Anomaly determination method, anomaly determination device, and program

Abstract

To provide an anomaly determination method that can perform effective anomaly detection processing.SOLUTION: An anomaly determination method includes receiving, as a received message, each of a plurality of messages which include a plurality of messages that are periodic and each of which includes a first field having a fixed value, calculating the time available for determining an anomaly in the received messages, obtaining a level determined by the calculated time, and selecting one of the following, according to the level, among n anomaly determinations: selecting all n anomaly determinations, selecting k anomaly determinations, or selecting none of the anomaly determinations. The n anomaly determinations include an anomaly determination that uses the reception timing based on the periodicity, or the number of received messages, and an anomaly determination that uses the first field.SELECTED DRAWING: Figure 12

Description

[Technical Field]

[0001] The present disclosure relates to a method for determining a detection function according to a processing load when detecting an abnormal message in an in-vehicle network. [Background technology]

[0002] In recent years, systems inside automobiles have been equipped with numerous devices called Electronic Control Units (ECUs). The communication network that connects these ECUs is called an in-vehicle network. There are many communication standards for in-vehicle networks. One of the most mainstream standards for in-vehicle networks is the Controller Area Network (hereafter referred to as CAN).

[0003] In a network based on the CAN standard (hereinafter referred to as a CAN network), the communication path (bus) consists of two cables, and the ECUs connected to the bus are also called nodes. Each node connected to the bus sends and receives data in units called frames or messages. CAN does not use identifiers to indicate the destination or source of data.

[0004] The node that sends a frame (hereafter referred to as the sending node) attaches an ID called a message ID that indicates the type of message to each message, and sends the message; in other words, sends a signal onto the bus. The node that receives the message (hereafter referred to as the receiving node) receives only messages that contain a predetermined message ID; in other words, it reads the signal from the bus. Messages with the same ID are sent at regular intervals.

[0005] As mentioned above, the numerous ECUs installed in automobile systems are each connected to a CAN network and operate by exchanging various messages with each other.

[0006] Here, an ECU that has a communication function with the outside of the CAN network may be illegally accessed from outside and may be illegally controlled by someone, causing the ECU to send an abnormal message (also called an attack message) to the CAN network. Such an ECU that has been illegally controlled by someone (also called a fraudulent ECU) may, for example, masquerade as another ECU and send an abnormal message, thereby illegally controlling the vehicle. A method for detecting such so-called spoofing attacks is disclosed, for example, in Patent Document 1. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] International Publication No. 2015 / 151418 Summary of the Invention [Problem to be solved by the invention]

[0008] However, the method disclosed in Patent Document 1 has a problem in that the abnormality detection process is not executed when the time available to execute the abnormality detection process for detecting an abnormal message sent to the in-vehicle network is short.

[0009] Therefore, the present disclosure provides an abnormality determination method and an abnormality determination device that can perform effective abnormality detection processing. [Means for solving the problem]

[0010] In order to solve the above problem, an abnormality determination method according to one embodiment of the present disclosure is an abnormality determination method for determining abnormalities in received messages, which receives, as the received messages, multiple messages including multiple messages having periodicity, each of the multiple messages including a first field having a fixed value, calculates a time available for determining abnormalities in the received messages, obtains a level determined by the calculated time, and, depending on the level, selects one of: (i) selecting all n abnormality determinations out of n abnormality determinations (n is a positive integer), (ii) selecting k abnormality determinations (k is a positive integer and k≦n) out of the n abnormality determinations, or (iii) selecting none of the n abnormality determinations, wherein the n abnormality determinations include an abnormality determination that uses the reception timing based on the periodicity or the number of the received messages, and an abnormality determination that uses the first field.

[0011] These comprehensive or specific aspects may be realized as a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium. [Effects of the Invention]

[0012] According to the abnormality determination method and the like according to one aspect of the present disclosure, it is possible to perform an appropriate abnormality detection process according to the detection process time. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing the overall configuration of an in-vehicle network system according to the first embodiment. [Figure 2] FIG. 2 is a diagram showing a format of a message (data frame) of the CAN protocol according to the first embodiment. [Figure 3]FIG. 3 is a block diagram showing an example of a gateway included in the in-vehicle network system according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of a reception ID list according to the first embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of a transfer rule according to the first embodiment. [Figure 6] FIG. 6 is a block diagram showing an example of an abnormality detection processing function group according to the first embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of the relationship between the determination function and the processing time and detection performance according to the first embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of the relationship between the determination function and the processing time and detection performance according to the first embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of the relationship between the determination function and the processing time and detection performance according to the first embodiment. [Figure 10] FIG. 10 is a block diagram showing an example of an ECU included in the in-vehicle network system according to the first embodiment. [Figure 11] FIG. 11 is a flowchart illustrating an example of the transfer process according to the first embodiment. [Figure 12] FIG. 12 is a flowchart showing another example of the abnormality detection process according to the first embodiment. [Figure 13] FIG. 13 is a flowchart showing yet another example of the abnormality detection process according to the first embodiment. [Figure 14] FIG. 14 is a flowchart showing another example of the abnormality detection process according to the first embodiment. [Figure 15] FIG. 15 is a flowchart showing yet another example of the abnormality detection process according to the first embodiment. [Figure 16] FIG. 16 is a flowchart showing another example of the abnormality detection process according to the first embodiment. [Figure 17] FIG. 17 is a flowchart showing an example of an abnormality detection process including a reset process according to the first embodiment. [Figure 18] FIG. 18 is a flowchart showing another example of the abnormality detection process including the reset process according to the first embodiment. [Figure 19] FIG. 19 is a flowchart showing yet another example of the abnormality detection process including the reset process according to the first embodiment. [Figure 20] FIG. 20 is a diagram showing an example of a reset process in the modified example. [Figure 21] FIG. 21 is a block diagram showing an example of an abnormality detection processing function group according to the second embodiment. [Figure 22] FIG. 22 is a flowchart illustrating an example of the abnormality detection process according to the second embodiment. [Figure 23] FIG. 23 is a flowchart showing another example of the abnormality detection process according to the second embodiment. [Figure 24] FIG. 24 is a flowchart showing yet another example of the abnormality detection process according to the second embodiment. [Figure 25] FIG. 25 is a flowchart showing another example of the abnormality detection process according to the second embodiment. [Figure 26] FIG. 26 is a flowchart showing yet another example of the abnormality detection process according to the second embodiment. [Figure 27] FIG. 27 is a block diagram showing an example of an abnormality detection processing function group according to the third embodiment. [Figure 28] FIG. 28 is a block diagram showing another example of the abnormality detection processing function group according to the third embodiment. [Figure 29] FIG. 29 is a diagram showing an example of non-selection information according to the third embodiment. [Figure 30] FIG. 30 is a flowchart showing an example of the abnormality detection process according to the third embodiment. [Figure 31] FIG. 31 is a flowchart showing another example of the abnormality detection process according to the third embodiment. [Figure 32] FIG. 32 is a flowchart showing an example of the non-selected information following process according to the third embodiment. [Figure 33] FIG. 33 is a table showing the determination functions and the selection conditions for the determination functions in the modified example. [Figure 34] FIG. 34 is a flowchart showing an example of an abnormality detection process in the modified example. [Figure 35] FIG. 35 is a flowchart showing another example of the abnormality detection process in the modified example. [Figure 36] FIG. 36 is a block diagram showing an example of an ECU in a modified example. [Figure 37] FIG. 37 is a block diagram showing another example of an ECU in the modified example. [Figure 38] FIG. 38 is a block diagram showing the overall configuration of an in-vehicle network system according to a modified example. [Figure 39] FIG. 39 is a block diagram showing an example of a communication ECU included in an in-vehicle network system according to a modified example. [Figure 40] FIG. 40 is a block diagram showing an example of a server in the modified example. [Figure 41] FIG. 41 is a table showing the determination functions and the selection conditions for the determination functions in the modified example. DETAILED DESCRIPTION OF THE INVENTION

[0014] (Knowledge that forms the basis of this disclosure) When a function that detects the transmission of an abnormal message on a CAN network generates and outputs the detection result and information related to the detection result as a log, a large amount of data is required to perform a detailed post-mortem check of the circumstances that led to the detection of the abnormality. However, if the storage capacity of the log output destination or the communication volume required to send the detection result to the log output destination is large, it will incur a significant time or resource cost.

[0015] Therefore, an abnormality determination method according to one embodiment of the present disclosure is an abnormality determination method for determining an abnormality in a received message, which receives as the received message a plurality of messages including a plurality of periodic messages, each of the plurality of messages including a first field having a fixed value and a second field having a variable value, and selects, depending on one or more criteria of the time, load, data amount, or number of messages, whether the abnormality determination method is to be executed, whether the determination will be made based on the reception timing based on the periodicity, or one or more of a plurality of abnormality determinations, each of which is composed of one or more of an abnormality determination using the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field.

[0016] As a result, the abnormality determination method according to one aspect of the present disclosure can perform appropriate abnormality detection processing according to the detection processing time, which is a limited time.

[0017] Furthermore, an abnormality determination device according to one embodiment of the present disclosure is an abnormality determination device in an in-vehicle network system including a network and one or more electronic control units connected to the network, and includes one or more processors and a memory unit accessible from the one or more processors, wherein the one or more processors receive, as the received messages, a plurality of messages including a plurality of periodic messages, each including a first field having a fixed value and a second field having a variable value, from the network, and selects, depending on one or more criteria of the time, load, data amount, or number of messages during which the abnormality determination method can be executed, whether to perform the determination using the reception timing based on the periodicity, or one of a plurality of combinations each consisting of one or more of a plurality of abnormality determinations including an abnormality determination using the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field.

[0018] As a result, the abnormality determination device according to one aspect of the present disclosure can perform appropriate abnormality detection processing according to the detection processing time, which is a limited time.

[0019] A program according to one aspect of the present disclosure is a program for causing the one or more processors in the abnormality determination device to execute the abnormality determination method.

[0020] This allows appropriate abnormality detection processing to be performed according to the detection processing time.

[0021] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0022] It should be noted that the embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component arrangements and connection forms, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as components that are optionally included.

[0023] (Embodiment 1) [1. Overview] In this embodiment, a detailed description will be given with reference to the drawings of a case in which an abnormality is determined by appropriately controlling the execution of a function for determining an abnormality in an in-vehicle network system depending on the time that the abnormality detection process can be executed.

[0024] [1.1 Overall configuration of in-vehicle network system] FIG. 1 is a block diagram showing the overall configuration of an in-vehicle network system according to this embodiment.

[0025] 1, the in-vehicle network system 10 is configured with a CAN network and includes ECU 100a, ECU 100b, ECU 100c, and ECU 100d, buses 200a and 200b, and a gateway 300. Note that the ECU 100a, ECU 100b, ECU 100c, and ECU 100d are examples of electronic control units.

[0026] In the following description, the ECU 100a, ECU 100b, ECU 100c, and ECU 100d may be collectively referred to as ECU 100, or may refer to an unspecified portion of the ECUs.

[0027] In the following description, the bus 200a and the bus 200b may be referred to as the bus 200 collectively or without specifying either one.

[0028] The ECU 100a is connected to an engine 101, the ECU 100b is connected to a brake 102, the ECU 100c is connected to a door opening / closing sensor 103, and the ECU 100d is connected to a window opening / closing sensor 104.

[0029] ECU 100 acquires messages that indicate the status of connected devices and periodically sends the messages that indicate the acquired status to bus 200. For example, ECU 100a acquires information about the rotation speed, which is one of the statuses of engine 101, and sends a message that includes a data value that indicates this rotation speed to bus 200 with a predetermined ID attached.

[0030] Furthermore, each ECU 100 reads messages transmitted by other ECUs 100 from the bus 200 and selectively receives the messages according to the IDs attached to the messages. This selective reception will be described later.

[0031] The gateway 300 connects the bus 200a, to which the ECUs 100a and 100b are connected, with the bus 200b, to which the ECUs 100c and 100d are connected. The gateway 300 has a function of transferring a message received from one bus 200 to the other bus 200. The gateway 300 is also a node on the CAN network.

[0032] The in-vehicle network system is an example for determining whether a message is an abnormal message or not, and for explaining an object to which the abnormality determination method and the like can be applied, and the object to which it can be applied is not limited to an in-vehicle network system.

[0033] [1.2 Message data format] 2 is a diagram showing the format of a message (data frame) of the CAN protocol, showing a message in the standard ID format of the CAN protocol.

[0034] The message consists of a Start Of Frame (SOF), an ID field, a Remote Transmission Request (RTR), an IDE (IDentifier Extension), a reserved bit (r), a Data Length Code (DLC), a data field, a CRC (Cycric Redundancy Check) sequence, a CRC delimiter (DEL on the left in the figure), an ACK (Acknowledgement) slot, an ACK delimiter (DEL on the right in the figure), and an EOF (End Of Frame).

[0035] SOF is a 1-bit dominant. Dominant means dominant. In a CAN network, which uses digital data transmission, dominant refers to the state in which voltage is applied to two cables constituting a bus to transmit a value of "0," or the value of this "0" transmitted. In contrast, recessive refers to the state in which voltage is applied to two cables constituting a bus to transmit a value of "1," or the value of this "1" transmitted. Recessive means inferior. If two nodes simultaneously transmit a value of "0" and a value of "1" to the bus, the value of "0" takes precedence. When the bus is idle, it is in a recessive state. Each ECU 100 begins transmitting a message by changing the state of the bus 200 from recessive to dominant, and other ECUs 100 read this change and synchronize. In Figure 2, the solid lines indicating the dominant or recessive values constituting the message indicate that the message can take either a dominant or recessive value. Since the SOF is fixed in the dominant state, the dominant line is solid and the recessive line is dashed.

[0036] An ID is an 11-bit value that indicates the type of data contained in a message. CAN is designed so that when multiple nodes start sending messages at the same time, messages with smaller ID values have higher priority. ID is synonymous with message ID and CAN ID.

[0037] RTR is a 1-bit dominant that indicates that the frame is a message.

[0038] Each IDE is a 1 bit dominant. A message is also called a data frame.

[0039] DLC is a 4-bit value that indicates the length of the following data field.

[0040] The data field is a value that indicates the content of the data being sent, and is up to 64 bits long, and the length can be adjusted in 8-bit increments. The specifications for allocating data to this section depend on the vehicle model or manufacturer.

[0041] The CRC sequence is a 15-bit value calculated from the transmitted values of the SOF, ID field, control field, and data field.

[0042] The CRC delimiter is a fixed 1-bit recessive delimiter that indicates the end of the CRC sequence. The receiving node determines whether there are any errors by comparing the result calculated from the SOF, ID field, control field, and data field values of the received message with the value of the CRC sequence.

[0043] The ACK slot is 1 bit long, and the transmitting node sends a recessive bit in this portion. The receiving node sends a dominant bit as an acknowledgment if it has received the CRC sequence correctly. Since dominant bits take priority, if communication of one message has been performed correctly up to the CRC sequence, the bus 200 is dominant during the transmission of the ACK slot.

[0044] The ACK delimiter is fixed to 1 recessive bit and is a delimiter that indicates the end of the ACK slot.

[0045] EOF is fixed to 7-bit recessive and indicates the end of the message.

[0046] [1.3 Gateway Configuration] 3 is a block diagram showing an example of a gateway 300 included in the in-vehicle network system 10 according to the first embodiment. In FIG. 3, the gateway 300 includes a frame transmitting / receiving unit 310, a frame interpretation unit 320, a received ID determination unit 330, a received ID list holding unit 340, a frame processing unit 350, a transfer rule holding unit 360, an anomaly detection processing function group 370, and a frame generation unit 380.

[0047] Note that these configurations indicate functions, and the gateway 300 is provided as an information processing device that includes, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory, etc., an input / output unit realized by an input / output port, etc.

[0048] The configuration exhibiting the above functions is realized by reading and executing a program stored in the storage unit by the processing unit and recording predetermined data in the storage unit. Alternatively, instead of recording predetermined data in the storage unit, these configurations may be realized by transmitting and receiving data via the input / output unit. Alternatively, the configuration exhibiting the above functions may be realized by a combination of these.

[0049] The frame transmitting / receiving unit 310 transmits and receives messages conforming to the CAN protocol to and from each of the buses 200a and 200b.

[0050] More specifically, the frame transmitting / receiving unit 310 reads out the message sent to the bus 200 bit by bit, and transfers the read out message to the frame interpreting unit 320 .

[0051] Furthermore, the frame transmitting / receiving unit 310 transmits a message to the buses 200a and 200b one bit at a time in accordance with the bus information transmitted from the frame generating unit 380.

[0052] The frame transmitting / receiving unit 310 transfers messages between the buses 200 by transmitting messages received from the bus 200a to the bus 200b and transmitting messages received from the bus 200b to the bus 200a.

[0053] The frame interpretation unit 320 receives message values from the frame transmission / reception unit 310, maps them to each field in the CAN protocol, and interprets the received message. The frame interpretation unit 320 transfers the series of values it has interpreted as ID field values to the received ID determination unit 330.

[0054] The frame interpretation unit 320 further determines, depending on the judgment result sent from the received ID judgment unit 330, whether to transfer the value of the ID field of the message and the data fields that appear after the ID field to the frame processing unit 350, or to cancel reception of the message.

[0055] Furthermore, if the frame interpretation unit 320 determines that the received message does not conform to the CAN protocol, it requests the frame generation unit 380 to transmit an error frame.

[0056] An error frame is a frame in a specific format defined by the CAN protocol that is sent from a node when an error occurs on the CAN network. When an error frame is sent to the bus, message transmission on that network is interrupted.

[0057] Furthermore, if the frame interpretation unit 320 interprets that the received frame is an error frame transmitted by another node, it discards the message being read.

[0058] The received ID determination unit 330 receives the value of the ID field from the frame interpretation unit 320, and determines whether or not to receive the read message according to the list of message IDs held by the received ID list holding unit 340. The received ID determination unit 330 sends the result of this determination to the frame interpretation unit 320.

[0059] The received ID list holding unit 340 holds a list of message IDs (also called a received ID list) received by the gateway 300. Fig. 4 is a diagram showing an example of the received ID list in the first embodiment. The received ID list in Fig. 4 will be described in detail later.

[0060] The frame processing unit 350 determines the destination bus 200 based on the ID of the received message in accordance with the rules regarding data transfer stored in the transfer rule storage unit 360, and sends information indicating the destination bus 200, the message ID sent from the frame interpretation unit 320, and the data to be transferred to the frame generation unit 380.

[0061] Furthermore, the frame processing unit 350 sends the message received from the frame interpretation unit 320 to the anomaly detection processing function group 370, and requests the anomaly detection processing function group 370 to determine whether or not the message is an abnormal message. The frame processing unit 350 does not forward a message that is determined to be an abnormal message by the anomaly detection processing function group 370.

[0062] The transfer rule storage unit 360 stores rules (hereinafter also referred to as transfer rules) relating to data transfer for each bus 200. Fig. 5 is a diagram showing an example of the transfer rules according to the first embodiment. The details of the transfer rules in Fig. 5 will be described later.

[0063] The abnormality detection processing function group 370 is a function group that determines whether a message being received is an abnormal message. The functional configuration included in the abnormality detection processing function group 370 will be described in detail later. The abnormality detection processing function group 370 sends the determination result to the frame processing unit 350.

[0064] In response to a request for error frame transmission from the frame interpretation unit 320, the frame generation unit 380 generates an error frame and causes the frame transmission / reception unit 310 to transmit the error frame.

[0065] Furthermore, the frame generation unit 380 generates a message frame using the message ID and data received from the frame processing unit 350, and sends the message frame to the frame transmission / reception unit 310 together with the bus information.

[0066] [1.4 Receiving ID List] As shown in FIG. 4, the reception ID list is a list of message IDs of messages that the gateway 300 receives and processes, and is held in the reception ID list holding unit 340 .

[0067] 4, the receiving ID list stores a message ID in each row. The receiving ID list in FIG. 4 has message IDs "1," "2," "3," and "4," and the gateway 300 receives messages with these message IDs. The gateway 300 stops receiving messages with message IDs that are not included in the receiving ID list.

[0068] The ID values and the number of IDs included in the received ID list are merely examples for the purpose of explanation, and the configuration of the received ID list used in the gateway 300 is not limited to this.

[0069] [1.5 Transfer Rules] The transfer rules are stored in the transfer rule storage unit 360. In Fig. 5, the transfer rules store in each row a combination of the bus 200 from which the message is transferred, the bus 200 to which the message is transferred, and the message ID to be transferred.

[0070] Specifically, the first line of the transfer rule specifies the source "bus 200a," the destination "bus 200b," and the ID "*," and the gateway 300 transfers messages received from bus 200a to bus 200b regardless of the ID. The second line of the transfer rule specifies the source "bus 200b," the destination "bus 200a," and the ID "3," and the gateway 300 transfers messages received from bus 200b to bus 200a if the message has the ID "3."

[0071] [1.6 Configuration of anomaly detection processing functions] 6 is a block diagram showing an example of an abnormality detection processing function group according to Embodiment 1. In FIG. 6, abnormality detection processing function group 370 includes determination function selection unit 371, control unit 372, abnormality detection unit 373, and detection rule storage unit 381.

[0072] These configurations indicate functions, and are realized in gateway 300 by the processing unit reading and executing a program stored in the memory unit, by the processing unit storing specified data in the memory unit, or by the processing unit transmitting and receiving data via the input / output unit, or by a combination of these.

[0073] The determination function selection unit 371 selects which determination function to execute from among the determination functions included in the anomaly detection unit 373 and sends the result to the control unit. The determination function selection unit 371 calculates the time available for the anomaly detection process by the anomaly detection unit 373 (detection processing time) and selects a determination function that fits within the detection processing time. FIG. 7 is a diagram showing an example of the relationship between the determination function, processing time, and detection performance in the first embodiment. For example, the determination function selection unit 371 holds the processing time and detection performance (e.g., false detection rate and detection rate) for each determination function as shown in FIG. 7, and determines a combination of determination functions that fits within the detection processing time calculated by the determination function selection unit 371 and selects the determination function. At this time, if there are multiple combinations of determination functions that fit within the detection processing time calculated by the determination function selection unit 371, the combination with the best detection performance (e.g., a combination with a low false detection rate and a high detection rate) is selected.

[0074] The control unit 372 controls the abnormality detection unit 373 so that the function selected by the determination function selection unit 371 from among the determination functions provided in the abnormality detection unit 373 is executed by the abnormality detection unit 373 .

[0075] The anomaly detection unit 373 includes at least seven types of determination functions. Specifically, the determination functions include a function to determine whether a DoS attack is occurring based on the amount of messages transmitted per unit time (the amount of messages is also referred to as the amount of data), a function to check the ID field of a message, a function to check the data length of a message, a function to check the period in which a message is transmitted (the period may be a time interval) for each CAN ID, a function to check the frequency at which a message is transmitted for each CAN ID, and a function to check the value of a data field of a message (the value of the data field is referred to as a data value).

[0076] The above-mentioned functions are called, in order, the DoS attack determination function, ID determination function, data length determination function, transmission period determination function, transmission frequency determination function, and data value determination function. Abnormality determination that uses reception timing based on periodicity or the number of received messages is the DoS attack determination function, transmission period determination function, transmission frequency determination function, etc. Abnormality determination that uses a field with a fixed value is the ID determination function, etc. Fields with fixed values, such as the ID field, are specific examples of first fields. Additionally, abnormality determination that uses a field with a variable value is the data length determination function and data value determination function, etc. Fields with variable values, such as the data field, are specific examples of second fields.

[0077] Furthermore, the abnormality detection unit 373 includes a function for recognizing and checking the vehicle state based on the determination results of these determination functions, the transmission cycle, the frequency, the data value, or the amount of change in the data value. This function is called a vehicle state determination function. Furthermore, the abnormality detection unit 373 includes a comprehensive determination function for comprehensively determining whether a message received from the frame processing unit 350 is an abnormal message based on the determination results of these determination functions. The result determined by the comprehensive determination function becomes the result of the detection process by the abnormality detection unit 373.

[0078] The detection rule storage unit 381 stores the judgment criteria required to execute each judgment function. The detection rule storage unit 381 stores individual judgment criteria for each CAN ID. Furthermore, the anomaly detection unit 373 may not execute a judgment function because no detection rule has been set. The control unit 372 controls the execution of the judgment function in accordance with the judgment criteria stored in the detection rule storage unit 381.

[0079] As described above, the detection rule storage unit 381 stores a judgment criterion for each CAN ID, and the judgment criterion differs for each judgment function. The judgment function for which the judgment criterion exists differs for each CAN ID. A single judgment function may have multiple judgment criteria for each CAN ID. Therefore, the judgment function that the judgment function selection unit 371 preferentially selects differs for each CAN ID of the received message.

[0080] Note that, if there are multiple combinations of determination functions that fit within the calculated detection processing time, the determination function selection unit 371 selects the combination of determination functions with the best detection performance, but this is not limited to this. For example, a combination with a low false positive rate and a high detection rate was selected, but this is not limited to this. The determination function selection unit 371 may select a combination of determination functions using only either the false positive rate or the detection rate as detection performance, or may use an evaluation index representing detection performance such as detection accuracy (Precision), F-measure, Infomedness, or Markedness, or a combination of these, instead of the false positive rate or the detection rate. Therefore, the determination function selection unit 371 can select an effective combination of determination functions for a target system by adopting an appropriate index for each system.

[0081] Note that the determination function selection unit 371 determines a combination of determination functions that fits within the calculated detection processing time and selects an appropriate combination from among the combinations of determination functions, but this is not limited to this. FIG. 8 is a diagram showing an example of the relationship between the determination functions and the processing time / detection performance in the first embodiment. As shown in FIG. 8, for example, when processing is performed in the order of the DoS attack determination function, ID determination function, data length determination function, transmission period determination function, data value (range) determination function, and vehicle state determination function, a selection may be made between a range of determination functions to be executed and a range of determination functions not to be executed. Here, the processing order of the determination functions is merely an example and is not limited to this. The order in which the determination functions are executed may be different, or other determination functions may be added to the described determination functions.

[0082] FIG. 9 is a diagram showing an example of the relationship between the determination function and the processing time / detection performance in the first embodiment. The determination function selection unit 371 may store in advance the processing time and detection performance for each combination of determination functions as shown in FIG. 9, and select one of the stored combinations. This allows the anomaly detection unit 373 to process the determination functions in an appropriate order for each system and appropriately select the determination function to be executed. Furthermore, by determining in advance, at the time of design, etc., the determination function to be selected by the determination function selection unit 371, the time required for selection can be reduced.

[0083] Although the determination function selection unit 371 determines a combination of determination functions that fits within the calculated detection processing time and selects the determination function, this is not limiting. For example, when the anomaly detection unit 373 detects an anomaly, the anomaly detection unit 373 may always select the determination function that detected the anomaly, and may not select some or all of the determination functions that did not detect the anomaly. When the anomaly detection unit 373 does not detect an anomaly, the anomaly detection unit 373 may select the minimum number of determination functions necessary within the detection processing time. This allows the anomaly detection unit 373 to continue selecting anomaly determination processing by a determination function that has detected an anomaly, thereby enabling continuous anomaly detection. Furthermore, when the anomaly detection unit 373 does not detect an anomaly, the anomaly detection processing time can be shortened.

[0084] When the frame transmitter / receiver 310 receives messages from multiple networks connected to the gateway 300, the anomaly detection unit 373 may select a determination function so that the anomaly detection process for a message from a network transmitting a message that will affect the operation of the vehicle if an abnormality occurs is longer than that for a network transmitting a message that will not affect the operation of the vehicle if an abnormality occurs. Also, the anomaly detection unit 373 may determine which determination function to select for each message. This increases the likelihood that the anomaly detection unit 373 can ensure sufficient detection process time for important messages, thereby making the in-vehicle network system 10 safer.

[0085] In order to calculate the detection processing time, the determination function selection unit 371 may use the time allowed from when the gateway 300 receives a message until the transfer is completed (allowed time) minus the transfer processing time required for transfer processing, such as determining the destination bus 200 or the process in which the frame transmission / reception unit 310 actually transmits the message to each bus 200. Alternatively, the determination function selection unit 371 may calculate the detection processing time by subtracting the transfer time from the allowed time and also excluding other necessary processing. This allows the in-vehicle network system 10 to prioritize the execution of the abnormality detection processing over other processing, or conversely, to prioritize the execution of other processing over the abnormality detection processing.

[0086] It is noted that, although the determination function selection unit 371 is described as calculating the detection processing time, the present invention is not limited to this, and the anomaly detection processing function group 370 may have a processing time calculation unit that calculates the detection processing time, and the determination function selection unit 371 may acquire the processing time from the processing time calculation unit and select a determination function, or the anomaly detection processing function group 370 may receive the detection processing time from the frame processing unit 350 and select a determination function based on that. This makes it possible to make the calculation of the processing time more efficient when processing times are calculated for functions other than the anomaly detection processing function group 370.

[0087] [1.7 ECU Configuration] Fig. 10 is a block diagram showing an example of an ECU included in the in-vehicle network system according to the embodiment 1. In Fig. 10, the ECU 100 includes a frame transmitting / receiving unit 110, a frame interpretation unit 120, a received ID determination unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180.

[0088] These configurations indicate functions, and are realized in gateway 300 by the processing unit reading and executing a program stored in the memory unit, by the processing unit storing specified data in the memory unit, or by the processing unit transmitting and receiving data via the input / output unit, or by a combination of these.

[0089] The frame transmitting / receiving unit 110 transmits and receives messages to and from the bus 200 in accordance with the CAN protocol.

[0090] More specifically, the frame transmitting / receiving unit 110 reads out the message sent to the bus 200 bit by bit, and transfers the read out message to the frame interpretation unit 120 .

[0091] Furthermore, the frame transmitting / receiving unit 110 sends the message sent from the frame generating unit 180 onto the bus 200 .

[0092] The frame interpretation unit 120 receives values representing messages from the frame transmission / reception unit 110, maps them to each field in the CAN protocol, and interprets the messages. The frame interpretation unit 120 transfers the interpreted series of values, which are the ID field, to the received ID determination unit 130.

[0093] The frame interpretation unit 120 further determines, depending on the judgment result sent from the received ID judgment unit 130, whether to transfer the value of the ID field contained in the message and the value of the data field that appears after the ID field to the frame processing unit 150, or to cancel reception of the message.

[0094] Furthermore, if the frame interpretation unit 120 determines that the target message does not conform to the CAN protocol, it requests the frame generation unit 180 to transmit an error frame.

[0095] Furthermore, if the frame interpretation unit 120 interprets that the received frame is an error frame transmitted by another node, it discards the message being read.

[0096] The received ID determination unit 130 receives the value of the ID field from the frame interpretation unit 120, and determines whether or not to receive the read message according to the list of message IDs held by the received ID list holding unit 140. The received ID determination unit 130 sends the result of this determination to the frame interpretation unit 120.

[0097] The received ID list holding unit 140 holds a received ID list received by the ECU 100. The received ID list has the same format as that shown in Fig. 4, and therefore a description thereof will be omitted here.

[0098] Frame processing unit 150 performs processing according to the data of the received message. The content of the processing differs for each ECU 100.

[0099] For example, when the ECU 100a receives a message indicating that a door is open while the vehicle is traveling at a speed exceeding 30 km / h, it executes a process to sound an alarm. When the ECU 100c receives a message indicating that the brakes are not applied and a door is opened, it executes a process to sound an alarm.

[0100] These processes are examples for the purpose of explanation, and ECU 100 may execute processes other than those described above. Frame processing unit 150 causes frame generation unit 180 to generate frames to be sent in order to execute such processes.

[0101] The data acquisition unit 170 acquires output data indicating the state of devices connected to the ECU 100 or measurement values from sensors, and transfers the acquired output data to the frame generation unit 180 .

[0102] In response to a request from the frame interpretation unit 120 to transmit an error frame, the frame generation unit 180 constructs an error frame and sends it to the frame transmission / reception unit 110 .

[0103] Furthermore, frame generating unit 180 generates a message frame by attaching a predetermined message ID to the value of the data received from data acquiring unit 170 , and sends the generated message frame to frame transmitting / receiving unit 110 .

[0104] [1.8 Transfer Processing] 11 is a flowchart showing an example of a transfer process in embodiment 1. The transfer process performed by gateway 300 is common regardless of the direction of transfer, so here, a case where gateway 300 transfers a message received from bus 200a to bus 200b will be described as an example.

[0105] First, the frame transmitting / receiving unit 310 reads a message from the bus 200a (step S1001). The frame transmitting / receiving unit 310 sends the data of each field of the read message to the frame interpretation unit 320.

[0106] Next, the frame interpretation unit 120, in cooperation with the received ID determination unit 130, determines from the value of the ID field (message ID) of the read message whether or not the message is a target message for processing (step S1002).

[0107] If the frame interpretation unit 120 determines that the read message is not a message to be processed (No in step S1002), the message is not transferred.

[0108] If the frame interpretation unit 120 determines that the read message is a message to be processed (Yes in step S1002), the frame interpretation unit 120 transfers the values of each field in the message to the frame processing unit 350. Thereafter, the frame processing unit 350 determines a bus to be the transfer destination in accordance with the transfer rules stored in the transfer rule storage unit 360 (step S1003).

[0109] Frame processing unit 350 sends the value of each field in the message received from frame interpretation unit 320 to anomaly detection processing function group 370, requesting a determination as to whether or not the message is abnormal. Anomaly detection processing function group 370 determines whether or not the sent message is abnormal based on the value of each field in the sent message, and sends the result of this determination to frame processing unit 350 (step S1004).

[0110] If the abnormality detection processing function group 370 determines that the message is an abnormal message (Yes in step S1005), the message is not transferred.

[0111] If the abnormality detection processing function group 370 determines that the message is a normal message and not an abnormal message (No in step S1005), the frame processing unit 350 requests the frame generation unit 380 to transfer the message to the destination bus determined in step S1003.

[0112] Upon receiving the request from frame processing unit 350, frame generating unit 380 generates a message to be received by the specified transfer destination, and causes frame transmitting / receiving unit 310 to send the message (step S1006).

[0113] In the above example, the forwarding destination of the received message is determined (step S1003) and then the determination of whether the message is an abnormal message (step S1004) is performed, but this is not limited to this. The forwarding destination of the received message may be determined after the determination of whether the message is an abnormal message. Furthermore, the determination of the forwarding destination of the received message and the determination of whether the message is an abnormal message may be performed in parallel.

[0114] [1.9 Anomaly detection processing] FIG. 12 is a flowchart showing another example of the abnormality detection process according to the first embodiment.

[0115] First, the anomaly detection processing function group 370 receives a request for anomaly detection processing from the frame processing unit 350 and calculates the time available for the anomaly detection processing (step S1101). Here, the time available for the anomaly detection processing is called the detection processing time. The detection processing time is calculated based on the amount of messages sent to the network, the amount of data included in the messages, the number of forwarding destinations of the messages, etc.

[0116] Next, the determination function selection unit 371 determines whether the calculated detection processing time is shorter than the time required for the detection processing (step S1102).

[0117] If the determination function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 selects a determination function to execute the processing (step S1103).

[0118] Next, the determination function selection unit 371 sends information about the selected determination function to the control unit 372.

[0119] Next, the control unit 372 controls each determination function so as to execute only the function selected by the determination function selection unit 371 in step S1103, and the abnormality detection unit 373 executes the abnormality detection process (step S1104).

[0120] If the judgment function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the control unit 372 controls each judgment function of the abnormality detection unit 373 so that all detection processing that should be performed is performed.

[0121] When the determination function selection unit 371 individually selects the determination functions to be executed, the processing performed in the step of executing the abnormality detection processing in Fig. 12 (step S1104) becomes the processing performed in steps S1110 to S1119 in Fig. 13. Fig. 13 is a flowchart showing yet another example of the abnormality detection processing in embodiment 1. Furthermore, the processing performed in step S1103 of Fig. 12 where the determination function selection unit 371 selects the determination function to be executed becomes the processing performed in step S1105 in Fig. 13.

[0122] If the determination function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 selects a determination function that can be executed within the detection processing time (step S1105). Then, the determination function selection unit 371 sends information about the selected determination function to the control unit 372.

[0123] If determination function selection section 371 determines that the calculated detection processing time is longer than the time required for the detection processing (No in step S1102), step S1110 described below is performed.

[0124] The control unit 372 determines whether the determination function selection unit 371 has selected the DoS attack determination function (step S1110).

[0125] If the control unit 372 determines that the DoS attack determination function has been selected by the determination function selection unit 371 (Yes in step S1110), the control unit 372 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0126] If the control unit 372 determines that the DoS attack determination function has not been selected (No in step S1110), the control unit 372 does not execute the DoS attack determination function of the anomaly detection unit 373.

[0127] Next, the control unit 372 determines whether the determination function selection unit 371 has selected the ID determination function (step S1112).

[0128] If the control unit 372 determines that the ID determination function has been selected by the determination function selection unit 371 (Yes in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0129] If the control unit 372 determines that the ID determination function has not been selected by the determination function selection unit 371 (No in step S1112), the control unit 372 does not execute the ID determination function of the abnormality detection unit 373.

[0130] Next, the control unit 372 determines whether or not the determination function selection unit 371 has selected the data length determination function (step S1114).

[0131] If the control unit 372 determines that the data length determination function has been selected by the determination function selection unit 371 (Yes in step S1114), the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0132] If the control unit 372 determines that the data length determination function has not been selected by the determination function selection unit 371 (No in step S1114), the control unit 372 does not execute the data length determination function of the abnormality detection unit 373.

[0133] The control unit 372 determines whether or not the determination function selection unit 371 has selected the transmission cycle determination function (step S1116).

[0134] If the control unit 372 determines that the transmission cycle determination function has been selected by the determination function selection unit 371 (Yes in step S1116), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0135] If the control unit 372 determines that the transmission cycle determination function has not been selected by the determination function selection unit 371 (No in step S1116), the control unit 372 does not execute the transmission cycle determination function of the abnormality detection unit 373.

[0136] The control unit 372 determines whether or not the determination function selection unit 371 has selected the data value determination function (step S1118).

[0137] If the control unit 372 determines that the data value determination function has been selected by the determination function selection unit 371 (Yes in step S1118), the control unit 372 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0138] If the control unit 372 determines that the data value determination function has not been selected by the determination function selection unit 371 (No in step S1118), the control unit 372 does not execute the data value determination function of the abnormality detection unit 373.

[0139] Here, the anomaly detection processing for the five determination functions, i.e., DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination, has been described. However, the anomaly detection processing may further include anomaly detection processing for transmission frequency determination and vehicle state determination. Furthermore, the anomaly detection processing may include a combination of some of the above determination functions, or may include other determination processing not described. For example, the processing may include a process in which the control unit 372 determines whether the determination function selection unit 371 has selected each determination function, and the control unit 372 controls the execution of the determination function based on the determination result. This allows for flexible control of the determination functions to be executed.

[0140] When the determination function selection unit 371 selects a range of determination functions to be executed and a range of determination functions not to be executed, the processing performed in the step (S1104) of executing the abnormality detection processing in Fig. 12 becomes the processing shown in Fig. 14. Moreover, the processing performed in step S1103 in Fig. 12 where the determination function selection unit 371 selects a function becomes the processing performed in step S1106 in Fig. 14.

[0141] 14 is a flowchart showing another example of the anomaly detection process according to Embodiment 1. If the determination function selection unit 371 determines that the detection process time is shorter than the time required for the detection process (Yes in step S1102), the determination function selection unit 371 determines the determination functions that can be executed within the detection process time, and selects the determination function at the time of terminating the anomaly detection process (step S1106).

[0142] Then, the determination function selection unit 371 sends the result to the control unit 372.

[0143] If determination function selection section 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), step S1120 described below is performed.

[0144] The control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the DoS attack determination function (step S1120).

[0145] If the control unit 372 determines that the judgment function selection unit 371 has selected not to terminate processing before the DoS attack judgment function (No in step S1120), the control unit 372 executes the DoS attack judgment function of the abnormality detection unit 373 (S1111).

[0146] If the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the DoS attack determination function (Yes in step S1120), the control unit 372 ends the anomaly detection process.

[0147] Subsequently, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the ID determination function (step S1112).

[0148] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate the processing before the ID determination function (No in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0149] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the ID determination function (Yes in step S1112), the control unit 372 ends the abnormality detection process.

[0150] Next, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the data length determination function (step S1122).

[0151] If the control unit 372 determines that the judgment function selection unit 371 has selected not to terminate processing before the data length judgment function (No in step S1122), the control unit 372 executes the data length judgment function of the abnormality detection unit 373 (step S1115).

[0152] If the control unit 372 determines that the selection to end the process before the data length determination function is made (Yes in step S1122), the control unit 372 ends the abnormality detection process.

[0153] Then, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the transmission cycle determination function (step S1123).

[0154] If the control unit 372 determines that the judgment function selection unit 371 has selected not to terminate processing before the transmission period judgment function (No in step S1123), the control unit 372 executes the transmission period judgment function of the abnormality detection unit 373 (step S1117).

[0155] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the transmission cycle determination function (Yes in step S1123), the control unit 372 ends the abnormality detection process.

[0156] Next, control unit 372 determines whether or not judgment function selection unit 371 has selected to end the process before the data value judgment function (step S1124).

[0157] If the control unit 372 determines that the judgment function selection unit 371 has selected not to terminate processing before the data value judgment function (No in step S1124), the control unit 372 executes the data value judgment function of the abnormality detection unit 373 (step S1119).

[0158] If control unit 372 determines that determination function selection unit 371 has selected to end the process before the data value determination function (Yes in step S1124), control unit 372 ends the abnormality detection process.

[0159] Here, the abnormality detection processing for the five determination functions, i.e., DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination, has been described. However, the processing described in FIG. 14 may further include abnormality detection processing for transmission frequency determination and vehicle state determination. Furthermore, the processing described in FIG. 14 may be a combination of some of the determination functions described above, or may include other determination functions. The processing described in FIG. 14 may include processing in which the control unit 372 determines whether the determination function selection unit 371 has selected a range of determination functions to be executed and a range of determination functions not to be executed, and the control unit 372 controls the execution of the determination functions based on the determination result. This eliminates the need to check whether each determination function has been selected, thereby reducing processing time.

[0160] In addition, if the judgment function selection unit 371 only selects whether or not to execute the transmission period judgment function and the data value judgment function, the step of executing the abnormality detection process shown in Figure 12 (step S1104) becomes the process shown in Figure 15.

[0161] Fig. 15 is a flowchart showing yet another example of the abnormality detection process according to Embodiment 1. The process performed in step S1103 in which determination function selection unit 371 shown in Fig. 12 selects a determination function is the process performed in step S1107 shown in Fig. 15.

[0162] The determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for the abnormality detection processing by the transmission cycle determination function and the data value determination function (step S1102).

[0163] If determination function selection section 371 determines that the detection processing time is shorter than the required time (Yes in step S1102), determination function selection section 371 does not select the transmission cycle determination function and the data value determination function (step S1107).

[0164] If determination function selection section 371 determines that the detection processing time is longer than the required time (No in step S1102), step S1111, which will be described next, is performed.

[0165] The control unit 372 executes the processing of the DoS attack determination function (step S1111).

[0166] Then, the control unit 372 executes the process of the ID determination function (step S1113).

[0167] Next, the control unit 372 executes the process of the data length determination function (step S1115).

[0168] Thereafter, control unit 372 determines whether or not determination function selection unit 371 has selected the transmission cycle determination function and the data value determination function (step S1130).

[0169] If the control unit 372 determines that the transmission period determination function and the data value determination function have been selected by the determination function selection unit 371 (Yes in step S1130), the control unit 372 executes the transmission period determination function of the abnormality detection unit 373 (step S1117).

[0170] Next, the control unit 372 executes the data value determination function (step S1119).

[0171] If the control unit 372 determines that the transmission period determination function and the data value determination function have not been selected by the determination function selection unit 371 (No in step S1130), the control unit 372 does not execute the transmission period determination function and the data value determination function of the abnormality detection unit 373.

[0172] Here, the abnormality detection processing for the five determination functions, i.e., DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination, has been described. However, the processing described in FIG. 15 may further include abnormality detection processing for transmission frequency determination and vehicle state determination. The processing described in FIG. 15 may be a combination of some of the determination processing described above, or may include other determination functions. The processing described in FIG. 15 does not only select whether to execute the transmission period determination function and the data value determination function, but also determines whether the determination function selection unit 371 has selected a combination of some of the determination functions, and the control unit 372 controls the execution of the determination functions based on the determination result. This allows the combination of processing to be executed to be determined in advance, such as during design, and allows for simultaneous confirmation of whether the determination functions are selected, thereby shortening processing time.

[0173] FIG. 16 is a flowchart showing another example of the abnormality detection process according to the first embodiment.

[0174] In addition, if the judgment function selection unit 371 not only selects whether or not to execute the transmission period judgment function and the data value judgment function, but also selects not to execute any judgment functions, the processing performed in step S1108 and step S1109 shown in FIG. 16 is added between the processing performed in step S1107 and step S1131 shown in FIG. 15.

[0175] Next, the determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for the anomaly detection processing by the DoS attack determination function, the ID determination function, and the data length determination function (step S1108).

[0176] If determination function selection section 371 determines that the detection processing time is shorter than the above-mentioned necessary time, determination function selection section 371 does not select any determination functions (step S1109).

[0177] Next, the control unit 372 determines whether or not the determination function selection unit 371 has selected all of the determination functions (step S1131). That is, the control unit 372 determines whether or not the determination function selection unit 371 has selected the DoS attack determination function, the ID determination function, or the data length determination function.

[0178] If the control unit 372 determines that the DoS attack determination function, ID determination function, and data length determination function have been selected by the determination function selection unit 371 (Yes in step S1131), the control unit 372 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0179] Thereafter, the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0180] Then, the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0181] The subsequent processing relating to the transmission cycle determination function and data value determination function is the same as the processing explained in FIG. 15, and therefore the explanation will be omitted.

[0182] If the control unit 372 determines that the DoS attack determination function, ID determination function, and data length determination function have not been selected by the determination function selection unit 371 (No in step S1131), the control unit 372 does not execute each determination function of the abnormality detection unit 373.

[0183] Here, the abnormality detection processing for the five determination functions (DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination) has been described as the processing illustrated in FIG. 16 . However, the processing illustrated in FIG. 16 may further include abnormality detection processing for transmission frequency determination and vehicle state determination. Furthermore, the processing illustrated in FIG. 16 may be a combination of several of the above determination processing, or may include other determination functions. The processing illustrated in FIG. 16 has been described as being divided into a processing for determining whether the DoS attack determination function, ID determination function, and data length determination function have been selected, and a processing for selecting only whether to execute the transmission period determination function and the data value determination function. However, this is not limited to this. The processing illustrated in FIG. 16 may be a processing in which the control unit 372 determines that the determination function selection unit 371 has selected all the determination functions, and the control unit 372 controls the execution of the determination functions based on the determination result. As a result, the abnormality determination method of this embodiment can perform abnormality determination even when there is no time to perform the abnormality detection processing.

[0184] The abnormality detection process by the determination function selection unit 371 and the control unit 372 is not limited to the above, and may be a combination of the above.

[0185] Note that, when the determination function selection unit 371 determines that the detection processing time is shorter than the time required for the detection processing (step S1102), it selects a determination function to be executed to perform processing, but this is not limited to this. When selecting a determination function to be executed to perform processing without performing the determination processing of step S1102, the determination function selection unit 371 may select all determination functions if the detection processing time is longer than the time required for the detection processing. This can simplify the processing by the determination function selection unit 371.

[0186] When the control unit 372 executes each determination function, the control unit 372 refers to the detection rules set for each CAN ID. Then, the control unit 372 performs control so that the determination functions selected by the determination function selection unit 371 and described in the detection rules are executed. In other words, a determination function that is not described in the detection rules is not executed even if it is selected by the determination function selection unit 371. Furthermore, if it is determined that the detection processing time calculated in step S1102 is longer than the time required for the detection processing, the control unit 372 assumes that all determination functions have been selected by the determination function selection unit 371, and executes the functions described in the detection rules.

[0187] [1.10 Reset Processing] In the abnormality detection process, depending on the type of determination function that was not selected when the determination function selection unit 371 selected the function to be executed, the next time one of the determination functions is executed, there is a possibility that a determination result different from normal will be obtained. For example, the transmission period determination function is based on the premise that the in-vehicle network system 10 periodically receives messages, and records the reception time of the previous reception (referred to as the previous reception time), and determines whether the currently received message is an abnormal message based on the difference between the previous reception time and the current reception time.

[0188] At this time, if the transmission cycle determination function is not selected by the determination function selection unit 371 even though the message arrived normally, the previous reception time cannot be recorded, so the reception time two times before will be compared with the current reception time, which may result in an inability to make a normal determination. In particular, if the transmission cycle determination function is not selected consecutively, the period during which the reception time cannot be recorded will be long, increasing the possibility that a normal determination will not be made. The same concern applies when the data value determination function determines whether a message is normal or abnormal based on the amount of change between the previous data value and the current data value.

[0189] Therefore, when a certain judgment function is not selected by the judgment function selection unit 371 and the processing is skipped, it is necessary to perform a reset process on the judgment function before the next execution of the judgment function to prevent an unexpected judgment result. In particular, for functions that make a judgment by comparing a previous value with a current value, such as a transmission cycle judgment function or a data value judgment function that judges the amount of change in data, or functions that perform cumulative calculations, such as a transmission frequency judgment function, when the judgment function is not selected by the judgment function selection unit 371 and the processing is skipped, it is necessary to perform a reset process in advance to clear the previous value or cumulative value.

[0190] Fig. 17 is a flowchart showing an example of an abnormality detection process including a reset process in embodiment 1. Fig. 18 is a flowchart showing another example of an abnormality detection process including a reset process in embodiment 1, and Fig. 19 is a flowchart showing yet another example of an abnormality detection process including a reset process in embodiment 1. This flowchart adds a reset process to the abnormality detection process shown in Fig. 15 in which the determination function selection unit 371 selects only whether or not to execute the transmission period determination function and the data value determination function. Therefore, a description of the same processes as in Fig. 15 other than the reset process will be omitted.

[0191] First, determination function selection section 371 checks the flag indicating that the processes of the transmission cycle determination function and the data value determination function have been skipped, thereby determining whether or not the previous processes have been skipped (step S1140).

[0192] If determination function selection section 371 determines that the previous process was skipped (Yes in step S1140), determination function selection section 371 requests control section 372 to execute reset processing for the transmission cycle determination function and the data value determination function.

[0193] Then, upon receiving the request from the determination function selection unit 371, the control unit 372 executes a reset process for the transmission cycle determination function (step S1141).

[0194] Next, the control unit 372 executes a reset process for the data value determination function (step S1142).

[0195] After steps S1101 and S1102, the determination function selection unit 371 performs processing in step S1107 to not select the transmission period determination function and the data value determination function, and then sets a flag indicating that the processing of the transmission period determination function and the data value determination function has been skipped (step S1143). Here, the flag indicating that the processing of the transmission period determination function and the data value determination function has been skipped is set for each CAN ID.

[0196] The reset process may, for example, clear the stored previous value and then store the value as the previous value when the judgment function is executed for the first time. Alternatively, after clearing the stored previous value, the message that the judgment function, which does not have a previous value, first judges to be a normal message may be stored as the previous value. Here, if the previous value is stored for each CAN ID, the previous value is stored when the judgment function is first executed and the message with the same CAN ID as when the previous value was cleared is first received, or when the judgment function, which does not have a previous value, judges that the received message is a normal message for the first time. Furthermore, it may be determined whether to store the previous value based on a message with a different CAN ID rather than a message with the same CAN ID.

[0197] For example, a message with a correct message authentication code (MAC) may be used as a criterion to determine whether to store the previous value, or a message with a different CAN ID that has a similar or the same transmission period may be used as a criterion to determine whether to store the previous value.

[0198] FIG. 20 is a diagram illustrating an example of a reset process in a modified example. FIG. 20 illustrates an example of messages having different CAN IDs with the same transmission period. For example, in the abnormality determination method according to the present disclosure, if the load factor falls below the threshold value immediately before time T2, and messages ID1, ID2, and ID3 are received at approximately the same time, the reception times of the messages ID1, ID2, and ID3 are stored as the previous values. Furthermore, in the abnormality determination method according to the present disclosure, the stored cumulative value may be initialized, or the retained vehicle state may be initialized. This allows the determination function to perform a more accurate determination after the reset process.

[0199] In the abnormality determination method according to the present disclosure, the reset process is performed on the transmission period determination function and the data value determination function, but this is not limited to this, and the reset process may be performed on other determination functions that have previous values, or on the transmission frequency determination function or vehicle state determination function that stores cumulative values or vehicle states. Furthermore, the reset process does not need to be performed at the timing shown in Fig. 17, and may be performed at the timing shown in Fig. 18 or 19, for example.

[0200] 17 to 19 are obtained by adding a reset process to the flowchart shown in FIG. 15, but this is not limiting, and a reset process may be added to other flowcharts of anomaly detection processes (for example, the flowcharts shown in FIGS. 12 to 14, 16, and 21 and subsequent figures). Furthermore, the timing at which the reset process is executed may be changed for each CAN ID. Thus, in the anomaly determination method according to the embodiment of the present disclosure, the reset process can be executed at an appropriate timing depending on the stored information.

[0201] Although the determination function selection unit 371 has set a flag indicating that processing has been skipped when it does not select the transmission period determination function or the data value determination function, this is not limited to this. For example, the determination function selection unit 371 may also refer to the detection rules set for each CAN ID, and if a determination function not selected by the determination function selection unit 371 is not executed as a detection rule, it may not need to set a flag indicating that processing has been skipped, or may not need to execute a reset process at the time of reset processing even if it sets a flag indicating that processing has been skipped. This reduces unnecessary reset processes, shortens processing time, and prevents a decrease in detection performance due to reset processes.

[0202] [1.11 Effect] In this embodiment, the anomaly detection processing function group 370 selects a determination function to be executed according to the time available for anomaly detection processing (detection processing time), thereby making it possible to select a combination of determination functions that can exhibit a significant anomaly detection effect according to the detection processing time even when the detection processing time is short. Also, by performing a reset process on some or all of the determination functions, it is possible to mitigate adverse effects caused by not executing the determination function, thereby further improving anomaly detection performance.

[0203] (Embodiment 2) [2. Overview] In the first embodiment, in the abnormality detection processing function group 370, the determination function selection unit 371 selects a determination function to perform processing, and the control unit 372 controls the execution of each determination function according to the selection result of the determination function selection unit 371. In the present embodiment, a case in which the control unit 372 determines which determination function to execute according to the detection processing time in an in-vehicle network system will be described with reference to the drawings.

[0204] [2.1 Configuration of anomaly detection processing functions] Fig. 21 is a block diagram showing an example of an abnormality detection processing function group in embodiment 2. In Fig. 21, abnormality detection processing function group 370 includes a control unit 374 and an abnormality detection unit 373. Note that a description of the same components as in embodiment 1 will be omitted.

[0205] These configurations indicate functions, and are realized by the processing unit reading and executing a program stored in the memory unit of the gateway 300, storing specified data in the memory unit, or transmitting and receiving data via the input / output unit, or by a combination of these processes.

[0206] The control unit 374 determines which of the determination functions included in the abnormality detection unit 373 can be executed within the detection processing time, and controls the execution of the determination functions. The control unit 374 calculates the time (detection processing time) available for the abnormality detection processing of the abnormality detection unit 373, and controls the execution of the determination functions so as to fit within the detection processing time.

[0207] For example, like the determination function selection unit 371 in the first embodiment, the control unit 374 holds data on the processing time and detection performance (for example, false detection rate and detection rate) for each determination function as shown in Fig. 7, finds a combination of determination functions that fits within the calculated detection processing time, and performs control so as to execute only those determination functions. At this time, if there are multiple combinations of determination functions that fit within the calculated detection processing time, the combination of determination functions with the best detection performance (for example, a combination with a low false detection rate and a high detection rate) is executed.

[0208] Note that, although the control unit 374 calculates the detection processing time in the above embodiment, the present invention is not limited to this. The anomaly detection processing function group 370 may include a processing time calculation unit that calculates the detection processing time, and the control unit 374 may acquire the processing time from the processing time calculation unit and select a determination function, or the anomaly detection processing function group 370 may acquire information related to the detection processing time from the frame processing unit 350 and select a determination function to execute based on that information. In this way, the control unit 374 only needs to manage the processing time related to the anomaly detection processing, which allows the anomaly detection processing to be loosely coupled with other functions and reduces the impact of other functions on the anomaly detection processing.

[0209] [2.2 Anomaly detection processing] FIG. 22 is a flowchart illustrating an example of the abnormality detection process according to the second embodiment.

[0210] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (detection processing time) (step S1101).

[0211] Next, the control unit 374 determines whether the detection processing time calculated in step S1101 is longer than the time required for the detection processing to be executed (step S1200).

[0212] If control unit 374 determines in step S1200 that the detection processing time is longer than the time required for the detection processing to be executed (Yes in step S1200), control unit 374 executes the abnormality detection processing (step S1104).

[0213] When the determination functions executed by the control unit 374 are individually controlled, the step of executing the abnormality detection process shown in Fig. 22 (step S1104) becomes the process shown in Fig. 23. Fig. 23 is a flowchart showing another example of the abnormality detection process in the second embodiment, and Fig. 24 is a flowchart showing yet another example of the abnormality detection process in the second embodiment.

[0214] After calculating the detection processing time in step S1101, the control unit 374 determines whether there is time to execute the DoS attack determination function (step S1210).

[0215] When the control unit 374 determines that there is time to execute the DoS attack determination function (Yes in step S1210), the control unit 374 executes the DoS attack determination function of the abnormality detection unit 373 (S1111).

[0216] If the control unit 374 determines that there is no time to execute the DoS attack determination function (No in step S1210), the control unit 374 does not execute the DoS attack determination function of the anomaly detection unit 373.

[0217] Next, the control unit 374 determines whether there is enough time to execute the ID determination function within the remaining detection processing time after the DoS attack determination function is executed (step S1211).

[0218] When the control unit 374 determines that there is time to execute the ID determination function (Yes in step S1211), the control unit 374 executes the ID determination function of the abnormality detection unit 373 (S1113).

[0219] If the control unit 374 determines that there is no time to execute the ID determination function (No in step S1211), the control unit 374 does not execute the ID determination function of the abnormality detection unit 373.

[0220] Next, the control unit 374 determines whether there is enough time to execute the data length determination function within the remaining detection processing time after executing the ID determination function (step S1212).

[0221] If the control unit 374 determines that there is time to execute the data length determination function (Yes in step S1212), the control unit 374 executes the data length determination function of the abnormality detection unit 373 (S1115).

[0222] If the control unit 374 determines that there is no time to execute the data length determination function (No in step S1212), the control unit 374 does not execute the data length determination function of the abnormality detection unit 373.

[0223] Then, the control unit 374 determines whether there is enough time to execute the transmission cycle determination function within the remaining detection processing time after executing the data length determination function (step S1213).

[0224] If the control unit 374 determines that there is time to execute the transmission cycle determination function (Yes in step S1213), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (S1117).

[0225] If the control unit 374 determines that there is no time to execute the transmission cycle determination function (No in step S1213), the control unit 374 does not execute the transmission cycle determination function of the abnormality detection unit 373.

[0226] Next, the control unit 374 determines whether there is enough time to execute the data value determination function within the remaining detection processing time after executing the transmission cycle determination function (step S1214).

[0227] When the control unit 374 determines that there is time to execute the data value determination function (Yes in step S1214), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (S1119).

[0228] If the control unit 374 determines that there is not enough time to execute the data value determination function (No in step S1214), the control unit 374 does not execute the data value determination function of the abnormality detection unit 373. This allows the abnormality determination method according to the present disclosure to flexibly control the selection of the determination function to be executed.

[0229] When the control unit 374 determines the range of the determination functions to be executed, the process of the flowchart shown in Fig. 14 in the first embodiment becomes the process of the flowchart shown in Fig. 24. This eliminates the need to check whether each determination function is selected or not, and can reduce the processing time required for the check.

[0230] Furthermore, when the control unit 374 determines only whether or not to execute the transmission cycle determination function and the data value determination function, the process of the flowchart shown in Fig. 15 in the first embodiment becomes the process of the flowchart shown in Fig. 25. Fig. 25 is a flowchart showing another example of the abnormality detection process in the second embodiment.

[0231] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (step S1101).

[0232] Next, the control unit 374 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0233] Next, the control unit 374 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0234] Then, the control unit 374 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0235] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be executed (step S1230).

[0236] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0237] If the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0238] If control unit 374 determines that the detection processing time is shorter than the time required for the processing to be executed (No in step S1230), control unit 374 ends the operation.

[0239] As a result, if the combination of processes to be performed can be determined in advance, such as at the time of design, it is possible to check all at once whether or not a determination function has been selected, thereby shortening the processing time. Also, if the control unit 374 determines not only whether or not to execute the transmission period determination function and the data value determination function, but also whether or not to execute all of the determination functions, the processing of the flowchart shown in Fig. 16 in the first embodiment becomes the processing of the flowchart shown in Fig. 26. Fig. 26 is a flowchart showing yet another example of the anomaly detection processing in the second embodiment. As a result, the anomaly detection method according to the present disclosure can also be used when there is no time to perform the anomaly detection processing.

[0240] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (step S1101).

[0241] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (step S1231).

[0242] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0243] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0244] Then, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0245] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be executed (step S1230).

[0246] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0247] If the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0248] If the control unit 374 determines that the detection processing time is shorter than the time required for the minimum processing performed by the control unit 374 (No in step S1231), the control unit 374 ends the operation.

[0249] Furthermore, if control unit 374 determines that the detection processing time is shorter than the time required for the processing to be executed (No in step S1230), control unit 374 ends the operation.

[0250] Although the abnormality detection processes related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination have been described, the abnormality detection method according to the present disclosure may further include abnormality detection processes related to transmission frequency determination and vehicle state determination. Furthermore, the abnormality detection method according to the present disclosure may include some combination of the above processes or may include other determination functions.

[0251] The abnormality detection process performed by the control unit 374 is not limited to the above, and may be a combination of the above.

[0252] In addition, the processing related to the DoS attack determination function, ID determination function, data length determination function, transmission period determination function, and data value determination function shown in Figures 13 to 19 and Figures 23 to 26 may be performed in a different order for each message ID.

[0253] [2.3 Reset process] In the abnormality detection process, when the control unit 374 determines whether or not to execute each determination function, depending on the determination function that was not executed, a determination result different from normal may be obtained the next time the determination function is executed. Therefore, as in the first embodiment, a reset process needs to be performed for the determination function that the control unit 374 has determined not to execute.

[0254] In the first embodiment, when the determination function selection unit 371 performed the process of selecting a determination function, a flag indicating that the process was skipped was set. In the second embodiment, when the control unit 374 determined not to execute each determination function, a flag indicating that the process was skipped must be set. The determination of whether or not to execute the reset process, made by the control unit 374 in accordance with the flag indicating that the process was skipped, is similar to the process shown in Figs. 17 to 19 in the first embodiment, and therefore description thereof will be omitted.

[0255] [2.4 Effects] In this embodiment, the anomaly detection processing function group 370 determines whether or not to execute each judgment function immediately before the execution of that judgment function, thereby enabling the execution time of each judgment function to be accurately reflected in the decision on whether or not to execute that judgment function, and making it possible to execute a combination of judgment functions that can achieve a significant anomaly detection effect.

[0256] (Embodiment 3) [3. Overview] In the first embodiment, in the anomaly detection processing function group 370, the determination function selection unit 371 selects a determination function to perform processing, and the control unit 372 controls the execution of each determination function according to the selection result of the determination function selection unit 371. In the present embodiment, a case will be described with reference to the drawings in which, when a determination function is not executed in an in-vehicle network system, the message at that time is saved, and when there is sufficient time for detection processing, anomaly detection processing is executed later for that message.

[0257] [3.1 Configuration of anomaly detection processing functions] Fig. 27 is a block diagram showing an example of an anomaly detection processing function group according to the third embodiment. In Fig. 27, anomaly detection processing function group 370 includes a determination function selection unit 371, an anomaly detection unit 373, a non-selection information storage unit 375, and a control unit 376. Alternatively, as shown in Fig. 28, similar to the second embodiment, the determination function selection unit 371 may not be provided, and the anomaly detection unit 373, the non-selection information storage unit 375, and a control unit 377 may be included. Fig. 28 is a block diagram showing another example of an anomaly detection processing function group according to the third embodiment. Note that a description of the same components as those in the first embodiment will be omitted.

[0258] These configurations indicate functions, and are realized by reading and executing a program stored in the memory unit of the gateway 300 using the processing unit, storing specified data in the memory unit, or transmitting and receiving data via the input / output unit, or by performing a combination of these.

[0259] The non-selection information holding unit 375 sends and holds information of the received message when some of the determination functions of the abnormality detection unit 373 are not executed. In addition, the non-selection information holding unit 375 sends the held message to the control unit 376 in response to a request from the control unit 376.

[0260] In addition to the functions of the control unit 372 in the first embodiment, the control unit 376 has a judgment function that was not selected in the past processing, and if it is determined that a message is stored in the non-selection information storage unit 375 and there is time to execute an abnormality detection processing for the message, the control unit 376 acquires the message from the non-selection information storage unit 375 and executes an abnormality detection processing for the message.

[0261] Note that control unit 377 has the same functions as control unit 376, except that control unit 377 has the functions of control unit 374 in the second embodiment instead of the functions of control unit 372 in the first embodiment.

[0262] Note that when some of the determination functions of the anomaly detection unit 373 are not executed, the non-selection information holding unit 375 may not only hold the received message but also hold information about the determination functions that were not executed, as shown in Fig. 28, for example, so that when the control unit 376 or the control unit 377 executes the anomaly detection process, the control unit 376 or the control unit 377 may execute the anomaly detection process related only to the determination functions that were not executed. Fig. 29 is a diagram showing an example of the non-selection information according to the third embodiment. As a result, in the anomaly determination method according to the present disclosure, only the necessary determination functions can be executed, thereby shortening the processing time.

[0263] [3.2 Anomaly detection processing] Fig. 30 is a flowchart showing an example of an abnormality detection process in the third embodiment, and Fig. 31 is a flowchart showing another example of the abnormality detection process in the third embodiment. In the abnormality detection process in the first embodiment shown in Fig. 12, if a certain determination function is not executed, the message received at that time is saved (step S1300). Then, if there is sufficient time for the detection process, the abnormality detection process for that message is executed later (step S1302). Here, a description of the same processes as those shown in Fig. 12 will be omitted.

[0264] After selecting a determination function whose detection processing time is shorter than the time required for the determination processing that should actually be executed (after step S1103), the determination function selection unit 371 requests the non-selected information holding unit 375 to store information related to the message. In response to the request from the determination function selection unit 371, the non-selected information holding unit 375 stores information related to the message (step S1300).

[0265] Thereafter, the control unit 376 executes an abnormality detection process, inquires of the non-selection information holding unit 375 as to whether or not there is non-selection information, and determines whether or not there is non-selection information (step S1301).

[0266] If the control unit 376 determines that there is non-selected information (Yes in step S1301), the control unit 376 executes non-selected information follow-up processing (step S1302). The non-selected information follow-up processing will be described later.

[0267] If the control unit 376 determines that there is no non-selected information (No in step S1301), the control unit 376 ends the abnormality detection process.

[0268] Note that when a message having the same CAN ID as the CAN ID of a message (received message) for which anomaly detection processing is requested by frame processing unit 350 is stored in non-selection information storage unit 375, if there is processing that uses the previous value in some of the determination functions, there is a possibility that the anomaly detection processing will not be performed correctly. Therefore, when a message having the same CAN ID as the CAN ID of the received message is stored in non-selection information storage unit 375, determination function selection unit 371 may not select a determination function having processing that uses the previous value, and may perform anomaly detection processing by all of the determination functions after the non-selection information follow-up processing for the message having the same CAN ID as the CAN ID of the received message is completed.

[0269] The above process is shown in FIG.

[0270] If the judgment function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the judgment function selection unit 371 determines whether a message having the same CAN ID as the CAN ID of the received message is held in the non-selection information holding unit 375 (step S1310).

[0271] If the judgment function selection unit 371 determines that a message having the same CAN ID as the CAN ID of the received message is stored in the non-selection information storage unit 375 (Yes in step S1310), the judgment function selection unit 371 selects only judgment functions for which the previous value is not required (step S1311).

[0272] Then, determination function selection section 371 stores non-selection information because some determination functions will be skipped (step S1300).

[0273] If the determination function selection unit 371 determines that a message having the same CAN ID as the CAN ID of the received message is not held in the non-selection information holding unit 375 (No in step S1310), the control unit 376 executes an abnormality detection process (step S1104). As a result, when the non-selection information follow-up process is completed, the state of each determination function becomes the same as when the determination function selection process was not performed, and therefore there is no need to perform a reset process.

[0274] [3.3 Non-selection information follow-up processing] 32 is a flowchart showing an example of the non-selected information following process according to Embodiment 3. In FIG. 32, the non-selected information following process described above will be explained.

[0275] First, the control unit 376 calculates the time available for the abnormality detection process (detection process time) for the message included in the non-selection information (step S1320).

[0276] Next, the control unit 376 acquires one piece of non-selection information from the non-selection information storage unit 375 (step S1321).

[0277] Next, the control unit 376 calculates the time required for the abnormality detection process of the message included in the acquired non-selection information, and determines whether or not the calculated time is shorter than the detection process time (step S1322).

[0278] If the control unit 376 determines that the time required for the abnormality detection process for the message included in the acquired non-selected information is shorter than the detection process time and that there is sufficient time (Yes in step S1322), the control unit 376 executes the abnormality detection process for the message included in the non-selected information (step S1323).

[0279] Then, the process returns to step S1320.

[0280] If the control unit 376 determines that the time required for the abnormality detection process of the message included in the acquired non-selected information is longer than the detection process time and that there is not enough time (No in step S1322), the control unit 376 returns the non-selected information to the non-selected information storage unit 375 (step S1324).

[0281] Here, the control unit 376 ends the non-selected information following process.

[0282] When executing an anomaly detection process for a message included in the non-selection information in step S1323, the control unit 376 may execute only the determination functions that were not selected in the previous anomaly detection process. At this time, in determining whether there is sufficient time in step S1322, it is determined whether there is sufficient time to process the determination functions that were not selected in the previous anomaly detection process. In this way, the anomaly detection method according to the present disclosure can execute only the necessary determination functions, thereby shortening the processing time.

[0283] [3.4 Effects] In this embodiment, if the determination function is not executed, the anomaly detection processing function group 370 saves the message received at that time and executes the anomaly detection process for that message later if there is sufficient time for the detection process. This allows the anomaly detection processing function group 370 to perform a determination that can maximize the anomaly detection effect while satisfying the time constraints when receiving a message, and also allows the anomaly detection process by the determination function to be executed as originally planned, albeit with a delay. As a result, the anomaly determination method and the like according to the present disclosure satisfy the processing time constraints without degrading the anomaly detection performance.

[0284] [4. Other Modifications] The present disclosure is not limited to the embodiments described above. Furthermore, various modifications conceivable by those skilled in the art to the embodiments and embodiments formed by combining components of different embodiments are also included within the scope of the present disclosure, as long as they do not deviate from the spirit of the present disclosure. For example, the following modifications are also included in the present disclosure.

[0285] (1) In the above embodiment, the anomaly detection processing function group 370 calculates the time available for the anomaly detection processing (detection processing time) and determines whether or not to select a determination function to be executed in the anomaly detection processing or which determination function to select based on whether the detection processing time is longer than the time required for the detection processing that should have been executed. However, the present disclosure is not limited to this. For example, the load factor, data volume, message volume, etc. of the in-vehicle network system 10 may be used to determine whether or not to select a determination function to be executed in the anomaly detection processing or which determination function to select. Here, the load factor refers to the ratio of the amount of data or messages transmitted per unit time to the maximum amount of data or messages that can be transmitted to the in-vehicle network.

[0286] Fig. 33 is a table showing determination functions and conditions for selecting the determination functions in the modified example. Fig. 34 is a flowchart showing an example of an abnormality detection process in the modified example. For example, Fig. 34 shows an example of determination functions selected depending on the load factor. The determination function selection unit 371 may determine the determination function to select based on the information described in Fig. 33 instead of the information in embodiment 1 described in Fig. 7.

[0287] For example, if a load rate of 60% or more is defined as high load, in the abnormality detection process shown in FIG. 34, the judgment function selection unit 371 judges that the load rate calculated in step S1400 is "high load" if it is 60% or more (step S1401).

[0288] Next, the determination function selection unit 371 selects a determination function to perform processing based on the information shown in FIG. 33 (step S1402).

[0289] Next, the control unit 374 executes an abnormality detection process (step S1104).

[0290] Moreover, if the determination function selection unit 371 does not determine that the load is "high" (No in step S1401), the control unit 374 executes an abnormality detection process (step S1104).

[0291] Fig. 35 is a flowchart showing another example of anomaly detection processing in a modified example. The processing is the same as that in Fig. 34 except that the load rate shown in Fig. 34 is used as the message volume. Also, although not shown, the same applies when the determination function to be selected by the determination function selection unit 371 is determined according to the data volume.

[0292] Note that instead of selecting a judgment function only when the load is high, the state determined by the load rate may be defined as three stages, "high load," "medium load," and "low load," and the judgment function to be selected by the judgment function selection unit 371 may be determined depending on which stage it is, or the stages may be combined to determine the judgment function to be selected by the judgment function selection unit 371 based on conditions such as "high load," "high load" + "medium load," and "full load." Also, the state determined by the load rate may be defined as two stages or four or more stages instead of three stages.

[0293] Note that an index other than the load rate, the data volume, or the message volume may be used, or the load rate, the data volume, or the message volume may be calculated for the entire in-vehicle network. Furthermore, for example, in the case of gateway 300, a value related to an index such as the load rate, the data volume, or the message volume may be calculated for a message forwarded by gateway 300, or a value related to an index such as the load rate, the data volume, or the message volume may be calculated for a message input to gateway 300.

[0294] The anomaly detection processing function group 370 may receive the load rate, data volume, or message volume from the frame processing unit 350, and may select a judgment function and control the execution of the judgment function based on that. Also, the load rate, data volume, or message volume may be received when there is a change in the stage, rather than each time a message is received. In this case, if the anomaly detection processing function group 370 does not receive the load rate, data volume, or message volume from the frame processing unit 350, it determines that the value is the same as the previous time.

[0295] In addition, the judgment function selection unit 371 may select a judgment function based on the state of the vehicle, such as whether the vehicle is stopped, moving, moving at a high speed, moving at a constant speed, in automatic driving, whether automatic driving has started, whether automatic driving has ended, whether a driving assistance function is operating, whether a driving assistance function has started, or whether a driving assistance function has ended, and the control unit 377 may control the execution of the judgment function.

[0296] The determination function selection unit 371 may select a determination function based on the determination function used in the detection rule set for each CAN ID, the detection processing time, the load rate, the data volume, and the message volume, and the control unit 377 may control the execution of the determination function. In other words, the determination function selection unit 371 or the control units 374 and 377 select a determination function from a combination of functions used in the detection rule.

[0297] Note that the determination function selection unit 371 determines the determination function to be selected based on the information shown in Fig. 33, but this is not limitative. For example, the determination function selection unit 371 may determine the determination function to be selected from a combination of determination functions and selection conditions as shown in Fig. 41.

[0298] FIG. 35 is a flowchart showing another example of the abnormality detection process in the modified example.

[0299] First, the control unit 374 calculates the amount of messages (step S1410).

[0300] Next, the control unit 374 determines whether the amount of messages is large (step S1411).

[0301] If the control unit 374 determines that the message volume is greater than the predetermined value (Yes in step S1411), the control unit 374 selects a determination function to perform processing (step S1412).

[0302] Then, the control unit 374 executes an abnormality detection process (step S1104).

[0303] Furthermore, if the control unit 374 determines that the message volume is less than the predetermined value (No in step S1411), the control unit 374 executes an abnormality detection process (step S1104).

[0304] As a result, the abnormality determination method, etc. disclosed herein can select a determination function using other indicators such as load rate, data volume, and message volume, even when it is difficult to calculate the detection processing time or when the detection processing time cannot be uniquely determined.

[0305] (2) In the above embodiment, the ECU 100 is described as including a frame transmitting / receiving unit 110, a frame interpretation unit 120, a received ID determination unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180, but the configuration of the ECU included in the in-vehicle network system of the present disclosure is not limited to this.

[0306] Fig. 36 is a block diagram showing an example of an ECU in a modified example. In Fig. 36, an ECU 100f is made up of a frame transmitting / receiving unit 110, a frame interpretation unit 120, a frame generation unit 180, and an abnormality detection processing function group 370. The frame interpretation unit 120 may receive all messages regardless of ID, for example, and request the abnormality detection processing function group 370 to determine whether or not each message is an abnormal message.

[0307] Furthermore, in addition to the configuration of FIG. 36, the ECU 100f may be provided with a received ID determination unit 130 and a received ID list holding unit 140, and may receive only messages having message IDs listed in the received ID list held by the received ID list holding unit, and may request the abnormality detection processing function group 370 to determine whether or not the message is an abnormal message.

[0308] The ECU 100g may further include an external communication unit 390.

[0309] This allows not only the gateway but also the ECU to analyze whether messages sent to the in-vehicle network are abnormal, improving the anomaly detection function in the in-vehicle network system and ensuring a higher level of safety.

[0310] Fig. 37 is a block diagram showing another example of an ECU in a modified example. ECU 100g shown in Fig. 37 may include a transmission data acquisition unit 171 that acquires data to be transmitted to bus 200 from another connected device or from the outside, and an abnormality detection processing function group 370g. The abnormality detection processing function group 370g included in ECU 100g may also determine whether the data received from transmission data acquisition unit 171 is an abnormal message, and may request frame generation unit 180 to transmit a message only when it is determined that the received data is not an abnormal message.

[0311] The ECU 100g may further include an external communication unit 390.

[0312] As a result, the abnormality determination method etc. according to the present disclosure can prevent the spread of an abnormal message to the in-vehicle network including the ECU 100g, for example, when an ECU used together with a car navigation system is externally manipulated and an abnormal message is transmitted from the car navigation system. Furthermore, the abnormality determination method etc. according to the present disclosure can prevent an abnormal message transmitted from outside the vehicle from penetrating into the in-vehicle network system.

[0313] (3) In the above embodiment, the determination function selection unit 371 uses one criterion to determine the determination function to be selected or executed. However, this is not limiting. For example, the determination function selection unit 371 may use different criteria for each CAN ID. Furthermore, if multiple buses are connected to the gateway 300 or the ECU, the determination function selection unit 371 may use different criteria for each of the multiple buses. Furthermore, the determination function selection unit 371 may use different criteria for each vehicle state, such as whether the vehicle is stopped, traveling, traveling at a high speed, traveling at a constant speed, operating in autonomous driving, has started autonomous driving, has ended autonomous driving, has a driving assistance function in operation, has started a driving assistance function, or has ended a driving assistance function.

[0314] If there is a standard for each CAN ID, the determination function selection unit 371 may not select a determination function for an important CAN ID, but may select a determination function for an unimportant CAN ID. Also, the determination function selection unit 371 may change the determination function to be selected depending on the importance.

[0315] As a result, the abnormality determination method and the like according to the present disclosure can more flexibly control the execution of the determination function, thereby enabling optimal execution depending on various systems and various situations.

[0316] (4) In the above embodiment, the anomaly detection processing function group 370 returns the judgment result to the frame processing unit 350, but this is not limited to this. Information regarding the selected judgment function or information regarding the executed judgment function may also be returned together with the judgment result.

[0317] This allows the frame processing unit 350 or the like that has called the abnormality detection processing function group 370 to check the accuracy of the determination result of the abnormality detection processing function group 370 .

[0318] (5) In the above embodiment, an in-vehicle network is shown as an example of a network communication system that communicates according to the CAN protocol. The technology according to the present disclosure is not limited to use in in-vehicle networks, but may also be used in networks other than in-vehicle networks that communicate according to the CAN protocol, such as networks for robots, industrial equipment, etc.

[0319] Although the CAN protocol is used for the in-vehicle network, it is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc. may also be used. Alternatively, a network may be a combination of these networks as a sub-network.

[0320] For example, in the case of Ethernet, the determination function selection unit 371 selects a determination function from functions such as a DoS attack determination function, a source address determination function, a destination address determination function, a protocol determination function, a source port number determination function, a destination port number determination function, or a data value determination function. Alternatively, the determination function selection unit 371 may select one or more determination functions from the above-mentioned plurality of determination functions as the determination function to be executed by the control unit 377. In network standards other than Ethernet, the same processing as in the case of CAN or Ethernet is performed for functions such as determining header information or payload values.

[0321] (6) The gateway 300 in the above embodiment may include a first processing unit and a second processing unit, and among the anomaly detection processing function group 370, the function of the determination function selection unit 371 may be processed by the first processing unit, and the functions of the control unit 372 and the anomaly detection unit 373 may be processed by the second processing unit. At this time, the result selected by the determination function selection unit 371 is sent from the first processing unit to the second processing unit. Then, in the second processing unit, the control unit 372 may control the determination function of the anomaly detection unit 373 in accordance with the selection result sent from the determination function selection unit 371.

[0322] The gateway 300 may also include a third processing unit, a fourth processing unit, and a fifth processing unit. The third processing unit includes a processing time calculation unit that calculates the detection processing time during which the determination function selection unit 371 performed the processing, and the detection processing time calculated by the processing time calculation unit is sent to the fourth processing unit. In the fourth processing unit, the determination function selection unit 371 selects a determination function according to the detection processing time, and sends the selected result to the fifth processing unit. In the fifth processing unit, the control unit 372 may control the determination function of the anomaly detection unit 373 according to the sent selection result.

[0323] Furthermore, the first processing unit may include a determination function selection unit 371, a control unit 372, and an anomaly detection unit 373, and the second processing unit may include a control unit 372 and anomaly detection unit 373. In the first processing unit, when the determination function selection unit 371 performs anomaly detection processing using the anomaly detection unit 373 of the first processing unit, the first processing unit may select a determination function that was not selected by the determination function selection unit 371 and send it to the second processing unit, and the control unit 372 and the anomaly detection unit 373 of the second processing unit may perform the anomaly detection processing, thereby performing the anomaly detection processing that was originally desired to be performed.

[0324] In addition, the gateway 300 may have separate processing units, such as a second processing unit and a fifth processing unit, and another ECU may have a first processing unit, a third processing unit, and a fourth processing unit. FIG. 38 is a block diagram showing the overall configuration of an in-vehicle network system according to a modified example, and FIG. 39 is a block diagram showing an example of a communication ECU included in the in-vehicle network system according to the modified example. As shown in FIG. 37, the in-vehicle network system includes a communication ECU 100e and communicates with a server 500 via an external network 400. The communication ECU 100e may include an external communication unit 390 as shown in FIG. 39 and transmit to the server 500 messages received from the in-vehicle network, abnormality detection processing results by the abnormality detection processing function group 370, and information on the executed determination functions.

[0325] Fig. 40 is a block diagram showing an example of a server in a modified example, and Fig. 41 is a table showing determination functions and selection conditions for the determination functions in the modified example. As shown in Fig. 40, server 500 includes a receiving unit 510, a message holding unit 520, and a processing unit 530, and the first processing unit and fourth processing unit described above may be processing unit 530. Furthermore, processing unit 530 may include a display unit and an input unit, and may display the detection processing time, load rate, data volume, message volume, vehicle status, etc., and an operator may select a determination function to be executed from the displayed information or information obtained from elsewhere, and input the selection result via the input unit.

[0326] The input result may be sent from server 500 to control unit 372, and control unit 372 may control the determination function of anomaly detection unit 373 in accordance with the input result. Furthermore, when server 500 determines from information regarding the determination function executed by anomaly detection unit 373 that a determination function that should be executed has not been executed, processing unit 530 of server 500 may perform anomaly detection processing on the message.

[0327] As a result, the in-vehicle network system of the present disclosure can be realized with a flexible configuration, and can be configured to take into account various system constraints.

[0328] (7) Each device in the above embodiments is specifically a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is recorded in the RAM or hard disk unit. Each device achieves its function when the microprocessor operates in accordance with the computer program. Here, a computer program is composed of a combination of multiple instruction codes that indicate commands to a computer to achieve a predetermined function.

[0329] (8) Some or all of the components constituting each device in the above embodiments may be configured as a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured to include a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0330] Furthermore, each of the components constituting each of the above devices may be individually integrated into a single chip, or some or all of them may be integrated into a single chip.

[0331] Although some or all of the components constituting each device in the embodiments are described herein as being implemented using a system LSI, they may also be referred to as ICs, LSIs, super LSIs, or ultra LSIs depending on the level of integration. Furthermore, the integrated circuit method is not limited to LSIs, and may be implemented using dedicated circuits or general-purpose processors. Field programmable gate arrays (FPGAs), which can be programmed after LSI fabrication, or reconfigurable processors, which allow the connections and settings of circuit cells within LSIs to be reconfigured, may also be used.

[0332] Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or other derived technologies, that technology may naturally be used to integrate functional blocks. The possibility of applying biotechnology as an integrated circuit technology that can replace LSI is also anticipated.

[0333] (9) Some or all of the components constituting each of the above devices may be configured as an IC card or a standalone module that can be attached to each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or the module achieves its functions when the microprocessor operates according to a computer program. This IC card or the module may be tamper-resistant.

[0334] (10) The present disclosure may be a computer program that causes a computer to implement the above-described method, or may be a digital signal that comprises the computer program.

[0335] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), or a semiconductor memory, or may be a digital signal recorded on such a recording medium.

[0336] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, or data broadcasting.

[0337] The present disclosure may also be a computer system having a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program.

[0338] The program or digital signal may also be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system.

[0339] (11) The above-described embodiments and modifications may be combined with each other.

[0340] The above describes a technique for determining a message to be used as a criterion for detecting fraudulent communications aimed at fraudulent control using fraudulent messages in an in-vehicle network according to one or more aspects, based on embodiments and their variations.

[0341] In each of these embodiments and their modifications, the message used as the criterion for detecting unauthorized communication is determined by the gateway or ECU connected to and communicating with the in-vehicle network system, or a combination of these with a server computer.

[0342] In this disclosure, a system that performs such fraudulent communication detection and includes one or more processors and a memory unit is referred to as a fraudulent communication detection criteria determination system.

[0343] Therefore, the fraudulent communication detection standard determination system may be realized by a single device, such as a single gateway connected to an in-vehicle network system, or may be realized by multiple devices, such as a combination of such a gateway and an ECU, or a combination of a gateway or ECU and a remote server computer.

[0344] Furthermore, this technology can be realized as a method that includes some or all of the processing steps performed by each component in each of the above embodiments or their variations, or as a program that is executed by a processor of the fraudulent communication detection criteria determination system to cause the fraudulent communication detection criteria determination system to implement this method.

[0345] In the above-described embodiment or its modification, a process performed by a specific component may be performed by another component instead of the specific component. The order of multiple processes may be changed, or multiple processes may be performed in parallel.

[0346] The above-described abnormality determination method may be executed by an abnormality determination device including one or more processors and a storage unit accessible from the one or more processors. The abnormality determination device may be the gateway 300 or the server 500, or may be included therein.

[0347] [Effects, etc.] The abnormality determination method of the present disclosure is an abnormality determination method for determining an abnormality in a received message, which receives as the received message a plurality of periodic messages each having a first field containing a fixed value and a second field containing a variable value, and selects, depending on one or more criteria of the time, load, data amount, or number of messages, whether the abnormality determination method is to be executed, whether the determination will be made based on the reception timing based on the periodicity or one of a plurality of combinations each consisting of one or more of abnormality determination using the number of received messages, abnormality determination using the field with a fixed value, and abnormality determination using the field with a variable value.

[0348] This allows the anomaly determination method according to the present disclosure to proceed with the process while selecting the anomaly determination to be performed within a limited time, thereby effectively determining whether an anomaly exists in a received message.

[0349] In addition, the abnormality determination method according to the present disclosure may perform the abnormality determination using the selected combination.

[0350] As a result, the abnormality determination method according to the present disclosure can effectively determine abnormalities in received messages within a limited time by executing a combination of abnormality determinations that have been selected in advance.

[0351] Furthermore, in the abnormality determination method according to the present disclosure, if an abnormality determination using the previous information among the multiple abnormality determinations has not been performed when the abnormality determination method is performed, the previous information used for the abnormality determination using the previous information may be reset the next time the abnormality determination method is performed.

[0352] As a result, the anomaly determination method according to the present disclosure can prevent a situation in which, when a certain anomaly determination is skipped and the same anomaly determination is performed, a normal determination is not performed due to normal data not being recorded because the anomaly determination was skipped. Thus, the anomaly determination method according to the present disclosure can effectively determine an anomaly in a received message.

[0353] In addition, the abnormality determination method according to the present disclosure may, when the load rate of the network for receiving the received message falls below a predetermined threshold, use information of the received message of a different type that was received immediately before as information in place of the previous information that was reset.

[0354] As a result, the abnormality determination method according to the present disclosure can avoid a situation in which, when an identical abnormality determination is performed after a certain abnormality determination has been skipped, the abnormality determination process cannot be performed because normal data has not been recorded due to the abnormality determination being skipped. In other words, in the above-mentioned case, the abnormality determination method according to the present disclosure can perform the same abnormality determination process as the skipped abnormality determination process by using information from the most recently received message with a different ID.

[0355] Furthermore, the abnormality determination method according to the present disclosure may execute the abnormality determination that was not selected if there is sufficient time to execute the abnormality determination method after the selected determination process has been executed.

[0356] This allows the abnormality determination method according to the present disclosure to perform more abnormality determinations, thereby more effectively determining abnormalities in received messages.

[0357] The abnormality determination device according to the present disclosure is an abnormality determination device in an in-vehicle network system including a network and one or more electronic control units connected to the network, and is equipped with one or more processors and a memory unit accessible from the one or more processors, wherein the one or more processors receive, as received messages, a plurality of messages including a plurality of periodic messages, each including a first field having a fixed value and a second field having a variable value, from the network, and selects, depending on one or more criteria of the time, load, data amount, or number of messages, by which the abnormality determination method performed by the abnormality determination device can be executed, whether to perform the determination using the reception timing based on the periodicity, or one of a plurality of combinations each consisting of one or more of a plurality of abnormality determinations including an abnormality determination using the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field.

[0358] As a result, the abnormality determination device according to the present disclosure can achieve the same effects as the abnormality determination method described above.

[0359] Furthermore, the program according to the present disclosure may be a program for causing a computer to execute the abnormality determination method according to the present disclosure.

[0360] As a result, the program according to the present disclosure can achieve the same effects as the abnormality determination method described above.

[0361] In addition, when it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, the abnormality determination method according to the present disclosure may execute a combination of one or more abnormality determinations that have a lower false positive rate and a higher detection rate than a predetermined standard, from among abnormality determination using the reception timing based on the periodicity or the number of received messages, abnormality determination using the first field, and abnormality determination using the second field.

[0362] As a result, the abnormality determination method according to the present disclosure can more effectively determine whether an abnormality exists in a received message.

[0363] In addition, if it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, the abnormality determination method according to the present disclosure does not need to execute the reception timing based on the periodicity, the abnormality determination using the number of received messages, and the abnormality determination using the second field.

[0364] As a result, the anomaly determination method disclosed herein can more effectively determine anomalies in received messages within a limited time by only performing anomaly determinations that use fields with changing values.

[0365] When it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, the abnormality determination method according to the present disclosure may select to terminate processing before performing any of the abnormality determinations using the reception timing based on the periodicity or the number of received messages, the abnormality determination using the first field, or the abnormality determination using the second field. This allows the abnormality determination method according to the present disclosure to more effectively determine abnormalities in received messages within a limited time.

[0366] When the abnormality determination method according to the present disclosure determines that the time during which the abnormality determination method can be executed is shorter than a predetermined time, information regarding the abnormality determination that has been determined not to be executed, among the reception timing based on the periodicity, or the abnormality determination using the number of received messages, the abnormality determination using a field with a fixed value, and the abnormality determination using a field with a variable value, or information regarding the target message for which the abnormality determination that has been determined not to be executed is to be performed, may be stored in memory.

[0367] This allows the anomaly determination method according to the present disclosure to later execute an anomaly determination that was previously determined not to be executed depending on the situation, thereby enabling the anomaly determination method according to the present disclosure to more effectively determine an anomaly in a received message. [Industrial Applicability]

[0368] The anomaly detection method and the like according to the present disclosure can be used to detect anomalies in messages in an in-vehicle network. Furthermore, the anomaly detection method and the like according to the present disclosure can perform an appropriate anomaly detection process according to the detection processing time available for the anomaly detection process. As a result, the anomaly detection method and the like according to the present disclosure can accurately identify normal messages even at times when anomaly detection processing could not be performed in the past, thereby enabling network protection. [Explanation of symbols]

[0369] 10 In-vehicle network system 100, 100a, 100b, 100c, 100d, 100e, 100f, 100g ECU 101 Engine 102 Brake 103 Door open / close sensor 104 Window open / close sensor 110 Frame Transmitter / Receiver 120 Frame Interpretation Unit 130 Reception ID determination unit 140 Reception ID list holder 150 Frame Processing Unit 170 Data Acquisition Unit 171 Transmission data acquisition unit 180, 380 frame generation unit 200, 200a, 200b buses 300 Gateway 310 Frame Transmitter / Receiver 320 Frame Interpretation Unit 330 Receiving ID determination unit 340 Reception ID list storage unit 350 Frame Processing Unit 360 Transfer rule storage unit 370 Anomaly detection processing function group 371 Judgment function selection unit 372, 374, 376, 377 Control section 373 Anomaly Detection Unit 375 Non-selection information storage unit 381 Detection Rule Storage Unit 390 External Communications Department 400 External Network 500 servers 510 Receiving unit 520 Message storage unit 530 Processing section

Claims

1. An abnormality determination method for determining an abnormality in a received message, comprising: receiving, as the received message, a plurality of messages including a plurality of periodic messages, each of the plurality of messages including a first field having a fixed value; Calculating a time available for determining an abnormality in the received message, and obtaining a level determined by the calculated time; Depending on the level, (i) selecting all n abnormality judgments from n abnormality judgments (n is a positive integer); (ii) selecting k (k is a positive integer and k≦n) abnormality judgments from the n abnormality judgments; (iii) selecting none of the n abnormality determinations; Select one of the the n abnormality determinations include an abnormality determination using the reception timing based on the periodicity or the number of received messages, and an abnormality determination using the first field. Abnormality determination method.

2. The level is defined in at least three stages: The abnormality determination method according to claim 1 .

3. The abnormality determination using the reception timing based on the periodicity or the number of received messages includes a DoS attack determination. The abnormality determination method according to claim 1 or 2.

4. The k abnormality determinations include a DoS attack determination. The abnormality determination method according to claim 1 or 2.

5. The k abnormality determinations are only DoS attack determinations. The abnormality determination method according to claim 1 or 2.

6. Furthermore, when the k abnormality determinations are selected, the selected abnormality determinations are notified. The abnormality determination method according to claim 1 or 2.

7. If the calculated time is longer than the time required to process all of the n abnormality determinations, all of the n abnormality determinations are selected. The abnormality determination method according to claim 1 or 2.

8. Execute the selected anomaly judgment, The abnormality determination method according to claim 1 or 2.

9. If there is time remaining to perform another abnormality determination after the k abnormality determinations have been performed, perform the abnormality determination that was not selected. The abnormality determination method according to claim 8.

10. If an abnormality determination using the previous information among the n abnormality determinations has not been performed, when an abnormality determination of the next received message is performed, the previous information used for the abnormality determination using the previous information is reset. The abnormality determination method according to any one of claims 1 to 9.

11. When the load factor of the network for receiving the received message falls below a predetermined threshold, information of the received message of a different type that was received immediately before is used as information in place of the reset previous information. The abnormality determination method according to claim 10.

12. An abnormality determination device in an in-vehicle network system including a network and one or more electronic control units connected to the network, one or more processors; a storage unit accessible by the one or more processors, The one or more processors: receiving, as received messages, a plurality of messages including a plurality of periodic messages from the network, each of the plurality of messages including a first field having a fixed value; Calculating a time available for determining an abnormality in the received message, and obtaining a level determined by the calculated time; Depending on the level, (i) selecting all n abnormality judgments from n abnormality judgments (n is a positive integer); (ii) selecting k (k is a positive integer and k≦n) abnormality judgments from the n abnormality judgments; (iii) selecting none of the n abnormality determinations; Select one of the the n abnormality determinations include an abnormality determination using the reception timing based on the periodicity or the number of received messages, and an abnormality determination using the first field. Abnormality determination device.

13. A program for causing a computer to execute the abnormality determination method according to any one of claims 1 to 11.

Images