Information processing device, information processing method, and monitoring device

Abstract

The present invention provides an information processing device, an information processing method, and a monitoring device that can reduce the processing load required for analysis compared to conventional methods. [Solution] The information processing device according to this disclosure comprises an acquisition unit, a storage unit, a specification unit, and an output unit. The acquisition unit acquires analysis target information related to logs by associating vehicle identification information indicating a vehicle identifier, type information indicating the type of first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device to be analyzed, and log information relating to logs output by the first in-vehicle device. The storage unit stores analysis information related to logs by associating vehicle identification information, type information, software version information, and analysis logic corresponding to the logs. The specification unit identifies logs based on the analysis target information and analysis information. The output unit outputs analysis result information obtained by analyzing the logs included in the analysis target information.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, an information processing method, and a monitoring apparatus.

Background Art

[0002] Conventionally, an in-vehicle device mounted on a vehicle stores analysis patterns obtained by patterning analysis data using first correspondence information indicating the correspondence between vehicle identification information related to vehicle configurations and type information related to the types of in-vehicle devices, and second correspondence information representing the correspondence between the type information and analysis logic. The in-vehicle device narrows down the analysis data using the analysis patterns, thereby reducing the load of security analysis processing.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] For example, a user may purchase devices that are selectively installed at a vehicle dealership (examples of which include electronic mirrors, dealer option navigation systems, front and rear drive recorders, all-around cameras, rear-seat displays, Electronic Toll Collection Systems (ETC), retractable mirrors, etc.) and install them on the vehicle. However, the above-described analysis patterns do not store information related to devices installed by the user after the vehicle is shipped from the factory in the in-vehicle device, and there are cases where security cannot be ensured for the devices installed later. In addition, for example, when these devices are individually updated, the analysis patterns may become bloated, which may increase the processing load on the server, leaving room for improvement.

[0005] One of the problems that this disclosure aims to solve is to provide an information processing device, an information processing method, and a monitoring device that can reduce the processing load required for analysis compared to conventional methods. [Means for solving the problem]

[0006] The information processing device relating to this disclosure comprises an acquisition unit, a storage unit, an identification unit, and an output unit. The acquisition unit acquires analysis target information related to logs by associating vehicle identification information indicating a vehicle identifier, type information indicating the type of first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device to be analyzed, and log information relating to logs output by the first in-vehicle device. The storage unit stores analysis information related to logs by associating vehicle identification information, type information, software version information, and analysis logic corresponding to the logs. The identification unit identifies logs based on the analysis target information and analysis information. The output unit outputs analysis result information obtained by analyzing the logs included in the analysis target information. [Effects of the Invention]

[0007] According to this disclosure, the processing load required for analysis can be reduced compared to conventional methods. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 shows an example of a schematic configuration of an information processing system according to the embodiment. [Figure 2] Figure 2 is a functional block diagram showing an example of the functional configuration of the monitoring device according to this embodiment. [Figure 3] Figure 3 is a functional block diagram showing an example of the functional configuration of a server according to this embodiment. [Figure 4] Figure 4 is a schematic diagram showing an example of vehicle information according to the embodiment. [Figure 5] Figure 5 is a schematic diagram showing an example of analytical information according to the embodiment. [Figure 6] Figure 6 is a flowchart showing an example of the processing flow performed by the monitoring device according to this embodiment. [Figure 7] Figure 7 is a flowchart showing an example of the processing flow executed by the server according to this embodiment. [Figure 8] Figure 8 is a sequence diagram showing an example of the processing flow executed by the information processing system according to the embodiment. [Figure 9] Figure 9 is a sequence diagram showing an example of the processing flow executed by the information processing system according to the embodiment. [Figure 10] Figure 10 shows an example of the schematic configuration of the information processing system related to the first modified example. [Figure 11] Figure 11 is a functional block diagram showing an example of the functional configuration of the monitoring device according to the first modified example. [Figure 12] Figure 12 is a sequence diagram showing an example of the processing flow executed by the information processing system according to the first modified example. [Figure 13] Figure 13 shows an example of the hardware configuration of an information processing system according to an embodiment and a modified example. [Modes for carrying out the invention]

[0009] The embodiments of the information processing device and monitoring device related to this disclosure will be described below with reference to the drawings.

[0010] (Embodiment) Figure 1 is a diagram showing an example of the schematic configuration of an information processing system 100 according to an embodiment. As shown in Figure 1, the information processing system 100 comprises a vehicle 10, a server 30, and a terminal device 50. The vehicle 10 and the server 30 are connected in a way that allows communication, for example, via a network. The server 30 and the terminal device 50 are connected in a way that allows communication, for example, via a network.

[0011] The vehicle 10 includes, for example, a TCU (Telematics Control Unit) 11, a monitoring device 12, a meter 13, a HUD (Head Up Display) 14, a navigation device 15, and an ECU 16. The TCU 11, the monitoring device 12, the meter 13, the HUD 14, the navigation device 15, and the ECU 16 are communicably connected via, for example, a CAN (Controller Area Network) 17. Note that the devices included in the vehicle 10 are not limited thereto.

[0012] The TCU 11 performs wireless communication with an external device. The TCU 11 performs wireless communication with, for example, the server 30. The monitoring device 12 acquires in-vehicle device information related to various in-vehicle devices mounted on the vehicle 10. A detailed description of the in-vehicle device information will be given later. The meter 13 displays various types of information from the instruments of the vehicle 10 to the driver.

[0013] The HUD 14 projects, for example, the speed of the vehicle 10, the shift position of the vehicle 10, travel guidance, warnings, and the like onto the windshield in front of the driver in response to the driver's operation of the vehicle 10. The navigation device 15 displays, for example, route guidance for the travel route along which the vehicle 10 travels, and displays various types of information related to the vehicle 10. The ECU 16 controls, for example, the traveling of the vehicle 10.

[0014] The server 30 is a device that identifies log information related to a log to be analyzed from vehicle information transmitted by the vehicle 10, and outputs analysis result information obtained by analyzing the log. The server 30 is a dedicated or general-purpose computer. Details of these processes will be described later. Note that although the server 30 is shown as a single configuration in FIG. 1, a plurality of servers 30 may be provided.

[0015] The terminal device 50 is used by a user who manages the server 30. The terminal device 50 is, for example, various types of computers such as a personal computer, a tablet PC, a smartphone, and a smart watch.

[0016] Figure 2 is a functional block diagram illustrating an example of the functional configuration of the monitoring device 12 according to the embodiment. The monitoring device 12 includes an acquisition unit 121, a generation unit 122, a first transmission unit 123, a reception unit 124, a first determination unit 125, an output unit 126, a storage unit 127, a second determination unit 128, and a second transmission unit 129. Note that the functions included in the monitoring device 12 are not limited to this configuration.

[0017] The acquisition unit 121 acquires in-vehicle device information. Specifically, the acquisition unit 121 acquires in-vehicle device information including the name related to each in-vehicle device mounted on the vehicle 10, the type of the in-vehicle device, and the software version of the in-vehicle device.

[0018] The generation unit 122 generates vehicle information. Specifically, the generation unit 122 generates the vehicle information based on the in-vehicle device information acquired by the acquisition unit 121 and vehicle identification information that uniquely identifies the vehicle 10 and indicates the identifier of the vehicle 10. The vehicle information includes the vehicle identification information indicating the identifier of the vehicle 10, type information indicating the type of the in-vehicle device mounted on the vehicle 10, and software version information indicating the software version of the in-vehicle device. The type information includes the name related to the in-vehicle device and the type of the in-vehicle device.

[0019] The first transmission unit 123 transmits the vehicle information to the server 30. Specifically, the first transmission unit 123 transmits the vehicle information generated by the generation unit 122 to the server 30.

[0020] The reception unit 124 receives situation change notification information indicating that an unknown in-vehicle device is present from the server 30. A detailed description of the situation change notification information will be given later.

[0021] The first determination unit 125 determines whether a situation change notification is necessary. Specifically, when an unknown in-vehicle device is present in the vehicle 10, the first determination unit 125 determines whether the user has selected a situation change notification indicating that a situation change of the vehicle 10 has occurred, that is, determines the necessity of the situation change notification. The user selects the necessity of the situation change notification using, for example, the navigation device 15.

[0022] Then, if the user selects to receive a status change notification, the navigation device 15 outputs to the monitoring device 12 that a status change notification is necessary. However, the method by which the user selects whether or not to receive a status change notification is not limited to this.

[0023] The output unit 126 outputs status change notification information. Specifically, if the first determination unit 125 determines that a status change notification is necessary, the output unit 126 outputs the status change notification information received by the receiving unit 124 to the navigation device 15. However, if the first determination unit 125 determines that a status change notification is necessary and the receiving unit 124 has already output the status change notification information received by the receiving unit 124 to the navigation device 15, the output unit 126 does not output the status change notification information.

[0024] Furthermore, if the first determination unit 125 determines that a status change notification is unnecessary, the output unit 126 will not output the status change notification information received by the receiving unit 124 to the navigation device 15. Note that the device that outputs the status change notification information is not limited to the navigation device 15.

[0025] The storage unit 127 stores log analysis target information by associating vehicle identification information, type information, software version information, and log information related to logs output by the in-vehicle device being analyzed. Specifically, based on the vehicle information generated by the generation unit 122, the storage unit 127 stores log analysis target information by associating vehicle identification information, type information, software version information, and log information related to logs output by the in-vehicle device being analyzed. The log information is analyzed by the server 30, for example, to determine whether there are any abnormalities in the in-vehicle device installed in the vehicle 10. A detailed explanation of the analysis target information will be given later.

[0026] The second determination unit 128 determines whether the information to be analyzed satisfies predetermined conditions. Specifically, the second determination unit 128 determines whether the information to be analyzed stored by the storage unit 127 satisfies predetermined conditions. Here, the second determination unit 128 determines that the information to be analyzed satisfies predetermined conditions if the server 30 has analysis logic corresponding to the log of the information to be analyzed. On the other hand, the second determination unit 128 determines that the information to be analyzed does not satisfy predetermined conditions if the server 30 has analysis logic corresponding to the log of the information to be analyzed.

[0027] The second transmission unit 129 transmits the analysis target information stored by the storage unit 127 to the server 30. Specifically, when the second determination unit 128 determines that the analysis target information satisfies predetermined conditions, the second transmission unit 129 transmits the analysis target information stored by the storage unit 127 to the server 30.

[0028] Figure 3 is a functional block diagram showing an example of the functional configuration of a server 30 according to the embodiment. The server 30 includes a storage unit 301, a first acquisition unit 302, a first determination unit 303, a first output unit 304, a second acquisition unit 305, a specific unit 306, an analysis processing unit 307, a second output unit 308, a second determination unit 309, a third output unit 310, and a fourth output unit 311. However, the functions of the server 30 are not limited to these.

[0029] The storage unit 301 stores various types of information. For example, the storage unit 301 stores analysis target information related to logs by associating vehicle identification information indicating the identifier of the vehicle 10, type information indicating the type of in-vehicle device installed in the vehicle 10, software version information indicating the software version of the first in-vehicle device, and log information related to logs output by the first in-vehicle device that is the target of analysis. The storage unit 301 also stores analysis information related to logs that are the target of analysis by associating vehicle identification information, type information, and software version information. A detailed explanation of the analysis target information and analysis information will be given later. Note that the various types of information stored by the storage unit 301 are not limited to these.

[0030] The first acquisition unit 302 acquires vehicle information. The first acquisition unit 302 is an example of an acquisition unit. Specifically, the first acquisition unit 302 acquires vehicle information transmitted by the monitoring device 12. Here, vehicle information will be explained using Figure 4.

[0031] Figure 4 is a schematic diagram showing an example of vehicle information according to the embodiment. Table T1 shown in Figure 4 is a table that associates vehicle identification information with the names of each in-vehicle device, the grade of the type of in-vehicle device, and the Ver. of the software version of the in-vehicle device. For example, if the vehicle identification information is "JP0001", it can be seen that the vehicle is equipped with in-vehicle devices named "ECU-A", "ECU-B", and "ECU-C".

[0032] Returning to Figure 3, the explanation continues. The first determination unit 303 determines whether there are any unknown in-vehicle devices in the vehicle information. Specifically, the first determination unit 303 determines whether there are any unknown in-vehicle devices in the vehicle information acquired by the first acquisition unit 302. For example, the first determination unit 303 extracts the vehicle identification information of the analysis information stored in the storage unit 301 that corresponds to the vehicle identification information included in the vehicle information acquired by the first acquisition unit 302. The first determination unit 303 also determines whether the type information of the extracted vehicle identification information of the analysis information matches the type information of the vehicle information.

[0033] Here, the first determination unit 303 determines that there are no unknown in-vehicle devices in the vehicle information if the type information of the vehicle identification information extracted from the analysis information matches the type information of the vehicle information. On the other hand, the first determination unit 303 determines that there are unknown in-vehicle devices in the vehicle information if the type information of the vehicle identification information extracted from the analysis information does not match the type information of the vehicle information.

[0034] The first output unit 304 outputs status change notification information to the vehicle 10 indicating the presence of an unknown in-vehicle device. The first output unit 304 is an example of an output unit. Specifically, when the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information, the first output unit 304 outputs status change notification information to the vehicle 10 indicating the presence of an unknown in-vehicle device.

[0035] Furthermore, the first output unit 304 outputs unknown type information regarding the type of unknown in-vehicle device to the terminal device 50. Specifically, when the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information, the first output unit 304 outputs unknown type information regarding the type of unknown in-vehicle device to the terminal device 50.

[0036] Furthermore, the first output unit 304 stores analysis information in the storage unit 301 by associating the vehicle identification information, the unknown vehicle type information, and the unknown software version information indicating the software version of the unknown in-vehicle device. Specifically, when the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information, the first output unit 304 stores analysis information in the storage unit 301 by associating the vehicle identification information, the unknown vehicle type information, and the unknown software version information indicating the software version of the unknown in-vehicle device.

[0037] The second acquisition unit 305 associates the vehicle identification information, type information, software version information, and log information related to the logs output by the in-vehicle device being analyzed, all transmitted by the monitoring device 12, to acquire the log analysis target information. The second acquisition unit 305 is an example of an acquisition unit.

[0038] The identification unit 306 identifies the log to be analyzed based on the information to be analyzed and the analysis information. Specifically, the identification unit 306 identifies the log to be analyzed by the server 30 based on the log information included in the information to be analyzed acquired by the second acquisition unit 305 and the log information included in the analysis information stored by the storage unit 301. The analysis information will now be explained using Figure 5.

[0039] Figure 5 is a schematic diagram showing an example of analysis information according to the embodiment. Table T2 shown in Figure 5 is a table that associates the name of the in-vehicle device, the grade of the in-vehicle device, the version (Ver.) of the in-vehicle device, the log information output by the in-vehicle device, and the analysis logic for the log information.

[0040] For example, if the in-vehicle device is "ECU-A", the grade is "A-Grade1", and the version is "v001", the log information output by "ECU-A" will be "ECU-A_A-Grade1_v001". The analysis logic corresponding to the log information "ECU-A_A-Grade1_v001" is "normal_range=(0, 50) if temperature<normal_range[0] or temperature> The text "normal_range[1]:" is displayed. The identification unit 306 identifies, for example, if the log information included in the information to be analyzed exists in the log information shown in table T2, it identifies that the server 30 will analyze the log.

[0041] Returning to Figure 3, let's continue the explanation. The analysis processing unit 307 analyzes the logs using the analysis information. Specifically, the analysis processing unit 307 analyzes the logs identified by the identification unit 306 using the analysis logic of the analysis information shown in Table T2. In other words, the analysis processing unit 307 applies the analysis logic to the log information output by each in-vehicle device that is the target of analysis. The analysis processing unit 307 also compares the analysis logic with the log information, and if they match, it analyzes that there is no abnormality in the in-vehicle device corresponding to that log information. Alternatively, for example, if the analysis processing unit 307 compares the analysis logic with the log information and they do not match, it analyzes that there is an abnormality in the in-vehicle device corresponding to that log information.

[0042] The second output unit 308 outputs analysis result information obtained by analyzing the logs included in the information to be analyzed. The second output unit 308 is an example of an output unit. Specifically, the second output unit 308 outputs analysis result information obtained by the analysis processing unit 307 using the analysis information to analyze the logs included in the information to be analyzed. The analysis result information includes, for example, abnormal information indicating that there is an abnormality in the in-vehicle device installed in the vehicle 10, and normal information indicating that there is no abnormality in the in-vehicle device installed in the vehicle 10.

[0043] The second determination unit 309 determines whether the analysis result information includes abnormal information indicating that there is a malfunction in the on-board equipment installed in the vehicle 10. Specifically, the second determination unit 309 determines whether the analysis result information output by the second output unit 308 includes abnormal information indicating that there is a malfunction in the on-board equipment installed in the vehicle 10.

[0044] The third output unit 310 outputs abnormality notification information to the terminal device 50, which associates vehicle information with abnormality information. The third output unit 310 is an example of an output unit. Specifically, when the second determination unit 309 determines that the analysis result information output by the second output unit 308 contains abnormality information, the third output unit 310 outputs abnormality notification information to the terminal device 50, which associates vehicle information with abnormality information.

[0045] The fourth output unit 311 outputs abnormal information to the monitoring device 12. The fourth output unit 311 is an example of an output unit. Specifically, when the second determination unit 309 determines that the analysis result information output by the second output unit 308 includes abnormal information, the fourth output unit 311 outputs abnormal information to the monitoring device 12. In addition to the abnormal information, the fourth output unit 311 may also output inquiry information indicating the contact information for the vehicle 10 to the monitoring device 12.

[0046] Furthermore, if the user selects status change notification, the monitoring device 12 outputs abnormal information and contact information indicating the contact details for vehicle 10 to the navigation device 15. However, if the user does not select status change notification, the monitoring device 12 does not output abnormal information or contact information indicating the contact details for vehicle 10 to the navigation device 15.

[0047] Figure 6 is a flowchart showing an example of the processing flow performed by the monitoring device 12 according to this embodiment.

[0048] The acquisition unit 121 acquires in-vehicle device information, including the name of each in-vehicle device installed in the vehicle 10, the type of the in-vehicle device, and the software version of the in-vehicle device (step S61). Subsequently, the generation unit 122 generates vehicle information based on the in-vehicle device information acquired by the acquisition unit 121 and vehicle identification information indicating a unique identifier for the vehicle 10 (step S62). Subsequently, the first transmission unit 123 transmits the vehicle information generated by the generation unit 122 to the server 30 (step S63).

[0049] The receiving unit 124 receives status change notification information from the server 30 indicating the presence of an unknown in-vehicle device (step S64). Next, the first determination unit 125 determines whether a status change notification is necessary (step S65). If the first determination unit 125 determines that a status change notification is unnecessary (step S65: unnecessary), the monitoring device 12 proceeds to step S66. On the other hand, if the first determination unit 125 determines that a status change notification is necessary (step S65: necessary), the monitoring device 12 proceeds to step S66.

[0050] In step S66, the output unit 126 outputs status change notification information (step S66). Subsequently, the storage unit 127 stores the analysis target information regarding the log to be analyzed by associating the vehicle identification information, type information, and software version information based on the vehicle information generated by the generation unit 122 (step S67).

[0051] Next, the second determination unit 128 determines whether the analysis target information stored by the storage unit 127 satisfies predetermined conditions (step S68). If the second determination unit 128 determines that the analysis target information stored by the storage unit 127 does not satisfy predetermined conditions (step S68: No), the monitoring device 12 proceeds to step S67. On the other hand, if the second determination unit 128 determines that the analysis target information stored by the storage unit 127 satisfies predetermined conditions (step S68: Yes), the monitoring device 12 proceeds to step S69.

[0052] In step S69, the second transmission unit 129 transmits the analysis target information stored by the storage unit 127 to the server 30 (step S69). Once the processing in step S69 is completed, the monitoring device 12 proceeds to step S67.

[0053] Figure 7 is a flowchart showing an example of the processing flow executed by the server 30 according to this embodiment.

[0054] The first acquisition unit 302 acquires vehicle information transmitted by the monitoring device 12 (step S71). Next, the first determination unit 303 determines whether there is an unknown in-vehicle device in the vehicle information (step S72). If the first determination unit 303 determines that there is no unknown in-vehicle device in the vehicle information (step S72: No), the server 30 proceeds to step S76. On the other hand, if the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information (step S72: Yes), the server 30 proceeds to step S73.

[0055] In step S73, the first output unit 304 outputs status change notification information to the vehicle 10 indicating the presence of an unknown in-vehicle device (step S73). Subsequently, the first output unit 304 outputs unknown type information regarding the type of the unknown in-vehicle device to the terminal device 50 (step S74). Subsequently, the first output unit 304 stores analysis information in the storage unit 301 by associating the vehicle identification information, the unknown type information, and the unknown software version information indicating the software version of the unknown in-vehicle device (step S75).

[0056] Next, the second acquisition unit 305 associates the vehicle identification information, type information, software version information, and log information related to the logs output by the in-vehicle device to be analyzed, which were transmitted by the monitoring device 12, to acquire the log analysis target information (step S76). Subsequently, the identification unit 306 identifies the log information to be analyzed by the server 30 based on the log information included in the analysis target information acquired by the second acquisition unit 305 and the log information included in the analysis information stored in the storage unit 301 (step S77).

[0057] Next, the analysis processing unit 307 analyzes the log information identified by the identification unit 306 using the analysis logic of the analysis information shown in table T2 (step S78). Subsequently, the second output unit 308 outputs the analysis result information obtained by the analysis processing unit 307 using the analysis information to analyze the log (step S79).

[0058] Next, the second determination unit 309 determines whether the analysis result information output by the second output unit 308 includes abnormal information indicating that there is an abnormality in the in-vehicle device installed in the vehicle 10 (step S80). If the second determination unit 309 determines that the analysis result information does not include abnormal information (step S80: No), the server 30's processing ends. On the other hand, if the second determination unit 309 determines that the analysis result information does include abnormal information (step S80: Yes), the server 30's processing proceeds to step S81.

[0059] In step S81, the third output unit 310 outputs abnormality notification information to the terminal device 50, associating vehicle information with abnormality information (step S81). Subsequently, the fourth output unit 311 outputs abnormality information to the monitoring device 12 (step S82). When the processing in step S82 is completed, the server 30's processing is completed.

[0060] Figure 8 is a sequence diagram showing an example of the processing flow executed by the information processing system 100 according to the embodiment. Steps S61 to S66 shown in Figure 8 are the same processes as steps S61 to S66 shown in Figure 6, so their explanation is omitted. Also, steps S71 to S74 shown in Figure 8 are the same processes as steps S71 to S74 shown in Figure 7, so their explanation is omitted.

[0061] In step S91, if the user selects status change notification, the navigation device 15 outputs to the monitoring device 12 that a status change notification is required.

[0062] Figure 9 is a sequence diagram showing an example of the processing flow executed by the information processing system 100 according to the embodiment. Steps S67 to S68 shown in Figure 9 are the same as steps S67 to S68 shown in Figure 6, so their explanation is omitted. Also, steps S76 to S83 shown in Figure 9 are the same as steps S76 to S83 shown in Figure 7, so their explanation is omitted.

[0063] In step S92, if the user selects to receive a status change notification, the monitoring device 12 outputs abnormal information and contact information indicating the contact point for the vehicle 10 to the navigation device 15.

[0064] As described above, the server 30 according to one aspect of this disclosure acquires analysis target information related to logs by associating vehicle identification information indicating an identifier of the vehicle 10, type information indicating the type of the first in-vehicle device installed in the vehicle 10, software version information indicating the software version of the first in-vehicle device to be analyzed, and log information relating to logs output by the first in-vehicle device.

[0065] Furthermore, the server 30 stores analysis information related to the log by associating vehicle identification information, type information, software version information, and analysis logic corresponding to the log. In addition, the server 30 identifies the log based on the information to be analyzed and the analysis information. Then, the server 30 outputs analysis result information obtained by analyzing the log included in the information to be analyzed.

[0066] For example, conventional in-vehicle devices store analysis patterns that categorize analysis data using first correspondence information that shows the correspondence between vehicle identification information and type information, and second correspondence information that shows the correspondence between type information and analysis logic. Conventional in-vehicle devices then reduce the security analysis processing by narrowing down the analysis data using these analysis patterns.

[0067] On the other hand, the server 30 according to this embodiment stores analysis information related to logs by associating vehicle identification information, type information, software version information, and analysis logic corresponding to the logs. In other words, the server 30 pre-identifies the type of in-vehicle device to be analyzed, the software version, and the logs output by the in-vehicle device to be analyzed, and applies the analysis logic to the identified logs.

[0068] For example, conventionally, information about devices installed by the user after the vehicle left the factory is not stored in the in-vehicle system. Furthermore, if these devices are updated individually, the analysis patterns can become bloated, leading to a high processing load on the server.

[0069] However, the server 30 in this embodiment stores analysis information, including the identification of the vehicle 10, at all times, and therefore also stores information about devices installed by the user after the vehicle has left the factory. Furthermore, even if these devices are individually updated, the server stores analysis information, including the software version and analysis logic, thus reducing the bloat of analysis information compared to conventional systems. Consequently, the server 30 can reduce the processing load required for analysis processing compared to conventional systems.

[0070] Furthermore, the server 30 acquires vehicle information including vehicle identification information, type information, and software version information. If there is an unknown second in-vehicle device in the vehicle information that is not included in the analysis information, the server 30 outputs unknown type information indicating the type of the second in-vehicle device. The server 30 associates the vehicle identification information, the unknown type information, and the unknown software version information indicating the software version of the second in-vehicle device, and stores the analysis information.

[0071] For example, if there is a malfunction in an in-vehicle device installed in vehicle 10, the server 30 can uniquely identify vehicle 10 because the analysis information includes vehicle identification information. Furthermore, since the server 30 only needs to add analysis information for unknown in-vehicle devices, the problem of analysis information becoming excessively large can be mitigated.

[0072] Furthermore, if the analysis results include abnormality information indicating that the first in-vehicle device is malfunctioning, the server 30 outputs abnormality notification information that associates the vehicle identification information with the abnormality information. Then, if the analysis results include abnormality information indicating that the first in-vehicle device is malfunctioning, the server 30 outputs the abnormality information and contact information indicating the contact point for vehicle 10 to vehicle 10. This allows the user to refer to the contact information and share the abnormality of the vehicle 10 they are using with the contact point.

[0073] The embodiments described above can also be modified and implemented as appropriate by changing some of the configurations or functions of each of the devices described above. Therefore, several modifications of the embodiments described above will be described below as other embodiments. In the following, we will mainly describe the differences from the embodiments described above, and will omit detailed explanations of points that are common with what has already been described.

[0074] (First variation) For example, the vehicle 10 may be equipped with a storage device that stores the analysis information transmitted by the server 30.

[0075] Figure 10 shows an example of the schematic configuration of the information processing system 100 according to the first modified example. As shown in Figure 10, the vehicle 10 includes a TCU 11, a monitoring device 12, a meter 13, a HUD 14, a navigation device 15, an ECU 16, and a storage device 18. The storage device 18 is connected via CAN 17 for communication.

[0076] The storage device 18 is a device that stores the analysis information transmitted by the server 30. The storage device 18 is an example of a storage unit. The storage device 18 is, for example, a storage device such as an HDD (hard disk drive). However, the storage device 18 is not limited to an HDD, and may be, for example, another storage device.

[0077] Next, the functions of the server 30 according to the first modified example will be described.

[0078] The identification unit 306 uses the analysis information stored in the storage unit 301 to identify a combination of type information and software version information for each vehicle identification information of the vehicle information acquired by the first acquisition unit 302. The identification unit 306 also uses the analysis information stored in the storage unit 301 to identify the analysis logic corresponding to the identified combination of type information and software version information. Furthermore, the identification unit 306 stores the analysis information, including the analysis logic corresponding to the identified combination of type information and software version information, in the storage unit 301, along with the identified date and time.

[0079] The first output unit 304 outputs analysis information to the monitoring device 12 of the vehicle 10, including type information identified by the identification unit 306, software version information, and analysis logic corresponding to the log. Furthermore, if the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information acquired by the first acquisition unit 302, the first output unit 304 outputs analysis information to the monitoring device 12, associating vehicle identification information, unknown type information indicating the type of the unknown in-vehicle device, unknown software version information indicating the software version of the unknown in-vehicle device, and unknown analysis logic for the log corresponding to the log output by the unknown in-vehicle device.

[0080] Furthermore, if the vehicle information acquired by the first acquisition unit 302 includes an in-vehicle device, but the software version of that in-vehicle device is different, the first determination unit 303 determines that there is an unknown in-vehicle device in the vehicle information acquired by the first acquisition unit 302.

[0081] Figure 11 is a functional block diagram showing an example of the functional configuration of the monitoring device 12 according to the first modified example. The monitoring device 12 includes an acquisition unit 121, a generation unit 122, a first transmission unit 123, a receiving unit 124, a first determination unit 125, an output unit 126, a storage unit 127, a second determination unit 128, and a second transmission unit 129, as well as an analysis unit 130.

[0082] The analysis unit 130 stores the analysis information, including vehicle identification information, vehicle type information, software version information, and analysis logic corresponding to the log, output by the server 30, in the storage device 18. The analysis unit 130 also associates the vehicle identification information, unknown vehicle type information, unknown software version information, and analysis logic output by the server 30, and stores them together with the analysis information in the storage device 18.

[0083] Furthermore, the analysis unit 130 uses the analysis information stored in the storage device 18 to analyze the log of analysis target information stored in the storage unit 127.

[0084] The storage unit 127 stores the analysis result information obtained by the analysis unit 130 using the analysis information to analyze the log, adding it to the information to be analyzed. The storage unit 127 also stores the analysis result information and the information to be analyzed in the storage device 18.

[0085] If the analysis result information stored by the storage unit 127 contains abnormal information, the output unit 126 transmits (outputs) the analysis result information and analysis target information stored by the storage unit 127 to the server 30.

[0086] Figure 12 is a sequence diagram showing an example of the processing flow executed by the information processing system 100 according to the first modified example. Steps S61 to S63 and step S72 shown in Figure 12 are the same processes as steps S61 to S63 and step S72 shown in Figure 6, so their explanation is omitted.

[0087] In step S121, the identification unit 306 of the server 30 uses the analysis information stored in the storage unit 301 to identify a combination of type information and software version information for each vehicle identification information of the vehicle information acquired by the first acquisition unit 302. In step S122, the identification unit 306 of the server 30 uses the analysis information stored in the storage unit 301 to identify an analysis logic corresponding to the identified combination of type information and software version information.

[0088] In step S123, the first output unit 304 of the server 30 outputs analysis information to the monitoring device 12 of the vehicle 10, which includes type information, software version information, and analysis logic corresponding to the log, as identified by the identification unit 306. In step S124, the identification unit 306 of the server 30 stores the analysis information, which includes the analysis logic corresponding to the combination of the identified type information and software version information, in the storage unit 301, along with the identified date and time.

[0089] In step S125, the analysis unit 130 of the monitoring device 12 stores the analysis information output by the server 30 in the storage device 18. In step S126, the first output unit 304 of the server 30 outputs analysis information to the monitoring device 12, associating the vehicle identification information, unknown type information indicating the type of the unknown in-vehicle device, unknown software version information indicating the software version of the unknown in-vehicle device, and the unknown analysis logic for the log corresponding to the log output by the unknown in-vehicle device.

[0090] In step S127, the analysis unit 130 of the monitoring device 12 stores the analysis information output by the server 30 in the storage device 18. In step S128, the analysis unit 130 of the monitoring device 12 uses the analysis information stored in the storage device 18 to analyze the log of the information to be analyzed stored in the storage unit 127. In step S129, the storage unit 127 of the monitoring device 12 adds the analysis result information obtained by the analysis unit 130 using the analysis information to the information to be analyzed and stores it.

[0091] In step S130, the storage unit 127 of the monitoring device 12 stores the analysis result information and the analysis target information in the storage device 18. In step S131, if the analysis result information stored in the storage unit 127 contains abnormal information, the output unit 126 of the monitoring device 12 transmits the analysis result information and the analysis target information stored in the storage unit 127 to the server 30.

[0092] As described above, the server 30 in the first modified example outputs analysis information to the vehicle 10. The monitoring device 12 in the first modified example stores analysis target information related to logs by associating vehicle identification information indicating the identifier of the vehicle 10, type information indicating the type of the first in-vehicle device installed in the vehicle 10, software version information indicating the software version of the first in-vehicle device, and log information related to the logs output by the first in-vehicle device that is the target of analysis.

[0093] Furthermore, the monitoring device 12 stores analysis information related to the log by associating vehicle identification information, type information, software version information, and analysis logic corresponding to the log. Then, the monitoring device 12 outputs analysis result information obtained by analyzing the log included in the information to be analyzed, based on the information to be analyzed and the analysis information.

[0094] If the monitoring device 12 finds that there is an unknown second in-vehicle device not included in the analysis information, it associates the vehicle identification information, unknown type information indicating the type of the second in-vehicle device, unknown software version information indicating the software version of the second in-vehicle device, and unknown analysis logic corresponding to the logs output by the second in-vehicle device, and stores them together with the analysis information. Furthermore, if the analysis result information includes abnormality information indicating an abnormality, the monitoring device 12 outputs the analysis result information and the analysis target information.

[0095] For example, the monitoring device 12 can analyze the in-vehicle devices installed in the vehicle 10 using the analysis information output from the server 30. Also, for example, if the analysis result information includes abnormal information indicating an anomaly, the monitoring device 12 outputs the analysis result information and the information to be analyzed to the server 30. This allows the server 30 to perform analysis processing on the in-vehicle devices with more anomalies, thereby reducing the processing load on the server 30.

[0096] (Hardware configuration) Figure 13 shows an example of the hardware configuration of the information processing system 100 according to the embodiment and modified example. The vehicle 10, server 30, and terminal device 50 of the information processing system 100 according to the embodiment and modified example are interconnected by a bus 45, etc., and the processor 41, main memory 42, auxiliary memory 43, and device I / F 44 are connected to each other, resulting in a hardware configuration that uses a normal computer.

[0097] The processor 41 is, for example, a CPU, which is a computing device that controls the vehicle 10, server 30, and terminal device 50 of the above embodiment and its modified form. The main memory 42 is, for example, RAM, which stores data necessary for various processes performed by the processor 41. The auxiliary memory 43 is, for example, ROM, which stores programs and the like that realize information processing by the processor 41.

[0098] The device interface 44 is an interface for various inputs / outputs and / or communications of the vehicle 10, the server 30, and the terminal device 50. For example, the device interface 44 may include a communication interface configured to allow connection of an external communication device that communicates with the vehicle 10, the server 30, and the terminal device 50, or configured to function as such a communication device.

[0099] As for communication interfaces, wired communication circuits such as USB (Universal Serial Bus®) and Ethernet®, or wireless communication circuits compatible with various standards such as 3G, LTE, 4G, 5G, 6G, Wi-Fi®, and Bluetooth® can be used as appropriate.

[0100] In the above embodiment and modified vehicle 10, server 30, and terminal device 50, the processor 41 reads a program from the auxiliary storage device 43 onto the main storage device 42 and executes it, thereby realizing each of the above-mentioned functional units on a computer.

[0101] Furthermore, the programs for executing the above-mentioned processes performed in the vehicle 10, server 30, and terminal device 50 of the above-described embodiment and modified version may be stored on the HDD. Alternatively, the programs for executing the above-mentioned processes performed in the vehicle 10, server 30, and terminal device 50 of the above-described embodiment and modified version may be pre-installed and provided in the auxiliary storage device 43.

[0102] Furthermore, the program for executing the above-mentioned processing performed in the vehicle 10, server 30, and terminal device 50 of the above-described embodiment and modified version may be provided as a computer program product by being stored in an installable or executable file format on a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD (Digital Versatile Disk), or flexible disk (FD). Alternatively, the program for executing the above-mentioned information processing performed in the vehicle 10, server 30, and terminal device 50 of the above-described embodiment and modified version may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Furthermore, the program for executing the above-mentioned information processing performed in the vehicle 10, server 30, and terminal device 50 of the above-described embodiment and modified version may be provided or distributed via a network such as the Internet.

[0103] According to at least one embodiment described above, the processing load required for analysis can be reduced compared to conventional methods.

[0104] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These embodiments can be carried out in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of Symbols]

[0105] 10 vehicles 11 TCU 12 Monitoring equipment 13 meters 14 HUD 15 Navigation System 16 ECU 17 CAN 18 Storage device 30 servers 41 processors 42 Main storage 43 Auxiliary storage device 44 Equipment I / F 45 bus 50 Terminal devices 100 Information Processing Systems 121 Acquisition Department 122 Generation part 123 First Transmitter 124 Receiving Unit 125 1st Judgment Section 126 Output section 127 Storage section 128 Second Judgment Section 129 Second Transmitter 130 Analysis Department 301 Storage section 302 First acquisition part 303 1st Judgment Department 304 First Output Section 305 Second Acquisition Department 306 Specific section 307 Analytical Processing Unit 308 Second Output Section 309 Second Judgment Department 310 Third Output Section 311 Fourth Output Section

Claims

1. An acquisition unit acquires analysis target information related to logs by associating vehicle identification information indicating a vehicle identifier, type information indicating the type of first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device to be analyzed, and log information related to logs output by the first in-vehicle device. A storage unit that stores analysis information related to the log by associating the vehicle identification information, the type information, the software version information, and the analysis logic corresponding to the log, A unit for identifying the log based on the information to be analyzed and the analysis information, The system includes an output unit that outputs analysis result information obtained by analyzing the log included in the information to be analyzed, Information processing device.

2. The acquisition unit acquires vehicle information including the vehicle identification information, the type information, and the software version information. The output unit outputs unknown type information indicating the type of the second on-board device if there is an unknown second on-board device in the vehicle information that is not included in the analysis information. The storage unit stores the analysis information by associating the vehicle identification information, the unknown type information, and the unknown software version information indicating the software version of the second in-vehicle device. The information processing apparatus according to claim 1.

3. If the analysis result information includes abnormality information indicating that the first in-vehicle device is malfunctioning, the output unit outputs abnormality notification information that associates the vehicle identification information with the abnormality information. The information processing apparatus according to claim 1.

4. If the analysis result information includes abnormality information indicating that the first in-vehicle device is malfunctioning, the output unit outputs the abnormality information and contact information indicating the vehicle's contact point to the vehicle. The information processing apparatus according to claim 1.

5. The output unit outputs the analysis information to the vehicle. The information processing apparatus according to claim 2.

6. An information processing method performed in an information processing device, The analysis target information for the log is obtained by associating vehicle identification information indicating the vehicle identifier, type information indicating the type of the first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device to be analyzed, and log information relating to the log output by the first in-vehicle device. The vehicle identification information, the type information, the software version information, and the analysis logic corresponding to the log are associated and the analysis information related to the log is stored. Based on the aforementioned information to be analyzed and the aforementioned analysis information, the log is identified, This includes outputting analysis result information obtained by analyzing the logs included in the aforementioned information to be analyzed, Information processing methods.

7. A storage unit stores analysis target information related to logs by associating vehicle identification information indicating a vehicle identifier, type information indicating the type of first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device, and log information relating to logs output by the first in-vehicle device that is the target of analysis. A storage unit that stores analysis information related to the log by associating the vehicle identification information, the type information, the software version information, and the analysis logic corresponding to the log, The system includes an output unit that outputs analysis result information obtained by analyzing the log included in the analysis target information based on the analysis target information and the analysis information. monitoring equipment.

8. If an unknown second in-vehicle device not included in the analysis information exists in the information to be analyzed, the storage unit associates the vehicle identification information, unknown type information indicating the type of the second in-vehicle device, unknown software version information indicating the software version of the second in-vehicle device, and unknown analysis logic corresponding to the log output by the second in-vehicle device, and stores them together with the analysis information. The monitoring device according to claim 7.

9. The output unit outputs the analysis result information and the analysis target information if the analysis result information includes abnormal information indicating an abnormality. The monitoring device according to claim 8.

10. An information processing method performed in a monitoring device, The system stores analysis target information related to the log by associating vehicle identification information indicating the vehicle identifier, type information indicating the type of the first in-vehicle device installed in the vehicle, software version information indicating the software version of the first in-vehicle device, and log information relating to the log output by the first in-vehicle device that is the target of analysis. The vehicle identification information, the type information, the software version information, and the analysis logic corresponding to the log are associated and the analysis information related to the log is stored. This includes outputting analysis result information obtained by analyzing the logs included in the information to be analyzed, based on the aforementioned information to be analyzed and the aforementioned analysis information. Information processing methods.

Images