Intrusion detection system, communication system, intrusion detection method and program

Abstract

To provide an IDS for detecting impersonation even in a state in which an object apparatus is stopped.SOLUTION: An intrusion detection system is an intrusion detection system for detecting impersonation in a network to which an apparatus for transmitting a telegraphic message including any of a plurality of pieces of identification information in prescribed time intervals so as to make a transmission order of the identification information a prescribed order is connected receives a telegraphic message flowing in the network, associates identification information included in the telegraphic message with a reception time of the telegraphic message to record them, calculates an order of recorded identification information and intervals of reception times, and determines an occurrence of impersonation to output an alert in the case that the calculated order does not match a prescribed order or that a difference between the calculated intervals and a prescribed time interval is not within an allowable range.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an intrusion detection system, a communication system, an intrusion detection method, and a program. [Background technology]

[0002] There are methods for detecting intrusions into communication systems that include on-board devices installed in vehicles. For example, Patent Document 1 discloses an intrusion detection method in which, in a communication system configured so that multiple devices transmit frames containing their own identification information (referred to as "self-IDs") to each other, if a frame containing the same ID as a self-ID is received, it is determined that spoofing has occurred. With this method, spoofing can only be detected by the device whose self-ID is used (the device targeted for spoofing). Therefore, for example, if an unauthorized device that has performed spoofing shuts down the target device through an attack, the spoofing will not be detected. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-11621 Summary of the Invention [Problem to be solved by the invention]

[0004] There is a need for a method that can detect spoofing even when the device that is the target of spoofing has been shut down.

[0005] The present disclosure provides an intrusion detection system, a communication system, an intrusion detection method, and a program that can solve the above problems. [Means for solving the problem]

[0006] The intrusion detection system disclosed herein is an intrusion detection system that detects spoofing in a network to which devices are connected that transmit messages containing any of a plurality of pieces of identification information at predetermined time intervals so that the identification information is transmitted in a predetermined order, and includes a receiving unit that receives messages flowing through the network and records the identification information contained in the messages in association with the reception times of the messages, and a determining unit that calculates the order in which the identification information is recorded and the interval between the recorded reception times, and determines that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range.

[0007] The intrusion detection method disclosed herein is an intrusion detection method that detects spoofing in a network to which a device is connected that transmits a message containing any of a plurality of pieces of identification information at predetermined time intervals so that the identification information is transmitted in a predetermined order, receives the message flowing through the network, records the identification information contained in the message in association with the reception time of the message, calculates the order in which the identification information was recorded and the interval between the recorded reception times, and determines that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range.

[0008] In addition, the program disclosed herein is an intrusion detection method for detecting spoofing in a network to which a device is connected that transmits messages containing any of a plurality of pieces of identification information at predetermined time intervals so that the transmission order of the identification information is a predetermined order, and causes a computer to execute a process of receiving messages flowing through the network, recording the identification information contained in the messages in association with the reception times of the messages, calculating the order in which the identification information was recorded and the interval between the recorded reception times, and determining that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range. [Effects of the Invention]

[0009] According to the intrusion detection system, communication system, intrusion detection method, and program of the present disclosure, it is possible to detect spoofing even in a situation where the device that has been the target of spoofing has been shut down. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a communication system according to an embodiment. [Figure 2] 4 is a flowchart illustrating an example of an operation of the in-vehicle controller according to the embodiment. [Figure 3] 4 is a timing chart showing an example of an operation of the in-vehicle controller according to the embodiment. [Figure 4] 1 is a timing chart showing an example of a communication state of frames on a network of a communication system according to an embodiment. [Figure 5] FIG. 4 is a diagram illustrating an example of a setting table according to the embodiment. [Figure 6] 1 is a diagram for explaining a method for detecting spoofing according to an embodiment; [Figure 7] 10 is a flowchart illustrating an example of a spoofing detection process according to the embodiment. [Figure 8] FIG. 1 illustrates an example of a hardware configuration of a communication system according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] <Embodiment> The communication system of the present disclosure will be described below with reference to FIGS. (composition) FIG. 1 is a diagram illustrating an example of a communication system according to an embodiment. The communication system 100 is a network system including multiple on-board controllers mounted on a vehicle (not shown). The communication system 100 includes on-board controllers 31 to 33 and a mobile-mounted IDS (Intrusion Detection System) 10. The on-board controllers 31 to 33 and the mobile-mounted IDS are connected by a network NW such as a Controller Area Network (CAN) including communication lines and the like, and are capable of transmitting and receiving data to and from each other. The network NW may be provided with a connection terminal for connecting a maintenance terminal for the communication system 100. The communication system 100 may include a rogue controller 20. The rogue controller 20 is connected to the network NW, for example, via a maintenance connection terminal or the like. The rogue controller 20 has a function of executing a spoofing attack on the on-board controllers 31 to 33 (for example, a function of transmitting frames similar to those of the on-board controllers 31 to 33, or a function of shutting down the on-board controllers 31 to 33).

[0012] The in-vehicle controllers 31 to 33 are configured with computers, and calculate information required for vehicle driving and control, and exchange the calculated information with each other. In general, the processing order of an in-vehicle controller is fixed by a program. Therefore, the interval and transmission order of frames are constant. The operation of the in-vehicle controllers 31 to 33 will be described with reference to FIG. 3, taking the in-vehicle controller 31 as an example. The in-vehicle controller 31 determines whether a predetermined calculation start condition is met (step S1). If the calculation start condition is not met (step S1; No), the in-vehicle controller 31 waits until the calculation start condition is met. If the calculation start condition is met (step S1; Yes), the in-vehicle controller 31 executes control calculation processing (step S2). When the control calculation processing is completed, the in-vehicle controller 31 creates a frame including the result of the control calculation processing, and transmits the created frame to the network NW. At this time, the frame transmission order and transmission interval are controlled to be constant. For example, the in-vehicle controller 31 is configured to transmit a frame with a frame ID of "0x100," a frame with a frame ID of "0x101," and a frame with a frame ID of "0x102" in this order at a predetermined transmission interval. First, the in-vehicle controller 31 creates data for the frame with a frame ID of "0x100" (step S3). Next, the in-vehicle controller 31 transmits the data created in step S3, i.e., the frame with a frame ID of "0x100" (step S4). The frame ID is stored, for example, in the header section of the frame to be transmitted, and the processing result of step S2 is stored in the body section. When a predetermined time has elapsed since transmitting the frame with frame ID = 0x100, the in-vehicle controller 31 then creates data for the frame with frame ID = 0x101 (step S5) and transmits the frame with frame ID = 0x101 (step S6). When a predetermined time has elapsed since transmitting the frame with frame ID=0x101, the in-vehicle controller 31 creates frame data with frame ID=0x102 (step S7). Next, the in-vehicle controller 31 transmits the frame with frame ID=0x102 created in step S7 (step S8).After transmitting the frame with frame ID=0x102, the in-vehicle controller 31 repeats the process from step S1.

[0013] 3 shows a timing chart of the process described with reference to FIG. 2. The in-vehicle controller 31 executes control calculation processing from time t0 to t1 (step S2), creates data with frame ID = 0x100 from time t1 to t2 (step S3), and transmits the frame with frame ID = 0x100 at time t2 (step S4). After transmitting the frame with frame ID = 0x100, at time t3 the in-vehicle controller 31 creates data with frame ID = 0x101 (step S5) and transmits the frame with frame ID = 0x101 at time t4 (step S6). Thereafter, at time t5 the in-vehicle controller 31 creates data with frame ID = 0x102 (step S7) and transmits the frame with frame ID = 0x102 at time t6 (step S8). At time t7, the in-vehicle controller 31 executes control calculation processing again.

[0014] A timing chart of the network NW is shown in Fig. 4. Between times t2 and t3, a frame with frame ID = 0x100 transmitted by the in-vehicle controller 31 flows through the network NW, between times t4 and t5, a frame with frame ID = 0x101 transmitted by the in-vehicle controller 31 flows through the network NW, and between times t6 and t7, a frame with frame ID = 0x102 transmitted by the in-vehicle controller 31 flows through the network NW.

[0015] In this way, each of the vehicle-mounted controllers 31 to 33 transmits frames including predetermined frame IDs in a predetermined order at predetermined time intervals. For example, the vehicle-mounted controller 31 transmits frames in the order of frame IDs = 0x100, 0x101, 0x102, the vehicle-mounted controller 32 transmits frames in the order of frame IDs = 0x200, 0x201, 0x202, and the vehicle-mounted controller 33 transmits frames in the order of frame IDs = 0x300, 0x301, 0x302 (FIG. 1). The mobile-mounted IDS 10 receives frames transmitted through the network NW and monitors the reception order and reception intervals of the frame IDs. For example, focusing on the vehicle-mounted controller 31, if the vehicle-mounted controller 31 is operating normally, the frame IDs included in the frames transmitted by the vehicle-mounted controller 31 and received by the mobile-mounted IDS 10 will be received in the order of 0x100, 0x101, 0x102, with each frame being received at a predetermined time interval. However, since the processing cycles and processing start timings of the vehicle-mounted controllers 31 to 33 are performed individually and independently, there is no unique order of frames received by the mobile-mounted IDS 10. Therefore, the mobile-mounted IDS 10 calculates the frame ID reception order and reception interval for each vehicle-mounted controller 31 to 33 connected to the network NW, and if at least one of these deviates from the predetermined transmission order or predetermined transmission interval, it determines that the vehicle-mounted controller 31, etc. has been spoofed.

[0016] As shown in FIG. 1, the mobile-mounted IDS 10 includes a frame receiving unit 11, a determining unit 12, an output unit 13, and a storage unit 14. The frame receiving unit 11 receives frames transmitted by the in-vehicle controllers 31 to 33 and the unauthorized controller 20, and records the frame ID included in the received frame in association with the reception time of the frame in the storage unit . The determination unit 12 reads out the frame IDs and reception times recorded in the storage unit 14, and determines whether there are any abnormalities in the reception order of the frame IDs and the reception intervals of the frames for each of the vehicle controllers 31-33. When the determination unit 12 determines that there is an abnormality in the reception order of the frame IDs and the reception interval of the frames, the output unit 13 outputs an alert. For example, the output unit 13 displays a message on a display device (not shown) connected to the network NW to notify the occurrence of spoofing, etc.

[0017] The storage unit 14 stores various information. For example, the storage unit 14 stores frame reception history information that associates frame IDs recorded by the frame receiving unit 11 with reception times. Furthermore, for example, the storage unit 14 stores information (for example, a setting table 141 illustrated in FIG. 5) that defines the frame ID transmission order and frame transmission intervals for each of the in-vehicle controllers 31 to 33. As illustrated in FIG. 5, the setting table 141 includes settings that indicate that the in-vehicle controller 31 transmits frames in the order of frame ID=0x100, 0x101, and 0x102, and that the transmission intervals between frames are such that the interval between frame ID=0x100 and frame ID=0x101 is T10, the interval between frame ID=0x101 and frame ID=0x102 is T11, and the interval between frame ID=0x102 and frame ID=0x100 is T12. The same applies to the in-vehicle controllers 32 to 33. The setting table 141 may be set in advance by a person in charge at the manufacturer, or the mobile-mounted IDS 10 may calculate the frame ID transmission order and frame transmission interval (for example, the average value of the intervals between frame reception times recorded in the memory unit 14) for each vehicle-mounted controller 31 to 33 from the frame ID reception order and frame reception interval at a predetermined time recorded by the frame receiving unit 11 in a normal state (for example, an operating environment before shipping in which it has been confirmed that no unauthorized controller 20 is connected), and set the calculated results in the setting table 141.

[0018] FIG. 6 shows a state in which the in-vehicle controller 31 has been subjected to a spoofing attack by the unauthorized controller 20 and has been disabled (stopped). The unauthorized controller 20 does not know the frame ID transmission sequence or frame transmission intervals by the in-vehicle controller 31. Therefore, the unauthorized controller 20 transmits frames in the order of frame IDs = 0x102, 0x101, 0x100, for example. The disabled in-vehicle controller 31 does not transmit frames, and the in-vehicle controllers 32 and 33 transmit frames as in normal operation. In such a case, the frame receiving unit 11 receives frames in the order of frame IDs = 0x200, 0x300, 0x102, 0x201, 0x101, 0x202, 0x100, 0x301, 0x302, for example. The determination unit 12 calculates the frame ID reception order and frame reception interval for each of the in-vehicle controllers 31 to 33 from the frame reception history information recorded in the storage unit 14, and compares the calculated order with the transmission order and frame transmission interval set in the setting table 141. In this example, the order of the frame IDs received for the in-vehicle controller 31 is 0x102, 0x101, 0x100, which is different from the transmission order of 0x100, 0x101, 0x102 set in the setting table 141. The determination unit 12 detects that the reception order of the frame IDs of frames that should have been transmitted from the in-vehicle controller 31 (the fact that the frames were transmitted from the in-vehicle controller 31 can be determined from the frame IDs) is different, and determines that a spoofed in-vehicle controller 31 exists within the network NW. As described above, according to this embodiment, even when the spoofed in-vehicle controller 31 is stopped, it is possible to detect intrusion into the network NW and spoofing.

[0019] 6 is based on the assumption that the in-vehicle controller 31 is disabled, but the same applies when the in-vehicle controller 31 is not disabled and performs control calculations normally. While frames are transmitted from the in-vehicle controller 31 in the correct order and at the correct time intervals, the unauthorized controller 20 transmits frames containing the same frame ID as the in-vehicle controller 31 in the wrong order or at the wrong time intervals, regardless of the in-vehicle controller 31. As a result, the reception order and reception interval of frames containing any of the frame IDs 0x100, 0x101, and 0x102 received by the mobile-mounted IDS 10 differ from the transmission order and time intervals set in the setting table 141, and the determination unit 12 can detect the presence of an impersonation of the in-vehicle controller 31 on the network NW.

[0020] (operation) Next, the flow of the spoofing detection process will be described with reference to FIG. 7 is a flowchart showing an example of a spoofing detection process according to the embodiment. First, the correct frame ID transmission order and transmission interval are set for each of the vehicle-mounted controllers 31-33 (step S11). For example, a person in charge at the manufacturer sets the frame ID transmission order and transmission interval for each of the vehicle-mounted controllers 31-33 in the setting table 141 stored in the storage unit 14. Alternatively, the mobile-mounted IDS 10 may read reception history information of the frame IDs and reception times recorded in the storage unit 14 by the frame receiving unit 11 in a normal state in which it has been confirmed that no unauthorized controller 20 is connected, analyze the reception order and reception interval of the frame IDs for each of the vehicle-mounted controllers 31-33, and set the analyzed reception order of the frame IDs as the transmission order of the frame IDs and the analyzed reception interval as the time interval until the next frame in the setting table 141. Once the correct frame ID transmission order and transmission interval are set, the mobile-mounted IDS 10 begins monitoring for spoofing. The frame receiving unit 11 receives frames transmitted through the network NW, associates the frame ID with the reception time, and records the associated frame ID in the storage unit 14 (step S12). Next, the determination unit 12 determines whether the reception order and reception interval of the frame IDs are normal (step S13). Specifically, the determination unit 12 reads reception history information (information in which frame IDs are associated with reception times and recorded) from the storage unit 14, and determines from which in-vehicle controller 31 or the like the frame ID was transmitted based on the frame ID included in the reception history information, and classifies the reception history information for each in-vehicle controller 31 to 33. The determination unit 12 arranges the frame IDs in order of reception time for each in-vehicle controller 31 to 33, and determines whether the order matches the transmission order set in the setting table 141. The determination unit 12 also arranges the frame IDs in order of reception time for each in-vehicle controller 31 to 33, and calculates the reception interval between the frame IDs. The determination unit 12 determines whether the difference between the calculated reception interval and the time interval to the next frame set in the setting table 141 is within an allowable range.If the reception order of the frame IDs does not match the transmission order set in the setting table 141, or if the difference between the calculated reception interval and the time interval set in the setting table 141 exceeds the allowable range (step S13; No), the determination unit 12 determines that an abnormality has occurred, and determines that spoofing has occurred for the in-vehicle controllers 31 to 33 in which the abnormality has been detected (step S14). If it is determined that spoofing has occurred, the output unit 13 outputs an alert (step S15). For example, the output unit 13 outputs to a display device information about which in-vehicle controller spoofing has been detected, the time of detection, etc. If the reception order of the frame IDs and the reception interval are both normal (step S13; Yes), the processing from step S12 is repeated.

[0021] 7, in step S13, it is determined whether the reception order and reception interval of the frame IDs are normal, but it may be configured to monitor only the reception order of the frame IDs, and determine that spoofing has occurred for the in-vehicle controller 31, etc. in which an abnormality in the transmission order has been detected if the reception order of the frame IDs does not match the transmission order set in the setting table 141. Alternatively, it may be configured to monitor only the reception interval of the frames, and determine that spoofing has occurred for the in-vehicle controller 31, etc. in which an abnormality in the reception interval has been detected if the difference between the reception interval of the frames and the time interval set in the setting table 141 exceeds an allowable range. Also, it may be configured to determine that spoofing has occurred for the in-vehicle controller 31, etc. in which an abnormality has been detected in step S13 only if both the reception order and reception interval of the frame IDs are abnormal.

[0022] (effect) As described above, according to this embodiment, by using an IDS connected to a network, it is possible to detect spoofing attacks with high accuracy, and damage can be expected to be minimized. Furthermore, spoofing can be detected even in situations where the device that is the target of spoofing has been shut down. In the above description, spoofing detection in a network including on-board controllers 31 to 33 mounted on a vehicle is the subject, but the present invention is not limited to general vehicles and can be applied to unmanned vehicles and unmanned forklifts. Furthermore, the present invention is not limited to vehicles and can be applied to various moving objects such as ships and aircraft.

[0023] FIG. 8 is a diagram illustrating an example of a hardware configuration of a communication system. The computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input / output interface 904, and a communication interface 905. The above-described mobile-mounted IDS 10, the on-vehicle controllers 31 to 33, and the unauthorized controller 20 are implemented in the computer 900. The above-described functions are stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads the program from the auxiliary storage device 903, loads it into the main storage device 902, and executes the above-described processing in accordance with the program. The CPU 901 also allocates a storage area in the main storage device 902 in accordance with the program. The CPU 901 also allocates a storage area in the auxiliary storage device 903 for storing data being processed in accordance with the program.

[0024] A program for implementing all or part of the functions of the vehicle-mounted IDS 10, the vehicle-mounted controllers 31-33, and the unauthorized controller 20 may be recorded on a computer-readable recording medium, and the program may be loaded into a computer system and executed to perform processing by each functional unit. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. Furthermore, if a WWW system is used, the term "computer system" also includes the homepage provision environment (or display environment). Furthermore, the term "computer-readable recording medium" refers to portable media such as CDs, DVDs, and USBs, as well as storage devices such as hard disks built into the computer system. Furthermore, if the program is distributed to the computer 900 via a communication line, the computer 900 may load the program into the main storage device 902 and execute the above-described processing. Furthermore, the program may be for implementing part of the above-described functions, or may be capable of implementing the above-described functions in combination with a program already stored in the computer system.

[0025] As described above, several embodiments according to the present disclosure have been described, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0026] <Additional Notes> The intrusion detection system, communication system, intrusion detection method, and program described in the embodiments can be understood, for example, as follows.

[0027] (1) An intrusion detection system according to a first aspect is an intrusion detection system that detects spoofing in a network to which devices are connected that transmit messages containing any of a plurality of pieces of identification information at predetermined time intervals so that the transmission order of the identification information is a predetermined order, and includes a receiving unit that receives messages flowing through the network and records the identification information contained in the messages in association with the reception times of the messages, and a determining unit that calculates the order in which the identification information is recorded and the interval between the recorded reception times, and determines that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range. This makes it possible to detect spoofing even when the device that is the target of spoofing has been shut down.

[0028] (2) An intrusion detection system according to a second aspect is an intrusion detection system that detects spoofing in a network to which a device is connected that transmits a message containing any of a plurality of pieces of identification information in a predetermined order, and includes a receiving unit that receives the message flowing through the network and records the identification information contained in the message in association with the time of reception of the message, and a determining unit that calculates the order in which the identification information was recorded and determines that spoofing has occurred if the calculated order does not match the predetermined order. This makes it possible to detect spoofing even when the device that is the target of spoofing has been shut down.

[0029] (3) An intrusion detection system according to a third aspect is an intrusion detection system that detects spoofing in a network to which devices are connected that transmit messages containing any of a plurality of pieces of identification information at predetermined time intervals so that the transmission order of the identification information is a predetermined order, and includes a receiving unit that receives messages flowing through the network and records the identification information contained in the messages in association with the reception times of the messages, and a determining unit that calculates the interval between the recorded reception times and determines that spoofing has occurred if the difference between the calculated interval and the predetermined time interval is not within an acceptable range. This makes it possible to detect spoofing even when the device that is the target of spoofing has been shut down.

[0030] (4) An intrusion detection system according to a fourth aspect is an intrusion detection system according to any one of (1) to (3), further comprising an output unit that outputs an alert when the determination unit determines that impersonation has occurred. This allows for quick action to be taken against the presence of impersonation.

[0031] (5) The intrusion detection system according to the fifth aspect is the intrusion detection system of (1), further comprising an analysis unit that reads out the identification information and the reception time that are associated and recorded by the receiving unit under normal conditions, and calculates the order in which the identification information is received and the reception interval of the telegram, and the determination unit determines that impersonation has occurred if the order in which the identification information is received calculated by the analysis unit does not match the order, and / or if the difference between the reception interval calculated by the analysis unit and the interval is not within an acceptable range. This eliminates the need to manually set the correct frame ID transmission order or frame transmission interval.

[0032] (6) A communication system according to a sixth aspect is a communication system mounted on a vehicle having an on-board controller (on-board device) as the equipment, and includes an intrusion detection system according to any one of (1) to (4), one or more on-board controllers, and a network connecting the intrusion detection system and the on-board controllers.

[0033] (7) An intrusion detection method according to a seventh aspect is an intrusion detection method for detecting spoofing in a network to which a device is connected that transmits a message containing any of a plurality of pieces of identification information at predetermined time intervals so that the transmission order of the identification information is a predetermined order, the intrusion detection method receiving the message flowing through the network, recording the identification information contained in the message in association with the reception time of the message, calculating the order in which the identification information was recorded and the interval between the recorded reception times, and determining that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range.

[0034] (8) A program according to an eighth aspect is an intrusion detection method for detecting spoofing in a network to which a device is connected, which transmits a message including any of a plurality of pieces of identification information at predetermined time intervals so that the transmission order of the identification information is a predetermined order, and causes a computer to execute the following process: receive a message flowing through the network; record the identification information included in the message in association with the reception time of the message; calculate the order in which the identification information was recorded and the interval between the recorded reception times; and determine that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an acceptable range. [Explanation of symbols]

[0035] 10. Mobile-mounted IDS 11. Frame receiver 12... Judgment section 13. Output section 14...Storage section 20. Rogue Controller 31, 32, 33... In-vehicle controller 100 Communication Systems 900···Computer 901 CPU 902...Main memory 903...Auxiliary storage device 904 Input / Output Interface 905···Communication Interface

Claims

1. An intrusion detection system for detecting spoofing in a network to which a device is connected, the device transmitting a message including any one of a plurality of pieces of identification information at predetermined time intervals in such a manner that the transmission order of the identification information is a predetermined order, comprising: a receiving unit that receives a message transmitted over the network and records the identification information included in the message in association with a time when the message was received; a determination unit that calculates an order in which the identification information was recorded and an interval between the recorded reception times, and determines that spoofing has occurred if the calculated order does not match the predetermined order and / or if a difference between the calculated interval and the predetermined time interval is not within an allowable range; An intrusion detection system comprising:

2. 1. An intrusion detection system for detecting spoofing in a network to which a device is connected, the device transmitting a message including any one of a plurality of pieces of identification information in a predetermined order, the intrusion detection system comprising: a receiving unit that receives a message transmitted over the network and records the identification information included in the message in association with a time when the message was received; a determination unit that calculates an order in which the identification information was recorded, and determines that spoofing has occurred if the calculated order does not match the predetermined order; An intrusion detection system comprising:

3. An intrusion detection system for detecting spoofing in a network to which a device is connected, the device transmitting a message including any one of a plurality of pieces of identification information at predetermined time intervals in such a manner that the transmission order of the identification information is a predetermined order, comprising: a receiving unit that receives a message transmitted over the network and records identification information included in the message in association with a time when the message was received; a determination unit that calculates an interval between the recorded reception times, and determines that spoofing has occurred if a difference between the calculated interval and the predetermined time interval is not within an allowable range; An intrusion detection system comprising:

4. an output unit that outputs an alert when the determination unit determines that spoofing has occurred; The intrusion detection system according to claim 1 , further comprising:

5. an analysis unit that reads out the identification information and the reception time that are associated and recorded by the receiving unit under normal conditions, and calculates the reception order of the identification information and the reception interval of the telegram; Furthermore, the determination unit determines that spoofing has occurred when the order of reception of the identification information calculated by the analysis unit does not match the order, and / or when a difference between the reception interval calculated by the analysis unit and the interval is not within an allowable range. The intrusion detection system of claim 1 .

6. A communication system mounted on a vehicle using the device as an on-board controller, An intrusion detection system according to any one of claims 1 to 3; one or more of the on-board controllers; a network connecting the intrusion detection system and the in-vehicle controller; A communication system including:

7. 1. An intrusion detection method for detecting spoofing in a network to which a device is connected, the device transmitting a message including any one of a plurality of pieces of identification information at predetermined time intervals in such a manner that the transmission order of the identification information is a predetermined order, comprising: receiving a message transmitted over the network, and recording the identification information included in the message and the time of reception of the message in association with each other; calculating an order in which the identification information was recorded and an interval between the recorded reception times, and determining that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an allowable range; Intrusion detection methods.

8. On the computer, 1. An intrusion detection method for detecting spoofing in a network to which a device is connected, the device transmitting a message including any one of a plurality of pieces of identification information at predetermined time intervals in such a manner that the transmission order of the identification information is a predetermined order, comprising: receiving a message transmitted over the network, and recording the identification information included in the message and the time of reception of the message in association with each other; a process of calculating an order in which the identification information was recorded and an interval between the recorded reception times, and determining that spoofing has occurred if the calculated order does not match the predetermined order and / or if the difference between the calculated interval and the predetermined time interval is not within an allowable range; A program that executes the following.

Images