether or not at least one of the first device and the second device is under attack, and outputs a determination result based on the determination.

[0008] In addition, these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a system, a method, an integrated circuit, a computer program, and a non-transitory recording medium. Effect of the Invention

[0009] According to the above aspect, it is possible to reduce the effects of attacks other than cyber attacks that affect vehicle driving control. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic diagram of an anomaly detection system for detecting an anomaly in a vehicle according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a server according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a hardware configuration of a vehicle according to an embodiment. [Figure 4] FIG. 4 is a block diagram illustrating an example of a functional configuration of the anomaly detection system according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of an object detection result. [Figure 6]FIG. 6 is a diagram illustrating an example of the vehicle data. [Figure 7] FIG. 7 is a diagram illustrating a first example of the sensor data. [Figure 8] FIG. 8 is a diagram illustrating a second example of the sensor data. [Figure 9] FIG. 9 is a diagram illustrating an example of the positioning information. [Figure 10] FIG. 10 is a diagram illustrating an example of the warning information. [Figure 11] FIG. 11 is a diagram illustrating an example of the region information. [Figure 12] FIG. 12 is a diagram for explaining a predetermined area defined by the area information. [Figure 13] FIG. 13 is a flowchart illustrating an example of an anomaly detection method in the anomaly detection system according to the embodiment. [Figure 14] FIG. 14 is a diagram for explaining a method for causing the object detection device to make a false detection. [Figure 15] FIG. 15 is a diagram for explaining a method for causing the object detection device to make a false detection. [Figure 16] FIG. 16 is a diagram for explaining a method for causing the object detection device to make a false detection. [Figure 17] FIG. 17 is a diagram for explaining the principle of detecting an attack that causes an object to be erroneously detected. [Figure 18] FIG. 18 is a diagram for explaining the principle of detecting an attack that causes an object to be erroneously detected. [Figure 19] FIG. 19 is a diagram for explaining another example of the object detection result. [Figure 20] FIG. 20 is a diagram for explaining another example of the object detection result. [Figure 21] FIG. 21 is a diagram for explaining another example of the object detection result. [Figure 22] FIG. 22 is a block diagram showing an example of a functional configuration of an anomaly detection system according to modification (1). [Figure 23] FIG. 23 is a flowchart showing an example of an anomaly detection method in the anomaly detection system according to the modification (1). [Figure 24] FIG. 24 is a diagram for explaining an example in which each vehicle is equipped with a plurality of types of sensors. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (Findings on which this disclosure is based) The present inventors have found that the conventional techniques described in the "Background Art" section have the following problems.

[0012] The technology in Patent Document 1 detects cyber attacks by comparing information about the surroundings of the vehicle observed by other vehicles with the driving state of the vehicle. In other words, the purpose of this technology is to monitor whether vehicle information has been tampered with.

[0013] In recent years, some vehicles are equipped with an object detection device that detects objects around the vehicle, and the detection results of the object detection device are used for vehicle travel control. In travel control using the detection results of the object detection device, for example, when an object that obstructs the travel of the vehicle is detected in the travel direction of the vehicle, the steering angle of the vehicle is changed or the travel of the vehicle is stopped to avoid colliding with the object. The inventors have found that there is a risk of an attack on a vehicle equipped with such an object detection device, in which the object detection device is made to erroneously detect an object that does not exist around the vehicle when an object actually exists around the vehicle, or conversely, the object detection device is made to erroneously detect an object that exists around the vehicle when an object does not actually exist around the vehicle. When such an attack that causes a false detection is made is made, the vehicle may perform unintended control such as colliding by continuing to travel even though there is an object in front of it, or stopping travel even though there is no object in front of it. Therefore, it is necessary to detect attacks that cause false detection.

[0014] After much research, the present inventor has discovered an anomaly detection device that can detect attacks that cause a vehicle's object detection device to make a false detection.

[0015] An anomaly detection device according to a first aspect of the present disclosure includes a first object detection device provided in a first device, which is a vehicle, and an acquisition unit that acquires a first object detection result generated by the first object detection device that detects objects in the vicinity of the first device, and a second object detection result generated by a second object detection device provided in a second device around the first device and that detects objects in the vicinity of the second device, a determination unit that determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result, and an output unit that outputs the determination result by the determination unit.

[0016] According to this, by comparing the first object detection result and the second object detection result, it is determined whether or not at least one of the first device and the second device is under attack, so that, for example, if the first object detection result and the second object detection result are different, it is possible to detect that an attack that causes the object detection device to make a false detection is taking place. Therefore, it is possible to reduce the influence of an attack that causes the object detection device to make a false detection and that affects the driving control of the vehicle.

[0017] An anomaly detection device according to a second aspect of the present disclosure is the anomaly detection device according to the first aspect, wherein the acquisition unit sequentially acquires first object detection results sequentially generated by the first object detection device and sequentially acquires second object detection results sequentially generated by the second object detection device, and the determination unit sequentially determines whether or not at least one of the first device and the second device is under attack by sequentially comparing the first object detection results and the second object detection results generated at corresponding times.

[0018] Therefore, it is possible to sequentially detect attacks that cause the object detection device to make erroneous detections.

[0019] An anomaly detection device according to a third aspect of the present disclosure is the anomaly detection device according to the first aspect, wherein the acquisition unit further acquires a first position of the first device when the first object detection device generates the first object detection result and a second position of the second device when the second object detection device generates the second object detection result, and the determination unit determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result generated when the first position is included in a specified area with the second object detection result generated when the second position is included in the specified area.

[0020] Therefore, for example, if a specific area is subjected to an attack that affects the vehicle's driving control and there is a high possibility that the vehicle will not be able to drive normally, the attack can be detected, thereby reducing the possibility that the vehicle will not be able to drive normally.

[0021] An anomaly detection device according to a fourth aspect of the present disclosure is the anomaly detection device according to the first aspect, wherein the determination unit determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result, which indicates that an object has been detected in the traveling direction of the first device, with the second object detection result.

[0022] Therefore, it is possible to determine whether or not the object detected by the first device is a false detection.

[0023] An anomaly detection device according to a fifth aspect of the present disclosure is an anomaly detection device according to any one of the first to fourth aspects, wherein the determination unit transforms the first object detection result and the second object detection result into a common coordinate system, determines whether the first object detection result and the second object detection result after the transformation are different from each other, and if the first object detection result and the second object detection result after the transformation are different, determines that at least one of the first device and the second device is under attack.

[0024] Therefore, by comparing the first object detection result and the second object detection result, it is possible to easily determine whether the objects detected by the two devices are the same, and if the objects detected by the two devices are different, it can be determined that at least one of the first device and the second device is under attack.

[0025] An anomaly detection device according to a sixth aspect of the present disclosure is the anomaly detection device according to the fifth aspect, wherein the first object detection result indicates whether or not an object is present in each of a plurality of pre-defined areas surrounding the first device, and the second object detection result indicates whether or not an object is present in each of a plurality of pre-defined areas surrounding the second device.

[0026] Therefore, by comparing the first object detection result and the second object detection result, it can be easily determined whether the objects detected by the two devices are the same.

[0027] An anomaly detection device according to a seventh aspect of the present disclosure is an anomaly detection device according to any one of the first to sixth aspects, wherein the first object detection device has a first sensor of a first type and a second sensor of a second type, the second object detection device has a third sensor of the first type and a fourth sensor of the second type, the first object detection result includes a first detection result of the first sensor and a second detection result of the second sensor, the second object detection result includes a third detection result of the third sensor and a fourth detection result of the fourth sensor, the determination unit compares the first detection result, the second detection result, the third detection result, and the fourth detection result, and when the determination unit identifies one detection result among four detection results including the first detection result, the second detection result, the third detection result, and the fourth detection result that is different from the other three detection results, the output unit notifies other vehicles of the sensor type of the sensor from which the identified one detection result was obtained.

[0028] An anomaly detection device according to an eighth aspect of the present disclosure is an anomaly detection device according to any one of the first to seventh aspects, wherein the acquisition unit further acquires a third object detection result generated by a third object detection device provided in a third device, which is a vehicle different from the first device, and which detects objects in the vicinity of the third device, and the determination unit compares the first object detection result, the second object detection result, and the third object detection result, and when one object detection result different from the other two object detection results is identified among three object detection results including the first object detection result, the second object detection result, and the third object detection result, determines that an apparatus provided with the object detection device from which the identified one object detection result was obtained is under attack.

[0029] An anomaly detection device according to a ninth aspect of the present disclosure is an anomaly detection device according to any one of the first to eighth aspects, wherein the second device is a vehicle or a roadside unit different from the first device.

[0030] An anomaly detection method according to a tenth aspect of the present disclosure includes a first object detection device provided in a first device, which is a vehicle, which acquires a first object detection result generated by the first object detection device that detects objects in the vicinity of the first device, and a second object detection device provided in a second device around the first device which acquires a second object detection result generated by the second object detection device that detects objects in the vicinity of the second device, and by comparing the first object detection result with the second object detection result, determines whether or not at least one of the first device and the second device is under attack, and outputs a determination result based on the determination.

[0031] A program according to an eleventh aspect of the present disclosure is a program for causing a computer to execute the anomaly detection method according to the tenth aspect.

[0032] (Embodiment) Hereinafter, an embodiment will be described with reference to the drawings.

[0033] [composition] FIG. 1 is a schematic diagram of an anomaly detection system for detecting an anomaly in a vehicle according to an embodiment.

[0034] 1, a server 100, two vehicles 200, a communication network 300, and a base station 310 of a mobile communication network are shown as components of an anomaly detection system 1. The server 100 and the two vehicles 200 are communicatively connected via the communication network 300 so as to be able to transmit and receive information to and from each other.

[0035] The server 100 is a device that monitors the states of the two vehicles 200. The server 100 periodically acquires log information from the two vehicles 200, and monitors the states of the two vehicles 200 based on the acquired log information. Note that when the two vehicles 200 perform inter-vehicle communication, the anomaly detection system 1 may be configured only with the two vehicles 200.

[0036] Note that, between the two vehicles 200, communication is not limited to via the communication network 300, and vehicle-to-vehicle communication may be performed. Also, although two vehicles 200 are illustrated in Fig. 1, three or more vehicles 200 may be capable of communicating with the server 100 or other vehicles 200. In the following, an example of two vehicles 200 will be described.

[0037] The vehicle 200 is equipped with a sensor that detects objects around the vehicle 200, and performs driving control of the vehicle 200 according to an object detection result based on the detection result of the sensor. The sensor that detects objects around the vehicle 200 is, for example, a LiDAR (Light Detection And Ranging) 206, a sonar 207, etc. (see Figs. 1 and 3). The vehicle 200 may be, for example, an autonomous vehicle capable of autonomous driving, or a vehicle having an ADAS (Advanced Driver-Assistance Systems) that assists the driver in driving.

[0038] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a server according to the embodiment.

[0039] As shown in FIG. 2, the server 100 includes, as its hardware configuration, a CPU (Central Processing Unit) 101, a main memory 102, a storage 103, and a communication IF (Interface) 104.

[0040] The CPU 101 is a processor that executes a control program stored in the storage 103 or the like.

[0041] The main memory 102 is a volatile storage area used as a work area when the CPU 101 executes a control program.

[0042] The storage 103 is a non-volatile storage area that holds control programs, contents, and the like.

[0043] The communication IF 104 is a communication interface that communicates with the two vehicles 200 via the communication network 300. The communication IF 104 is, for example, a wired LAN interface. The communication IF 104 may be a wireless LAN interface. The communication IF 104 is not limited to a LAN interface, and may be any communication interface that can establish a communication connection with a communication network.

[0044] FIG. 3 is a block diagram illustrating an example of a hardware configuration of a vehicle according to an embodiment.

[0045] As shown in FIG. 3, the vehicle 200 includes, as its hardware configuration, a TCU (Telematics Control Unit) 201, multiple ECUs 202, a storage 203, an in-vehicle display 204, an input IF (Interface) 205, a LiDAR 206, and multiple sonars 207.

[0046] The TCU 201 is a communication unit that allows the vehicle 200 to perform wireless communication with the communication network 300. The TCU 201 is a communication unit that includes a cellular module that complies with the standards of a mobile communication network.

[0047] The multiple ECUs 202 include a control circuit that acquires information from the TCU 201, acquires detection results from various sensors, and performs processing according to the acquired information and detection results. For example, at least one of the multiple ECUs 202 is a control circuit that acquires detection results from various sensors and controls autonomous driving of the vehicle 200 using the acquired detection results. The multiple ECUs 202 also include a control circuit that executes control of the in-vehicle display 204 provided in the vehicle 200 or other devices provided in the vehicle 200. Here, the other devices include, for example, an engine, a motor, a meter, a transmission, a brake, a steering wheel, a power window, an air conditioner, and the like. The multiple ECUs 202 may be provided corresponding to each of these various devices. Although not shown here, each of the multiple ECUs 202 may include a storage unit (non-volatile storage area) that stores a program executed by each ECU 202. The storage unit is, for example, a non-volatile memory.

[0048] The storage 203 is a non-volatile storage area that holds control programs, etc. The storage 203 is realized by, for example, a hard disk drive (HDD) or a solid state drive (SSD).

[0049] The in-vehicle display 204 is disposed in the cabin of the vehicle 200 and displays information in the form of characters or symbols to a user in the cabin. The in-vehicle display 204 may display images. The in-vehicle display 204 is a liquid crystal display, an organic EL display, or the like.

[0050] The input IF 205 is disposed in the cabin of the vehicle 200 and receives input (operation) from a user in the cabin. The input IF 205 may be, for example, a touch panel disposed on the surface of the in-vehicle display 204, or a touch pad disposed within reach of a user seated in a seat of the vehicle 200.

[0051] The LiDAR 206 is a sensor that detects the presence or absence of an object and the distance to the object by emitting a laser light and measuring the time it takes for the emitted laser light to reflect off the object and return. The LiDAR 206 is provided outside the vehicle 200 and emits a laser light in a number of specific directions around the vehicle 200. The multiple directions are defined by an angle (horizontal angle) from a reference direction (e.g., a front-to-rear direction) of the vehicle 200 when the vehicle 200 is viewed from above, and an angle (elevation angle) from a reference direction (e.g., a front-to-rear direction) of the vehicle 200 when the vehicle 200 is viewed from the side. That is, the multiple directions are defined by different combinations of horizontal angles and elevation angles.

[0052] Each of the multiple sonars 207 is a sensor that emits ultrasonic waves in a specific direction and detects the presence or absence of an object and the distance to the object based on the ultrasonic waves that are reflected by the object and returned. The multiple sonars 207 are provided outside the vehicle 200 and are sensors that measure the distance to an object approaching the vehicle 200. The multiple sonars 207 are arranged at different positions around the vehicle 200. The different positions around the vehicle 200 include the front center, front right, front left, rear center, rear right, rear left, etc. of the vehicle 200. The multiple sonars 207 are arranged at different positions, and therefore emit ultrasonic waves in different directions (specific directions).

[0053] Next, a description will be given of the functional configuration of the anomaly detection system 1. Fig. 4 is a block diagram showing an example of the functional configuration of the anomaly detection system according to the embodiment. Note that in Fig. 4, the communication network 300 is omitted.

[0054] As shown in FIG. 4, the anomaly detection system 1 includes a server 100 and two vehicles 200. The server 100 and the two vehicles 200 are communicatively connected via a communication network 300. Below, a functional configuration of one of the two vehicles 200 will be described. The functional configuration of the other vehicle 200 is similar to the functional configuration of the one vehicle 200, and therefore a description thereof will be omitted. The one vehicle 200 will be referred to as vehicle 200, and the other vehicle 200 will be referred to as the other vehicle 200. The vehicle 200 is an example of a first device. The other vehicle 200 is an example of a second device.

[0055] The vehicle 200 includes a communication unit 210, an object detection device 220, an abnormality detection device 230, a positioning system 240, and a vehicle control unit 250.

[0056] The communication unit 210 communicates with the server 100 and the other vehicles 200 via the communication network 300. The communication unit 210 may also perform vehicle-to-vehicle communication with the other vehicles 200. This allows the communication unit 210 to exchange information with the server 100 and with the other vehicles 200. The communication unit 210 acquires, for example, from the other vehicles 200, an object detection result (second object detection result) by an object detection device 220 (second object detection device) provided in the other vehicles 200. The communication unit 210 is realized, for example, by the TCU 201.

[0057] The object detection device 220 detects objects around the vehicle 200 equipped with the object detection device 220. The object detection device 220 may detect objects around the vehicle 200 using the detection result by the LiDAR 206, or may detect objects around the vehicle 200 using the detection result by the sonar 207. Since the detection result by the LiDAR 206 includes the distance to the object and the direction, the object detection device 220 may generate the detection result by the LiDAR 206 as the object detection result as it is. Since the detection result by the sonar 207 also includes the distance to the object and the direction, the object detection device 220 may generate the detection result by the sonar 207 as the object detection result as it is. In addition, the object detection device 220 may perform a predetermined object recognition process on at least one of the detection result by the LiDAR 206 and the detection result by the sonar 207, and generate the process result as the object detection result. The object detection result includes the relative position of the object around the vehicle 200 with respect to the reference position of the vehicle 200. The relative position may be indicated by coordinates of a Cartesian coordinate system relative to a reference position of the vehicle 200, or may be indicated by coordinates of a polar coordinate system. Furthermore, the relative position may be indicated by information indicating the presence or absence of an object for each of a plurality of regions around the vehicle 200. The surroundings of the vehicle 200 may be the surroundings when the vehicle 200 is viewed from above. The predetermined object recognition process may be a process using a machine learning model. The object detection device 220 is an example of a first object detection device. The object detection device 220 is realized by at least one of the LiDAR 206 and the sonar 207, and the ECU 202.

[0058] Note that the object detection device 220 may detect objects around the vehicle 200 using detection results from a stereo camera (i.e., stereo images) instead of using the detection results from the LiDAR 206 or the sonar 207. For example, a three-dimensional model generated by performing feature point matching on the stereo images may be used for object detection in this case.

[0059] The anomaly detection device 230 is a device that detects an attack (anomaly) on at least one of the vehicle 200 and the other vehicle 200 by comparing an object detection result by the object detection device 220 with an object detection result by an object detection device 220 provided in the other vehicle 200. The anomaly detection device 230 includes an acquisition unit 231, a determination unit 232, and an output unit 233.

[0060] The acquisition unit 231 acquires a first object detection result generated by the object detection device 220 (first object detection device) equipped in the vehicle 200 and a second object detection result generated by the object detection device 220 (second object detection device) equipped in another vehicle 200. The acquisition unit 231 sequentially acquires the first object detection result from the object detection device 220. For example, when acquiring a plurality of first object detection results generated by the detection process in the object detection device 220 at a plurality of different timings, the acquisition unit 231 may acquire one first object detection result for each timing at which one first object detection result was generated. Furthermore, when acquiring a plurality of first object detection results generated by the detection process in the object detection device 220 at a plurality of different timings, the acquisition unit 231 may acquire a plurality of first object detection results generated in a first period all at once.

[0061] Furthermore, the acquisition unit 231 sequentially acquires the second object detection results from the other vehicles 200 via the communication unit 210. For example, when acquiring a plurality of second object detection results generated by the detection process in the object detection device 220 of the other vehicles 200 at a plurality of different timings, the acquisition unit 231 may acquire one second object detection result for each timing at which the one second object detection result was generated. Furthermore, when acquiring a plurality of second object detection results generated by the detection process in the object detection device 220 of the other vehicles 200 at a plurality of different timings, the acquisition unit 231 may acquire the plurality of second object detection results generated in the second period all at once.

[0062] The acquisition unit 231 may acquire the second object detection result by performing vehicle-to-vehicle communication with the other vehicle 200, or may acquire the second object detection result via the communication network 300. When acquiring the second object detection result via the communication network 300, the vehicle 200 may acquire the second object detection result from the other vehicle 200 that is close to the position of the vehicle 200. "Close to the position of the vehicle 200" means that the vehicle 200 is included in a predetermined area based on the position of the vehicle 200, and the predetermined area is, for example, an area of ​​a predetermined radius centered on the position of the vehicle 200. The predetermined radius may be determined according to the detection range of the sensor (LiDAR 206, sonar 207) equipped in the vehicle 200. In other words, the other vehicle 200 may be a vehicle that is in a position having a detection range that overlaps with the detection range of the object detection device 220 equipped in the vehicle 200.

[0063] The determination unit 232 compares the first object detection result with the second object detection result to determine whether or not at least one of the vehicle 200 (first device) and the other vehicle 200 (second device) is under attack. The determination unit 232 sequentially determines whether or not at least one of the vehicle 200 and the other vehicle 200 is under attack by comparing the first object detection result and the second object detection result generated at corresponding timings. The first object detection result and the second object detection result generated at corresponding timings may be the first object detection result and the second object detection result acquired at close timings to each other among the multiple first object detection results and the multiple second object detection results acquired by the acquisition unit 231. The first object detection result and the second object detection result acquired at close timings to each other may be a combination of one object detection result and the other object detection result acquired for the first time after the one object detection result, or a combination of the first and second object detection results whose timing difference is less than a predetermined period (for example, one second).

[0064] The first object detection result and the second object detection result may include the timing at which the object detection result was detected. In this case, the determination unit 232 may compare the first object detection result and the second object detection result generated by detection at timings close to each other among the multiple first object detection results and the multiple second object detection results acquired by the acquisition unit 231. The first object detection result and the second object detection result generated by detection at timings close to each other may be a combination of first and second object detection results whose difference in timing is less than a predetermined period (for example, one second).

[0065] Furthermore, the determination unit 232 transforms the first object detection result and the second object detection result into a common coordinate system, and determines whether the transformed first object detection result and the transformed second object detection result are different from each other. If the transformed first object detection result and the transformed second object detection result are different, the determination unit 232 determines that at least one of the vehicle 200 and the other vehicle 200 is under attack.

[0066] In this case, the acquisition unit 231 acquires the second object detection result and the position of the other vehicle 200 when the detection of the second object detection result was performed on the other vehicle 200. For example, the determination unit 232 converts the second object detection result into a coordinate system based on the position of the vehicle 200, using the second object detection result acquired from the other vehicle 200, the position of the other vehicle 200 when the detection of the second object detection result was performed on the other vehicle 200, and the position of the vehicle 200 when the detection of the second object detection result was performed on the other vehicle 200. In this manner, the determination unit 232 may convert the second object detection result into a coordinate system common to the first object detection result. Note that, when the first object detection result and the second object detection result are different, such as an orthogonal coordinate system and a polar coordinate system, the determination unit 232 may convert the result into one of the coordinate systems.

[0067] The output unit 233 outputs the determination result by the determination unit 232. For example, the output unit 233 may display a screen including the determination result on the in-vehicle display 204. Also, for example, the output unit 233 may transmit the determination result to another vehicle 200, to the server 100, or to a terminal carried by a user of the vehicle 200 or to a terminal carried by a user of the other vehicle 200. The determination result may include warning information. The warning information includes information indicating that the vehicle 200 or the other vehicle 200 may be under attack. Also, the warning information may include information indicating which type of sensor is under attack.

[0068] The abnormality detection device 230 is realized by, for example, a TCU 201, an ECU 202, a storage 203, an in-vehicle display 204, and the like.

[0069] The positioning system 240 detects the position of the vehicle 200. The positioning system 240 may be a global positioning system (GPS) or a positioning system using simultaneous localization and mapping (SLAM).

[0070] The vehicle control unit 250 performs autonomous driving control or ADAS control of the vehicle 200. The vehicle control unit 250 is realized by a plurality of ECUs 202.

[0071] FIG. 5 is a diagram showing an example of an object detection result.

[0072] The object detection result shown in FIG. 5 includes a first object detection result and a second object detection result. One row of the object detection result indicates one object detection result. The object detection result includes a timestamp, a vehicle ID, vehicle data, a sensor ID_1, sensor data_1, sensor ID_2, and sensor data_2. The timestamp indicates the timing at which the corresponding object detection result was detected or the timing at which the corresponding object detection result was generated. The vehicle ID indicates an identifier of a device (vehicle) equipped with an object detection device that generated the corresponding object detection result. The vehicle data indicates information about a device (vehicle) equipped with an object detection device that generated the corresponding object detection result. The sensor ID_1 indicates an identifier of a first sensor used for object detection by the object detection device that generated the corresponding object detection result. The sensor data_1 indicates a detection result by the first sensor of the sensor ID_1. The sensor ID_2 indicates an identifier of a second sensor used for object detection by the object detection device that generated the corresponding object detection result. The sensor data_2 indicates a detection result by the second sensor of the sensor ID_2. The first sensor and the second sensor may be sensors of different types. The first sensor may be, for example, a LiDAR, and the second sensor may be, for example, a sonar.

[0073] FIG. 6 is a diagram illustrating an example of the vehicle data.

[0074] The vehicle data includes a vehicle ID, a vehicle coordinate, a vehicle speed vector, and vehicle information. The vehicle ID indicates an identifier of the corresponding vehicle. The vehicle coordinate indicates the position of the vehicle when the corresponding vehicle data is acquired. The vehicle speed vector indicates the vehicle speed and the traveling direction of the vehicle when the corresponding vehicle data is acquired. The vehicle information includes the planar shape of the vehicle of the corresponding vehicle data, the position of each sensor, the coordinate reference point, etc.

[0075] Fig. 7 is a diagram illustrating a first example of sensor data. Fig. 7 is an example of sensor data when the sensor is a LiDAR.

[0076] The sensor data includes a sensor ID, a sensor type, and sensor information. The sensor ID indicates an identifier of a sensor that detected the corresponding sensor data. The sensor type indicates a type of the corresponding sensor. The sensor information indicates a detection result (raw data) detected by the sensor.

[0077] Fig. 8 is a diagram showing a second example of the sensor data, which is an example of the sensor data when the sensor is a sonar.

[0078] The sensor data includes a sensor ID, a sensor type, and sensor information. The sensor ID indicates an identifier of a sensor that detected the corresponding sensor data. The sensor type indicates a type of the corresponding sensor. The sensor information indicates detection results (raw data) detected by the multiple sensors included in the sensor ID.

[0079] FIG. 9 is a diagram illustrating an example of the positioning information.

[0080] The positioning information indicates a position detected by the positioning system 240 of the vehicle 200. The positioning information includes, for example, latitude and longitude indicating the position of the vehicle 200.

[0081] FIG. 10 is a diagram illustrating an example of the warning information.

[0082] The warning information includes a timestamp, a transmitting vehicle ID, a victim vehicle ID, a damaged sensor ID_1, and a damaged sensor ID_2. The timestamp indicates the timing when the warning information was generated. The transmitting vehicle ID indicates the identifier of the vehicle that transmitted (generated) the warning information. The victim vehicle ID indicates the identifier of the vehicle under attack. The damaged sensor ID_1 indicates the identifier of the sensor under attack. The damaged sensor ID_2 indicates the identifier of another sensor under attack.

[0083] Fig. 11 is a diagram showing an example of region information, and Fig. 12 is a diagram for explaining a predetermined region defined by the region information.

[0084] The area information is information stored in advance in the storage 203 of the vehicle 200. The area information includes, for example, information for identifying a predetermined area. The predetermined area is, for example, an area that is used in the determination of step S11 described later, and is predefined as an area where the vehicle 200 is likely to be unable to run normally when the vehicle 200 is subjected to an attack that affects object detection. The predetermined area is, for example, an area where vehicle accidents are more likely to occur than other areas. The area information includes an area ID, latitude 1, longitude 1, latitude 2, and longitude 2. The area ID is an identifier of the predetermined area. The latitude 1 and longitude 1 are information indicating the coordinates of a point P1 at a corner of the predetermined area A1 shown in FIG. 12. The latitude 2 and longitude 2 are information indicating the coordinates of a point P2 diagonally opposite the point P1 in the predetermined area A1. The predetermined area A1 is a rectangular area defined by two points, the points P1 and P2, as shown in FIG. 12.

[0085] [Operation] FIG. 13 is a flowchart illustrating an example of an anomaly detection method in the anomaly detection system according to the embodiment.

[0086] The abnormality detection device 230 of the vehicle 200 determines whether or not it is a predetermined timing (S11). If it is the predetermined timing (Yes in S11), the abnormality detection device 230 proceeds to step S12, and if it is not the predetermined timing (No in S11), the abnormality detection device 230 returns to step S11.

[0087] The predetermined timing may be a timing when the object detection device 220 acquires the first object detection result and the second object detection result generated at corresponding timings. The predetermined timing may be a timing when the vehicle 200 and the other vehicle 200 are included in a predetermined area. In this case, the abnormality detection device 230 acquires the position of the vehicle 200 and the position of the other vehicle 200, and performs the determination of step S11 based on the acquired positions of the vehicle 200 and the other vehicle 200. The predetermined timing may be a time when the vehicle 200 or the other vehicle 200 detects an object in its traveling direction. In this case, the abnormality detection device 230 determines that the predetermined timing is a case where the first object detection result indicates that an object has been detected in the traveling direction of the vehicle 200, or a case where the second object detection result indicates that an object has been detected in the traveling direction of the other vehicle 200.

[0088] The abnormality detection device 230 acquires an object detection result (second object detection result) of the other vehicle 200 (S12).

[0089] Anomaly detection device 230 compares the first object detection result with the second object detection result and determines whether the first object detection result differs from the second object detection result (S13).

[0090] If the first object detection result and the second object detection result are different (Yes in S13), the abnormality detection device 230 determines that one of the vehicle 200 and the other vehicle 200 is under attack (S14).

[0091] If the first object detection result and the second object detection result are the same (No in S13), the anomaly detection device 230 determines that the vehicle 200 and the other vehicles 200 are normal (that is, the vehicle 200 and the other vehicles 200 are not under attack) (S15).

[0092] The anomaly detection device 230 outputs the determination result of step S14 or the determination result of step S15 (S16). Specifically, if step S14 is completed, the anomaly detection device 230 outputs a determination result that one of the vehicles 200 is under attack, and if step S15 is completed, the anomaly detection device 230 outputs a determination result that the vehicle is normal.

[0093] [Principle of false positive] 14 to 16 are diagrams for explaining a method for causing the object detection device to make a false detection.

[0094] 14 shows an example in which an absorbing material 401 that absorbs ultrasonic waves generated by sonar is attached to a surface of an object 400 located in the traveling direction of the vehicle 200, close to the vehicle 200. As a result, ultrasonic waves emitted from the sonar of the vehicle 200 are not reflected because they are absorbed by the absorbing material 401. Therefore, in normal reflected waves that are expected to be reflected when the absorbing material 401 is not attached, waves of a frequency corresponding to ultrasonic waves are measured, but in reflected waves that have been attacked, waves of a frequency corresponding to ultrasonic waves are not measured, so that the vehicle 200 may mistakenly determine that there is no object in the traveling direction.

[0095] FIG. 15 shows an example in which a jamming ultrasonic wave is emitted toward the vehicle 200 by a jamming device 410 that emits ultrasonic waves. An object 400 exists in the traveling direction of the vehicle 200, and the ultrasonic waves emitted from the vehicle 200 are reflected by the object 400, so the vehicle 200 can detect the ultrasonic waves reflected by the object 400. However, since the vehicle 200 continuously receives ultrasonic waves from the jamming device 410, the reflected waves that are attacked continuously contain ultrasonic waves. Therefore, the vehicle 200 may not be able to determine whether or not an object exists in the traveling direction. Therefore, the vehicle 200 may mistakenly determine that no object exists in the traveling direction.

[0096] 16 shows an example in which an absorbing material 401 that absorbs ultrasonic waves generated by sonar is attached to a surface of an object 400 located in the traveling direction of the vehicle 200, the surface being close to the vehicle 200, and a jamming device 410 that emits ultrasonic waves is emitting jamming ultrasonic waves toward the vehicle 200. When the jamming device 410 emits ultrasonic waves toward the vehicle 200 that disguise the distance of the object 400, that is, when the jamming device 410 emits ultrasonic waves toward the vehicle 200 that are detected with a delayed phase as shown in FIG. 16, the vehicle 200 may mistakenly recognize that the object 400 is located farther away than its actual location.

[0097] In this way, an attack on the object detection of the vehicle 200 may cause the vehicle 200 to erroneously detect the presence or absence of an object or the position of the object. Note that, although attacks on sonar have been described with reference to Figs. 14 to 16, attacks on LiDAR can also be realized in a similar manner.

[0098] [Attack detection principle] 17 and 18 are diagrams for explaining the principle of detecting an attack that causes an object to be erroneously detected.

[0099] FIG. 17 is a diagram for explaining an example of detecting an attack that erroneously detects a non-existent object 50 as being present on the vehicle 200 at the position p1.

[0100] FIG. 17 shows a vehicle 200 at a position p1, a vehicle 200 at a position p2 ahead of the vehicle 200 at the position p1, and a jamming device 410 that emits jamming ultrasonic waves that cause the vehicle 200 to erroneously detect an object 50 that does not exist around the vehicle 200. The jamming device 410 emits jamming ultrasonic waves that cause the vehicle 200 to erroneously detect the object 50 as existing at a position p3, by erroneously detecting the object 50. On the other hand, the jamming device 410 can attack the vehicle 200 at the position p1, but it is difficult to simultaneously attack the vehicle 200 at the position p2 that runs ahead of the vehicle 200. Even if the jamming device 410 can simultaneously attack the vehicle 200, it is difficult to cause the two vehicles 200 to erroneously detect that the object 50 exists in the same place. For this reason, when at least one of the two vehicles 200 is under attack, there is a high possibility that the first object detection result of the vehicle 200 at the position p1 and the second object detection result of the vehicle 200 at the position p2 do not match. Therefore, by comparing the first object detection result and the second object detection result, it is possible to determine whether or not at least one of the two vehicles 200 is under attack.

[0101] As described above, when comparing the first object detection result and the second object detection result, coordinate conversion is performed to match one of the coordinate systems. For example, using positions p1 and p2 and the second object detection result, the second object detection result indicating the relative position of position p3 with respect to position p2 is converted to a second object detection result indicating the relative position of position p3 with respect to position p1, using positions p1 and p2 and the second object detection result. This makes it easy to compare the first object detection result and the second object detection result in a coordinate system with position p1 as the reference.

[0102] FIG. 18 is a diagram for explaining an example of detecting an attack that erroneously detects that an object 51 that exists is not present on the vehicle 200 at the position p1.

[0103] FIG. 18 shows a vehicle 200 at a position p1, a vehicle 200 at a position p2 ahead of the vehicle 200 at the position p1, and a jamming device 410 that emits jamming ultrasonic waves that cause the object 51 around these vehicles 200 to be erroneously detected as not existing. Although not shown, an ultrasonic absorbing material may be attached to the surface of the object 51. The jamming device 410 emits jamming ultrasonic waves toward the vehicle 200 to cause the object 50 to be erroneously detected as existing at a position p3. On the other hand, as in the case of FIG. 17, the jamming device 410 can attack the vehicle 200 at the position p1, but it is difficult to simultaneously attack the vehicle 200 at the position p2 traveling ahead. Even if it can attack simultaneously, it is difficult to cause the two vehicles 200 to erroneously detect that the object 50 exists in the same place. For this reason, when at least one of the two vehicles 200 is under attack, there is a high possibility that the first object detection result of the vehicle 200 at position p1 will not match the second object detection result of the vehicle 200 at position p2. Therefore, by comparing the first object detection result and the second object detection result, it is possible to determine whether or not at least one of the two vehicles 200 is under attack.

[0104] The above also applies to the case of an attack that causes the position of an object to be mistakenly detected as different from its actual position, so by comparing the first object detection result and the second object detection result, it is possible to detect an attack on at least one of the vehicle 200 and another vehicle 200.

[0105] [Other examples of object detection results] Other examples of the object detection results will be described with reference to FIGS.

[0106] Fig. 19 is a diagram showing an example of an object detection result when an object is detected using sonar. Fig. 20 is a diagram showing an example of an object detection result when an object is detected using LiDAR. Fig. 21 is a diagram showing an example of an object detection result after a process for commonizing the object detection results by sonar and LiDAR is performed. In Fig. 19, a hatched square in area A14 indicates an object detection result when sonar is used, and in Fig. 20, a hatched circle in area A14 indicates an object detection result when LiDAR is used.

[0107] When detecting an object using sonar, the accuracy of the position where the object is detected is lower than when detecting an object using LiDAR, so the area where the object exists is larger than the detection result of LiDAR. In this way, the area where the object is likely to exist differs depending on the accuracy of the sensor, even if the same object is detected. In other words, when an object is detected using sensors with different accuracy, the first object detection result and the second object detection result may differ even if the object is detected at the same position. For this reason, for example, the surroundings of the vehicle 200 may be divided into eight areas A11 to A14, A16 to A19, and information indicating whether or not an object exists in these eight areas A11 to A14, A16 to A19 may be used as the object detection result. Thereby, for example, as shown in FIG. 21, the object detection result shown in FIG. 19 (square with diagonal hatching) and the object detection result shown in FIG. 20 (circle with diagonal hatching) are converted into an object detection result indicating that an object exists in the area A14. In this way, by making the format of the object detection result common regardless of the accuracy of the sensor, it is possible to easily determine whether or not two object detection results are different.

[0108] [Effects, etc.] Anomaly detection device 230 of this embodiment includes an acquisition unit 231 that acquires a first object detection result generated by a first object detection device (object detection device 220) provided in a first device (vehicle 200) that is a vehicle and that detects objects in the vicinity of the first device, and a second object detection result generated by a second object detection device provided in a second device (another vehicle 200) around the first device and that detects objects in the vicinity of the second device, a determination unit 232 that determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result, and an output unit 233 that outputs the determination result by the determination unit 232.

[0109] According to this, by comparing the first object detection result and the second object detection result, it is determined whether or not at least one of the first device and the second device is under attack, so that, for example, if the first object detection result and the second object detection result are different, it is possible to detect that an attack that causes the object detection device to make a false detection is taking place. Therefore, it is possible to reduce the influence of an attack that causes the object detection device to make a false detection and that affects the driving control of the vehicle.

[0110] Furthermore, in anomaly detection device 230 according to this embodiment, acquisition unit 231 sequentially acquires first object detection results sequentially generated by the first object detection device, and sequentially acquires second object detection results sequentially generated by the second object detection device. Determination unit 232 sequentially compares the first object detection results and the second object detection results generated at corresponding timings, thereby sequentially determining whether or not at least one of the first device and the second device is under attack.

[0111] Therefore, it is possible to sequentially detect attacks that cause the object detection device to make erroneous detections.

[0112] Furthermore, in anomaly detection device 230 according to this embodiment, acquisition unit 231 further acquires a first position of the first device when the first object detection device generates a first object detection result, and a second position of the second device when the second object detection device generates a second object detection result. Determination unit 232 determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result generated when the first position is included in a predetermined area with the second object detection result generated when the second position is included in a predetermined area.

[0113] Therefore, for example, if a specific area is subjected to an attack that affects the vehicle's driving control and there is a high possibility that the vehicle will not be able to drive normally, the attack can be detected, thereby reducing the possibility that the vehicle will not be able to drive normally.

[0114] Furthermore, in anomaly detection device 230 according to this embodiment, judgment unit 232 judges whether or not at least one of the first device and the second device is under attack by comparing a first object detection result indicating that an object has been detected in the traveling direction of the first device with a second object detection result.

[0115] Therefore, it is possible to determine whether or not the object detected by the first device is a false detection.

[0116] Furthermore, in anomaly detection device 230 according to this embodiment, determination unit 232 transforms the first object detection result and the second object detection result into a common coordinate system, and determines whether the transformed first object detection result and the second object detection result differ from each other. If the transformed first object detection result and the second object detection result differ, determination unit 232 determines that at least one of the first device and the second device is under attack.

[0117] Therefore, by comparing the first object detection result and the second object detection result, it is possible to easily determine whether the objects detected by the two devices are the same, and if the objects detected by the two devices are different, it can be determined that at least one of the first device and the second device is under attack.

[0118] Furthermore, in anomaly detection device 230 according to this embodiment, the first object detection result indicates whether or not an object exists in each of a plurality of pre-defined regions surrounding the first device, and the second object detection result indicates whether or not an object exists in each of a plurality of pre-defined regions surrounding the second device.

[0119] Therefore, by comparing the first object detection result and the second object detection result, it can be easily determined whether the objects detected by the two devices are the same.

[0120] [Variations] (1) In the above embodiment, the presence or absence of an attack on at least one of the two vehicles 200 is determined by determining whether or not two object detection results by the object detection devices equipped in the two vehicles 200 differ, but this is not limited thereto. For example, three object detection results by object detection devices equipped in three vehicles 200 may be compared to identify one vehicle 200 that has been the target of an attack.

[0121] FIG. 22 is a block diagram showing an example of a functional configuration of an anomaly detection system according to modification (1).

[0122] An abnormality detection system 1A according to modification (1) differs from the abnormality detection system 1 according to the embodiment in that it has three vehicles 200. Also, the processing by the abnormality detection devices 230 provided in the three vehicles 200 is different. Note that other configurations are similar to the abnormality detection system 1 according to the embodiment, so the following mainly describes the differences.

[0123] The acquisition unit 231 acquires two object detection results by the object detection devices 220 of the two other vehicles 200. That is, in addition to the second object detection result by one of the two other vehicles 200, the acquisition unit 231 further acquires a third object detection result generated by the object detection device 220 (third object detection device) by the other of the two other vehicles 200, which is an object detection device 220 that detects objects in the vicinity of the other vehicle 200.

[0124] The determination unit 232 compares the first object detection result, the second object detection result, and the third object detection result by the object detection device 220 equipped in the vehicle 200, and if it identifies one object detection result among the three object detection results including the first object detection result, the second object detection result, and the third object detection result that is different from the other two object detection results, it determines that the vehicle (device) equipped with the object detection device from which the identified object detection result was obtained is under attack.

[0125] The anomaly detection device 230 may obtain three or more object detection results from three or more other vehicles 200. Even in this case, the anomaly detection device 230 compares four or more object detection results including the vehicle 200 and three or more other vehicles 200, and determines whether or not the majority of the object detection results match. When the majority of the object detection results match, and there is an object detection result that does not match, the vehicle equipped with the object detection device from which the object detection result that does not match may be determined to be under attack. In the above determination, instead of determining whether or not the majority of the object detection results match, it may be determined whether or not a number of object detection results greater than the majority match. That is, the threshold value used for the determination may be changed. For example, this threshold value may be changed according to the number of object detection results to be compared.

[0126] FIG. 23 is a flowchart showing an example of an anomaly detection method in the anomaly detection system according to the modification (1).

[0127] The abnormality detection device 230 of the vehicle 200 determines whether or not it is a predetermined timing (S21). If it is the predetermined timing (Yes in S21), the abnormality detection device 230 proceeds to step S22, and if it is not the predetermined timing (No in S21), the abnormality detection device 230 returns to step S21. The predetermined timing is the same as in the embodiment.

[0128] The abnormality detection device 230 acquires object detection results (second object detection result, third object detection result) of two or more other vehicles 200 (S22).

[0129] The anomaly detection device 230 determines whether all of the object detection results match (S23).

[0130] If all object detection results do not match (No in S23), the anomaly detection device 230 determines that the vehicle 200 corresponding to the majority of the remaining object detection results is under attack, and issues a warning to the vehicle 200 identified as being under attack (S24). Note that, if it is determined that the majority of object detection results do not match, the anomaly detection device 230 may determine that the vehicle 200 corresponding to the non-matching object detection results is under attack, and issue a warning.

[0131] If all the object detection results match (Yes in S23), the anomaly detection device 230 determines that the vehicle 200 and the other vehicles 200 are normal (that is, the vehicle 200 and the other vehicles 200 are not under attack) and notifies the result (S25).

[0132] In this way, it may be possible to identify the vehicle 200 under attack by comparing the object detection results detected from three or more vehicles 200. For this reason, the driver of the vehicle 200 under attack may be notified that the vehicle 200 is under attack, or the vehicle may be subjected to autonomous driving control using object detection results by sensors of other surrounding vehicles 200 until the vehicle switches to manual driving or stops in a safe place (road shoulder), or the drivers of other surrounding vehicles 200 may be notified that the identified vehicle 200 is under attack.

[0133] (2) In the above embodiment, the other vehicle 200 has the object detection device 220, but the object detection device 220 may be provided not only in the other vehicle 200 but also in a device other than the vehicle 200, such as a roadside device. In other words, the second device may be realized by a device that is not running and is stopped, not limited to a device having a running function such as a vehicle. Such a second device such as a roadside device may have, for example, a configuration of the vehicle 200 except for the positioning system 240 and the vehicle control unit 250. In other words, a second device that does not have a running function such as a roadside device includes a communication unit 210, an object detection device 220, and an abnormality detection device 230. Note that the communication unit 210, the object detection device 220, and the abnormality detection device 230 are the same as the configurations of the same names described in the embodiment, and detailed description thereof will be omitted. In addition, the second device may store in advance the position where the second device is located, and use the previously stored position instead of the position detected by the positioning system 240.

[0134] (3) FIG. 24 is a diagram for explaining an example in which each vehicle is equipped with a plurality of types of sensors.

[0135] For example, the first object detection device equipped in vehicle A has a sonar (first sensor of a first type), a LiDAR (second sensor of a second type), and a radar, and the second object detection device equipped in vehicle B has a sonar (third sensor of a first type), a LiDAR (fourth sensor of a second type), and a radar. In this case, it may be determined that the radar is under attack based on the detection result of the sensor in which the inconsistency occurs, for example, as shown in FIG.

[0136] (4) In the above embodiment, the abnormality detection device 230 is provided in the vehicle 200, but the abnormality detection device 230 may be provided in the server 100.

[0137] [others] In the above-described embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software for realizing the production management device, production management system, etc. of the above-described embodiments is a program that causes a computer to execute each step included in the flowchart shown in the figure.

[0138] The following cases are also included in this disclosure:

[0139] (1) Specifically, each of the above devices is a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. Each device achieves its function by the microprocessor operating in accordance with the computer program. Here, a computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0140] (2) Some or all of the components constituting each of the above devices may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0141] (3) Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that is detachable from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the module may include the above-mentioned ultra-multifunction LSI. The microprocessor operates according to a computer program, causing the IC card or the module to achieve its functions. The IC card or the module may be tamper-resistant.

[0142] (4) The present disclosure may be embodied as any of the methods described above. It may also be embodied as a computer program for implementing these methods by a computer, or as a digital signal comprising the computer program.

[0143] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0144] Furthermore, the present disclosure may involve transmitting the computer program or the digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0145] The present disclosure may also provide a computer system having a microprocessor and a memory, the memory storing the above-mentioned computer program, and the microprocessor operating in accordance with the computer program.

[0146] In addition, the program or the digital signal may be implemented by another independent computer system by recording it on the recording medium and transferring it, or by transferring the program or the digital signal via the network, etc.

[0147] (5) The above-described embodiments and modifications may be combined with each other. [Industrial Applicability]

[0148] The present disclosure is useful as an anomaly detection device that can reduce the effects of attacks that affect vehicle driving control other than cyber attacks. [Explanation of symbols]

[0149] 1. Anomaly detection system 50, 51, 400 objects 100 Servers 102 Main memory 103, 203 Storage 200 vehicles 201 TCU 202 ECU 203 Storage 204 In-vehicle display 205 Input IF 206 LiDAR 207 Sonar 210 Communications Department 220 Object detection device 230 Anomaly Detection Device 231 Acquisition Department 232 Judgment section 233 Output section 240 Positioning System 250 Vehicle control unit 300 Communication Network 310 base station 401 Absorbent material 410 Jammer

Claims

1. an acquisition unit that acquires a first object detection result generated by a first object detection device provided in a first device, which is a vehicle, and that detects objects in the vicinity of the first device, and a second object detection result generated by a second object detection device provided in a second device in the vicinity of the first device, and that detects objects in the vicinity of the second device; a determination unit that determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result; an output unit that outputs a determination result by the determination unit; Anomaly detection device.

2. the acquisition unit sequentially acquires a first object detection result sequentially generated by the first object detection device, and sequentially acquires a second object detection result sequentially generated by the second object detection device, The determination unit sequentially compares the first object detection result and the second object detection result generated at corresponding timings to sequentially determine whether or not at least one of the first device and the second device is under attack. The anomaly detection device according to claim 1 .

3. The acquisition unit further acquires a first position of the first device when the first object detection device generates the first object detection result and a second position of the second device when the second object detection device generates the second object detection result, The determination unit determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result generated when the first position is included in a predetermined area with the second object detection result generated when the second position is included in the predetermined area. The anomaly detection device according to claim 1 .

4. The determination unit determines whether or not at least one of the first device and the second device is under attack by comparing the first object detection result, which indicates that an object has been detected in a traveling direction of the first device, with the second object detection result. The anomaly detection device according to claim 1 .

5. The determination unit is Transforming the first object detection result and the second object detection result into a common coordinate system, and determining whether the transformed first object detection result and the transformed second object detection result are different from each other; If the first object detection result and the second object detection result after the conversion are different, it is determined that at least one of the first device and the second device is under attack. The anomaly detection device according to claim 1 .

6. the first object detection result indicates whether or not an object is present in each of a plurality of predetermined regions surrounding the first device; The second object detection result indicates whether or not an object is present in each of a plurality of predetermined regions surrounding the second device. The anomaly detection device according to claim 5 .

7. the first object detection device has a first sensor of a first type and a second sensor of a second type; the second object detection device has a third sensor of the first type and a fourth sensor of the second type, the first object detection result includes a first detection result of the first sensor and a second detection result of the second sensor; the second object detection result includes a third detection result of the third sensor and a fourth detection result of the fourth sensor, The determination unit compares the first detection result, the second detection result, the third detection result, and the fourth detection result, When the determination unit identifies one detection result that is different from the other three detection results among the four detection results including the first detection result, the second detection result, the third detection result, and the fourth detection result, the output unit notifies other vehicles of a sensor type of a sensor from which the identified one detection result was obtained. The anomaly detection device according to claim 1 .

8. The acquisition unit further acquires a third object detection result generated by a third object detection device provided in a third device that is a vehicle different from the first device and detects objects around the third device; The determination unit compares the first object detection result, the second object detection result, and the third object detection result, and when it identifies one object detection result that is different from the other two object detection results among three object detection results including the first object detection result, the second object detection result, and the third object detection result, it determines that a device including the object detection device from which the identified one object detection result was obtained is under attack. The anomaly detection device according to claim 1 .

9. The second device is a vehicle or a roadside device different from the first device. The anomaly detection device according to claim 1 .

10. A first object detection result is obtained by a first object detection device provided in a first device which is a vehicle and which detects objects around the first device, and the first object detection result is generated by the first object detection device; acquiring a second object detection result generated by a second object detection device provided in a second device around the first device, the second object detection device detecting an object around the second device; determining whether or not at least one of the first device and the second device is under attack by comparing the first object detection result with the second object detection result; The result of the judgment is output. Anomaly detection methods.

11. A program for causing a computer to execute the anomaly detection method according to claim 10.

Images