DETECTION DEVICE, VEHICLE, DETECTION METHOD, AND DETECTION PROGRAM

Abstract

This detection device comprises: a message acquisition unit that acquires one or more transmitted messages in an in-vehicle network; a data acquisition unit that acquires a set of a plurality of types of data corresponding to the same time and included in the transmitted messages acquired by the message acquisition unit; a storage unit for storing a detection condition created in advance and based on a plurality of the sets corresponding to each of a plurality of times; a calculation unit that uses the set acquired by the data acquisition unit and the detection condition as a basis to calculate an estimation error for a type of data to be monitored in the set; and a determination unit that uses the estimation error calculated by the calculation unit and another estimation error calculated by the calculation unit in the past as a basis to determine whether a transmitted message corresponding to the type of data to be monitored is a fraudulent message.

Description

[Technical field]

[0001] The present disclosure relates to a detection device, a vehicle, a detection method, and a detection program. This application claims priority based on Japanese Patent Application No. 2020-86520, filed on May 18, 2020, the disclosure of which is incorporated herein in its entirety. [Background technology]

[0002] Patent Document 1 (JP 2019-29961 A) discloses the following detection device: That is, the detection device is a detection device that detects unauthorized messages in an in-vehicle network mounted on a vehicle, and includes a message acquisition unit that acquires one or more transmission messages in the in-vehicle network, a data acquisition unit that acquires a set of multiple types of data corresponding to the same time included in the transmission message acquired by the message acquisition unit, a storage unit that stores detection conditions based on a plurality of the sets corresponding to a plurality of times that are created in advance, and a detection unit that detects the unauthorized messages based on the sets acquired by the data acquisition unit and the detection conditions. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-29961 A Summary of the Invention

[0004] The detection device disclosed herein is a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, and includes a message acquisition unit that acquires one or more transmitted messages in the in-vehicle network, a data acquisition unit that acquires sets of multiple types of data corresponding to the same time included in the transmitted messages acquired by the message acquisition unit, a memory unit that stores detection conditions based on multiple sets that correspond to multiple times and that are created in advance, a calculation unit that calculates an estimated error of the data of a type of monitored object in the set based on the set acquired by the data acquisition unit and the detection conditions, and a judgment unit that judges whether the transmitted message corresponding to the data of the type of monitored object is a fraudulent message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

[0005] The detection method disclosed herein is a detection method in a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle and has a memory unit, and includes the steps of acquiring one or more transmitted messages in the in-vehicle network and acquiring sets of multiple types of data corresponding to the same time included in the acquired transmitted messages, wherein the memory unit stores detection conditions based on multiple sets that correspond to multiple times and that are created in advance, and the detection method further includes the steps of calculating an estimated error of the data of the type of monitored object in the set based on the acquired set and the detection conditions, and determining whether the transmitted message corresponding to the data of the type of monitored object is a fraudulent message based on the calculated estimated error and the estimated error calculated in the past.

[0006] The detection program disclosed herein is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network mounted in a vehicle and has a memory unit, and is a program for causing a computer to function as a message acquisition unit that acquires one or more transmitted messages in the in-vehicle network, and a data acquisition unit that acquires multiple sets of data corresponding to the same time included in the transmitted messages acquired by the message acquisition unit, wherein the memory unit stores detection conditions based on multiple sets corresponding to multiple times that have been created in advance, and further causes the computer to function as a calculation unit that calculates an estimated error of the data of a type of monitored object in the set based on the set acquired by the data acquisition unit and the detection conditions, and a judgment unit that judges whether the transmitted message corresponding to the data of the type of monitored object is a fraudulent message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

[0007] One aspect of the present disclosure can be realized not only as a detection device including such a characteristic processing unit, but also as an in-vehicle communication system including the detection device, or as a semiconductor integrated circuit that realizes a part or all of the detection device. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to a first embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating a configuration of a bus connection device group according to the first embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating a configuration of a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining a process of creating a normal model used by the gateway device according to the first embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram for explaining the timing of the synchronization process performed in the gateway device according to the first embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram for explaining the timing of the synchronization process performed in the gateway device according to the first embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram for explaining a creation process in a learning phase of a normal model according to the first embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram for explaining a verification process in a test phase of the normal model according to the first embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram for explaining a process of detecting an unauthorized message using the normal model according to the first embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram for explaining a creation process in a learning phase for the modified example of the normal model according to the first embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram for explaining a process of detecting an unauthorized message using the modified example of the normal model according to the first embodiment of the present disclosure. [Figure 12] FIG. 12 is a flowchart defining an operation procedure when the gateway device according to the first embodiment of the present disclosure receives a transmission message. [Figure 13] FIG. 13 is a flowchart defining an operation procedure when the gateway device according to the first embodiment of the present disclosure stores a received transmission message in a storage unit. [Figure 14] FIG. 14 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to the second embodiment of the present disclosure. As illustrated in FIG. [Figure 15] FIG. 15 is a diagram illustrating an example of a change over time in the transmission interval of a periodic message to be monitored in an in-vehicle communication system according to the second embodiment of the present disclosure. [Figure 16] FIG. 16 is a diagram illustrating an example of a frequency distribution of transmission intervals of target messages in an in-vehicle communication system according to the second embodiment of the present disclosure. [Figure 17] FIG. 17 is a diagram illustrating an example of detection of an unauthorized message by a detection unit in the gateway device according to the second embodiment of the present disclosure. [Figure 18] FIG. 18 is a flowchart defining an operation procedure when the gateway device according to the second embodiment of the present disclosure receives a target message. [Figure 19] FIG. 19 is a flowchart defining an operation procedure when the gateway device according to the second embodiment of the present disclosure performs a determination process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Conventionally, detection devices have been developed that detect unauthorized messages in in-vehicle networks.

[0010] [Problem that this disclosure aims to solve] There is a need for a technology that goes beyond the technology described in Patent Document 1 and that can more accurately detect fraudulent messages in in-vehicle networks.

[0011] The present invention has been made to solve the above-mentioned problems, and its object is to provide a detection device, vehicle, detection method, and detection program that are capable of more accurately detecting fraudulent messages in an in-vehicle network.

[0012] [Effects of this disclosure] According to the present disclosure, it is possible to more accurately detect fraudulent messages in an in-vehicle network.

[0013] [Description of the embodiments of the present disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0014] (1) A detection device according to an embodiment of the present disclosure is a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, and includes a message acquisition unit that acquires one or more transmission messages in the in-vehicle network, a data acquisition unit that acquires sets of multiple types of data corresponding to the same time included in the transmission messages acquired by the message acquisition unit, a memory unit that stores detection conditions based on a plurality of the sets corresponding to a plurality of times that are created in advance, a calculation unit that calculates an estimated error of the data of a type of monitored object in the set based on the set acquired by the data acquisition unit and the detection conditions, and a judgment unit that judges whether the transmission message corresponding to the data of the type of monitored object is a fraudulent message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

[0015] In this way, the configuration calculates the estimation error of the type of data to be monitored in a set of multiple types of data, and judges whether or not a transmitted message corresponding to the data is an unauthorized message based on the calculated estimation error and the previously calculated estimation error, and therefore, compared to the conventional configuration that judges whether or not a transmitted message is an unauthorized message based on the validity of the current estimation error, the influence of sudden changes in data on the judgment result can be suppressed, thereby improving detection performance, and therefore, unauthorized messages in the in-vehicle network can be more accurately detected.

[0016] (2) Preferably, the calculation unit calculates an evaluation value regarding the legitimacy of the data of the type to be monitored based on the calculated estimated error and a distribution of the estimated error created using the detection conditions, and the judgment unit judges whether the transmitted message corresponding to the data of the type to be monitored is an unauthorized message based on the evaluation value calculated by the calculation unit and the evaluation value previously calculated by the calculation unit.

[0017] With this configuration, unauthorized messages can be detected more accurately on the in-vehicle network based on the current evaluation value and the past evaluation value.

[0018] (3) Preferably, the judgment unit calculates a moving average of the estimated error based on the estimated error calculated by the calculation unit and the estimated error calculated in the past by the calculation unit, and judges whether the transmitted message corresponding to the type of data to be monitored is an unauthorized message based on the calculated moving average.

[0019] With this configuration, it is possible to more accurately detect fraudulent messages in an in-vehicle network based on a moving average of the current estimation error and the past estimation error.

[0020] (4) Preferably, the detection conditions are created based on the set of a plurality of types of data having a predetermined correlation.

[0021] In this way, by configuring the detection conditions to be created based on a set of multiple types of data that have a certain degree of relationship between the data, it is possible to create a detection condition that can narrow the range of values ​​that other data in the set can take from one piece of data in the set. This makes it possible to more accurately determine the validity of the other data. In other words, it is possible to create an appropriate detection condition.

[0022] (5) More preferably, the calculation unit calculates an evaluation value regarding the legitimacy of the data of the type of the monitored object based on the calculated estimated error and a distribution of the estimated error created using the detection conditions, and the judgment unit judges whether the transmitted message corresponding to the data of the type of the monitored object is an unauthorized message based on the evaluation value calculated by the calculation unit and the evaluation value previously calculated by the calculation unit.

[0023] With this configuration, even if an attacker modifies some of the data of the type of data to be monitored and the multiple types of correlation data, it is possible to determine an abnormality in the set of data based on the relationship between the modified data and the remaining data. In other words, in order to illegally intrude, an attacker must modify all of the data of the type of data to be monitored and the multiple types of correlation data, making it difficult to illegally intrude into the in-vehicle network. This makes it possible to improve the security of the in-vehicle network.

[0024] (6) More preferably, when there are multiple types of correlation data, which is the data having the correlation with the data of the type of the monitored object, multiple detection conditions are created based on the data of the type of the monitored object and the multiple types of correlation data.

[0025] This configuration makes it difficult to make unauthorized intrusions into the in-vehicle network and reduces the calculation load in calculating the detection conditions.

[0026] (7) Preferably, the data is status data representing a state.

[0027] With this configuration, for example, when the status data of the type being monitored is a value that changes discontinuously, such as the gear shift position or the state of a seat belt, it is possible to more accurately determine whether a transmitted message corresponding to the status data of the type being monitored is a fraudulent message.

[0028] (8) Preferably, the data acquisition unit acquires sets of the plurality of types of data each included in a different one of the transmission messages.

[0029] In many cases, multiple types of data with different reception times, transmission times, or creation times are included in different transmission messages. With the above-described configuration, it is possible to prevent the type of data to be detected from being limited by time.

[0030] (9) More preferably, the message acquisition unit stores the acquired multiple outgoing messages in a memory unit, and the data acquisition unit acquires the set from each of the outgoing messages stored in the memory unit.

[0031] With this configuration, for example, the data in the multiple transmission messages stored in the storage unit can be resampled, so that the times of multiple types of data can be synchronized, making it possible to easily obtain a set of multiple types of data corresponding to the same time.

[0032] (10) Preferably, the detection device further includes a monitoring unit that monitors the transmission messages in the in-vehicle network and a distribution acquisition unit that acquires a distribution of transmission intervals of the transmission messages, wherein the judgment unit detects a fraudulent message based on a monitoring result by the monitoring unit and the distribution acquired by the distribution acquisition unit, and the calculation unit calculates the estimated error of the data stored in the transmission message for the transmission message that the judgment unit judges not to be the fraudulent message based on the distribution, and the judgment unit judges whether the transmission message that the judgment unit judges not to be the fraudulent message based on the distribution is the fraudulent message or not, based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

[0033] A transmission message with a precisely disguised transmission interval is difficult to detect as an unauthorized message based on the monitoring results and the distribution. With the above configuration, the transmission message can be detected as an unauthorized message based on the set and the detection conditions, thereby improving security in the in-vehicle network.

[0034] (11) A vehicle according to an embodiment of the present disclosure includes the detection device.

[0035] With this configuration, a vehicle equipped with a detection device can more accurately detect fraudulent messages in an in-vehicle network.

[0036] (12) A detection method according to an embodiment of the present disclosure is a detection method in a detection device that detects fraudulent messages in an in-vehicle network mounted in a vehicle and has a memory unit, the detection method including the steps of acquiring one or more transmission messages in the in-vehicle network and acquiring sets of multiple types of data corresponding to the same time included in the acquired transmission messages, wherein the memory unit stores detection conditions based on a plurality of the sets corresponding to a plurality of times that have been created in advance, the detection method further including the steps of calculating an estimated error of the data of the type of monitored object in the set based on the acquired set and the detection conditions, and determining whether the transmission message corresponding to the data of the type of monitored object is a fraudulent message based on the calculated estimated error and an estimated error calculated in the past.

[0037] In this way, the method of calculating the estimation error of the type of data to be monitored in a set of multiple types of data and judging whether or not a transmitted message corresponding to the data is an unauthorized message based on the calculated estimation error and the previously calculated estimation error can suppress the influence of sudden changes in data on the judgment result, compared to the conventional technology configuration that judges whether or not a transmitted message is an unauthorized message based on the validity of the current estimation error, thereby improving detection performance, and therefore enabling more accurate detection of unauthorized messages in the in-vehicle network.

[0038] (13) A detection program according to an embodiment of the present disclosure is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network mounted in a vehicle and has a memory unit, the detection program causing a computer to function as a message acquisition unit that acquires one or more transmitted messages in the in-vehicle network, and a data acquisition unit that acquires multiple sets of data corresponding to the same time included in the transmitted messages acquired by the message acquisition unit, the memory unit stores detection conditions based on multiple sets corresponding to multiple times that have been created in advance, and the program also causes the computer to function as a calculation unit that calculates an estimated error of the data of a type of monitored object in the set based on the set acquired by the data acquisition unit and the detection conditions, and a judgment unit that judges whether the transmitted message corresponding to the data of the type of monitored object is a fraudulent message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

[0039] In this way, the configuration calculates the estimation error of the type of data to be monitored in a set of multiple types of data, and judges whether or not a transmitted message corresponding to the data is an unauthorized message based on the calculated estimation error and the previously calculated estimation error, and therefore, compared to the conventional configuration that judges whether or not a transmitted message is an unauthorized message based on the validity of the current estimation error, the influence of sudden changes in data on the judgment result can be suppressed, thereby improving detection performance, and therefore, unauthorized messages in the in-vehicle network can be more accurately detected.

[0040] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0041] <First embodiment> [Configuration and basic operation] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to a first embodiment of the present disclosure.

[0042] 1, an in-vehicle communication system 301 includes a gateway device 101, a plurality of in-vehicle communication devices 111, and a plurality of bus connection device groups 121. The gateway device 101 includes a plurality of in-vehicle communication devices 111, and a plurality of bus connection device groups 121.

[0043] FIG. 2 is a diagram illustrating a configuration of a bus connection device group according to the first embodiment of the present disclosure.

[0044] 2, bus connection device group 121 includes a plurality of control devices 122. Note that bus connection device group 121 is not limited to a configuration including a plurality of control devices 122, and may be a configuration including one control device 122.

[0045] The in-vehicle communication system 301 is mounted on a vehicle 1 traveling on a road. The in-vehicle network 12 includes a plurality of in-vehicle devices that are devices inside the vehicle 1. Specifically, the in-vehicle network 12 includes a plurality of in-vehicle communication devices 111 and a plurality of control devices 122, which are examples of the in-vehicle devices.

[0046] In addition, as long as the in-vehicle network 12 is configured to include multiple in-vehicle devices, it may be configured to include multiple in-vehicle communication devices 111 but not include a control device 122, or it may be configured to include no in-vehicle communication device 111 but include multiple control devices 122, or it may be configured to include one in-vehicle communication device 111 and one control device 122.

[0047] In the in-vehicle network 12, the in-vehicle communication device 111 communicates with, for example, a device outside the vehicle 1. Specifically, the in-vehicle communication device 111 is, for example, a TCU (Telematics Communication Unit), a short-range wireless terminal device, and an ITS (Intelligent Transport Systems) wireless device.

[0048] The TCU is capable of wireless communication with a wireless base station device in accordance with a communication standard such as LTE (Long Term Evolution) or 3G, and is also capable of communication with the gateway device 101. The TCU relays information used for services such as navigation, vehicle theft prevention, remote maintenance, and FOTA (Firmware Over The Air).

[0049] The short-range wireless terminal device is capable of wireless communication with a wireless terminal device such as a smartphone carried by a person riding in the vehicle 1, i.e., a passenger, according to communication standards such as Wi-Fi (registered trademark) and Bluetooth (registered trademark), and is also capable of communicating with the gateway device 101. The short-range wireless terminal device relays information used for services such as entertainment.

[0050] The short-range wireless terminal device can perform wireless communication using radio waves in the LF (Low Frequency) band or UHF (Ultra High Frequency) band with a wireless terminal device such as a smart key held by a passenger and a wireless terminal device provided in a tire according to a predetermined communication standard, and can also communicate with the gateway device 101. The short-range wireless terminal device relays information used for services such as smart entry and TPMS (Tire Pressure Monitoring System).

[0051] The ITS radio device can perform road-to-vehicle communication with roadside devices such as optical beacons, radio beacons, and ITS spots installed near roads, can perform vehicle-to-vehicle communication with on-board terminals installed in other vehicles, and can communicate with the gateway device 101. The ITS radio device relays information used for services such as congestion relief, safe driving support, and route guidance.

[0052] The gateway device 101 is capable of transmitting and receiving data such as firmware updates and data accumulated by the gateway device 101 to and from a maintenance terminal device outside the vehicle 1 via a port 112 .

[0053] The gateway device 101 is connected to the in-vehicle device via, for example, transmission lines 13 and 14. Specifically, the transmission lines 13 and 14 are transmission lines conforming to standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network) standards.

[0054] In this example, the in-vehicle communication device 111 is connected to the gateway device 101 via a corresponding transmission line 14 that complies with the Ethernet standard. Also, each control device 122 in the bus connection device group 121 is connected to the gateway device 101 via a corresponding transmission line 13 that complies with the CAN standard. The control device 122 can control, for example, functional units in the vehicle 1.

[0055] The transmission lines 13 are provided for each system, for example. Specifically, the transmission lines 13 are, for example, a drive system bus, a chassis / safety system bus, a body / electrical system bus, and an AV / information system bus.

[0056] An engine control device, an AT (Automatic Transmission) control device, and an HEV (Hybrid Electric Vehicle) control device, which are examples of the control device 122, are connected to the drive system bus. The engine control device, the AT control device, and the HEV control device control the engine, the AT, and switching between the engine and the motor, respectively.

[0057] A brake control device, a chassis control device, and a steering control device, which are examples of the control device 122, are connected to the chassis / safety system bus. The brake control device, the chassis control device, and the steering control device control the brakes, the chassis, and the steering, respectively.

[0058] An instrument display control device, an air conditioner control device, an anti-theft control device, an air bag control device, and a smart entry control device, which are examples of the control device 122, are connected to the body / electrical system bus. The instrument display control device, the air conditioner control device, the anti-theft control device, the air bag control device, and the smart entry control device control the instruments, the air conditioner, the anti-theft mechanism, the air bag mechanism, and the smart entry, respectively.

[0059] A navigation control device, an audio control device, an ETC (Electronic Toll Collection System) (registered trademark) control device, and a telephone control device, which are examples of the control device 122, are connected to the AV / information bus. The navigation control device, the audio control device, the ETC control device, and the telephone control device control the navigation device, the audio device, the ETC device, and the mobile phone, respectively.

[0060] Further, the configuration is not limited to one in which the control device 122 is connected to the transmission line 13, and a device other than the control device 122, for example, a sensor, may be connected to the transmission line 13.

[0061] The gateway device 101 is, for example, a central gateway (CGW), and is capable of communicating with an in-vehicle device.

[0062] The gateway device 101 performs relay processing, for example, to relay information exchanged between control devices 122 connected to different transmission lines 13 in the vehicle 1, information exchanged between each in-vehicle communication device 111, and information exchanged between the control device 122 and the in-vehicle communication device 111.

[0063] More specifically, in the vehicle 1, for example, a message is periodically transmitted from one in-vehicle device to another in-vehicle device in accordance with a predetermined arrangement. In this example, a message periodically transmitted from one control device 122 to another control device 122 will be described, but the same applies to messages transmitted between the control device 122 and the in-vehicle communication device 111, and messages transmitted between the in-vehicle communication devices 111.

[0064] The message may be transmitted by broadcast or unicast. Hereinafter, a message that is transmitted periodically is also referred to as a periodic message.

[0065] In addition to the periodic messages, there are messages transmitted irregularly from one control device 122 to another control device 122 in the vehicle 1. The messages include an ID for identifying the contents of the message and the sender, etc. It is possible to identify whether a message is a periodic message or not by the ID.

[0066] [Gateway device] FIG. 3 is a diagram illustrating a configuration of a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0067] 3, gateway device 101 includes communication processing unit 51, storage unit 52, data acquisition unit 53, detection unit 54, and message acquisition unit 55. Communication processing unit 51, data acquisition unit 53, detection unit 54, and message acquisition unit 55 are realized by a processor such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor). Storage unit 52 is, for example, a non-volatile memory. Detection unit 54 is an example of a calculation unit and an example of a determination unit.

[0068] The gateway device 101 functions as a detection device and detects unauthorized messages in the in-vehicle network 12 mounted on the vehicle 1.

[0069] Specifically, the communication processing unit 51 in the gateway device 101 performs relay processing. More specifically, when the communication processing unit 51 receives a message from a certain control device 122 via the corresponding transmission line 13, it transmits the received message to another control device 122 via the corresponding transmission line 13.

[0070] [Message acquisition section] The message acquisition unit 55 acquires a plurality of transmission messages in the in-vehicle network 12. The message acquisition unit 55 stores the acquired plurality of transmission messages in the storage unit 52, for example.

[0071] More specifically, detection condition information including, for example, the type of data to be acquired by the message acquisition unit 55 is registered in the storage unit 52. The detection condition information will be described in detail later.

[0072] The message acquisition unit 55 recognizes the type of data that it is to acquire based on the detection condition information registered in the storage unit 52 .

[0073] The message acquisition unit 55 monitors data included in messages relayed by the communication processing unit 51, and performs the following processing every time a message including data of the type to be acquired is detected.

[0074] That is, the message acquisition unit 55 acquires the detected message from the communication processing unit 51, and attaches to the acquired message a timestamp indicating the time at which the message was received.

[0075] The message acquisition unit 55 then stores the time-stamped message in the storage unit 52 .

[0076] [Storage] 4 is a diagram for explaining a process of creating a normal model used by the gateway device according to the first embodiment of the present disclosure. In FIG. 4, the horizontal axis indicates data X, and the vertical axis indicates data Y.

[0077] 4, storage unit 52 stores detection conditions based on a plurality of pairs that are created in advance and correspond to a plurality of times, for example, data creation times. Here, a pair is, for example, a pair of two types of data that are included in a transmission message acquired by message acquisition unit 55 and correspond to the same creation time.

[0078] Specifically, the storage unit 52 stores, for example, a normal model M2 created in advance by a server. The normal model M2 is created, for example, based on a set of two types of data having a predetermined correlation. More specifically, the normal model M2 is created based on a set of data on a type of monitoring target and data having a correlation with the data on the type of monitoring target.

[0079] More specifically, different types of raw data R1 to RN, each of which includes a plurality of time-series data, are registered in the server by a user, where N is an integer equal to or greater than 2. In this example, the raw data R1 to RN are data acquired during development of a test vehicle of the same type as the vehicle 1.

[0080] The server converts, for example, raw data R1 to raw data RN into data 1 to data N each including a plurality of time-series data at a common plurality of creation times.

[0081] More specifically, for example, if the creation time of the time series data included in raw data R1 and the creation time of the time series data included in raw data R2 are not synchronized, the server resamples raw data R2 to synchronize the creation time of the time series data included in raw data R2 with the creation time of the time series data included in raw data R1.

[0082] Similarly, for example, if the creation time of the time series data included in raw data R1 and the creation time of the time series data included in raw data R3 are not synchronized, the server resamples raw data R3 to synchronize the creation time of the time series data included in raw data R3 with the creation time of the time series data included in raw data R1.

[0083] The server performs the same process on the raw data R4 to raw data RN to synchronize the creation time of the time series data included in the raw data R4 to raw data RN with the creation time of the time series data included in the raw data R1. As a result, the raw data R1 to raw data RN, each of which includes multiple time series data, are converted into data 1 to data N, each of which includes multiple time series data at multiple common creation times.

[0084] The server selects data X and Y from data 1 to data N, where X and Y are different from each other and are integers between 1 and N. The selection of data X and Y is performed, for example, in a brute force manner.

[0085] In FIG. 4, pairs of data X and data Y corresponding to multiple pieces of time-series data at multiple common creation times are indicated by black circles.

[0086] The server, for example, calculates a correlation coefficient based on multiple sets of selected data X and data Y.

[0087] For example, if the calculated correlation coefficient is 0.4 or more and 0.7 or less, the server determines that there is a correlation between data X and data Y. Also, for example, if the calculated correlation coefficient is greater than 0.7, the server determines that there is a strong correlation between data X and data Y.

[0088] If the server determines that there is a correlation or a strong correlation between the data X and the data Y, it creates a normal model M2 based on the data X and the data Y.

[0089] Specifically, the server creates a normal model M2 through machine learning in accordance with algorithms such as Mahalanobis, Oneclass-SVM (Support Vector Machine), LOF (Local Outlier Factor), Isolation forest, and NN (Nearest-Neighbor).

[0090] On the other hand, if the server does not determine that there is a correlation between the data X and the data Y and does not determine that there is a strong correlation, the server does not create the normal model M2.

[0091] For example, the server creates a plurality of normal models M2 and creates model information for each of the created normal models M2. Here, the model information indicates the normal model M2 and a combination of the types of the corresponding data X and data Y.

[0092] Combinations of the types of data X and data Y include, for example, engine speed and speed, yaw rate and steering angle, yaw rate and vehicle height, accelerator opening and vehicle acceleration, and the like.

[0093] A plurality of pieces of model information created by the server are, for example, compiled as detection condition information and then registered in the storage unit 52 when the vehicle 1 is manufactured.

[0094] The detection condition information may be updated. Specifically, for example, the communication processing unit 51 receives the detection condition information updated by the server from the server via the in-vehicle communication device 111, and updates the detection condition information registered in the storage unit 52 to the received detection condition information.

[0095] Furthermore, the server is not limited to a configuration for producing a plurality of normal models M2, and may be a configuration for producing one normal model M2.

[0096] [Data Acquisition Section] Referring again to FIG. 3, data acquisition unit 53 acquires a set of two types of data that are included in the transmitted message acquired by message acquisition unit 55 and that correspond to the same time, for example, the reception time.

[0097] More specifically, the data acquisition unit 53 acquires from the storage unit 52 a plurality of pieces of model information included in the detection condition information stored in the storage unit 52 .

[0098] (When two types of data are included in the same sent message) The data acquisition unit 53 acquires, for example, a set of two types of data from each transmitted message stored in the storage unit 52.

[0099] More specifically, the data acquisition unit 53 acquires, from the storage unit 52, a set of two types of data included in the same transmission message, based on the acquired plurality of pieces of model information, for example.

[0100] Specifically, for example, when data matching the combination of types indicated by the model information is stored in the same transmission message and transmitted in the in-vehicle network 12, the data acquisition unit 53 acquires the two types of data from the same transmission message stored in the memory unit 52.

[0101] For example, when a transmission message including the two types of data is newly stored in storage unit 52 by message acquisition unit 55, data acquisition unit 53 acquires the two types of data from the newly stored transmission message, and outputs the acquired set of the two types of data and the combination of types indicated by the model information to detection unit 54. In this way, when two types of data are included in the same transmission message, for example, data acquisition unit 53 acquires the set of two types of data stored in the transmission messages with the same reception time as a "set of two types of data."

[0102] (When two types of data are included in different sent messages) 5 is a diagram for explaining the timing of the synchronization process performed in the gateway device according to the first embodiment of the present disclosure, in which the horizontal axis indicates time.

[0103] With reference to FIG. 5, data acquisition unit 53 acquires, from storage unit 52, a set of two types of data each included in a different transmission message, based on the acquired plurality of pieces of model information, for example.

[0104] Specifically, for example, when data matching the type combination indicated by the model information is stored in a separate transmission message and transmitted in the in-vehicle network 12, the data acquisition unit 53 performs the following process.

[0105] That is, the data acquisition unit 53 acquires, for example, a plurality of transmission messages MJ including one type of data DJ and a plurality of transmission messages MK including the other type of data DK from the storage unit 52. Here, the transmission messages MJ and the transmission messages MK are, for example, messages transmitted in the in-vehicle network 12 at the same cycle.

[0106] The data acquisition unit 53 associates a reception time with one type of data DJ, for example, based on the timestamps attached to a plurality of transmission messages MJ including one type of data DJ.

[0107] Specifically, the data acquisition unit 53 associates the reception times tj1 and tj2 with the data DJ1 and DJ2, which are examples of the data DJ, respectively.

[0108] Similarly, the data acquisition unit 53 associates the other type of data DK with a reception time based on, for example, the timestamps attached to a plurality of transmission messages MK including the other type of data DK.

[0109] Specifically, the data acquisition unit 53 associates the reception times tk1 and tk2 with the data DK1 and DK2, which are examples of the data DK, respectively.

[0110] The data acquisition unit 53 performs a synchronization process to synchronize the reception time of one type of data DJ with the reception time of the other type of data DK, for example, by resampling the other type of data DK based on the reception time associated with one type of data DJ and the reception time associated with the other type of data DK.

[0111] For example, when a transmission message MJ including one type of data DJ is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 performs a synchronization process.

[0112] Specifically, for example, when a transmission message MJ corresponding to reception time tj2 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 generates resampled data RDK1, RDK2 corresponding to the reception times tj1, tj2, respectively, by resampling the data DK including the data DK1, DK2, etc. For example, the data acquisition unit 53 generates resampled data RDK1, RDK2 corresponding to the reception times tj1, tj2, respectively, by interpolating the data DK based on a plurality of data DK.

[0113] For example, when the synchronization process is completed, the data acquisition unit 53 acquires the latest set of two types of data from the two types of synchronized data, and outputs the acquired set of two types of data and the combination of types indicated by the model information to the detection unit 54.

[0114] Specifically, the data acquisition unit 53 outputs, for example, a set of data DJ2 and resample data RDK2, and a combination of types indicated by the model information to the detection unit 54. That is, when two types of data are included in different transmission messages, the data acquisition unit 53 acquires, as a "set of two types of data," a set of data consisting of one type of data DJ2 stored in a transmission message MJ at a reception time tj2 and resample data RDK2 of data DK2 stored in a transmission message MK at a reception time tk2 immediately before the reception time tj2, among transmission messages MK including the other type of data DK. In this way, the data acquisition unit 53 is not limited to a configuration that acquires a set of two types of data stored in transmission messages at the same reception time, for example, when two types of data are included in different transmission messages.

[0115] The timing at which the data acquisition unit 53 performs the synchronization process may be, for example, the timing at which the message acquisition unit 55 newly stores in the storage unit 52 a transmission message MK including the other type of data DK.

[0116] Specifically, for example, when a transmission message MK corresponding to reception time tk2 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 generates resampled data RDK1 corresponding to reception time tj1 by resampling the data DK including the data DK1, DK2, etc. For example, the data acquisition unit 53 generates resampled data RDK1 corresponding to reception time tj1 by performing interpolation of the data DK based on the multiple data DK.

[0117] Then, the data acquisition unit 53 outputs to the detection unit 54, for example, the set of the data DJ1 and the resample data RDK1, and the combination of the type indicated by the model information.

[0118] In addition, the timing at which the data acquisition unit 53 performs the synchronization process may be, for example, the timing at which both a transmission message containing one type of data and a transmission message containing the other type of data are newly stored in the memory unit 52 by the message acquisition unit 55.

[0119] 6 is a diagram for explaining the timing of the synchronization process performed in the gateway device according to the first embodiment of the present disclosure, in which the horizontal axis indicates time.

[0120] 6, a transmission message MP including one type of data DP and a transmission message MQ including the other type of data DQ are messages transmitted in different cycles in the in-vehicle network 12, for example.

[0121] The data acquisition unit 53 associates the reception times tp1 and tp2 with the data DP1 and DP2, which are examples of the data DP, respectively.

[0122] Furthermore, the data acquiring section 53 associates the reception times tq1, tq2, tq3, and tq4 with the data DQ1, DQ2, DQ3, and DQ4, which are examples of the data DQ, respectively.

[0123] For example, when both the transmission messages MP and MQ are newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 performs a synchronization process.

[0124] Specifically, for example, the data acquisition unit 53 determines that both the transmission messages MP and MQ have been newly stored in the storage unit 52 by the message acquisition unit 55 at the reception time tp1, and performs synchronization processing.

[0125] Similarly, the data acquisition unit 53 determines that both the transmission messages MP and MQ have been newly stored in the storage unit 52 by the message acquisition unit 55 at the reception time tp2, for example, and performs synchronization processing.

[0126] For example, in the synchronization process at the reception time tp2, the data acquiring unit 53 generates resampled data RDQ1 and RDQ2 corresponding to the reception times tp1 and tp2, respectively, by resampling the data DQ including the data DQ1 to DQ4, etc. For example, the data acquiring unit 53 generates resampled data RDQ1 and RDQ2 corresponding to the reception times tp1 and tp2, respectively, by performing interpolation of the data DQ based on the multiple data DQ.

[0127] The data acquisition unit 53 outputs to the detection unit 54, for example, a set of the data DP2 and the resample data RDQ2, and a combination of the types indicated by the model information.

[0128] In addition, in the synchronization process at the reception time tp2, the data acquisition unit 53 may generate resampled data RDP1 to RDP4 (not shown) corresponding to the reception times tq1 to tq4, respectively, by resampling the data DP including the data DP1, DP2, etc. Specifically, for example, the data acquisition unit 53 generates resampled data RDP1 to RDP4 corresponding to the reception times tq1 to tq4, respectively, by performing interpolation of the data DP based on a plurality of data DP.

[0129] In this case, the data acquiring unit 53 outputs the set of resampled data RDP4 and data DQ4, and the combination of types indicated by the model information to the detecting unit 54. That is, for example, when two types of data are included in different transmission messages, the data acquiring unit 53 acquires, as a "set of two types of data," a data set consisting of one type of data DQ4 stored in a transmission message MQ at reception time tq4 and resampled data RDP4 of data DP2 stored in a transmission message MP at reception time tp2, which is immediately after the reception time tq4, of the transmission message MP including the other type of data DP.

[0130] At this time, the data acquisition unit 53 may also output the set of resampled data RDP2 and data DQ2, and the set of resampled data RDP3 and data DQ3 to the detection unit 54. This makes it possible to increase the amount of data used to detect fraudulent messages.

[0131] Here, the normal model M2 is created based on multiple sets of two types of data that have the same creation time, while the sets of two types of data acquired by the data acquisition unit 53 are sets of two types of data that have the same reception time.

[0132] Since messages are transmitted at high speed in the in-vehicle network 12, the creation time of the data and the reception time of the data can be considered to be substantially the same. The transmission time of the data can also be considered to be substantially the same as the creation time of the data and the reception time of the data.

[0133] [Detection unit] The detection unit 54 calculates an estimate of the monitored data, which is the data of the type to be monitored in the set of two types of data acquired by the data acquisition unit 53, and uses the calculated estimate to determine whether a transmitted message including the monitored data is an unauthorized message.

[0134] FIG. 7 is a diagram for explaining a creation process in a learning phase of a normal model according to the first embodiment of the present disclosure.

[0135] 7, one normal model M2 is created based on the monitored data and the correlation data. The monitored data and the correlation data have a correlation relationship.

[0136] The monitored data is data measured by a sensor, and specifically, is continuously changing data such as vehicle speed, engine speed, yaw rate, etc. Hereinafter, the data measured by the sensor is also referred to as sensor data.

[0137] The correlation data may be sensor data or status data that represents a predefined state, specifically, the status data representing the state of the gears, seat belts, and other operating parts of the vehicle 1.

[0138] The server trains a normal model M2, for example, based on a training dataset using a least absolute shrinkage and selection operator (LASSO) and a regression tree.

[0139] Here, the learning data set includes monitored data and correlation data corresponding to a plurality of identical times, specifically times tm1, tm2, tm3, tm4, tm5, and so on.

[0140] More specifically, the server creates the normal model M2 such that, for example, when corresponding correlation data at the same time is input to the normal model M2, an estimated value close to the value of the corresponding monitored data is output.

[0141] FIG. 8 is a diagram for explaining a verification process in a test phase of the normal model according to the first embodiment of the present disclosure.

[0142] Referring to FIG. 8, the regular model M2 is validated using a test dataset, which is similar to the training dataset.

[0143] In particular, the server creates a distribution of estimation errors using the normal model M2. More particularly, the server obtains an estimation value output from the normal model M2 by inputting correlation data at time tt1, which is part of the test data set, to the normal model M2.

[0144] Then, the server calculates the estimated error ydiff using, for example, the following equation (1).

number

[0145] Here, y1 is the value of the corresponding monitored data, that is, the value of the monitored data at time tt1, and y1 is the estimated value output from the normal model M2.

[0146] The server also processes the correlation data and the monitored data in the test data set at times other than the time tt1 in the same manner, thereby generating validation data including the estimated error ydiff at each time.

[0147] The server creates a distribution of the estimated error ydiff based on the validation data. This distribution represents the frequency of the estimated error ydiff. In this example, the distribution is unimodal.

[0148] If the created distribution is unimodal, the server calculates the mean value μ and variance σ^2 of each estimation error ydiff contained in the validation data, where "a^b" means the bth power of a.

[0149] The server creates model information Md2 indicating, for example, a normal model M2, a mean value μ and a variance σ^2, and a combination of the types of monitored data and correlation data.

[0150] The model information Md2 created by the server is registered in the storage unit 52 as detection condition information, for example, when the vehicle 1 is manufactured.

[0151] Referring again to FIG. 3, the data acquisition unit 53 acquires the detection condition information from the storage unit 52, and acquires the model information Md2 included in the acquired detection condition information.

[0152] When a transmission message including data matching the combination indicated by the model information Md2 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 acquires a set of two types of data as described above. Specifically, the data acquisition unit 53 performs the following process.

[0153] That is, based on the model information Md2, the data acquisition unit 53 acquires from the memory unit 52 a set of monitored data and correlation data contained in the same transmitted message, and outputs the acquired set and a combination of types indicated by the model information Md2 to the detection unit 54.

[0154] Furthermore, when any one of a plurality of transmission messages each including data matching the combination indicated by the model information Md2 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 performs the synchronization process as described above. Specifically, the data acquisition unit 53 performs the following process.

[0155] That is, the data acquisition unit 53 acquires pairs of monitoring target data and correlation data included in different transmission messages from the storage unit 52 based on the model information Md2, and performs synchronization processing on the acquired monitoring target data and correlation data.

[0156] When the synchronization process is completed, the data acquisition unit 53 acquires the latest set of monitored data and correlation data from the synchronized monitored data and correlation data, and outputs the acquired set and the combination of types indicated by the model information Md2 to the detection unit 54.

[0157] FIG. 9 is a diagram for explaining a process of detecting an unauthorized message using the normal model according to the first embodiment of the present disclosure.

[0158] Referring to Figure 9, when the detection unit 54 receives, for example, a set of monitored data and correlation data at time td1 from the data acquisition unit 53, and a combination of the type indicated by the model information Md2, the detection unit 54 refers to multiple pieces of model information included in the detection condition information in the memory unit 52, and acquires, from the memory unit 52, the model information Md2 corresponding to the received combination.

[0159] The detection unit 54 calculates, for example, an estimated error ydiff of the monitored data among the two types of data in the set acquired by the data acquisition unit 53 based on the set of monitored data and correlation data acquired by the data acquisition unit 53, and the normal model M2 included in the model information Md2.

[0160] More specifically, the detection unit 54 inputs the correlation data received from the data acquisition unit 53 into the normal model M2 included in the model information Md2, thereby acquiring an estimated value output from the normal model M2.

[0161] The detection unit 54 then calculates the estimated error ydiff at time td1 by substituting the acquired estimated value and the value of the monitored data at time td1 as y1 and y1, respectively, into the above-mentioned equation (1). The detection unit 54 stores the calculated estimated error ydiff in the storage unit 52.

[0162] For example, the detection unit 54 calculates an evaluation value regarding the validity of the monitored data based on the calculated estimated error ydiff and the distribution of the estimated error ydiff created using the normal model M2.

[0163] More specifically, the detection unit 54 calculates the Mahalanobis distance D(t)^2 at time t by substituting the calculated estimated error ydiff and the mean value μ and variance σ^2 included in the model information Md2 into the following formula (2). For example, the detection unit 54 calculates the Mahalanobis distance D(td1)^2 of the estimated error ydiff at time td1. The Mahalanobis distance D(t)^2 is an example of an evaluation value regarding the validity of the monitored data.

number

[0164] The detection unit 54 may be configured to calculate a vector of the estimation error ydiff by performing multivariate analysis, and to calculate the Mahalanobis distance D(t)^2 based on the following equation (3).

number

[0165] where X(t) is the vector of the estimation errors ydiff, and μx is the mean vector of the estimation errors ydiff.

[0166] The detection unit 54 stores the calculated Mahalanobis distance D(t)^2 in the storage unit 52 in association with the estimated error ydiff.

[0167] The detection unit 54 judges whether or not the transmitted message corresponding to the monitored data is an unauthorized message based on the calculated estimated error ydiff and the previously calculated estimated error ydiff. More specifically, when the detection unit 54 calculates the estimated error ydiff, the detection unit 54 judges whether or not the transmitted message corresponding to the monitored data is an unauthorized message based on the estimated error ydiff and the previously calculated estimated error ydiff in the storage unit 52.

[0168] For example, the detection unit 54 determines whether or not a transmitted message corresponding to the monitored data is an unauthorized message based on the calculated Mahalanobis distance D(t)^2 and a previously calculated Mahalanobis distance D(t)^2.

[0169] More specifically, the detection unit 54 calculates the Mahalanobis distance D(t)^2 at time t, and then determines whether the transmitted message corresponding to the monitored data is an unauthorized message based on the Mahalanobis distance D(t)^2 and the Mahalanobis distance D(t-1)^2 at time (t-1) previously calculated in the memory unit 52.

[0170] For example, the detection unit 54 detects the CUSUM( Cumulative Sum or MCUSUM (Multivariate Cumulative Sum), it is determined whether a transmitted message corresponding to the monitored data is an unauthorized message.

[0171] More specifically, after calculating the Mahalanobis distance D(t)^2, the detection unit 54 calculates the score T(t)^2 by substituting the calculated Mahalanobis distance D(t)^2 into the following equation (4), and stores the calculated score T(t)^2 in the memory unit 52.

number

[0172] Here, the score T(t-1)^2 is the score of the Mahalanobis distance D(t-1)^2 at the time (t-1) calculated immediately before the Mahalanobis distance D(t)^2. k is a preset parameter for limiting the outlier of the sum of the score T(t-1)^2 and the Mahalanobis distance D(t)^2.

[0173] For example, when the calculated score T(t)^2 is equal to or greater than a predetermined threshold value Th1, the detection unit 54 determines that the transmitted message corresponding to the monitored data is an unauthorized message.

[0174] On the other hand, for example, when the calculated score T(t)^2 is smaller than a predetermined threshold value Th1, the detection unit 54 determines that the transmitted message corresponding to the monitored data is a legitimate message.

[0175] When the detection unit 54 determines that the transmitted message corresponding to the monitored data is an unauthorized message, the detection unit 54 performs, for example, the following process. That is, the detection unit 54 records in the storage unit 52 the ID of the transmitted message determined to be unauthorized, a combination of the type of response, and the like.

[0176] In addition, the detection unit 54 notifies a host device inside or outside the vehicle 1 via the communication processing unit 51 that an unauthorized message is being transmitted over the transmission line 13 .

[0177] Although the distribution of the estimated error ydiff created by the server has been described as being unimodal, this is not limiting and the distribution of the estimated error ydiff created by the server may be multimodal.

[0178] In this case, the server approximates the distribution of the estimation error ydiff by, for example, a mixed Gaussian distribution in which K Gaussian distributions are superimposed, and calculates the mean values ​​μ1 to μK and variances σ1^2 to σK^2 of each Gaussian distribution, as well as the mixture ratios C1 to CK of each Gaussian distribution.

[0179] The server creates model information Md2 indicating, for example, a normal model M2, mean values ​​μ1 to μK, variances σ1^2 to σK^2 and mixture ratios C1 to CK, as well as combinations of types of monitored data and correlated data.

[0180] In this case, the detection unit 54 calculates the Mahalanobis distance D(t)^2 by substituting the calculated estimated error ydiff, as well as the average values ​​μ1 to μk, variances σ1^2 to σk^2, and mixture ratios C1 to Ck contained in the model information Md2, into the following equation (5).

number

[0181] Here, B in formula (5) is expressed by the following formula (6).

number

[0182] [Variation 1] It should be noted that the detection unit 54 is configured to calculate the Mahalanobis distance D(t)^2 and use an analysis method according to CUSUM or MCUSUM to determine whether or not a transmitted message corresponding to the monitored data is an unauthorized message, but this is not limited to this.

[0183] For example, the detection unit 54 may be configured to calculate a moving average of the estimated error ydiff based on the calculated estimated error ydiff and the estimated error ydiff calculated in the past, and to determine whether or not a transmitted message corresponding to the monitored data is an unauthorized message based on the calculated moving average. ExponentillyWeighted Moving Average) or MEWMA (Multivariate Exponentilly The monitoring target data may be configured to determine whether a transmitted message corresponding to the monitored data is an unauthorized message by using an analysis method based on a Weighted Moving Average.

[0184] More specifically, the detection unit 54 performs multivariate analysis to calculate a vector of the estimation error ydiff, and calculates the exponentially weighted moving average A(t) based on the following equation (7).

number

[0185] Here, X(t) is a vector of the estimated error ydiff, and λ is a preset moving average coefficient.

[0186] Then, after calculating the exponentially weighted moving average A(t), the detection unit 54 calculates the score Ta(t)^2 by substituting the calculated exponentially weighted moving average A(t) into the following equation (8).

number

[0187] For example, when the calculated score Ta(t)^2 is equal to or greater than a predetermined threshold value Th2, the detection unit 54 determines that the transmitted message corresponding to the monitored data is an unauthorized message.

[0188] On the other hand, for example, when the calculated score Ta(t)^2 is smaller than a predetermined threshold value Th2, the detection unit 54 determines that the transmitted message corresponding to the monitored data is a legitimate message.

[0189] [Variation 2] Referring again to FIG. 3, the normal model is described as being created based on a set of two types of data having a predetermined correlation, but this is not limited to this and the normal model may be created based on a set of, for example, three or more types of data having a predetermined correlation.

[0190] More specifically, for example, when there are q types of correlation data having a correlation with the monitored data, one normal model M4 is created based on the monitored data and the q types of correlation data, where q is an integer equal to or greater than 2.

[0191] There is a correlation between the monitored data and each of the q types of correlation data. Furthermore, there may or may not be a correlation between the q types of correlation data.

[0192] The server trains a normal model M4, for example, using LASSO and a regression tree based on the training dataset.

[0193] Here, the learning data set includes a plurality of monitored data and correlation data groups each corresponding to the same time, specifically, times tm1, tm2, tm3, tm4, tm5, and so on.

[0194] More specifically, the server creates the normal model M4 such that, for example, when a group of corresponding correlated data at the same time is input to the normal model M4, an estimated value close to the value of the corresponding monitored data is output.

[0195] The server generates validation data including the estimated error ydiff at each time, and generates a distribution of the estimated error ydiff based on the generated validation data.

[0196] The server calculates the estimated error for each validation data. ydiff Calculate the mean value μ and variance σ^2.

[0197] The server creates, for example, a normal model M4, a mean value μ and a variance σ^2, and model information Md4 indicating a combination of q types of data types in the monitored data and the correlated data group.

[0198] The model information Md4 created by the server is registered in the storage unit 52 as detection condition information, for example, when the vehicle 1 is manufactured.

[0199] Referring again to FIG. 3, the data acquisition unit 53 acquires the detection condition information from the storage unit 52, and acquires the model information Md4 included in the acquired detection condition information.

[0200] When a transmission message including data matching the combination indicated by the model information Md4 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 performs the following process.

[0201] That is, based on the model information Md4, the data acquisition unit 53 acquires from the memory unit 52 a set of monitored data and correlated data groups contained in the same transmitted message, and outputs to the detection unit 54 a combination of the acquired set and the types indicated by the model information Md4.

[0202] Furthermore, when the message acquisition unit 55 newly stores in the storage unit 52 any one of a plurality of transmission messages each including data matching the combination indicated by the model information Md4, the data acquisition unit 53 performs the following process.

[0203] That is, the data acquisition unit 53 acquires sets of monitoring target data and correlation data groups contained in different transmission messages from the memory unit 52 based on the model information Md4, and performs synchronization processing on the acquired monitoring target data and correlation data groups.

[0204] When the synchronization process is completed, the data acquisition unit 53 acquires the latest set of monitored data and correlated data groups from the synchronized monitored data and correlated data groups, and outputs the acquired set and the combination of types indicated by the model information Md4 to the detection unit 54.

[0205] For example, when the detection unit 54 receives from the data acquisition unit 53 a set of monitored data and correlation data groups at time td1, and a combination of the type indicated by the model information Md4, the detection unit 54 refers to multiple model information included in the detection condition information in the memory unit 52, and acquires from the memory unit 52 the model information Md4 corresponding to the received combination.

[0206] The detection unit 54 calculates the estimated error ydiff of the monitored data using the above-mentioned equation (1) based on, for example, the set of monitored data and correlation data group acquired by the data acquisition unit 53, and the normal model M4 included in the model information Md4, and stores the calculated estimated error ydiff in the memory unit 52.

[0207] The detection unit 54 calculates the Mahalanobis distance D(t)^2 by substituting the calculated estimated error ydiff, as well as the mean value μ and variance σ^2 contained in the model information Md4 into the above equation (2), and stores the calculated Mahalanobis distance D(t)^2 in the memory unit 52 in correspondence with the estimated error ydiff.

[0208] Then, the detection unit 54 calculates the score T(t)^2 by substituting the calculated Mahalanobis distance D(t)^2 into the above-mentioned equation (4), and determines whether the transmitted message corresponding to the monitored data is an unauthorized message based on the calculated score T(t)^2.

[0209] A configuration using the standard model M4 allows for more accurate detection of fraudulent messages.

[0210] [Variation 3] In the second variant example, when there are q types of correlation data having a correlation with the monitored data, one normal model M4 is created based on the monitored data and the q types of correlation data, but this is not limited to this.

[0211] For example, when there are two types of correlation data having a correlation with the monitoring target data, two detection conditions are created based on the monitoring target data and the two types of correlation data.

[0212] Specifically, when the server determines that data S and data T are correlated or strongly correlated with each other among data 1 to data N that have the same creation time, and determines that data S and data U are correlated or strongly correlated with each other, the server performs the following processing.

[0213] That is, the server creates a normal model M4 based on the data S and T, regardless of the magnitude of the correlation coefficient between the data T and U, and also creates a normal model M4 based on the data S and U.

[0214] With this configuration, the calculation load in creating the normal model can be reduced compared to a configuration in which one normal model M4 is created based on the data S, T, and U.

[0215] [Variation 4] Although the gateway device 101 has been described as being configured to use one normal model M4 or two normal models M4 based on the data S, T, and U, the present invention is not limited to this.

[0216] More specifically, for example, a multidimensional data set can be transformed into a lower dimensional data set using principal component analysis as described in Patent Document 2 (JP 2016-57438 A).

[0217] Specifically, for example, the server converts a set of three types of data into a set of two types of data using principal component analysis, and creates a normal model M4 based on the converted set.

[0218] The storage unit 52 in the gateway device 101 registers an eigenvector for converting a set of three types of data into a set of two types of data, a normal model M4 created by the server, and model information indicating a combination of the types of corresponding data S, data T, and data U.

[0219] When the detection unit 54 receives a set of three types of data and a combination of types indicated by the model information from the data acquisition unit 53, it refers to the model information in the memory unit 52 and acquires the normal model M4 and eigenvector corresponding to the received combination from the corresponding model information in the memory unit 52.

[0220] The detection unit 54 uses the acquired eigenvector to convert the set of three types of data received from the data acquisition unit 53 into a set of two types of data, and based on the converted set and the normal model M4, determines whether one, two, or three transmitted messages containing the three types of data are fraudulent messages.

[0221] [Variation 5] FIG. 10 is a diagram for explaining a creation process in a learning phase for the modified example of the normal model according to the first embodiment of the present disclosure.

[0222] 10, one normal model M5 is created based on the monitored data and q types of correlation data. The monitored data and each of the q types of correlation data have a correlation. In addition, there may or may not be a correlation between the q types of correlation data.

[0223] The monitored data is status data that indicates a state, such as a gear shift position, a seat belt state, or the like, which changes discontinuously.

[0224] The q types of data included in the correlation data group may be sensor data or status data.

[0225] The server trains a normal model M5, for example, based on the training dataset using a decision tree and a Random Forest.

[0226] Here, the learning data set includes a plurality of monitored data and correlation data groups each corresponding to the same time, specifically, times tm1, tm2, tm3, tm4, tm5, and so on.

[0227] More specifically, the server creates the normal model M5 so that, for example, when a group of corresponding correlated data at the same time is input to the normal model M5, an estimated value that matches the value of the corresponding monitored data is output.

[0228] The server creates, for example, a normal model M5 and model information Md5 indicating a combination of q types of data in the monitoring target data and the correlation data group.

[0229] The model information Md5 created by the server is registered in the storage unit 52 as detection condition information, for example, when the vehicle 1 is manufactured.

[0230] Referring again to FIG. 3, the data acquisition unit 53 acquires the detection condition information from the storage unit 52, and acquires the model information Md5 included in the acquired detection condition information.

[0231] When a transmission message including data matching the combination indicated by the model information Md5 is newly stored in the storage unit 52 by the message acquisition unit 55, the data acquisition unit 53 performs the following process.

[0232] That is, based on the model information Md5, the data acquisition unit 53 acquires from the memory unit 52 a set of monitored data and correlated data groups contained in the same transmitted message, and outputs to the detection unit 54 a combination of the acquired set and the types indicated by the model information Md5.

[0233] Furthermore, when the message acquisition unit 55 newly stores in the storage unit 52 any one of a plurality of transmission messages each including data matching the combination indicated by the model information Md5, the data acquisition unit 53 performs the following process.

[0234] That is, the data acquisition unit 53 acquires sets of monitoring target data and correlation data groups contained in different transmission messages from the storage unit 52 based on the model information Md5, and performs synchronization processing on the acquired monitoring target data and correlation data groups.

[0235] When the synchronization process is completed, the data acquisition unit 53 acquires the latest set of monitored data and correlated data groups from the synchronized monitored data and correlated data groups, and outputs the acquired set and the combination of types indicated by the model information Md5 to the detection unit 54.

[0236] FIG. 11 is a diagram for explaining a process of detecting an unauthorized message using the modified example of the normal model according to the first embodiment of the present disclosure.

[0237] Referring to Figure 11, when the detection unit 54 receives, for example, from the data acquisition unit 53, a set of monitored data and correlation data group at time td1, and a combination of the type indicated by the model information Md5, the detection unit 54 refers to multiple pieces of model information included in the detection condition information in the memory unit 52, and acquires from the memory unit 52 the model information Md5 corresponding to the received combination.

[0238] The detection unit 54 estimates the value of the monitored data based on, for example, the correlation data group acquired by the data acquisition unit 53 and the normal model M5 included in the model information Md2.

[0239] More specifically, the detection unit 54 inputs the group of correlation data received from the data acquisition unit 53 into the normal model M5 included in the model information Md5, thereby acquiring an estimated value of the monitored data output from the normal model M5.

[0240] Then, the detection unit 54 calculates the estimation error ydiff by comparing the acquired estimated value with the value of the monitored data at the time td1.

[0241] More specifically, the detection unit 54, for example, compares the acquired estimated value with the value of the monitored data at time td1, and calculates the estimated error ydiff as “1” if these values ​​match, or “zero” if these values ​​do not match.

[0242] After calculating the estimated error ydiff, the detection unit 54 stores the calculated estimated error ydiff in the storage unit 52.

[0243] The detection unit 54 judges whether or not the transmitted message corresponding to the monitored data is an unauthorized message based on the calculated estimated error ydiff and the previously calculated estimated error ydiff. More specifically, when the detection unit 54 calculates the estimated error ydiff, the detection unit 54 judges whether or not the transmitted message corresponding to the monitored data is an unauthorized message based on the estimated error ydiff and the previously calculated estimated error ydiff in the storage unit 52.

[0244] For example, when the newly calculated estimated error ydiff and the previously calculated estimated error ydiff in the storage unit 52 are "zero", the detection unit 54 determines that the transmitted message corresponding to the monitored data is an unauthorized message.

[0245] On the other hand, if at least one of the newly calculated estimated error ydiff and the estimated error ydiff previously calculated in the memory unit 52 is “1”, the detection unit 54 determines that the transmitted message corresponding to the monitored data is a legitimate message.

[0246] [Operation flow] Each device in the in-vehicle communication system according to the embodiment of the present disclosure includes a computer including a memory, and a processor such as a CPU in the computer reads out from the memory and executes a program including some or all of the steps in the following flowcharts and sequences. Each of the programs for the devices can be installed from the outside. Each of the programs for the devices is distributed in a state in which it is stored in a recording medium.

[0247] FIG. 12 is a flowchart defining an operation procedure when the gateway device according to the first embodiment of the present disclosure receives a transmission message.

[0248] With reference to FIG. 12, a situation is assumed in which model information Md2 indicates a combination of a normal model M2 and the types of data X that is monitoring target data and data Y that is correlation data.

[0249] First, the gateway device 101 waits for a transmission message from, for example, the control device 122 (NO in step S102).

[0250] Then, when the gateway device 101 receives a transmission message from the control device 122 (YES in step S102), it checks whether or not the received transmission message includes data of the type to be acquired (step S104).

[0251] Next, if the received transmission message includes data of the type to be acquired (YES in step S104), the gateway device 101 stores the received transmission message in the storage unit 52 (step S106). At this time, the gateway device 101 attaches a timestamp to the transmission message.

[0252] Next, the gateway device 101 stores the received outgoing message in the memory unit 52 (step S106), or, if the received outgoing message does not include data of the type to be acquired (NO in step S104), performs relay processing of the received outgoing message and then waits for a new outgoing message from the control device 122 (NO in step S102).

[0253] FIG. 13 is a flowchart defining an operation procedure when the gateway device according to the first embodiment of the present disclosure stores a received transmission message in a storage unit.

[0254] With reference to FIG. 13, a situation is assumed in which model information Md2 indicates a combination of a normal model M2 and the types of data X that is monitoring target data and data Y that is correlation data.

[0255] First, the gateway device 101 waits for a transmission message to be stored in the storage unit 52 (NO in step S202).

[0256] Then, when the transmission message is stored in the memory unit 52 (YES in step S202), the gateway device 101 checks whether the monitored data and correlation data that match the two types of combinations indicated by the model information Md2 are stored in the transmission message, i.e., the same transmission message (step S204).

[0257] Next, if the monitored data and correlation data that match the two types of combinations indicated by the model information Md2 are not included in the same transmitted message, i.e., if they are included separately in separate transmitted messages (NO in step S204), the gateway device 101 performs synchronization processing on the monitored data and correlation data indicated by the model information Md2 (step S206).

[0258] Next, the gateway device 101 obtains a set of monitored data and correlation data indicated by the model information Md2 from the transmitted message, or obtains the latest set of monitored data and correlation data indicated by the model information Md2 from the monitored data and correlation data that have been synchronized (step S208).

[0259] Next, the gateway device 101 acquires the normal model M2 corresponding to the acquired set of monitoring target data and correlation data from the storage unit 52 (step S210).

[0260] Next, the gateway device 101 calculates the estimation error ydiff of the monitoring target data based on the acquired set of monitoring target data and correlation data, and the normal model M2 (step S212).

[0261] Next, the gateway device 101 calculates the Mahalanobis distance D(t)^2 based on the calculated estimated error ydiff and the distribution of the estimated error ydiff created using the normal model M2 (step S214).

[0262] Next, the gateway device 101 calculates a score T(t)^2 based on the calculated Mahalanobis distance D(t)^2 and the Mahalanobis distance D(t-1)^2 calculated immediately before in the storage unit 52 (step S216).

[0263] Next, the gateway device 101 compares the calculated score T(t)^2 with a predetermined threshold value Th1 (step S218).

[0264] Next, if the score T(t)^2 is smaller than the threshold value Th1, the gateway device 101 determines that the transmitted message corresponding to the monitored data is a valid message (step S222).

[0265] On the other hand, if the score T(t)^2 is equal to or greater than the threshold value Th1, the gateway device 101 determines that the transmitted message corresponding to the monitored data is an unauthorized message (step S224).

[0266] Next, the gateway device 101 waits for a new transmission message to be stored in the storage unit 52 (NO in step S202).

[0267] In the above-mentioned operation flow, a situation is assumed in which the normal model M2 and the model information Md2 indicating the combination of the corresponding types of monitoring target data and correlation data are used, but the present invention is not limited to this. For example, the normal model M4 and the model information Md4 indicating the combination of the monitoring target data and q types of correlation data may be used. In this case, the gateway device 101 acquires a set of the monitoring target data and q types of correlation data in the above-mentioned step S208, and acquires the corresponding normal model M4 from the storage unit 52 in the above-mentioned step S210.

[0268] In addition, in the gateway device according to the first embodiment of the present disclosure, the message acquisition unit 55 is configured to acquire a plurality of transmission messages in the in-vehicle network 12, but is not limited to this. The message acquisition unit 55 may be configured to acquire one transmission message in the in-vehicle network 12. For example, when data matching two types of combinations indicated by the model information is included in the one transmission message, it is possible to determine whether the transmission message is an unauthorized message.

[0269] In addition, in the in-vehicle communication system according to the first embodiment of the present disclosure, the gateway device 101 is configured to detect unauthorized messages in the in-vehicle network 12, but this is not limited to the above. In the in-vehicle communication system 301, a detection device other than the gateway device 101 may be configured to detect unauthorized messages in the in-vehicle network 12.

[0270] In addition, in the gateway device according to the first embodiment of the present disclosure, the data acquisition unit 53 is configured to acquire a set of multiple types of data corresponding to the same reception time, but this is not limited to the above. The data acquisition unit 53 may be configured to acquire a set of multiple types of data corresponding to the same transmission time or the same creation time, etc., not limited to the reception time. Specifically, for example, when the control device 122 stores the creation time of data or the transmission time of a transmission message in a transmission message and transmits it, the data acquisition unit 53 can acquire a set of multiple types of data corresponding to the same transmission time or the same creation time.

[0271] In addition, in the gateway device according to the first embodiment of the present disclosure, the detection unit 54 is configured to detect unauthorized messages in transmission messages exchanged between the control devices 122, but this is not limited to the above. The detection unit 54 may be configured to detect unauthorized messages in transmission messages exchanged between the control devices 122 and the in-vehicle communication devices 111, and transmission messages exchanged between the in-vehicle communication devices 111.

[0272] In addition, in the gateway device according to the first embodiment of the present disclosure, the normal model is configured to be created based on a set of multiple types of data having a predetermined correlation, but this is not limited thereto. The normal model may be configured to be created based on a set of multiple types of data not having a predetermined correlation.

[0273] In addition, in the gateway device according to the first embodiment of the present disclosure, the data acquisition unit 53 is configured to acquire multiple types of data from each transmission message stored in the storage unit 52 by the message acquisition unit 55 and resample the acquired data, but this is not limited to this. For example, if the reception times of the transmission messages are close to each other, the data acquisition unit 53 may be configured to directly receive each transmission message from the message acquisition unit 55, acquire multiple types of data from each received transmission message, and use the acquired data for detection without resampling.

[0274] Meanwhile, there is a demand for technology that can more accurately detect fraudulent messages in in-vehicle networks.

[0275] For example, a so-called occupied bus attack model is assumed as an attack model by a malicious in-vehicle device, in which legitimate messages from normal in-vehicle devices are stopped and malicious messages with the same transmission period as the legitimate messages are transmitted. In such an occupied bus attack model, if the malicious in-vehicle device machine-learns the transmission times of legitimate messages from normal in-vehicle devices and transmits malicious messages so that the standard deviation of the transmission intervals is approximately the same as the standard deviation of the transmission intervals of the legitimate messages, it is not easy to detect the malicious messages.

[0276] The technology described in Patent Document 1 can detect fraudulent messages based on an occupied bus attack model. However, when the monitored data included in a legitimate message suddenly changes, the technology described in Patent Document 1 may erroneously detect the legitimate message as a fraudulent message, and therefore further improvement in detection performance is desired.

[0277] In response to this, the gateway device 101 according to the first embodiment of the present disclosure detects an unauthorized message in the in-vehicle network 12 mounted on the vehicle 1. The message acquisition unit 55 acquires one or more transmission messages in the in-vehicle network 12. The data acquisition unit 53 acquires a set of multiple types of data corresponding to the same time, which are included in the transmission message acquired by the message acquisition unit 55. The storage unit 52 stores detection conditions based on a plurality of sets corresponding to multiple times, which are created in advance. The detection unit 54 calculates an estimation error of the monitoring target data in the set based on the set acquired by the data acquisition unit 53 and the detection condition. The detection unit 54 determines whether or not the transmission message corresponding to the monitoring target data is an unauthorized message, based on the calculated estimation error and an estimation error calculated in the past.

[0278] The detection method according to the first embodiment of the present disclosure is a detection method in a gateway device 101 including a storage unit 52, which detects an unauthorized message in an in-vehicle network 12 mounted on a vehicle 1. The storage unit 52 stores detection conditions based on a plurality of sets corresponding to a plurality of times that are created in advance. In this detection method, first, the gateway device 101 acquires one or a plurality of transmission messages in the in-vehicle network 12. Next, the gateway device 101 acquires a plurality of sets of data corresponding to the same time that are included in the acquired transmission message. Next, the gateway device 101 calculates an estimation error of the monitoring target data in the set based on the acquired set and the detection condition. Next, the gateway device 101 determines whether or not the transmission message corresponding to the monitoring target data is an unauthorized message based on the calculated estimation error and the previously calculated estimation error.

[0279] In this way, the configuration and method of calculating an estimated error for monitored data in a set of multiple types of data and determining whether a transmitted message corresponding to the monitored data is a fraudulent message based on the calculated estimated error and an estimated error calculated in the past can reduce the impact of sudden changes in data on the determination result, compared to conventional technology configurations that determine whether a transmitted message is a fraudulent message based on the validity of the current estimated error, thereby improving detection performance.

[0280] Therefore, the detection device and the detection method according to the first embodiment of the present disclosure can detect fraudulent messages in an in-vehicle network more accurately. More specifically, according to the above configuration and method, in an occupied bus attack model, a fraudulent message can be detected using, for example, an accumulated value of an estimated error, so that the detection performance can be improved compared to the technology described in Patent Document 1. Also, according to the above configuration and method, even in a so-called shared bus attack model in which a fraudulent message is sent without stopping a legitimate message from a normal in-vehicle device, a fraudulent message can be detected using, for example, an accumulated value of an estimated error, so that in a case where a certain degree of risk of a normal message being determined to be a fraudulent message is acceptable, the detection performance can be improved compared to the technology described in Patent Document 1.

[0281] Next, another embodiment of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference characters and the description thereof will not be repeated.

[0282] <Second embodiment> This embodiment relates to a gateway device that incorporates detection of unauthorized messages based on the transmission interval of transmitted messages, as compared with the gateway device according to the first embodiment. Contents other than those described below are the same as those of the gateway device according to the first embodiment.

[0283] [Configuration and basic operation] FIG. 14 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to the second embodiment of the present disclosure. As illustrated in FIG.

[0284] 14, gateway device 103 includes a communication processing unit 51, a storage unit 52, a data acquiring unit 53, a message acquiring unit 55, a monitoring unit 57, a distribution acquiring unit 58, and a detection unit 64. The detection unit 64 is an example of a calculation unit and an example of a determination unit.

[0285] The operations of the communication processing unit 51, the storage unit 52, the data acquisition unit 53, and the message acquisition unit 55 in the gateway device 103 are similar to those of the communication processing unit 51, the storage unit 52, the data acquisition unit 53, and the message acquisition unit 55 in the gateway device 101 shown in Fig. 3. The monitoring unit 57, the distribution acquisition unit 58, and the detection unit 64 are realized by a processor such as a CPU and a DSP, for example.

[0286] 15 is a diagram illustrating an example of a change over time in the transmission interval of a periodic message to be monitored in an in-vehicle communication system according to a second embodiment of the present disclosure, in which the vertical axis indicates the transmission interval and the horizontal axis indicates time.

[0287] 15, the transmission interval is, for example, the interval of timing at which a periodic message to be monitored is transmitted over the transmission line 13. Hereinafter, the periodic message to be monitored is also referred to as a target message.

[0288] As shown in Fig. 15, the transmission interval of the target message is not constant but varies. This is because arbitration is performed when the target message is transmitted, and delays in internal processing vary due to clock skew.

[0289] Here, arbitration will be described. Priority is assigned to messages according to, for example, IDs. For example, when the transmission timings of multiple messages overlap, arbitration is performed in the in-vehicle network 12 to transmit messages with higher priority over messages with lower priority via the transmission line 13. Such arbitration causes variations in the transmission intervals.

[0290] 16 is a diagram showing an example of a frequency distribution of transmission intervals of target messages in an in-vehicle communication system according to a second embodiment of the present disclosure, in which the vertical axis indicates the frequency and the horizontal axis indicates the transmission intervals.

[0291] 16, the frequency distribution of the transmission intervals is approximately symmetrical about Ct milliseconds. The frequency distribution of the transmission intervals can be approximated by, for example, a predetermined model function Func1.

[0292] 14 again, the monitoring unit 57 monitors, for example, a transmission message in the in-vehicle network 12. More specifically, the monitoring unit 57 monitors, for example, a relay process of the transmission message in the communication processing unit 51, and measures a transmission interval of the target message based on a monitoring result.

[0293] Specifically, for example, one ID indicating the target message is registered in the monitoring unit 57. Hereinafter, the registered ID indicating the target message is also referred to as a registered ID. Note that multiple registered IDs may be registered in the monitoring unit 57.

[0294] For example, when the communications processing unit 51 receives a transmission message, the monitoring unit 57 checks the ID included in the transmission message received by the communications processing unit 51. If the checked ID matches the registered ID, the monitoring unit 57 holds the reception time t1 of the transmission message received by the communications processing unit 51, i.e., the target message, as, for example, a measurement criterion.

[0295] Then, when the communication processing unit 51 receives a new target message including a registration ID, the monitoring unit 57 holds the reception time t2 of the newly received target message and performs the following process.

[0296] That is, the monitor 57 calculates the transmission interval of the target message by subtracting the reception time t1 from the reception time t2, and outputs the calculated transmission interval and the registration ID to the detector 64.

[0297] The distribution acquisition unit 58 acquires, for example, the distribution of the transmission intervals of the transmission messages. In detail, the distribution acquisition unit 58 acquires, for example, distribution information indicating the distribution of the transmission intervals that has been created in advance by another device, specifically, a server.

[0298] More specifically, the server acquires, for example, a plurality of transmission intervals of the target message. The transmission intervals are measured, for example, in a test vehicle of the same type as the vehicle 1. Note that the server may acquire the transmission intervals measured in the vehicle 1.

[0299] For example, the server uses, as the model function Func1, a probability density function p of a normal distribution with a variable x, as shown in the following formula (9): Hereinafter, the probability density function p is also referred to as a normal distribution function.

number

[0300] Here, x bar and σ ̂2 are parameters, which are the average value and variance of multiple transmission intervals, respectively, and are calculated by the following equations (10) and (11), respectively.

number

number

[0301] Here, t is the number of samples in the transmission interval, and xi is the i-th transmission interval. The server transmits distribution information including x and σ^2 to the vehicle 1 at a predetermined distribution timing, for example.

[0302] When the distribution acquisition unit 58 receives distribution information from the server via the in-vehicle communication device 111 and the communication processing unit 51, it creates a model function Func1 shown in equation (9) based on the received distribution information, and outputs the created model function Func1 to the detection unit 64.

[0303] In the above description, the gateway device 101 has a configuration in which the distribution acquisition unit 58 receives distribution information from the server via the in-vehicle communication device 111 and the communication processing unit 51 and outputs the distribution information to the detection unit 64. However, the present invention is not limited to this. For example, the gateway device 101 may have a non-volatile memory, and the distribution acquisition unit 58 may acquire the distribution information from the non-volatile memory to which the distribution information has been written by the maintenance terminal device via the port 112, and output the distribution information to the detection unit 64.

[0304] 17 is a diagram illustrating an example of detection of an unauthorized message by a detection unit in a gateway device according to the second embodiment of the present disclosure, in which the vertical axis indicates the score and the horizontal axis indicates the variable x.

[0305] 17, the detection unit 64 detects an unauthorized message based on, for example, the monitoring result by the monitoring unit 57 and the distribution of the transmission intervals acquired by the distribution acquisition unit 58.

[0306] In detail, the detection unit 64 judges whether or not a transmitted message should be regarded as an unauthorized message based on, for example, the transmission intervals measured by the monitoring unit 57, distribution information indicating the distribution of the transmission intervals, and a predetermined threshold value. Here, the detection unit 64 has a threshold value ThB registered therein.

[0307] In other words, the detector 64 detects an unauthorized message based on the position of the transmission interval measured by the monitor 57 in the distribution of the transmission intervals.

[0308] Upon receiving the model function Func1 from the distribution acquisition unit 58, the detection unit 64 creates a score function Sc1 by modifying the received model function Func1. More specifically, the detection unit 64 creates, for example, -log(Func1) as the score function Sc1. Here, "log(c)" means the common logarithm of c.

[0309] In Fig. 17, the score function Sc1 is expressed so that the measurement reference time is x = 0. Therefore, the horizontal axis shown in Fig. 17 indicates the transmission interval. Furthermore, the score function Sc1 indicates the minimum value when the variable x is the average value, that is, x bar.

[0310] The detection unit 64 calculates the score by substituting the transmission interval received from the monitoring unit 57 into the variable x in the score function Sc1.

[0311] If the calculated score is, for example, equal to or less than a threshold value ThB, the detection unit 64 determines that the currently transmitted target message should not be regarded as an unauthorized message, that is, determines that the target message is a legitimate message or a message whose transmission interval is spoofed. Hereinafter, a message whose transmission interval is spoofed is also referred to as a spoofed message.

[0312] Specifically, when the detection unit 64 receives the transmission interval Tc shown in FIG. 17 from the monitoring unit 57, it determines that the currently transmitted target message C is a valid message or a fake message.

[0313] This is because, for example, when the target message is a legitimate message or a fake message, the transmission interval is likely to be located near the center of the frequency distribution shown in FIG. 16, even including variations due to arbitration and internal processing delays, etc.

[0314] On the other hand, when the calculated score is greater than the threshold value ThB, the detection unit 64 determines that the currently transmitted target message is an unauthorized message. Specifically, when the detection unit 64 receives the transmission interval Ta shown in Fig. 17 from the monitoring unit 57, it determines that the currently transmitted target message A is an unauthorized message. Similarly, when the detection unit 64 receives the transmission interval Tb from the monitoring unit 57, it determines that the currently transmitted target message B is an unauthorized message.

[0315] This is because, for example, if the target message is an unauthorized message, there is a high possibility that the target message has not been sent in accordance with a predetermined agreement.

[0316] Furthermore, when lowering the security level, the threshold value registered in the detection unit 64 is changed to ThA, which is larger than ThB. As a result, a transmitted message that has been determined to be an unauthorized message by the detection unit 64, such as the target message B corresponding to the transmission interval Tb, is determined to be a legitimate message or a forged message after the threshold value is changed.

[0317] The detection unit 64 notifies the monitoring unit 57 of the result of the determination based on the transmission interval received from the monitoring unit 57 .

[0318] The monitoring unit 57 uses, for example, the timing of receiving a transmitted message that is determined to be a valid message or a fake message as a measurement criterion for the transmission interval.

[0319] More specifically, if the judgment result notified by the detection unit 64 indicates that the target message transmitted this time is a legitimate message or a forged message, the monitoring unit 57 uses the reception time t2 as a new measurement standard for the transmission interval.

[0320] Then, when the communication processing unit 51 receives a new target message including a registration ID, the monitoring unit 57 holds the reception time t3 of the newly received target message and performs the following process.

[0321] That is, the monitor 57 calculates a new transmission interval for the target message by subtracting the reception time t2 from the reception time t3, and outputs the calculated transmission interval to the detector 64.

[0322] On the other hand, if the determination result notified by the detection unit 64 indicates that the currently transmitted target message is an unauthorized message, the monitoring unit 57 maintains the reception time t1 as the measurement standard.

[0323] Then, when the communication processing unit 51 receives a new target message including a registration ID, the monitoring unit 57 holds the reception time t3 of the newly received target message and performs the following process.

[0324] That is, the monitor 57 calculates a new transmission interval for the target message by subtracting the reception time t1 from the reception time t3, and outputs the calculated transmission interval to the detector 64.

[0325] For example, for a target message that is determined not to be a fraudulent message based on the distribution of transmission intervals measured by the monitoring unit 57, the detection unit 64 calculates an estimated error ydiff of the data stored in the target message, and determines whether or not the message is a fraudulent message based on the calculated estimated error ydiff and an estimated error ydiff calculated in the past.

[0326] More specifically, when the detection unit 64 determines that the currently transmitted target message C is a valid message or a fake message, the detection unit 64 outputs the registration ID received from the monitoring unit 57 to the data acquisition unit 53 .

[0327] When the data acquisition unit 53 receives the registration ID from the detection unit 64, it acquires the latest transmission message having the received registration ID, that is, the latest target message, from among the multiple transmission messages stored in the storage unit 52.

[0328] In this example, one piece of data is stored in the target message. The data acquisition unit 53 recognizes the type of the one piece of data stored in the latest target message acquired. Note that the target message may include two or more pieces of data. Hereinafter, the type of one piece of data included in the latest target message acquired by the data acquisition unit 53 is also referred to as the target type.

[0329] The data acquisition unit 53 refers to a plurality of pieces of model information included in the detection condition information stored in the storage unit 52, and acquires, from the storage unit 52, model information indicating the recognized target type from among the plurality of pieces of model information referred to.

[0330] The data acquisition unit 53 identifies the type of data to be combined with the target type based on the acquired model information. Hereinafter, the type of data to be combined with the target type is also referred to as the other party type. Hereinafter, the data of the target type is the monitored data, and the data of the other party type is the correlation data.

[0331] The data acquisition unit 53, for example, acquires from the memory unit 52 a plurality of target messages including data of the target type and a plurality of transmission messages including data of the other party type, and performs a synchronization process to synchronize the reception time of the target type data and the reception time of the other party type data based on each acquired transmission message.

[0332] When the synchronization process is completed, the data acquisition unit 53 acquires the latest set of two types of data from the two types of synchronized data, and outputs the acquired set of two types of data and the combination of types indicated by the model information to the detection unit 64.

[0333] When the detection unit 64 receives a set of two types of data and a combination of types indicated by the model information from the data acquisition unit 53, it refers to multiple pieces of model information included in the detection condition information in the memory unit 52, and acquires a normal model M2 corresponding to the received combination from the corresponding model information in the memory unit 52.

[0334] The detection unit 64 calculates the estimation error ydiff of the target type of data based on the set of the target type of data and the other party type of data acquired by the data acquisition unit 53, and the normal model M2 included in the model information Md2.

[0335] The detection unit 54 calculates the Mahalanobis distance D(t)^2 by substituting the calculated estimated error ydiff, and the mean value μ and variance σ^2 included in the model information Md2 into the above-mentioned equation (2).

[0336] After calculating the Mahalanobis distance D(t)^2, the detection unit 54 calculates the score T(t)^2 by substituting the calculated Mahalanobis distance D(t)^2 into the above-mentioned equation (4), and determines whether the target message is a fraudulent message based on the calculated score T(t)^2.

[0337] When the detection unit 64 determines that the target message is an unauthorized message, the detection unit 64 performs, for example, the following process: That is, the detection unit 64 records in the storage unit 52 a combination of the registration ID, the ID of the transmitted message including the data on the recipient type, and the type of response.

[0338] In addition, the detection unit 64 notifies a higher-level device inside or outside the vehicle 1 via the communication processing unit 51 that an unauthorized message is being transmitted over the transmission line 13 .

[0339] [Operation flow] FIG. 18 is a flowchart defining an operation procedure when the gateway device according to the second embodiment of the present disclosure receives a target message.

[0340] Referring to FIG. 18, first, the gateway device 103 receives a first target message and sets the reception time of the target message as a measurement criterion (step S302).

[0341] Next, the gateway device 103 waits for the target message (NO in step S304).

[0342] Then, when the gateway device 103 receives the target message (YES in step S304), it performs a determination process to determine whether or not the received target message should be regarded as an unauthorized message (step S306).

[0343] Next, the gateway device 103 waits for a new target message (step S30 4 So NO).

[0344] 19 is a flowchart defining an operation procedure when the gateway device according to the second embodiment of the present disclosure performs a determination process. FIG. 19 shows details of the operation in step S306 in FIG.

[0345] Referring to FIG. 19, the gateway device 103 calculates the transmission interval by subtracting the measurement criterion from the receiving time of the target message (step S402).

[0346] Next, the gateway device 103 calculates the score by substituting the calculated transmission interval into the score function Sc1 (step S404).

[0347] Next, if the calculated score is greater than the threshold value ThB (NO in step S406), the gateway device 103 determines that the currently transmitted target message is an unauthorized message (step S428).

[0348] On the other hand, if the calculated score is equal to or less than the threshold value ThB (YES in step S406), the gateway device 103 determines that the currently transmitted target message is a legitimate message or a fake message (step S408).

[0349] Next, the gateway device 103 updates the measurement criterion to the reception time of the currently transmitted target message (step S410).

[0350] Next, the gateway device 103 checks whether or not both the target type of data, ie, monitoring target data, and the other party type of data, ie, correlation data, are stored in the target message (step S412).

[0351] Next, if both the monitored data and the correlation data are not included in the target message, i.e., if they are included separately in separate transmission messages (NO in step S412), the gateway device 103 performs synchronization processing on the monitored data and the correlation data (step S414).

[0352] Next, the gateway device 103 obtains a set of two types of data, more specifically, a set of monitored data and correlated data, from the target message, or obtains the latest set of monitored data and correlated data from the monitored data and correlated data that have been subjected to synchronization processing (step S416).

[0353] Next, the gateway device 103 acquires the normal model M2 corresponding to the set of the monitoring target data and the correlation data from the storage unit 52 (step S418).

[0354] Next, the gateway device 103 calculates an estimated error ydiff of the monitored data based on the acquired set of monitored data and correlation data and the normal model M2. The gateway device 103 also calculates a Mahalanobis distance D(t)^2 based on the calculated estimated error ydiff and the distribution of the estimated error ydiff created using the normal model M2. The gateway device 103 also calculates a score T(t)^2 based on the calculated Mahalanobis distance D(t)^2 and the Mahalanobis distance D(t-1)^2 calculated immediately before in the storage unit 52 (step S420).

[0355] Next, the gateway device 103 compares the calculated score T(t)^2 with a predetermined threshold value Th1 (step S422).

[0356] Next, if the score T(t)^2 is smaller than the threshold value Th1, the gateway device 103 determines that the currently transmitted target message is a valid message (step S426).

[0357] On the other hand, if the score T(t)^2 is equal to or greater than the threshold value Th1, the gateway device 103 determines that the currently transmitted target message is an unauthorized message (step S428).

[0358] In the gateway device according to the second embodiment of the present disclosure, the monitoring unit 57 is configured to measure the transmission interval based on the reception time of the target message, but this is not limited to the above. For example, the monitoring unit 57 may be configured to obtain the transmission time of the target message and measure the transmission interval based on the obtained transmission time.

[0359] Furthermore, although the gateway device according to the second embodiment of the present disclosure is configured to acquire the distribution of the transmission intervals of the target messages measured in the test vehicle, this is not limiting. The gateway device 103 may be configured to accumulate the transmission intervals measured in the vehicle 1 and create the distribution based on the accumulated transmission intervals.

[0360] Since the other configurations and operations are similar to those of the gateway device according to the first embodiment, detailed description will not be repeated here.

[0361] It should be noted that it is also possible to combine some or all of the components and operations of the devices according to the first and second embodiments of the present disclosure as appropriate.

[0362] The above-described embodiments should be considered as illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0363] The above description includes the following additional features.

[0364] [Appendix 1] A detection device for detecting an unauthorized message in an in-vehicle network mounted in a vehicle, comprising: A message acquisition unit that acquires one or more transmission messages in the in-vehicle network; a data acquisition unit that acquires a set of multiple types of data corresponding to the same time, the data being included in the transmission message acquired by the message acquisition unit; A storage unit that stores detection conditions based on a plurality of sets that are created in advance and that correspond to a plurality of times, respectively; a calculation unit that calculates an estimation error of the data of the type of the monitoring target in the set based on the set acquired by the data acquisition unit and the detection condition; a determination unit that determines whether or not the transmitted message corresponding to the data of the type to be monitored is an unauthorized message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit, the data is sensor data, The time is a reception time, a transmission time, or a creation time, The judgment unit determines whether the transmitted message corresponding to the data of the target type is an fraudulent message by using an analysis method according to CUSUM, MCUSUM, EWMA or MEWMA based on the estimated error and the estimated error calculated in the past.

[0365] [Appendix 2] A detection device for detecting an unauthorized message in an in-vehicle network mounted in a vehicle, comprising: A message acquisition unit that acquires one or more transmission messages in the in-vehicle network; a data acquisition unit that acquires a set of multiple types of data corresponding to the same time, the data being included in the transmission message acquired by the message acquisition unit; A storage unit that stores detection conditions based on a plurality of sets that are created in advance and that correspond to a plurality of times, respectively; a calculation unit that calculates an estimation error of the data of the type of the monitoring target in the set based on the set acquired by the data acquisition unit and the detection condition; a determination unit that determines whether or not the transmitted message corresponding to the data of the type to be monitored is an unauthorized message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit, The detection device, wherein the message acquisition unit, the data acquisition unit, the calculation unit, and the determination unit are realized by a processor. [Explanation of symbols]

[0366] 1 vehicle 12 In-vehicle network 13,14 Transmission lines 51 Communication processing unit 52 Storage section 53 Data Acquisition Section 54 Detection unit 55 Message acquisition unit 57 Monitoring Department 58 Distribution acquisition part 64 Detection unit 101,103 Gateway device 111 Vehicle communication device 112 Port 121 Bus connection devices 122 Control device 301 In-vehicle communication system

Claims

1. A detection device for detecting fraudulent messages in an in-vehicle network installed in a vehicle, comprising: a message acquisition unit that acquires one or more transmission messages in the in-vehicle network; a data acquisition unit that acquires a set of multiple types of data corresponding to the same time, the data being included in the transmission message acquired by the message acquisition unit; A storage unit that stores detection conditions based on a plurality of sets that are created in advance and that correspond to a plurality of times, respectively; a calculation unit that calculates an estimation error of the data of the type of the monitoring target in the set based on the set acquired by the data acquisition unit and the detection condition; a determination unit that determines whether or not the transmitted message corresponding to the data of the type to be monitored is an unauthorized message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit, The judgment unit calculates a moving average of the estimated error based on the estimated error calculated by the calculation unit and the estimated error calculated in the past by the calculation unit, and judges whether the transmitted message corresponding to the type of data to be monitored is an fraudulent message based on the calculated moving average.

2. The detection device according to claim 1 , wherein the detection condition is created based on the set of a plurality of types of data having a predetermined correlation.

3. The detection device according to claim 2, wherein when there are multiple types of correlation data, which is the data having the correlation with the data of the type of the monitored object, one detection condition is created based on the data of the type of the monitored object and the multiple types of correlation data.

4. 3. The detection device according to claim 2, wherein when there are multiple types of correlation data, which is the data having the correlation with the data of the type of the monitored object, multiple detection conditions are created based on the data of the type of the monitored object and the multiple types of correlation data.

5. The detection device according to claim 1 , wherein the data is status data representing a state.

6. The detection device according to claim 1 , wherein the data acquisition unit acquires sets of the plurality of types of data each included in a different one of the transmission messages.

7. The message acquisition unit stores the acquired plurality of transmission messages in a storage unit, The detection device according to claim 6 , wherein the data acquisition unit acquires the set from each of the transmission messages stored in the storage unit.

8. The detection device further comprises: a monitoring unit that monitors the transmission message in the in-vehicle network; a distribution acquisition unit that acquires a distribution of the transmission intervals of the transmission messages; The determination unit detects an unauthorized message based on a monitoring result by the monitoring unit and the distribution acquired by the distribution acquisition unit; the calculation unit calculates the estimation error of the data stored in the transmission message for the transmission message that is determined by the determination unit not to be an unauthorized message based on the distribution; 8. The detection device according to claim 1, wherein the determination unit determines whether the transmitted message that is determined not to be a fraudulent message based on the distribution is a fraudulent message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit.

9. A vehicle comprising a detection device according to any one of claims 1 to 8.

10. A detection method for detecting an unauthorized message in an in-vehicle network mounted on a vehicle, the detection method comprising: obtaining one or more outgoing messages in the in-vehicle network; acquiring a set of a plurality of types of data corresponding to the same time included in the acquired transmission message, the storage unit stores detection conditions based on a plurality of the sets that are created in advance and that correspond to a plurality of times, respectively; The detection method further comprises: calculating an estimation error of the data of the type of the monitored object in the set based on the acquired set and the detection condition; determining whether the transmitted message corresponding to the type of data to be monitored is an unauthorized message based on the calculated estimated error and the estimated error previously calculated; In the step of determining whether the transmitted message is an unauthorized message, a moving average of the estimated error is calculated based on the calculated estimated error and the estimated error calculated in the past, and whether the transmitted message corresponding to the type of data to be monitored is an unauthorized message is determined based on the calculated moving average.

11. A detection program for detecting an unauthorized message in an in-vehicle network mounted on a vehicle, the detection program being used in a detection device having a storage unit, the detection device comprising: Computer, a message acquisition unit that acquires one or more transmission messages in the in-vehicle network; a data acquisition unit that acquires a set of multiple types of data corresponding to the same time, which are included in the transmission message acquired by the message acquisition unit; It is a program to function as the storage unit stores detection conditions based on a plurality of the sets that are created in advance and that correspond to a plurality of times, respectively; In addition, the computer a calculation unit that calculates an estimation error of the data of the type of the monitoring target in the set based on the set acquired by the data acquisition unit and the detection condition; a determination unit that determines whether or not the transmitted message corresponding to the data of the type to be monitored is an unauthorized message based on the estimated error calculated by the calculation unit and the estimated error previously calculated by the calculation unit; It is a program to function as The judgment unit calculates a moving average of the estimated error based on the estimated error calculated by the calculation unit and the estimated error calculated in the past by the calculation unit, and judges whether the transmitted message corresponding to the type of data to be monitored is an unauthorized message based on the calculated moving average.

Images