Monitoring device

Abstract

To provide a monitoring device capable of more correctly determining abnormality of a vehicle in a vehicle network.SOLUTION: A gateway device includes a monitoring part mounted on a vehicle for monitoring a count value of a counter for counting the number of error occurrences detected in an on-vehicle network of the vehicle, a pattern information generation part for generating pattern information showing time change of the count value on the basis of a monitoring result of the monitoring part, and an abnormality detection part for detecting abnormality in the on-vehicle network on the basis of the pattern information generated by the pattern information generation part and reference information based on the time change of the count value observed in advance.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to a monitoring device, a vehicle monitoring method, and a vehicle monitoring program. This application claims priority based on Japanese Patent Application No. 2022-78888, filed May 12, 2022, the disclosure of which is incorporated herein in its entirety. [Background technology]

[0002] Japanese Patent Laid-Open Publication No. 2013-131907 (Patent Document 1) discloses the following technology: A vehicle network monitoring device that monitors communication data in a vehicle network where data is communicated between multiple on-board control devices, and includes a monitoring unit that detects unauthorized data by monitoring a data communication format defined for operating a communication protocol used in the vehicle network. The monitoring unit monitors the number of error frame transmissions sent by the on-board control device based on error detection as the data communication format, and detects that unauthorized data is being transmitted to the vehicle network when the number of monitored error frame transmissions exceeds a defined number of transmissions. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-131907 Summary of the Invention

[0004] The monitoring device of the present disclosure is a monitoring device mounted on a vehicle, and includes a monitoring unit that monitors the count value of a counter that counts the number of times an error has occurred in the vehicle's on-board network, a pattern information generation unit that generates pattern information indicating changes in the count value over time based on the monitoring results of the monitoring unit, and an abnormality detection unit that detects abnormalities in the on-board network based on the pattern information generated by the pattern information generation unit and reference information based on changes in the count value over time that have been observed in advance.

[0005] The vehicle monitoring method disclosed herein is a vehicle monitoring method in a monitoring device mounted on a vehicle, and includes the steps of monitoring the count value of a counter that counts the number of times an error has occurred in the vehicle's on-board network, generating pattern information indicating changes in the count value over time based on the monitoring results, and detecting an abnormality in the on-board network based on the generated pattern information and reference information based on previously observed changes in the count value over time.

[0006] The vehicle monitoring program disclosed herein is a vehicle monitoring program used in a monitoring device mounted on a vehicle, and is a program for causing a computer to function as a monitoring unit that monitors the count value of a counter that counts the number of times errors have occurred in the vehicle's on-board network, a pattern information generation unit that generates pattern information indicating the change in the count value over time based on the monitoring results of the monitoring unit, and an abnormality detection unit that detects abnormalities in the on-board network based on the pattern information generated by the pattern information generation unit and reference information based on the change in the count value over time that has been observed in advance.

[0007] One aspect of the present disclosure may be realized as a semiconductor integrated circuit that implements part or all of a monitoring device, or may be realized as a system including a monitoring device. [Brief explanation of the drawings]

[0008] [Figure 1]FIG. 1 is a diagram showing a configuration of a vehicle monitoring system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of transition of the count value of the error counter and an abnormality detection timing in the in-vehicle communication system according to the embodiment of the present disclosure. [Figure 5] FIG. 5 is a flowchart illustrating an example of an operation procedure when the gateway device according to the embodiment of the present disclosure detects an abnormality in the in-vehicle network. [Figure 6] FIG. 6 is a flowchart illustrating an example of an operation procedure when the gateway device according to the embodiment of the present disclosure performs stop control. DETAILED DESCRIPTION OF THE INVENTION

[0009] Conventionally, techniques have been developed to improve security in in-vehicle networks.

[0010] [Problem to be solved by this disclosure] There is a need for a technology that goes beyond the technology described in Patent Document 1 and enables more accurate determination of vehicle abnormalities.

[0011] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a monitoring device, a vehicle monitoring method, and a vehicle monitoring program that can more accurately determine vehicle abnormalities.

[0012] [Effects of this disclosure] According to the present disclosure, abnormalities in a vehicle can be determined more accurately.

[0013] [Description of the embodiments of the present disclosure] First, the contents of the embodiments of the present disclosure will be listed and described. (1) A monitoring device according to an embodiment of the present disclosure is a monitoring device mounted on a vehicle, and includes a monitoring unit that monitors the count value of a counter that counts the number of errors detected in the vehicle's in-vehicle network, a pattern information generation unit that generates pattern information indicating changes in the count value over time based on the monitoring results of the monitoring unit, and an anomaly detection unit that detects an anomaly in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on changes in the count value over time that have been observed in advance.

[0014] In a vehicle, even under normal circumstances, errors may occur due to electromagnetic waves, etc., generated from various devices and wire harnesses. Therefore, a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold may result in a false detection of an abnormality. In contrast, by using the configuration described above to detect an abnormality using the time change in the error occurrence count value, false detection due to a natural increase in the number of error occurrences can be prevented, and vehicle abnormalities can be more accurately determined.

[0015] (2) In the above (1), the reference information may be pattern information indicating a time change of the count value observed in advance, and the abnormality detection unit may compare the pattern information generated by the pattern information generation unit with the reference information, and detect an abnormality in the in-vehicle network based on the comparison result.

[0016] With this configuration, it is possible to detect an abnormality in the vehicle through a simple process of comparing two pieces of pattern information.

[0017] (3) In the above (2), the anomaly detection unit may be capable of performing a first anomaly detection process that detects the anomaly based on the pattern information generated by the pattern information generation unit and the reference information, and a second anomaly detection process that detects the anomaly based on a comparison result between the count value and a predetermined threshold value, and the maximum value of the count value in the reference information may be smaller than the predetermined threshold value.

[0018] This configuration makes it possible to detect an abnormality from the increasing trend of the count value without waiting until the count value reaches a predetermined threshold. In other words, it is possible to detect an abnormality before the count value reaches the predetermined threshold, thereby shortening the time during which the in-vehicle network is vulnerable to attack and suppressing the impact of cyber-attacks on the vehicle.

[0019] (4) In any of (1) to (3) above, the anomaly detection unit may perform, in parallel, a first anomaly detection process that detects the anomaly based on the pattern information generated by the pattern information generation unit and the reference information, and a second anomaly detection process that detects the anomaly based on a comparison result between the count value and a predetermined threshold value.

[0020] With this configuration, it is possible to perform more versatile anomaly detection using a method that uses a threshold value and a method that uses pattern information.

[0021] (5) In any of the above (1) to (4), the error may be an error related to communication in the in-vehicle network.

[0022] This configuration makes it possible to more accurately detect abnormalities caused by cyber attacks on vehicles.

[0023] (6) In the above (5), the error may be an error caused by a CRC (Cyclic Redundancy Check) in accordance with the CAN (Controller Area Network) standard.

[0024] With this configuration, abnormality detection can be easily performed by utilizing an existing mechanism that conforms to bus standards that are widely used in vehicles.

[0025] (7) In the above (2), the anomaly detection unit may detect the anomaly by performing the comparison using a statistical analysis technique.

[0026] With this configuration, the two pieces of pattern information can be compared more accurately using statistical processing.

[0027] (8) In the above (1), the reference information may be a learning model created by machine learning using previously observed changes in the count value over time, and the anomaly detection unit may detect an anomaly in the in-vehicle network by providing the pattern information generated by the pattern information generation unit to the learning model.

[0028] With this configuration, the two types of pattern information can be more accurately determined using machine learning.

[0029] (9) In any one of the above (1) to (8), the monitoring device may further include an abnormality processing unit that performs a predetermined notification process when the abnormality detection unit detects the abnormality.

[0030] This configuration makes it possible to analyze the abnormality in an external device that can grasp a wider range of information, and to prevent the user from continuing to use the vehicle without realizing that there has been unauthorized access to the vehicle or data tampering, and thus the vehicle continues to be used without realizing that there is a minor malfunction.

[0031] (10) In any of (1) to (9) above, an abnormality processing unit may be provided that, when the abnormality detection unit detects the abnormality, controls the monitoring device to stop receiving data from the in-vehicle network.

[0032] With this configuration, for example, when the monitoring device is installed in a gateway device in an in-vehicle network, the impact of cyber attacks on the vehicle can be suppressed.

[0033] (11) In the above (10), the abnormality processing unit releases the stop control after a predetermined time has elapsed since the stop control was performed.

[0034] This configuration makes it possible to continue communication in the in-vehicle network while suppressing the impact of cyber attacks on the vehicle, for example.

[0035] (12) In the above (11), the reference information is pattern information indicating a time change of the count value observed in advance, the abnormality detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and detects an abnormality in the in-vehicle network based on the comparison result, and the abnormality processing unit sets the predetermined time according to the comparison result.

[0036] With this configuration, the length of the data reception suspension period can be set to an appropriate length depending on the degree of mismatch between the two pieces of pattern information.

[0037] (13) A vehicle monitoring method according to an embodiment of the present disclosure is a vehicle monitoring method in a monitoring device mounted on a vehicle, and includes the steps of monitoring a count value of a counter that counts the number of times an error has occurred in the vehicle's on-board network, generating pattern information indicating changes in the count value over time based on the monitoring results, and detecting an abnormality in the on-board network based on the generated pattern information and reference information based on previously observed changes in the count value over time.

[0038] In a vehicle, even under normal circumstances, errors may occur due to electromagnetic waves, etc., generated from various devices and wire harnesses. Therefore, a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold may result in a false detection of an abnormality. In contrast, by using the configuration described above to detect an abnormality using the time change in the error occurrence count value, false detection due to a natural increase in the number of error occurrences can be prevented, and vehicle abnormalities can be more accurately determined.

[0039] (14) A vehicle monitoring program according to an embodiment of the present disclosure is a vehicle monitoring program used in a monitoring device mounted on a vehicle, and is a program for causing a computer to function as a monitoring unit that monitors the count value of a counter that counts the number of errors detected in the vehicle's on-board network, a pattern information generation unit that generates pattern information indicating changes in the count value over time based on the monitoring results of the monitoring unit, and an abnormality detection unit that detects abnormalities in the on-board network based on the pattern information generated by the pattern information generation unit and reference information based on changes in the count value over time that have been observed in advance.

[0040] In a vehicle, even under normal circumstances, errors may occur due to electromagnetic waves, etc., generated from various devices and wire harnesses. Therefore, a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold may result in a false detection of an abnormality. In contrast, by using the configuration described above to detect an abnormality using the time change in the error occurrence count value, false detection due to a natural increase in the number of error occurrences can be prevented, and vehicle abnormalities can be more accurately determined.

[0041] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0042] [Configuration and Operation] 1 is a diagram illustrating a configuration of a vehicle monitoring system according to an embodiment of the present disclosure. Referring to FIG. 1, a vehicle monitoring system 401 includes one or more in-vehicle communication systems 201 and a management server 301, which is an example of an external device. The in-vehicle communication system 201 is mounted on a vehicle 90.

[0043] The in-vehicle communication system 201 monitors the occurrence of errors in the in-vehicle network of the vehicle 90, and detects an abnormality in the in-vehicle network of the vehicle 90 based on the monitoring results. When the in-vehicle communication system 201 detects an abnormality, it transmits abnormality occurrence information generated based on the occurrence status to the management server 301 via the external network 501.

[0044] The management server 301 receives the abnormality occurrence information sent from the in-vehicle communication system 201, analyzes the abnormality occurrence information, and based on the analysis results, performs processing to notify the user, for example, that there has been unauthorized access to the vehicle 90 and data tampering, etc.

[0045] 2 is a diagram illustrating a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle communication system 201 includes a gateway device 101, which is an example of a monitoring device, one or more in-vehicle devices 202, and an external communication device 151. For example, an in-vehicle network 251 includes the gateway device 101 and one or more in-vehicle devices 202. FIG. 2 illustrates an example in which the in-vehicle network 251 includes one gateway device 101 and three in-vehicle devices 202.

[0046] The gateway device 101 is connected to the in-vehicle device via, for example, a bus 81. Specifically, the bus 81 is a bus conforming to standards such as CAN (Controller Area Network) (registered trademark), CAN FD (CAN with Flexible Data Rate), CAN XL, FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0047] The in-vehicle device 202 includes a sensor, an actuator, a camera, a GPS (Global Positioning System) receiver, a navigation device, an automatic driving processing ECU (Electronic Control Unit), an ADAS (Advanced Driving Assistant System) ECU, a wiper control device, an engine control device, an AT (Automatic Transmission) control device, an HEV (Hybrid Electric Vehicle) control device, a brake control device, a chassis control device, a steering control device, an instrument display control device, and a maintenance device.

[0048] The gateway device 101 is connected to a plurality of in-vehicle devices 202 and an external communication device 151, and is capable of communicating with each of the in-vehicle devices 202 and the external communication device 151. Note that, instead of the gateway device 101, an integrated ECU that controls the operation of each in-vehicle device 202 may be provided as an example of a monitoring device in the in-vehicle network 251.

[0049] For example, the in-vehicle device 202 periodically or irregularly stores vehicle-related information indicating measurement results related to the vehicle 90 and its own ID in a frame and transmits the frame to another in-vehicle device 202 connected to the bus 81. Note that the in-vehicle device 202 may be configured to transmit the frame to the gateway device 101, or to another in-vehicle device (not shown) via the gateway device 101 and a cable or bus (not shown).

[0050] 3 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 3, gateway device 101 includes a communication processing unit 1, a monitoring unit 2, a pattern information generating unit 3, an abnormality detecting unit 6, an abnormality processing unit 7, an error counter 8, and a storage unit 9. Storage unit 9 is, for example, a non-volatile memory.

[0051] When frames are directly transmitted and received between in-vehicle devices 202 via the bus 81, the communication processing unit 1 receives in parallel frames transmitted from one in-vehicle device 202 to another in-vehicle device 202 via the bus 81. The communication processing unit 1 may be configured to receive frames in order to perform relay processing for relaying frames transmitted between the in-vehicle device 202 and an in-vehicle device such as the external communication device 151.

[0052] The monitoring unit 2 monitors the count value CN of an error counter 8 that counts the number of errors, ie, mistakes or failures, detected in the in-vehicle network 251 of the vehicle 90.

[0053] For example, the error is an error related to communication in the in-vehicle network 251. Specifically, the error is an error caused by a CRC (Cyclic Redundancy Check) according to the CAN standard.

[0054] More specifically, when the communication processing unit 1 receives a frame from the in-vehicle device 202 via the bus 81, it performs processing to detect an error in the received frame. If the communication processing unit 1 detects the error, it outputs an error occurrence notification indicating the reception time of the frame to the monitoring unit 2.

[0055] The monitoring unit 2 receives an error occurrence notification from the communication processing unit 1 and counts up the error counter 8. The monitoring unit 2 stores a set of the count value CN of the error counter 8 after counting up and the reception time indicated in the error occurrence notification in the storage unit 9. In this way, a log of the error occurrence situation in the in-vehicle network 251 is collected and stored in the storage unit 9. Note that the configuration is not limited to one in which the monitoring unit 2 counts up the error counter 8, and a configuration in which a unit other than the monitoring unit 2 counts up the error counter 8 may also be used.

[0056] Based on the monitoring results of the monitoring unit 2, the pattern information generation unit 3 generates pattern information (hereinafter also referred to as error log information), which is time-series data indicating changes over time in the count value CN, and outputs it to the abnormality detection unit 6. More specifically, the pattern information generation unit 3 generates the error log information based on the log stored in the storage unit 9. The error log information indicates the occurrence of errors, for example, an increasing trend in the count value CN. The error log information is time-series data for a period of, for example, 1 second or 10 seconds.

[0057] The abnormality detection unit 6 detects an abnormality in the in-vehicle network 251 based on the error log information generated by the pattern information generation unit 3 and reference information based on the time variation of the count value CN observed in advance. When the abnormality detection unit 6 detects the abnormality, it notifies the abnormality processing unit 7 that the abnormality has occurred and outputs error log information corresponding to the abnormality to the abnormality processing unit 7.

[0058] More specifically, the reference information is pattern information that indicates a time variation of the count value CN that has been observed in advance. The abnormality detection unit 6 compares the error log information received from the pattern information generation unit 3 with the reference information stored in the storage unit 9, and detects an abnormality in the in-vehicle network 251 based on the comparison result.

[0059] As an example, the reference information is created based on the count value CN of the error counter 8 collected by test driving or the like before the vehicle 90 is shipped.

[0060] In the vehicle 90, even during normal operation, errors may occur due to electromagnetic waves or the like generated from various devices and wire harnesses. For this reason, it is possible to obtain pattern information indicating some kind of error occurrence state as reference information.

[0061] For example, the anomaly detection unit 6 detects an anomaly by performing the above comparison using a statistical analysis technique. Specifically, the statistical analysis is, for example, analysis of variance or linear regression analysis.

[0062] The reference information may be a learning model created by machine learning using a time variation of the count value CN observed in advance. That is, the anomaly detection unit 6 may be configured to detect an anomaly in the in-vehicle network 251 by providing the learning model with the pattern information generated by the pattern information generation unit 3.

[0063] Specifically, the anomaly detection unit 6 uses a learning model based on a deep learning technique as an example of machine learning.

[0064] The abnormality processing unit 7 performs a predetermined notification process when the abnormality detection unit 6 detects an abnormality. More specifically, upon receiving the notification from the abnormality detection unit 6, the abnormality processing unit 7 outputs, for example, abnormality occurrence information indicating the error log information received from the abnormality detection unit 6 to the communication processing unit 1.

[0065] The abnormality processing unit 7 may be configured to output information indicating normality to the communication processing unit 1 periodically or irregularly when no abnormality is detected.

[0066] The communication processing unit 1 outputs the abnormality occurrence information received from the abnormality processing unit 7 to the outside-vehicle communication device 151.

[0067] The external vehicle communication device 151 communicates with the management server 301 via the external network 501 shown in Figure 1 by wirelessly communicating with a wireless base station (not shown) according to a communication method such as WiFi (registered trademark) or LTE (registered trademark) (Long Term Evolution).

[0068] For example, the external vehicle communication device 151 receives abnormality occurrence information from the communication processing unit 1 in the gateway device 101 and transmits the abnormality occurrence information to the management server 301 via the external network 501 .

[0069] The management server 301 receives the abnormality occurrence information transmitted from the exterior communication device 151 via the external network 501 and analyzes the abnormality occurrence information. Then, the management server 301 transmits, for example, analysis information indicating the analysis result to a user terminal (not shown) or the vehicle 90 via the external network 501.

[0070] As another example of the notification process, the abnormality processing unit 7 may be configured to transmit the abnormality occurrence information to the in-vehicle device 202, which is a navigation device, via the communication processing unit 1, and notify the user of the contents of the abnormality occurrence information using the navigation device. Also, the abnormality processing unit 7 may be configured to transmit the abnormality occurrence information to a specific in-vehicle device 202 via the communication processing unit 1, or to broadcast the abnormality occurrence information.

[0071] Furthermore, the abnormality processing unit 7 may be configured to perform stop control to stop the gateway device 101 from receiving data from the in-vehicle network 251 when the abnormality detection unit 6 detects an abnormality.

[0072] More specifically, as an example of stop control, the abnormality processing unit 7 performs bus shutdown, i.e., controls the communication processing unit 1 to discard all frames arriving from the bus 81 at the communication processing unit 1. For example, after a predetermined time has elapsed since the abnormality processing unit 7 performed bus shutdown, the abnormality processing unit 7 releases the bus shutdown and returns to a normal state.

[0073] The abnormality processing unit 7 may be configured to set the predetermined time (hereinafter also referred to as the recovery time) according to the result of the comparison between the error log information and the reference information by the abnormality detection unit 6. Specifically, for example, when the abnormality detection unit 6 determines that the error log information and the reference information do not match, it notifies the abnormality processing unit 7 that an abnormality has occurred and the degree of mismatch between them. For example, when the degree of mismatch is large, the abnormality processing unit 7 sets the recovery time to a large value, and when the degree of mismatch is small, it sets the recovery time to a small value. The degree of mismatch is, for example, the score obtained by the various analyses described above or the number of mismatches in the pattern comparison.

[0074] 4 is a diagram illustrating an example of transition of the count value of the error counter and an abnormality detection timing in the in-vehicle communication system according to the embodiment of the present disclosure, in which the horizontal axis represents time and the vertical axis represents the count value CN.

[0075] 4, in a comparative example in which an abnormality detection process is performed based on the result of comparing the count value CN with a predetermined threshold value ThC, the count value CN becomes equal to or greater than the threshold value ThC at time t2, and an abnormality in the in-vehicle network 251 is detected.

[0076] In contrast, the gateway device 101 is configured to detect an abnormality based on error log information indicating a time change in the count value CN and reference information based on previously observed time changes in the count value CN, thereby making it possible to detect an abnormality from the increasing trend of the count value CN without waiting until the count value CN reaches a predetermined threshold. That is, for example, as shown in FIG. 4, an abnormality can be detected at time t1 before time t2 at which the count value CN reaches the threshold value ThC. For example, when the abnormality processing unit 7 performs the bus shutdown as described above, the time during which the in-vehicle network 251 is subjected to a DoS (Denial-of-Service) attack or the like can be shortened compared to the comparative example, making it more difficult to install unauthorized devices in the in-vehicle network 251.

[0077] [Variations] The anomaly detection unit 6 may be capable of performing a first anomaly detection process that detects an anomaly based on the pattern information generated by the pattern information generation unit 3 and the reference information, and a second anomaly detection process that detects an anomaly based on the comparison result between the count value CN and a predetermined threshold value ThC.

[0078] That is, the abnormality detection unit 6 may be configured to be able to selectively perform either the first abnormality detection process or the second abnormality detection process.

[0079] The maximum value of the count value CN in the reference information is smaller than a predetermined threshold value ThC, for example, in the example shown in FIG.

[0080] The abnormality detection unit 6 may be configured to perform the first abnormality detection process and the second abnormality detection process in parallel.

[0081] [Operation flow] FIG. 5 is a flowchart illustrating an example of an operation procedure when the gateway device according to the embodiment of the present disclosure detects an abnormality in the in-vehicle network.

[0082] 5, first, the gateway device 101 monitors the count value CN of the error counter 8 in the in-vehicle network 251, collects a log of the error occurrence status in the in-vehicle network 251, and stores it in the storage unit 9 (step S1).

[0083] Next, the gateway device 101 generates pattern information, ie, error log information, which is time-series data indicating the change over time of the count value CN, based on the monitoring result, for example, based on the log stored in the storage unit 9 (step S2).

[0084] Next, the gateway device 101 acquires reference information stored in the storage unit 9, for example, pattern information indicating a time variation of the count value CN of the error counter 8 observed in advance, from the storage unit 9 (step S3).

[0085] Next, the gateway device 101 compares the generated error log information with the reference information, and if it determines that the two do not match (NO in step S4), it performs the above-mentioned abnormality processing (step S5).

[0086] If the gateway device 101 determines that the generated error log information matches the reference information (YES in step S4), or after performing abnormality processing (step S5), it continues monitoring the count value CN and collecting logs (step S1).

[0087] FIG. 6 is a flowchart illustrating an example of an operation procedure when the gateway device according to the embodiment of the present disclosure performs stop control.

[0088] Referring to FIG. 6, first, when the gateway device 101 detects an abnormality in the in-vehicle network 251 as described above, the gateway device 101 performs stop control to stop data reception at the gateway device 101 from the in-vehicle network 251 (step S11).

[0089] Next, if the degree of inconsistency between the error log information and the reference information is large (YES in step S12), the gateway device 101 sets the recovery time to TL (step S13), and if the degree of inconsistency is small (NO in step S12), it sets the recovery time to TS, which is smaller than TL (step S14).

[0090] Next, when the recovery time has elapsed since the start of the stop control (YES in step S15), the gateway device 101 releases the stop control and returns to the normal state (step S16).

[0091] In the in-vehicle communication system according to the embodiment of the present disclosure, the gateway device 101 is configured to include the error counter 8, but this is not limiting. The gateway device 101 may not be configured to include the error counter 8, and the monitoring unit 2 may be configured to acquire the count value CN of an error counter included in the in-vehicle device 202 or the like.

[0092] Furthermore, the error counter is not limited to a configuration that indicates the number of times an error has occurred in a received frame, but may also indicate the number of times an error frame transmitted from the in-vehicle device 202 when an error has occurred in the received frame of the in-vehicle device 202 has been received by the gateway device 101.

[0093] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or according to a logic circuit pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA), and an application-specific integrated circuit (ASIC). Note that the physically separate processors may cooperate with each other to execute each of the processes. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium.

[0094] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0095] The above description includes the following additional features. [Appendix 1] A monitoring device mounted on a vehicle, a processing circuit; The processing circuitry monitor a count value of a counter that counts the number of occurrences of errors detected in the vehicle's in-vehicle network; generating pattern information indicating a change in the count value over time based on the monitoring results; A monitoring device that detects an abnormality in the in-vehicle network based on the generated pattern information and reference information based on previously observed changes in the count value over time. [Explanation of symbols]

[0096] 1. Communication processing unit 2 Monitoring Department 3. Pattern information generation section 6. Anomaly detection unit 7 Abnormality processing section 8 Error Counters 9 Memory section 81 Bus 90 vehicles 101 Gateway device 151 External vehicle communication device 201 In-vehicle communication system 202 On-vehicle equipment 251 In-Vehicle Network 301 Management Server 401 Vehicle Monitoring System

Claims

1. A monitoring device mounted on a vehicle, a monitoring unit that monitors a count value of a counter that counts the number of occurrences of errors detected in the vehicle's in-vehicle network; a pattern information generating unit that generates pattern information indicating a time change of the count value based on a monitoring result of the monitoring unit; A monitoring device comprising an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on previously observed changes in the count value over time.

2. the reference information is pattern information indicating a time change of the count value observed in advance, The monitoring device according to claim 1 , wherein the abnormality detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and detects an abnormality in the in-vehicle network based on a comparison result.

3. the anomaly detection unit is capable of performing a first anomaly detection process of detecting the anomaly based on the pattern information generated by the pattern information generation unit and the reference information, and a second anomaly detection process of detecting the anomaly based on a comparison result between the count value and a predetermined threshold value, The monitoring device according to claim 2 , wherein the maximum value of the count value in the reference information is smaller than the predetermined threshold value.

4. 4. The monitoring device according to claim 1, wherein the anomaly detection unit concurrently performs a first anomaly detection process that detects the anomaly based on the pattern information generated by the pattern information generation unit and the reference information, and a second anomaly detection process that detects the anomaly based on a comparison result between the count value and a predetermined threshold value.

5. The monitoring device according to claim 1 , wherein the error is an error related to communication in the in-vehicle network.

6. 6. The monitoring device according to claim 5, wherein the error is an error due to a CRC (Cyclic Redundancy Check) in accordance with a CAN (Controller Area Network) standard.

7. The monitoring device according to claim 2 , wherein the anomaly detection unit detects the anomaly by performing the comparison using a statistical analysis technique.

8. the reference information is a learning model created by machine learning using a time change of the count value observed in advance, The monitoring device according to claim 1 , wherein the anomaly detection unit detects an anomaly in the in-vehicle network by providing the pattern information generated by the pattern information generation unit to the learning model.

9. The monitoring device further comprises: The monitoring device according to claim 1 , further comprising an abnormality processing unit that performs a predetermined notification process when the abnormality detection unit detects the abnormality.

10. The monitoring device further comprises: The monitoring device according to claim 1 , further comprising an abnormality processing unit that performs stop control to stop the monitoring device from receiving data from the in-vehicle network when the abnormality detection unit detects the abnormality.

11. The monitoring device according to claim 10 , wherein the abnormality processing unit cancels the stop control after a predetermined time has elapsed since the stop control was performed.

12. the reference information is pattern information indicating a time change of the count value observed in advance, the anomaly detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and detects an anomaly in the in-vehicle network based on a comparison result; The monitoring device according to claim 11 , wherein the abnormality processing unit sets the predetermined time period in accordance with a result of the comparison.

13. A vehicle monitoring method for a monitoring device mounted on a vehicle, comprising: monitoring a count value of a counter that counts the number of occurrences of errors detected in the vehicle's in-vehicle network; generating pattern information indicating a change in the count value over time based on the monitoring result; A vehicle monitoring method including a step of detecting an abnormality in the in-vehicle network based on the generated pattern information and reference information based on previously observed changes in the count value over time.

14. A vehicle monitoring program used in a monitoring device mounted on a vehicle, Computer, a monitoring unit that monitors a count value of a counter that counts the number of occurrences of errors detected in the vehicle's in-vehicle network; a pattern information generating unit that generates pattern information indicating a time change of the count value based on a monitoring result of the monitoring unit; an anomaly detection unit that detects an anomaly in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a time variation of the count value observed in advance; Vehicle monitoring program to function as.

Images