Determination method, determination system, and program

Abstract

Provided is a determination method for determining a reference message that is used to detect unauthorized communication in an on-vehicle network system (10) including a network and one or more electronic control units connected to the network. The reference message is used as a reference for a decision as to whether a message sent to the network is an abnormal message. The determination method comprises: a storage step (S1007) for storing candidate information related to one or more reference message candidates each of which is a candidate of the reference message; a first determination step (S1106) for determining a determination method for determining the reference message from the one or more reference message candidates included in the candidate information stored in the storage step, on the basis of the one or more reference message candidates; and a second determination step (S1107) for determining the reference message from the one or more reference message candidates using the determination method.

Description

[Technical field]

[0001] The present disclosure relates to a method for determining a reference message used to detect unauthorized communication in a network system. [Background technology]

[0002] In recent years, systems inside automobiles have been equipped with many devices called electronic control units (ECUs, hereafter also referred to as ECUs). The network that connects these ECUs is called an in-vehicle network. There are many communication standards for in-vehicle networks. One of the most mainstream standards for in-vehicle networks is the Controller Area Network (hereafter also referred to as CAN).

[0003] In a network based on the CAN standard (hereafter also referred to as a CAN network), the communication path (bus) consists of two cables, and the ECUs connected to the bus are also called nodes. Each node connected to the bus sends and receives data in units called frames or messages. CAN also does not use identifiers to indicate the destination or source of data. A node that sends a frame (hereafter also referred to as a sending node) attaches an ID called a message ID that indicates the type of message to each message, that is, sends a signal to the bus. A node that receives a message (hereafter also referred to as a receiving node) receives only messages that include a predetermined message ID, that is, reads a signal from the bus. Messages with the same ID are sent at a fixed, predetermined interval.

[0004] As described above, many ECUs arranged in a system inside a vehicle are connected to a CAN network and operate while exchanging various messages with each other. Here, an ECU having a communication function with the outside of the CAN network may be attacked from the outside and hijacked, and may start sending unauthorized messages (hereinafter also referred to as abnormal messages) to the CAN network. Such a hijacked ECU (hereinafter also referred to as an unauthorized ECU) may, for example, masquerade as another ECU and send abnormal messages, thereby unauthorizedly controlling the vehicle. For example, a method described in Patent Document 1 is known as a method for detecting such so-called spoofing attacks. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2014 / 115455 Summary of the Invention [Problem to be solved by the invention]

[0006] However, the method described in Patent Document 1 has a problem in that it can only detect spoofing attacks that are occurring, but cannot determine which messages are abnormal messages. A possible solution to this problem is to determine a reference message for determining whether a message is abnormal, and to determine whether a message is abnormal or not on the basis of the determined reference message. In this case, it is desirable to set the reference message appropriately.

[0007] Therefore, the present disclosure is intended to solve the above problem, and provides a reference message determination method, etc., that appropriately determines a reference message for determining whether or not an individual message sent to a network is an abnormal message. [Means for solving the problem]

[0008] In order to solve the above problems, a determination method according to one embodiment of the present disclosure is a method for determining a reference message used to detect unauthorized communications in an in-vehicle network system including a network and one or more electronic control units connected to the network, wherein the reference message is a message used as a criterion for determining whether a message sent to the network is an abnormal message or not, and the determination method includes a storage step for storing candidate information regarding one or more reference message candidates that are candidates for the reference message, a first determination step for determining the determination method for determining the reference message from the one or more reference message candidates included in the candidate information stored in the storage step based on the one or more reference message candidates, and a second determination step for determining the reference message from the one or more reference message candidates using the determination method determined in the first determination step.

[0009] In addition, a determination system according to one embodiment of the present disclosure is a determination system for a reference message used to detect unauthorized communications in an in-vehicle network system including a network and one or more electronic control units connected to the network, the determination system comprising one or more processors and a memory unit, wherein the reference message is a message used as a criterion for determining whether a message sent to the network is an abnormal message or not, and the one or more processors use the memory unit to store candidate information regarding one or more reference message candidates that are candidates for the reference message, determine a determination method for determining the reference message from the one or more reference message candidates included in the stored candidate information based on the one or more reference message candidates, and determine the reference message from the one or more reference message candidates using the determination method.

[0010] Moreover, a program according to one aspect of the present disclosure is a program for causing a computer to execute the above-described determination method.

[0011] In addition, these comprehensive or specific aspects may be realized by a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0012] According to a determination method etc. according to one aspect of the present disclosure, it is possible to appropriately determine a reference message for determining whether or not an individual message sent to a network is an abnormal message. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing an overall configuration of an in-vehicle network system according to the first embodiment. [Diagram 2] FIG. 2 is a diagram showing a data frame format of the CAN protocol. [Diagram 3] FIG. 3 is a block diagram showing an example of a functional configuration of a gateway included in the in-vehicle network system according to the first embodiment. As shown in FIG. [Figure 4] FIG. 4 is a diagram showing an example of a data configuration of the reception ID list in the first embodiment. [Diagram 5] FIG. 5 illustrates an example of a data configuration of a transfer rule held in the gateway according to the first embodiment. [Figure 6] FIG. 6 is a block diagram showing an example of a functional configuration of the fraud detection processing function group according to the first embodiment. As shown in FIG. [Figure 7] FIG. 7 is a block diagram illustrating an example of a functional configuration of the fraud detection unit in the first embodiment. As illustrated in FIG. [Figure 8] FIG. 8 is a diagram showing a message receiving pattern in the first embodiment. [Figure 9] FIG. 9 is a block diagram showing an example of a functional configuration of an ECU included in the in-vehicle network system according to the first embodiment. As shown in FIG. [Figure 10] FIG. 10 is a flow diagram illustrating an example of the fraud detection process according to the first embodiment. [Figure 11] FIG. 11 is a flow chart showing an example of the reference message determination process in the first embodiment. [Figure 12] FIG. 12 is a block diagram showing an overall configuration of an in-vehicle network system according to the second embodiment. [Figure 13] FIG. 13 is a block diagram showing an example of a functional configuration of a gateway included in the in-vehicle network system according to the second embodiment. As shown in FIG. [Figure 14] FIG. 14 is a block diagram showing an example of a functional configuration of the fraud detection processing function group according to the second embodiment. In FIG. [Figure 15] FIG. 15 is a block diagram illustrating an example of a functional configuration of the server according to the second embodiment. As shown in FIG. [Figure 16] FIG. 16 is a block diagram showing a first example of a functional configuration of a fraud detection processing function group in another modified example. [Figure 17] FIG. 17 is a flow diagram showing an example of fraud detection processing in another modified example. [Figure 18] FIG. 18 is a block diagram showing a second example of the functional configuration of the fraud detection processing function group in another modified example. [Figure 19] FIG. 19 is a block diagram showing a third example of the functional configuration of the fraud detection processing function group in another modified example. [Figure 20] FIG. 20 is a block diagram showing a first example of a functional configuration of an ECU in another modified example. [Figure 21] FIG. 21 is a block diagram showing a second example of the functional configuration of the ECU in another modified example. [Figure 22] FIG. 22 is a block diagram showing a third example of a functional configuration of an ECU in another modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] (Knowledge that forms the basis of this disclosure) When the unauthorized ECU starts to transmit abnormal messages, normal messages and abnormal messages are mixed in messages with the same ID in the CAN network. In such a situation, the timing of transmission of the normal message and the timing of transmission of the abnormal message may become very close to each other, or may be intentionally brought close by an attacker, so that the timing of transmission of the abnormal message may also be within the tolerance (the difference from the timing at which the normal message is predicted to be transmitted is within the tolerance). In such a case, it becomes difficult to distinguish between normal messages and abnormal messages, and the possibility of false detection increases. The same thing may happen not only to the timing of transmission of the message, but also to the data value contained in the message. When a reference message for determining whether or not a message is abnormal is determined based on such normal messages and abnormal messages within the tolerance, it is desirable to set the reference message appropriately. For example, it is desirable to set the normal message of the normal message and the abnormal message as the reference message.

[0015] Therefore, a determination method according to one embodiment of the present disclosure is a method for determining a reference message used to detect unauthorized communications in an in-vehicle network system including a network and one or more electronic control units connected to the network, wherein the reference message is a message used as a criterion for determining whether a message sent to the network is an abnormal message or not, and the determination method includes a storage step for storing candidate information regarding one or more reference message candidates that are candidates for the reference message, a first determination step for determining the determination method for determining the reference message from the one or more reference message candidates included in the candidate information stored in the storage step based on the one or more reference message candidates, and a second determination step for determining the reference message from the one or more reference message candidates using the determination method determined in the first determination step.

[0016] As a result, since a determination method according to one or more reference message candidates is determined, for example, when an abnormal message is included in one or more reference message candidates, it is possible to prevent the abnormal message from being set as the reference message. Therefore, a more appropriate reference message can be determined. Also, for example, a more appropriate reference message can be determined compared to when the method for determining the reference message is fixed.

[0017] In addition, in the first determination step, for each of a plurality of determination methods for determining the reference message, an appropriateness indicating the degree of appropriateness of determining the reference message using the determination method from the one or more reference message candidates may be calculated, and the determination method may be determined based on the calculated appropriateness.

[0018] This makes it possible to appropriately determine the method for determining the reference message based on the appropriateness.

[0019] In addition, in the first determination step, a determination method having the highest appropriateness among the plurality of determination methods may be determined as a determination method for determining the reference message from the one or more reference message candidates.

[0020] This makes it possible to more appropriately determine the method for determining the reference message based on the appropriateness.

[0021] In addition, the appropriateness may be calculated by calculating a first difference between a predicted value for a message to be sent to the network and each of the values ​​indicated by the one or more reference message candidates, and calculating a second difference which is the difference between two or more of the calculated first differences.

[0022] When the reference message candidates include normal messages and abnormal messages, the first difference in the normal messages and the first difference in the abnormal messages may be values ​​far apart. In other words, when the reference message candidates include an abnormal message, the second difference may be large.

[0023] Therefore, by determining the method that produces the largest second difference as the method for determining the reference message, a normal message can be determined as the reference message among candidate reference messages that include both normal messages and abnormal messages, thereby making it possible to more appropriately determine the reference message.

[0024] In addition, in the first determination step, if there are three or more values ​​indicated by the one or more reference message candidates, two of the values ​​closest to the predicted value may be extracted, and the two first differences may be calculated based on the two extracted values ​​and the predicted value.

[0025] This allows the determination method to be determined based on two values ​​close to the predicted value, i.e., two values ​​considered to be suitable for the reference message, so that a determination method more suitable for determining the reference message can be determined.

[0026] The predicted value may also be calculated based on a value indicated by the reference message determined in the past.

[0027] This makes it possible to calculate the predicted value using the value indicated by the past reference message, thereby reducing the amount of processing required to calculate the predicted value.

[0028] The prediction value may be obtained by inputting the one or more reference message candidates having the same ID into a prediction model created in advance.

[0029] This makes it possible to easily calculate predicted values ​​by using the prediction model.

[0030] The determination method may also include at least one of a periodicity determination method for determining the reference message based on a period at which a message sent to the network is transmitted, and a data determination method for determining the reference message based on a value of data included in a message sent to the network.

[0031] This makes it possible to determine the reference message by using either the period, which is an index commonly used in networks, or the data value as a judgment type.

[0032] The method may further include a determination step of determining whether or not a message sent to the network is an abnormal message, and the one or more reference message candidates may include the abnormal message determined to be abnormal in the determination step, and in the second determination step, a message other than the abnormal message among the one or more reference message candidates may be determined to be the reference message.

[0033] This makes it possible to prevent an abnormal message from being determined as the reference message when the abnormal message is included, which means that the reference message can be determined more appropriately.

[0034] The method may further include a determination step of determining whether or not the message sent to the network is an abnormal message, and in the second determination step, one or more messages determined to be normal in the current receiving cycle may be set as candidate reference messages, and a reference message for the next receiving cycle may be determined before the next receiving cycle.

[0035] This allows the reference message for the next receiving cycle to be determined within the current receiving cycle, making it possible to delete reference message candidates other than the determined reference message within the current receiving cycle, thereby reducing the capacity of the storage device included in the device that executes the method for determining the reference message.

[0036] A determination system according to an embodiment of the present disclosure is a determination system for a reference message used to detect unauthorized communication in an in-vehicle network system including a network and one or more electronic control units connected to the network, the determination system comprising one or more processors and a storage unit, the reference message being a message used as a criterion for determining whether a message sent to the network is an abnormal message or not, the one or more processors using the storage unit to store candidate information regarding one or more reference message candidates that are candidates for the reference message, determine a determination method for determining the reference message from the one or more reference message candidates included in the stored candidate information based on the one or more reference message candidates, and determine the reference message from the one or more reference message candidates using the determination method. A program according to an embodiment of the present disclosure is a program for causing a computer to execute the reference message determination method described above.

[0037] This provides the same effect as the above-mentioned method of determining the reference message.

[0038] Hereinafter, the embodiment will be described in detail with reference to the drawings.

[0039] In addition, the embodiments described below are all comprehensive or specific examples. In other words, the numerical values, components, arrangement and connection of components, steps, and order of steps shown in the following embodiments are examples of the present disclosure and are not intended to limit the present disclosure. The present disclosure is specified based on the description of the claims. Therefore, among the components in the following embodiments, components that are not described in the independent claims showing the highest concept of the present disclosure are described as components that are not necessarily required to achieve the object of the present disclosure but constitute a more preferred form.

[0040] (Embodiment 1) [1. Overview] Here, the first embodiment will be described with reference to the drawings, taking as an example an in-vehicle network system in which it is determined whether a transmitted message is an abnormal message or not.

[0041] [1.1 Overall configuration of in-vehicle network system] 1 is a block diagram showing an overall configuration of an in-vehicle network system 10 according to the present embodiment. The in-vehicle network system 10 is mounted on a vehicle 1, for example.

[0042] The in-vehicle network system 10 is configured with a CAN network and includes ECUs (ECU100a, ECU100b, ECU100c, and ECU100d in the figure, which will hereinafter be referred to collectively or as an unspecified part of them, and will be referred to as ECU100 below), a bus (bus 200a and bus 200b in the figure, which will hereinafter be referred to collectively or as an unspecified part of them, and will be referred to as bus 200 below), and a gateway 300.

[0043] ECU 100a is connected to engine 101, ECU 100b is connected to brake 102, ECU 100c is connected to door sensor 103, and ECU 100d is connected to window sensor 104. Each ECU 100 acquires the state of the device to which it is connected, and periodically transmits a message representing the acquired state to bus 200. For example, ECU 100a acquires the rotation speed, which is one state of engine 101, and transmits a message including a data value representing this rotation speed to bus 200 with a predetermined ID attached. Each ECU 100 reads messages transmitted by other ECUs 100 from bus 200, and selectively receives the messages according to the ID attached to the messages. This selective reception will be described later.

[0044] The gateway 300 connects the bus 200a to which the ECUs 100a and 100b are connected, and the bus 200b to which the ECUs 100c and 100d are connected. The gateway 300 has a function of transferring a message received from one bus to the other bus. The gateway 300 is also a node on the CAN network.

[0045] Note that the in-vehicle network system 10 is an example for explaining targets to which an unauthorized communication detection standard determination system (e.g., a standard message determination system) that determines whether a message is an abnormal message can be applied, and the targets to which it can be applied are not limited to the in-vehicle network system 10.

[0046] [1.2 Message data format] 2 is a diagram showing the data frame format (message format) of the CAN protocol, showing a message in the standard ID format of the CAN protocol.

[0047] The message consists of Start Of Frame (also referred to as SOF in the figure and below), an ID field, Remote Transmission Request (also referred to as RTR in the figure and below), IDentifier Extension (also referred to as IDE in the figure and below), reserved bit (also referred to as r in the figure and below), data length code (also referred to as DLC in the figure and below), a data field, a Cyclic Redundancy Check (also referred to as CRC in the figure and below) sequence, a CRC delimiter (DEL on the left in the figure), an Acknowledgement (also referred to as ACK in the figure and below) slot, an ACK delimiter (DEL on the right in the figure), and end of frame (also referred to as EOF in the figure and below).

[0048] SOF is a 1-bit dominant. In a CAN network where a digital method is used to transmit data, dominant refers to a state in which voltage is applied to two cables constituting a bus so as to transmit a value of “0”, or the value of this “0” being transmitted. In contrast, a state in which voltage is applied to two cables constituting a bus so as to transmit a value of “1”, or the value of this “1” being transmitted, is called recessive. When two nodes simultaneously transmit a value of “0” and a value of “1” to the bus, the value of “0” takes precedence. The bus is recessive when idle. Each ECU 100 starts transmitting a message by changing the state of the bus 200 from recessive to dominant, and the other ECUs 100 read this change and synchronize. In FIG. 2, the parts where the lines indicating the dominant or recessive constituting the message are solid lines indicate that the dominant or recessive values ​​can be taken. Since SOF is fixed dominant, the dominant lines are solid and the recessive lines are dashed.

[0049] The ID is an 11-bit value that indicates the type of data that the message contains. In addition, CAN is designed so that when multiple nodes start sending messages at the same time, messages with smaller ID values ​​have higher priority when arbitrating between them.

[0050] RTR is a 1-bit dominant that indicates that the frame is a message (data frame).

[0051] IDE and r are each 1-bit dominant.

[0052] DLC is a 4-bit value that indicates the length of the following data field.

[0053] The data field is a value that indicates the content of the data being sent, and is a maximum of 64 bits long, and the length can be adjusted in 8-bit increments. The specifications regarding the allocation of data to this part depend on the vehicle model and manufacturer.

[0054] The CRC sequence is a 15-bit value calculated from the transmitted values ​​of the SOF, ID field, control field, and data field.

[0055] The CRC delimiter is a fixed 1-bit recessive delimiter that indicates the end of the CRC sequence. The receiving node determines whether the received message is abnormal by comparing the result calculated from the SOF, ID field, control field, and data field of the received message with the value of the CRC sequence.

[0056] The ACK slot is 1 bit long, and the transmitting node transmits a recessive bit in this portion. If the receiving node has received the CRC sequence normally, it transmits a dominant bit as an acknowledgment. Since dominant bits have priority, if the communication of one message has been normal up to the CRC sequence, the bus 200 is dominant during the transmission of the ACK slot.

[0057] The ACK delimiter is a fixed 1-bit recessive delimiter that indicates the end of an ACK slot.

[0058] EOF is a fixed 7-bit recessive bit that indicates the end of the message.

[0059] Note that the data format of the message is an example to explain the target to which the fraudulent communication detection standard determination system, which determines whether a message is an abnormal message, can be applied, and the target to which it can be applied is not limited to this data format.

[0060] [1.3 Gateway configuration] 3 is a block diagram showing an example of a functional configuration of a gateway 300 included in the in-vehicle network system 10. The gateway 300 includes a frame transmitting / receiving unit 310, a frame interpreting unit 320, a received ID determining unit 330, a received ID list holding unit 340, a frame processing unit 350, a transfer rule holding unit 360, a fraud detection processing function group 370, and a frame generating unit 380. The gateway 300 determines a reference message to be used for detecting fraudulent communication in the in-vehicle network system 10 including a network and one or more electronic control units (ECUs) connected to the network.

[0061] These components are functional components, and the gateway 300 is provided as an information processing device including, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory or the like, an input / output unit realized by an input / output port, etc. Each of the functional components listed above is realized by reading and executing a program stored in the storage unit by the processing unit, storing predetermined data in the storage unit, sending and receiving data via the input / output unit, or a combination of these.

[0062] The frame transmitting / receiving unit 310 transmits and receives messages conforming to the CAN protocol to and from each of the buses 200a and 200b. More specifically, the frame transmitting / receiving unit 310 reads out the message sent to the bus 200 one bit at a time, and transfers the read message to the frame interpretation unit 320. The frame transmitting / receiving unit 310 also transmits the message one bit at a time to the buses 200a and 200b in accordance with the bus information notified by the frame generation unit 380. The frame transmitting / receiving unit 310 transmits the message received from the bus 200a to the bus 200b, and transmits the message received from the bus 200b to the bus 200a, thereby transferring the message between the buses 200.

[0063] The frame interpretation unit 320 receives message values ​​from the frame transmission / reception unit 310 and interprets the frame (message) by mapping them to each field in the CAN protocol. The frame interpretation unit 320 transfers a series of values ​​that it determines to be ID field values ​​in this interpretation to the received ID determination unit 330.

[0064] Frame interpretation unit 320 further determines, depending on the judgment result notified by received ID judgment unit 330, whether to transfer the value of the ID field of the message and the data fields appearing after the ID field to frame processing unit 350, or to cancel reception of the message.

[0065] If the frame interpretation unit 320 determines that the message does not conform to the CAN protocol, it requests the frame generation unit 380 to transmit an error frame. An error frame is a frame in a predetermined format defined by the CAN protocol that is different from the above-mentioned messages and is transmitted from a node when an error occurs on the CAN network. For example, when an error flag is transmitted to the bus, the transmission of the most recent message on the network is interrupted.

[0066] Furthermore, if the frame interpretation unit 320 determines that it has received an error frame transmitted by another node, it discards the message being read.

[0067] The received ID determination unit 330 receives the value of the ID field from the frame interpretation unit 320, and determines whether or not to receive the read message according to the list of message IDs held by the received ID list holding unit 340. The received ID determination unit 330 notifies the frame interpretation unit 320 of the result of this determination.

[0068] The receiving ID list holding unit 340 holds a list of message IDs received by the gateway 300 (hereinafter also referred to as a receiving ID list). Fig. 4 is a diagram showing an example of the data configuration of the receiving ID list. The details of the receiving ID list will be described later using this example.

[0069] The frame processing unit 350 determines a destination bus based on the ID of the received message in accordance with the transfer rules stored in the transfer rule storage unit 360, and passes the destination bus, the message ID notified by the frame interpretation unit 320, and the data to be transferred to the frame generation unit 380.

[0070] Furthermore, frame processing unit 350 sends a message received from frame interpretation unit 320 to fraud detection processing function group 370, requesting it to determine whether or not the message is an abnormal message. Frame processing unit 350 does not forward a message that is determined to be an abnormal message by fraud detection processing function group 370.

[0071] The transfer rule storage unit 360 stores rules regarding data transfer for each bus (hereinafter, also referred to as transfer rules). Fig. 5 is a diagram showing an example of the data configuration of the transfer rules. The details of the transfer rules will be described later using this example.

[0072] The fraud detection processing function group 370 is a function group that determines whether a message being received is an abnormal message or not. The functional configuration included in the fraud detection processing function group 370 will be described in detail later.

[0073] In response to a request from the frame interpretation section 320 to transmit an error frame, the frame generation section 380 constructs an error frame and causes the frame transmission / reception section 310 to transmit it.

[0074] Furthermore, the frame generating unit 380 creates a message frame using the message ID and data received from the frame processing unit 350, and sends it to the frame transmitting / receiving unit 310 together with the bus information.

[0075] [1.4 Receiving ID list] FIG. 4 is a diagram showing an example of the data configuration of the receiving ID list in this embodiment. The receiving ID list is a list of message IDs received by the gateway 300. In this example, each line contains the ID of a message that the gateway 300 receives from the bus 200 and is to process. In the setting based on the receiving ID list in this example, the gateway 300 receives messages with message IDs of "1", "2", "3" or "4". Reception of messages with IDs not included in the receiving ID list is stopped. Note that the ID values ​​and the number of IDs included in the list in this example are examples for explanation, and do not limit the configuration of the receiving ID list used in the gateway 300.

[0076] [1.5 Transfer Rules] 5 is a diagram showing an example of the data configuration of transfer rules held by gateway 300 in this embodiment. In this example, each line includes a combination of a source bus and a destination bus (indicated as 200a and 200b in this example) from which a message is transferred, and the ID of the message to be transferred. In the settings based on the transfer rules in this example, gateway 300 transfers messages received from bus 200a to bus 200b, regardless of the message's ID.

[0077] Furthermore, among the messages received from bus 200b, only the message with the message ID "3" is transferred to bus 200a.

[0078] [1.6 Configuration of fraud detection processing function group] Fig. 6 is a block diagram showing an example of the functional configuration of the fraud detection processing function group 370 in this embodiment. Fig. 6 is a block diagram showing the functional configuration of the fraud detection processing function group 370 included in the gateway 300. The fraud detection processing function group 370 has a fraud detection unit 371, a reference message information storage unit 372, a message save processing unit 373, a normal message information storage unit 374, a reference message determination unit 375, a judgment type determination unit 376, a periodicity judgment unit 377, and a data judgment unit 378.

[0079] These functional components are also realized by reading and executing a program stored in a memory unit in the gateway 300 using a processing unit, storing specified data in the memory unit, sending and receiving data via an input / output unit, or a combination of these.

[0080] The fraud detection unit 371 determines whether or not the message received from the frame processing unit 350 is an abnormal message.

[0081] The fraud detection unit 371 has multiple types of judgment functions. Each judgment function refers to a different rule (not shown) that is set in advance and saved (stored) in a storage unit, and checks the received message using the rule referred to, that is, judges whether each message conforms to the rule. Then, the fraud detection unit 371 judges whether the received message is an abnormal message based on the judgment result of each judgment function. If the received message is an abnormal message, the fraud detection unit 371 detects the occurrence of fraud.

[0082] FIG. 7 is a block diagram showing an example of a functional configuration of the fraud detection unit 371 in this embodiment. In this example, the fraud detection unit 371 has six types of judgment functions that check predetermined points of a message. Specifically, the six types of judgment functions include a function of checking the ID field of a message (ID judgment function), a function of checking the data length of a message (data length judgment function), a function of checking the period (time interval) at which a message is transmitted (transmission period judgment function), a function of checking the frequency at which a message is transmitted (transmission frequency judgment function), a function of checking the value of a data field of a message (data value) (data value judgment function), and a function of recognizing the state of the vehicle based on the judgment results of these judgment functions, the transmission period, the frequency, the data value, or the amount of change in the data value, and checking the vehicle state (for example, a vehicle state judgment function). Furthermore, the fraud detection unit 371 has a final result judgment function that comprehensively judges whether a received message is an abnormal message or not from the judgment results of these judgment functions. The result of the final result judgment function becomes the result of fraud detection by the fraud detection unit 371.

[0083] These functional components are also realized by reading and executing a program stored in a memory unit in the gateway 300 using a processing unit, storing specified data in the memory unit, sending and receiving data via an input / output unit, or a combination of these.

[0084] When checking a specific point of a message in each of the above judgment functions, the check may be performed based on the information of a previously received message with the same ID or on the information of a related message. Each judgment function obtains the information of the message to be used as the reference from the reference message information storage unit 372.

[0085] Returning to the explanation of Fig. 6, fraud detection unit 371 notifies reference message information storage unit 372 of information relating to messages that are candidates for the reference message from among the received messages. Fraud detection unit 371 notifies reference message information storage unit 372 of messages that the final result determination function has determined to be "normal messages" from among the received messages as messages that are candidates for the reference message (reference message candidates). The reference message candidates are candidates for the reference message used as a criterion for determining whether or not a message sent to the network is an abnormal message.

[0086] The fraud detection unit 371 also notifies the message storage processing unit 373 of the message that the final result determination function has determined to be a “normal message”.

[0087] The reference message information storage unit 372 stores information about the reference message used by the fraud detection unit 371 and information about reference message candidates. For example, in the case of a message that is sent periodically, a message with the same ID that is one period older becomes the reference message. On the other hand, a message received in the current period is a message (reference message candidate) that may become the reference message for messages one period later, and therefore is stored as a reference message candidate in the current period.

[0088] The information on the reference message is, for example, information indicating a reference message determined by the reference message determination unit 375. The information on the reference message candidates is an example of candidate information, and is, for example, information indicating one or more reference message candidates. The information on the reference message is, for example, information indicating one of the one or more reference message candidates included in the candidate information.

[0089] The reference message information storage unit 372 may further store a message that can be used as a reference message when no reference message candidate is stored. The reference message information storage unit 372 may store the message in advance.

[0090] The reference message information holding unit 372 holds information on messages that are candidates for the reference message notified by the fraud detection unit 371. Furthermore, in response to a request from the reference message determination unit 375, the reference message information holding unit 372 notifies the reference message determination unit 375 of information on messages that are candidates for the reference message. Furthermore, the reference message information holding unit 372 also holds information on the reference message determined by the reference message determination unit 375, and in response to a request from the fraud detection unit 371, notifies the fraud detection unit 371 of information on the reference message. When the reference message determination unit 375 determines a reference message from the reference message candidates, the reference message information holding unit 372 deletes the reference message candidate used at that time.

[0091] The message storage processing unit 373 performs a process of storing information about the message notified by the fraud detection unit 371 in the normal message information holding unit 374. When a plurality of messages with the same ID are stored as normal messages in a certain period and one message is selected as a reference from the plurality of messages with the same ID by the reference message determination unit 375, the message storage processing unit 373 either keeps only the message selected as the reference message and deletes the other messages, or stores information indicating which message was selected as the reference message together with the message.

[0092] The normal message information storage unit 374 stores information about messages that are determined to be normal by the fraud detection unit 371. This information is used when the periodicity determination unit 377 or the data determination unit 378 calculates a predicted value of the reception time or data value of the currently received message from messages received in the past.

[0093] The reference message determination unit 375 determines a reference message to be used as a reference based on the difference in transmission time from a message with the same ID that is one cycle older, calculated using the transmission period determination function of the fraud detection unit 371, and the amount of change from a message with the same ID that is one cycle older, calculated using the data value determination function.

[0094] For example, when a margin of time length α (see FIG. 8) is considered before and after the expected reception time (for example, see the expected reception time T1 shown in FIG. 8) for a periodically transmitted message, and a margin of data value is considered before and after the amount of change in data, multiple messages may be transmitted that do not deviate from either margin. In this case, the reference message determination unit 375 determines a message to be used as a reference message for a message with the same ID one cycle later, using these multiple messages as reference message candidates.

[0095] The reference message determination unit 375 obtains information regarding messages that are candidates for the reference message (reference message candidates) from the reference message information storage unit 372, and determines a message to be used as the reference message from the candidates using the determination method determined by the judgment type determination unit 376.

[0096] When determining a reference message, the reference message determination unit 375 notifies the judgment type determination unit 376 of candidates for the reference message, and determines the reference message from the reference message candidates using a judgment type according to the result determined by the judgment type determination unit 376.

[0097] The judgment type determination unit 376 determines a judgment method for determining a reference message from one or more reference message candidates based on one or more reference message candidates. The judgment method includes two or more judgment methods, and includes at least one of a periodic judgment method for making a judgment to determine a reference message based on a period in which a message sent to the network is transmitted, and a data judgment method for making a judgment to determine a reference message based on a value of data included in a message sent to the network. In this embodiment, the judgment method includes a periodic judgment method and a data judgment method.

[0098] The judgment type determination unit 376, for example, obtains the reference message candidate notified by the reference message determination unit 375 and the rule value held by the fraud detection unit 371, and requests judgment from the periodic judgment unit 377 and the data judgment unit 378. The judgment type determination unit 376 determines which judgment type, periodic judgment or data value judgment, should be used to determine a reference message from one or more reference message candidates, based on the clarity obtained as the judgment result of the periodic judgment unit 377 and the clarity obtained as the judgment result of the data judgment unit 378, and notifies the reference message determination unit 375 of the result.

[0099] The method of calculating clarity will be described later, but clarity indicates the degree of whether a reference message can be clearly determined from one or more reference message candidates. Clarity can also be said to indicate the appropriateness of a reference message candidate from one or more reference message candidates as a reference message. Clarity can also be said to indicate the appropriateness of determining a reference message from one or more reference message candidates by each of a plurality of determination methods. Clarity is an example of appropriateness.

[0100] For example, there are message M1 (see FIG. 8) and message M2 (see FIG. 8) as reference message candidates, and when compared with the current reference message, the clarity is low if the difference between message M1 and message M2 from the reference message is similar, and high if the difference between message M1 and message M2 from the reference message is significantly different. Then, the judgment type determination unit 376 selects a judgment type with a higher clarity between the periodic judgment and the data value judgment. For example, the judgment type determination unit 376 selects a judgment type with the highest clarity between the periodic judgment and the data value judgment. It can also be said that the judgment type determination unit 376 calculates the clarity for each of a plurality of determination methods, and determines the determination method with the highest clarity among the plurality of determination methods as the determination method for determining the reference message from one or more reference message candidates.

[0101] This makes it possible to select a reference message using a judgment type in which the differences between the reference message and the candidate messages are significantly different from each other and therefore a clear judgment is possible, rather than a judgment type in which the differences between the reference message and the candidate messages are similar and therefore a judgment is difficult to make, thereby making it possible to more reliably select a reference message by the reference message determination unit 375.

[0102] When comparing the definiteness obtained from the periodicity determination unit 377 with the definiteness obtained from the data determination unit 378, the determination type determination unit 376 normalizes the definiteness by the margin in each rule, for example, to make the magnitude of each definiteness uniform. For example, when the margin for the reception time is within the range of the assumed value T1±α (see FIG. 8), the determination type determination unit 376 determines the determination type using a value obtained by dividing the definiteness obtained from the periodicity determination unit 377 by 2α. Note that in FIG. 8 described later, the assumed value T1 indicates the assumed value T1 of the time, and is also described as the assumed reception time T1.

[0103] The method of normalizing the degree of clarity is not limited to the above, but normalization is performed by the margin in the rule. For example, when the margin is the range of the expected value T1±α, the degree of clarity may be divided by α instead of 2α, or may be normalized by dividing by the expected value T1 (predicted value). In addition, the deviation between the expected value T1 and the actual reception time or data value may be measured in advance using test data, etc., and the variance value σ of the deviation may be calculated, and normalization may be performed by the variance value (σ, 2σ, 3σ, etc.). This is not limited to the above, and any method may be used as long as it can normalize values ​​in different units. In addition, if it is known in advance that there is a difference in the clarity (clarity) of the judgment result between the periodic judgment and the data judgment, the normalization may be performed taking this into consideration. For example, if the clarity of the periodic judgment is higher than the clarity of the data judgment, the normalized clarity of the periodic judgment may be further multiplied by a coefficient or a constant may be added.

[0104] The periodicity judgment unit 377 calculates the expected reception time (T1) in the current period as a predicted value of the reception time from the reception time of the current reference message and periodicity information included in the rule referenced by the transmission periodicity judgment function of the fraud detection unit 371. The periodicity judgment unit 377 selects a reference message from the multiple reference message candidates by comparing the reception times of the multiple reference message candidates notified by the judgment type determination unit 376 with the predicted value, that is, the expected reception time (T1).

[0105] FIG. 8 is a diagram showing a message reception pattern in this embodiment. For example, as shown in FIG. 8, if the reception time of the message M1 is T11 and the reception time of the message M2 is T12, both T11 and T12 are within the range of the margin of the rule, between T1-α and T1+α, and therefore the fraud detection unit 371 judges that both are normal messages. However, it is necessary to select one of them as the reference message. Therefore, the periodicity judgment unit 377 selects, as the reference message, the message that is closer to the expected reception time (T1), which is the predicted value, between the reception time (T11) of the message M1 and the reception time (T12) of the message M2. In FIG. 8, the periodicity judgment unit 377 selects the message M1 as the reference message because the message M1 is closer to the expected reception time (T1) than the message M2.

[0106] The periodicity determination unit 377 calculates the clarity from the difference between the reception times of a plurality of reference message candidates and the estimated reception times, which are predicted values. For example, in FIG. 8, the difference (|(T11-T1)-(T1-T12)| or ||T11-T1|-|T12-T1||) between the difference (T11-T1) between the reception time T11 of the message M1 and the estimated reception time T1 of the message M2 and the difference (T1-T12) between the reception time T12 of the message M2 and the estimated reception time T1 of the message M2 is defined as the clarity. Here, "|A|" indicates the absolute value of A. For example, when the messages M1 and M2 are separated by the same amount with the estimated reception time T1 as the center, that is, when the values ​​of |T11-T1| and |T12-T1| are similar, the clarity is low. On the other hand, as shown in FIG. 8, when the reception time T11 of the message M1 is closer to the expected reception time T1 than the reception time T12 of the message M2, that is, when |T11-T1| is sufficiently smaller than |T12-T1|, the degree of certainty is high.

[0107] The difference (T11-T1) and the difference (T1-T12) are examples of a first difference, and the difference (|(T11-T1)-(T1-T12)| or the difference (|T11-T1|-|T12-T1||) is an example of a second difference. The clarity is, for example, a positive value (for example, an absolute value). In this embodiment, the second difference means the clarity. Also, the clarity can be said to indicate the degree to which an abnormal message is included in one or more reference message candidates.

[0108] In addition, the periodicity determination unit 377 may calculate a predicted value as the expected reception time of the message to be received from information on the reception times of multiple messages with the same ID stored in the normal message information storage unit 374, or may calculate a predicted value as the expected reception time of the message to be received from information on the reception times of one or more messages with different IDs that are correlated with the reception times.

[0109] Returning to the explanation of Fig. 6, the data determination unit 378 calculates an assumed data value (D1) in the current cycle as a predicted value of the data value from information on the amount of change between the data value of the current reference message and the data value included in the rule referenced by the data value determination function of the fraud detection unit 371. The data determination unit 378 selects a reference message from the multiple reference message candidates by comparing the data values ​​of the multiple reference message candidates notified by the determination type determination unit 376 with the predicted value, that is, the assumed data value (D1).

[0110] Further, the data determination unit 378 calculates the clarity from the difference between the data values ​​of the multiple reference message candidates and the expected data values, which are predicted values. For example, similar to the case of the periodicity determination unit 377, the difference (|(D11-D1)-(D1-D12)| or ||D11-D1|-|D12-D1||) between the difference (D11-D1) between the data value D11 of the message M1 and the expected data value D1 and the difference (D1-D12) between the data value D12 of the message M2 and the expected data value D1 is defined as the clarity. Note that the difference (D11-D1) and the difference (D1-D12) are examples of the first difference, and the difference (|(D11-D1)-(D1-D12)| or ||D11-D1|-|D12-D1||) is an example of the second difference. In this embodiment, the second difference means the clarity. Also, the degree of certainty can be said to indicate the degree to which an abnormal message is included in one or more reference message candidates.

[0111] As described above, the determination method calculates the difference between the predicted value for the message to be sent to the network and each value of the information on the reference message candidate, and determines the difference (second difference) between these differences (first difference) as the clarity. This makes it possible to calculate the clarity according to the messages stored as candidates for the reference message.

[0112] The data determination unit 378 may calculate a predicted value as an expected data value of a message to be received from the data values ​​of multiple messages with the same ID stored in the normal message information storage unit 374, or may calculate a predicted value as an expected data value of a message to be received from information on the data values ​​of one or more messages with different IDs that are correlated in terms of data values.

[0113] The periodicity determination unit 377 or the data determination unit 378 may predict the predicted value based on a prediction model that is created in advance and can calculate the predicted value. The periodicity determination unit 377 or the data determination unit 378 may obtain, as a predicted value, output data (predicted value of data value or reception time) obtained by inputting data values ​​of multiple messages with the same ID or reception times of multiple messages with the same ID as input data into the prediction model. For example, the periodicity determination unit 377 or the data determination unit 378 may generate a model such as an AR (AutoRegressive) model, an ARMA (AutoRegressive Moving Average) model, an HMM (Hidden Markov Model), a Bayesian model, an SVM (Support Vector Machine), a neural network, or deep learning from information on normal messages using machine learning, statistical processing, or probability theory, and calculate a predicted value regarding the expected reception time or the expected data value of a message to be received using the model.

[0114] Furthermore, the period determination unit 377 or the data determination unit 378 may use a value indicated by a current (current frame) or past (past frame) reference message as a predicted value for determining a reference message for the next reception period. The data determination unit 378 may use, for example, a value (data value) indicated by a current or past reference message as a predicted value for determining a reference message for the next reception period. For example, the predicted value may be calculated based on values ​​indicated by past reference messages. For example, the predicted value may be the average, median, or mode of values ​​indicated by past reference messages, or may be the same value as the value indicated by the most recent reference message. In this embodiment, the value indicated by the reference message is, for example, a reception time or a data value.

[0115] In addition, when there are three or more reference message candidate messages, the periodicity judgment unit 377 or the data judgment unit 378 may determine one message M1 as the reference message from all the reference message candidate messages, and then determine a message M2 that may be the next reference message candidate from the remaining messages that were not determined as the reference message, and calculate the clarity from two messages, the message M1 determined as the first reference message and the message M2 determined as the next reference message. For example, when there are three or more reference message candidates (for example, when there are three or more values ​​indicated by one or more reference message candidates), the periodicity judgment unit 377 or the data judgment unit 378 may extract two reference message candidates (for example, two values) close to the predicted value, and calculate the clarity based on the values ​​indicated by the two extracted reference message candidates and the predicted value.

[0116] In the periodicity judgment unit 377 or the data judgment unit 378, a message with a small difference in simple value from the predicted value is judged to be the reference message, but this is not limited to the above. The periodicity judgment unit 377 or the data judgment unit 378 may use any method that can judge one message as the reference message from a plurality of reference message candidates. For example, when the reception time or data value of an actual normal message is set as a true value, the periodicity judgment unit 377 or the data judgment unit 378 may learn the deviation amount between the true value and the predicted value in advance using test data, and may judge the reference message by taking into account the distribution of the deviation amount. For example, if the actual reception time is unlikely to deviate from the predicted value in the direction of delay, the periodicity judgment unit 377 or the data judgment unit 378 may make the difference from the predicted value large even if the delay is small, and if the actual reception time is earlier than the predicted value, the difference may be small even if there is a large difference. In addition, the periodicity judgment unit 377 or the data judgment unit 378 may use an index other than the deviation amount, and may learn the received message in real time instead of learning in advance. At this time, the calculation of the clarity is also calculated by taking into account the distribution.

[0117] It should be noted that the periodicity determination unit 377 or the data determination unit 378 calculates the degree of clarity from the difference between the information of a plurality of reference message candidates and the predicted value, but is not limited to this. The periodicity determination unit 377 or the data determination unit 378 may calculate the degree of clarity for each judgment type in advance. At this time, the judgment type determination unit 376 may determine the judgment type with the highest degree of clarity among the rules related to the received message held by the fraud detection unit 371 as the judgment type to be used to determine the reference message.

[0118] The information on the reference message candidates held by the reference message information holding unit 372 may include, for example, information such as a message ID, DLC, data value, and reception time. The reference message information holding unit 372 may also hold rule information for each message ID that is required when determining the reference message. The data values ​​may hold all received data values, or may store only data values ​​in a specific region of the received data values, or may store the data values ​​as they are, or may store the results of some calculation performed on the data values.

[0119] In the above description, the fraud detection unit 371 notifies the reference message information storage unit 372 of messages that the final result determination function has determined to be "normal messages" among the received messages as reference message candidates, but is not limited to this. For example, a rule for determining whether a message is a reference message may be provided in addition to the rule for determining whether a message is normal, and messages that satisfy the rule may be notified to the reference message information storage unit 372 as reference message candidates. This allows the fraud detection unit 371 to determine only messages that are more suitable as reference messages among normal messages as reference message candidates. Conversely, the fraud detection unit 371 can also determine abnormal messages that deviate slightly from normal messages as reference message candidates, and can determine the reference message from a wider range of messages.

[0120] [1.7 ECU Configuration] 9 is a block diagram showing an example of a functional configuration of the ECU 100 included in the in-vehicle network system 10 according to the present embodiment. The ECU 100 has a frame transmitting / receiving unit 110, a frame interpreting unit 120, a received ID determining unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquiring unit 170, and a frame generating unit 180.

[0121] These components are functional components, and the ECU 100 is provided as an information processing device including, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory or the like, an input / output unit realized by an input / output port, etc. Each of the functional components listed above is realized by reading and executing a program stored in the storage unit by the processing unit, storing predetermined data in the storage unit, sending and receiving data via the input / output unit, or a combination of these.

[0122] The frame transmitting / receiving unit 110 transmits and receives messages conforming to the CAN protocol to and from the bus 200. More specifically, the frame transmitting / receiving unit 110 reads out a message sent to the bus 200 one bit at a time, and transfers the read message to the frame interpretation unit 120. In addition, the frame transmitting / receiving unit 110 transmits out a message notified by the frame generation unit 180 to the bus 200.

[0123] The frame interpretation unit 120 receives message values ​​from the frame transmission / reception unit 110 and interprets the frame (message) by mapping them to each field in the CAN protocol. The frame interpretation unit 120 transfers a series of values ​​that it determines to be ID fields in this interpretation to the received ID determination unit 130.

[0124] Frame interpretation unit 120 further determines, depending on the judgment result notified by received ID judgment unit 130, whether to transfer the value of the ID field of the message and the data fields appearing after the ID field to frame processing unit 150, or to cancel reception of the message.

[0125] Furthermore, if the frame interpretation unit 120 determines that the message does not conform to the CAN protocol, it requests the frame generation unit 180 to transmit an error frame.

[0126] Furthermore, if the frame interpretation unit 120 determines that it has received an error frame transmitted by another node, it discards the message being read.

[0127] The received ID determination unit 130 receives the value of the ID field from the frame interpretation unit 120, and determines whether or not to receive the read message according to the list of message IDs held by the received ID list holding unit 140. The received ID determination unit 130 notifies the frame interpretation unit 120 of the result of this determination.

[0128] The reception ID list holding unit 140 holds a reception ID list, which is a list of message IDs received by the ECU 100. The reception ID list is the same as that shown in Fig. 4, and a description thereof will be omitted here.

[0129] The frame processing unit 150 performs processing according to the data of the received message. The content of the processing differs depending on each ECU 100. For example, when the ECU 100a receives a message indicating that a door is open when the speed exceeds 30 km / h, the ECU 100a performs processing for sounding an alarm. When the ECU 100c receives a message indicating that the brakes are not applied and the door is opened, the ECU 100a performs processing for sounding an alarm. These processing operations are examples given for the purpose of explanation, and the ECU 100 may perform processing other than the above. The frame processing unit 150 causes the frame generating unit 180 to generate a frame to be sent in order to perform such processing.

[0130] The data acquisition unit 170 acquires output data indicating the state of devices connected to each ECU 100 or measured values ​​by sensors, and transfers the data to the frame generation unit 180 .

[0131] The frame generator 180 composes an error frame in accordance with the error frame transmission request notified by the frame interpreter 120 and sends it to the frame transmitter / receiver 110 .

[0132] Furthermore, frame generating unit 180 generates a message frame by attaching a predetermined message ID to the value of the data received from data acquiring unit 170 , and sends the message frame to frame transmitting / receiving unit 110 .

[0133] [1.8 Fraud detection processing] 10 is a flow diagram showing an example of fraud detection processing in the present embodiment. Specifically, FIG. 10 is a flow diagram showing an example of fraud detection processing in the fraud detection processing function group 370.

[0134] First, fraud detection section 371 receives a message from frame processing section 350 (step S1001).

[0135] The fraud detection unit 371 that has received the message determines whether the reception cycle for the periodically transmitted message has shifted to the next reception cycle (step S1002).

[0136] In step S1002, if the fraud detection unit 371 determines that it has moved on to the next receiving period (Yes in S1002), the fraud detection unit 371 requests the reference message determination unit 375 to determine a new reference message, and the reference message determination unit 375 determines the reference message (step S1003).

[0137] After determining a new reference message in step S1003, or if it is determined in step S1002 that the next receiving period has not yet begun (No in S1002), the frame processing unit 350 determines the destination bus in accordance with the transfer rules stored in the transfer rule storage unit 360 (step S1004).

[0138] The frame processing unit 350 notifies the fraud detection processing function group 370 of the values ​​of each field in the message received from the frame interpretation unit 320, and requests a determination as to whether or not the message is abnormal. The fraud detection unit 371 performs fraud detection processing (step S1005). The fraud detection unit 371 uses various determination functions such as an ID determination function to determine whether the received message is an abnormal message or a normal message. At this time, the various determination functions of the fraud detection unit 371 perform the determination using the reference message determined in step S1003 as necessary.

[0139] The final result determination function of fraud detection unit 371 comprehensively determines the final determination of the message based on the results of the determinations of various determination functions such as the ID determination function, that is, determines whether the received message is an abnormal message or not (step S1006), and notifies frame processing unit 350 of the determination result. Step S1006 is an example of a determination step.

[0140] If the fraud detection unit 371 determines that the message is an abnormal message (Yes in step S1006), the message is not stored or transferred.

[0141] If it is determined in step S1006 that the message is a normal message and not an abnormal message (No in step S1006), the fraud detection unit 371 requests the message storage processing unit 373 to store the normal message, and the message storage processing unit 373 stores (stores) information about the normal message in the normal message information storage unit 374, and the fraud detection unit 371 stores (stores) the message as a reference message candidate in the reference message information storage unit 372 (S1007). Step S1007 is an example of a storage step.

[0142] Thereafter, frame processing unit 350 requests frame generation unit 380 to transfer the message to the destination bus determined in step S1004. Upon receiving the request from frame processing unit 350, frame generation unit 380 generates a message to be received by the specified destination, and has frame transmission / reception unit 310 send this message. In other words, frame generation unit 380 transfers the message to the destination via frame transmission / reception unit 310 (step S1008).

[0143] [1.9 Criteria message determination process] Fig. 11 is a flow diagram showing an example of a reference message determination process in this embodiment. Specifically, Fig. 11 is a flow diagram showing an example of a reference message determination process in the fraud detection processing function group 370.

[0144] First, the reference message determining unit 375 acquires reference message candidates from the reference message information storage unit 372 (S1101).

[0145] The reference message determination unit 375 judges whether there are a plurality of messages that are candidates for the reference message acquired from the reference message information storage unit 372, or whether there is only one (S1102).

[0146] In step S1102, if there are multiple messages that can be reference message candidates (Yes in step S1102), the reference message determination unit 375 requests the determination type determination unit 376 to determine a determination method for determining the reference message. Note that the multiple reference message candidates may include an abnormal message.

[0147] The judgment type determining unit 376 acquires the rules associated with the message ID from the fraud detecting unit 371, and checks whether there are two rules, a rule regarding the period and a rule regarding the change in the data value (S1103).

[0148] In step S1103, if there are both rules related to the period and rules related to changes in data value (Yes in step S1103), the judgment type determination unit 376 requests the period judgment unit 377 to make a judgment based on the period, and the period judgment unit 377 judges the reference message from the reception times of multiple reference message candidates (S1104). Furthermore, the judgment type determination unit 376 requests the data judgment unit 378 to make a judgment based on changes in data value, and the data judgment unit 378 judges the reference message from the data values ​​of the multiple reference message candidates (S1105).

[0149] The judgment type determination unit 376 determines which judgment type (judgment method) to use from the judgment result by the periodic judgment unit 377 and the judgment result by the data judgment unit 378 (S1106), and notifies the reference message determination unit 375. The judgment type determination unit 376 makes the judgment in step S1106, for example, based on the clarity acquired from the periodic judgment unit 377 and the clarity acquired from the data judgment unit 378. For example, the judgment result may include the clarity. Step S1106 is an example of a first determination step.

[0150] The reference message determination unit 375 determines a final reference message using the judgment method notified by the judgment type determination unit 376 (S1107). The reference message determination unit 375 determines a reference message based on the clarity, and can determine a message other than an abnormal message from among one or more reference message candidates as the reference message. Step S1107 is an example of a second determination step.

[0151] If the answer is No in step S1103, the judgment type determination unit 376 checks whether there is a rule regarding the period (S1108). If there is a rule regarding the period in step S1108 (Yes in step S1108), the judgment type determination unit 376 requests the period judgment unit 377 to make a judgment based on the period, and the period judgment unit 377 judges the reference message from the reception times of multiple reference message candidates (S1109). The judgment type determination unit 376 determines the reference message judged by the period judgment unit 377 as the final reference message (S1110).

[0152] If the answer is No in step S1108, the judgment type determination unit 376 checks whether there is a rule regarding data change (S1111). If there is a rule regarding data change in step S1111 (Yes in S1111), the judgment type determination unit 376 requests the data judgment unit 378 to make a judgment based on the change in data value, and the data judgment unit 378 judges the reference message from the amount of change in the data value of multiple reference message candidates (S1112). The judgment type determination unit 376 determines the reference message judged by the data judgment unit 378 as the final reference message (S1113).

[0153] If the result is No in step S1111, the judgment type determination unit 376 notifies the reference message determination unit 375 that judgment is impossible. The reference message determination unit 375 determines a final reference message from a plurality of reference message candidates using a predetermined method (S1114).

[0154] If the answer is No in step S1102, that is, if there is only one message that can be the reference message candidate, the reference message determination unit 375 determines the one reference message candidate as the reference message (S1115). In this case, the process of calculating the clarity is not performed.

[0155] The reference message determination unit 375 may determine whether there are both rules related to the period and rules related to changes in the data value, and may request the determination type determination unit 376 to determine which determination type to use only if both rules are present. At this time, if there are only rules related to the period, the reference message determination unit 375 may request the period determination unit 377 to make a determination based on the period, and if there are only rules related to the data value, the reference message determination unit 375 may request the data determination unit 378 to make a determination based on the data value, and if there are neither rules, the reference message determination unit 375 may make a determination using a predetermined method and determine the reference message. Even if there are no rules related to the period or data value, if the reception time or the data value can be predicted, the predicted value may be used to determine the reference message.

[0156] [1.10 Effects] In this embodiment, in the fraud detection process in the fraud detection processing function group 370, when determining the reference message to be used by the various determination functions of the fraud detection unit 371, a determination type that can make a clearer determination is selected from periodic determination and data value determination, and the reference message is determined from the determination result of the selected determination type. This makes it possible to prevent the occurrence of a situation in which fraud detection cannot be performed correctly as a result of using an abnormal message as the reference message, which could have occurred in the past, and therefore makes it possible to determine with higher accuracy whether or not a message is an abnormal message. As a result, the safety of the in-vehicle network system 10 is improved.

[0157] (Embodiment 2) [2. Overview] Here, as a second embodiment, an in-vehicle network system in which some functions of the fraud detection processing function group are arranged in a server outside the vehicle and a gateway communicates with the server will be described with reference to the drawings.

[0158] [2.1 Overall configuration of in-vehicle network system] Fig. 12 is a block diagram showing the overall configuration of an in-vehicle network system 10a according to the present embodiment. In Fig. 12, components common to those in the in-vehicle network system 10 shown in Fig. 1 are designated by common reference numerals, and descriptions thereof will be omitted.

[0159] The in-vehicle network system 10a is composed of a CAN network and includes an ECU (ECU100a, ECU100b, ECU100c, and ECU100d in the figure, which will hereinafter be referred to collectively or as an unspecified part of them as ECU100), a bus (bus 200a and bus 200b in the figure, which will hereinafter be referred to collectively or as an unspecified part of them as bus 200), a gateway 300b, an external network 400, and a server 500.

[0160] The gateway 300b connects the bus 200a to which the ECUs 100a and 100b are connected, and the bus 200b to which the ECUs 100c and 100d are connected. The gateway 300b has a function of transferring a message received from one bus to the other bus. The gateway 300b is also a node on the CAN network.

[0161] The external network 400 is a communication network for communication between the gateway 300b and the server 500. The communication method of the external network 400 may be wired or wireless. In addition, the wireless communication method is not particularly limited, and may be, for example, existing technologies such as Wi-Fi, 3G, or LTE (Long Term Evolution).

[0162] The server 500 communicates with the gateway 300b via the external network 400.

[0163] Gateway 300b and server 500 each share some of the functions of fraud detection processing function group 370 in embodiment 1, and gateway 300b and server 500 operate in conjunction with each other to execute the fraud detection processing of fraud detection processing function group 370 in embodiment 1.

[0164] [2.2 Gateway configuration] Fig. 13 is a block diagram showing an example of a functional configuration of a gateway 300b included in the in-vehicle network system 10a in this embodiment. In Fig. 13, components common to Fig. 3 are indicated by common reference numerals, and descriptions thereof will be omitted. Below, the gateway 300b will be described, focusing on the differences from the gateway 300.

[0165] Gateway 300b differs from gateway 300 in that it has a fraud detection processing function group 370b instead of fraud detection processing function group 370 in the configuration of gateway 300, and also has an external communication unit 390. These components are also functional components, and are realized by the reading and execution by a processing unit of a program stored in a storage unit in gateway 300b, the storage unit storing predetermined data, or the sending and receiving of data via an input / output unit, or a combination of these.

[0166] The fraud detection processing function group 370b determines whether or not a received message is an abnormal message by communicating with and cooperating with the server 500. The configuration included in the fraud detection processing function group 370b will be described in detail later.

[0167] The external communication unit 390 communicates with the server 500 .

[0168] [2.3 Configuration of fraud detection processing function group] Fig. 14 is a block diagram showing an example of the functional configuration of fraud detection processing function group 370b in this embodiment. In Fig. 14, components common to Fig. 6 are indicated by common reference numerals, and description thereof will be omitted.

[0169] The fraud detection processing function group 370b includes a fraud detection section 371, a message storage processing section 373b, a period determination section 377b, and a data determination section 378b.

[0170] If message storage processing unit 373b receives the determination result of fraud detection unit 371 and determines that the received message is a normal message and needs to be stored, it communicates with server 500 via external communication unit 390 and transmits information about the normal message to server 500 to store it. The determination of whether or not to store the message is the same as in the first embodiment.

[0171] The periodicity determination unit 377b and the data determination unit 378b determine a reference message from a plurality of reference message candidates in response to a determination request from the determination type determination unit 376. When making this determination, the periodicity determination unit 377b and the data determination unit 378b communicate with the server 500 via the external communication unit 390, receive a prediction model generated by the server 500, and calculate a prediction value using the received prediction model.

[0172] In generating the prediction model in the server 500, a model of information on normal messages may be obtained using a method such as machine learning, statistical processing, or probability theory, and the model may be used as the prediction model. In addition, the server 500 may perform processes from generating the prediction model to calculating the predicted value in response to a request from the periodicity determination unit 377b and the data determination unit 378b, and the periodicity determination unit 377b and the data determination unit 378b may only perform the process of determining a reference message from the predicted value.

[0173] The division of processing between the fraud detection processing function group 370b and the server 500 is not limited to the above, and may be determined appropriately.

[0174] [2.4 Server configuration] 15 is a block diagram showing an example of a functional configuration of the server 500 in this embodiment. The server 500 has a normal message information storage unit 374b and a prediction model generation unit 379. These components are functional components, and the server 500 is a so-called server computer, which is realized by one or more computers equipped with an information processing device such as a processor, a storage device such as a semiconductor memory, an input / output unit including an input / output port, and the like. Each of the functional components listed above is realized by reading and executing a program stored in the storage unit by a processing unit, storing predetermined data in the storage unit, sending and receiving data via the input / output unit, or a combination of these.

[0175] The normal message information storage unit 374b stores information about normal messages that are instructed to be stored by the message storage processing unit 373 of the gateway 300b. In addition, in response to a request from the prediction model generation unit 379, the normal message information storage unit 374b outputs the stored information about normal messages.

[0176] The prediction model generation unit 379 acquires information about normal messages from the normal message information storage unit 374b, and predicts at least one of the expected reception time and the data value from normal messages received in the past. At this time, the expected reception time may be predicted using only the reception time information, or may be predicted by adding the data value. Also, the prediction may be made using only messages with the same ID, or may be predicted by adding messages with other IDs. As a specific prediction method, a model (network) such as an AR (AutoRegressive) model, an ARMA (AutoRegressive Moving Average) model, an HMM (Hidden Markov Model), a Bayesian model, an SVM (Support Vector Machine), a neural network, or deep learning may be generated from information about normal messages using machine learning, statistical processing, or probability theory, and the model may be used to calculate a predicted value regarding the expected reception time or the expected data value of the message to be received. Also, prediction may be made using a prediction method not shown above.

[0177] Furthermore, the prediction model generation unit 379 transmits the prediction model in response to a request from the periodicity determination unit 377b or the data determination unit 378b of the gateway 300b.

[0178] The server 500 may communicate with a plurality of vehicles 1 and may assume some of the functions of the fraud detection processing function group in each vehicle 1. In this case, the server 500 may have an individual normal message information storage unit 374b and a prediction model generation unit 379 for each vehicle 1, or may have a set of the normal message information storage unit 374b and the prediction model generation unit 379 for the plurality of vehicles 1 with which it communicates. The server 500 may also have a set of the normal message information storage unit 374b and the prediction model generation unit 379 for some of the plurality of vehicles 1 with which it communicates. When the server 500 has one set for the plurality of vehicles 1, the normal message information storage unit 374b stores information about normal messages acquired from each vehicle 1 together with information identifying each vehicle 1.

[0179] In addition, the prediction model generation unit 379 may individually generate a prediction model from the information received from each vehicle 1 and transmit the individual model to each vehicle 1, or may generate a prediction model using integrated information from each vehicle 1 and transmit the model to each vehicle 1.

[0180] Here, the method of integrating the information from each vehicle 1 may be, for example, integrating information from all vehicles 1, or integrating information by manufacturer or vehicle model of each vehicle 1, or by model or grade. Alternatively, information may be integrated by vehicle class (size, engine displacement, etc.) of each vehicle 1, by location of each vehicle 1, or by function of each vehicle 1 (for example, automatic driving function, driving assistance function, communication function, etc.). Alternatively, information may be integrated by type or further version of firmware or software executed by ECU 100 or the like on each vehicle 1. Furthermore, a combination of these integration methods may be used.

[0181] [2.5 Effects] In this embodiment, the gateway 300b communicates with a server 500 outside the vehicle 1, and some of the functions of the fraud detection processing function group 370 in the first embodiment are carried out by the server 500.

[0182] Conventionally, a prediction model was generated only from information collected by each vehicle 1, and the accuracy of the prediction model was limited. However, in this embodiment, by storing information in the server 500, it is possible to generate a prediction model from information of multiple vehicles 1. As a result, a prediction model is generated quickly or with higher accuracy based on more normal messages. Then, by using this prediction model in each vehicle 1, it is possible to determine the reference message with higher accuracy. As a result, the safety of the in-vehicle network system 10a is improved. In addition, since information regarding normal messages is stored in the server 500, there is no need to provide a large-capacity information storage device in the gateway 300b, and it is also possible to reduce the manufacturing and maintenance costs of each vehicle 1.

[0183] [3. Other Modifications] The present disclosure is not limited to the above-described embodiments, and various modifications conceivable by those skilled in the art and combinations of components in different embodiments are also included within the scope of the present disclosure, provided they do not deviate from the spirit of the present disclosure. For example, the following modifications are also included in the present disclosure.

[0184] (1) In the above embodiment, the reference message determination unit 375 of the fraud detection processing function group 370 is requested to determine a reference message by the fraud detection unit 371, but this is not limited to the above. Fig. 16 is a block diagram showing a first example of the functional configuration of the fraud detection processing function group 370c in this modification. For example, as shown in Fig. 16, the frame processing unit 350 may determine the timing for determining the reference message, and the frame processing unit 350 may request the reference message determination unit 375 to determine the reference message.

[0185] This makes it possible to determine the reference message at any timing as required.

[0186] (2) In the above embodiment, in the fraud detection process, when the reception period of a periodically transmitted message moves to the next, a reference message is determined from the reference message candidates, but this is not limited to the above. Fig. 17 is a flow diagram showing an example of the fraud detection process in this modification. For example, as shown in Fig. 17, when a received message is determined to be a normal message (No in step S1006), the fraud detection unit 371 determines whether there are multiple messages determined to be normal within the same reception period (S1010).

[0187] If it is determined in step S1010 that there is more than one reference message (Yes in step S1010), the fraud detection unit 371 requests the reference message determination unit 375 to determine a reference message for the next receiving cycle, and the reference message determination unit 375 determines a reference message for the next receiving cycle (S1011). This process is the same as the process for determining a reference message in the first embodiment (S1003, FIG. 11), so details will be omitted.

[0188] If it is determined in step S1010 that there are not multiple normal messages, that is, that the message is the first normal message in the receiving cycle (No in step S1010), the fraud detection unit 371 determines the received message that is a normal message as a reference message candidate for the next receiving cycle (S1012).

[0189] In this way, the reference message determination unit 375 of the fraud detection processing function group 370c determines the reference message for the next receiving cycle before the next receiving cycle, using one or more messages determined to be normal in the current receiving cycle as reference message candidates. Steps S1011 and S1012 are an example of a second determination step.

[0190] Thereafter, similarly to the first embodiment, fraud detection unit 371 stores the normal message in normal message information storage unit 374 and the reference message candidate in reference message information storage unit 372 (S1007), and frame processing unit 350 transfers the message to the transfer destination (S1008).

[0191] In addition, when the reception period of a periodically transmitted message changes to the next one (Yes in step S1002), the fraud detection unit 371 updates the reference message candidate, of which only one is stored in the reference message information storage unit 372, as the reference message for the new reception period (S1009).

[0192] As a result, there will always be only one reference message candidate, and the amount of data stored in reference message information storage unit 372 can be reduced. In particular, when abnormal messages are transmitted consecutively, an increase in the amount of data to be stored as reference message candidates can be suppressed. Also, in the first embodiment, since the number of reference message candidates changes dynamically during system operation, it was necessary to make the area for storing the messages of the reference message candidates variable length, or to store the reference message candidates with a preset upper limit, and replace or discard them when the upper limit is exceeded; however, since there can be only one reference message candidate, the system can be simplified.

[0193] (3) In the above embodiment, the periodicity judgment unit 377 and the data judgment unit 378 calculate the predicted value individually, but this is not limited to the above. FIG. 18 is a block diagram showing a second example of the functional configuration of the fraud detection processing function group 370d in this modification. For example, as shown in FIG. 18, the fraud detection processing function group 370d may have a prediction model generation unit 379, and the periodicity judgment unit 377 and the data judgment unit 378 may use the generated prediction model to calculate the predicted value, or the prediction model generation unit 379 itself may calculate the predicted value using the generated prediction model and notify the periodicity judgment unit 377 and the data judgment unit 378. The prediction model generation unit 379 has the function described in the second embodiment.

[0194] This eliminates the need for both the periodicity determination unit 377 and the data determination unit 378 to have a prediction model, making it possible to save on storage area costs and reduce model generation processing or prediction value calculation processing, etc. Furthermore, by generating and predicting a prediction model using a plurality of pieces of information, rather than prediction using only the reception time in the periodicity determination unit 377 or prediction using only the data value in the data determination unit 378, prediction accuracy is improved, and ultimately detection accuracy in the fraud detection unit 371 can be improved.

[0195] (4) In the above embodiment, the fraud detection processing function group 370 includes the fraud detection unit 371, the reference message information storage unit 372, the message save processing unit 373, the normal message information storage unit 374, the reference message determination unit 375, the judgment type determination unit 376, the periodicity determination unit 377, and the data judgment unit 378, but is not limited thereto. FIG. 19 is a block diagram showing a third example of the functional configuration of the fraud detection processing function group 370e in this modification. For example, as shown in FIG. 19, the fraud detection processing function group 370e may include the fraud detection unit 371, the reference message information storage unit 372, the reference message determination unit 375, the judgment type determination unit 376, the periodicity determination unit 377, and the data judgment unit 378, or may further include other components. In this case, for example, the periodicity determination unit 377 and the data judgment unit 378 perform judgment processing using the reference message stored in the reference message information storage unit 372.

[0196] (5) In the above embodiment, the ECU 100 is described as being composed of a frame transmission / reception unit 110, a frame interpretation unit 120, a received ID determination unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180, but this is not limited to this.

[0197] Fig. 20 is a block diagram showing a first example of the functional configuration of the ECU 100e in this modification. For example, as shown in Fig. 20, the ECU 100e may include a fraud detection processing function group 370. At this time, the frame processing unit 150 may request the fraud detection processing function group 370 to determine whether or not the message is an abnormality, or the frame interpretation unit 120 may request the fraud detection processing function group 370 to determine whether or not the message is an abnormality. Each of the multiple ECUs 100e may have the fraud detection processing function group 370, or at least one ECU 100e may have the fraud detection processing function group 370. In this case, the gateway 300 may not have the fraud detection processing function group 370.

[0198] Fig. 21 is a block diagram showing a second example of the functional configuration of the ECU 100f in this modified example. For example, as shown in Fig. 21, the ECU 100f may be composed of a frame transceiver 110, a frame interpretation unit 120, a frame generator 180, and a fraud detection processing function group 370. In this case, the frame interpretation unit 120 receives all messages and requests the fraud detection processing function group 370 to determine whether or not the messages are abnormal messages.

[0199] 21, the ECU 100f may have a received ID determination unit 130 and a received ID list holding unit 140, receive only messages having a message ID written in the received ID list held by the received ID list holding unit, and request the fraud detection processing function group 370 to determine whether the message is an abnormal message. The fraud detection processing function group 370 may be configured as either the fraud detection processing function group 370 or 370b.

[0200] This allows not only the gateway 300 but also the ECU 100 to determine whether the message transmitted to the bus 200 is an abnormality message.

[0201] Fig. 22 is a block diagram showing a third example of the functional configuration of the ECU 100g in this modified example. Furthermore, as shown in Fig. 22, the ECU 100g has a transmission data acquisition unit 171 that acquires data to be transmitted to the bus 200 from another source, and the fraud detection processing function group 370 may determine whether the data received from the transmission data acquisition unit 171 is an abnormality message, and request the frame generation unit 180 to transmit a message only when it is determined that the data is not an abnormality message.

[0202] This makes it possible to prevent an abnormality message from being transmitted from the car navigation system or the like in the ECU 100g used together with the car navigation system or the like.

[0203] The fraud detection processing function group 370 shown in Figs. 20 to 22 above may be replaced with any one of the fraud detection processing function groups 370b to 370e.

[0204] (6) In the above embodiment, an example was shown in which the action taken when fraud was detected was to not forward the received message, but the action taken after fraud detection is not limited to this. For example, the gateway 300 may perform fraud detection processing while receiving a message, and when it determines that the message is an abnormal message, it may invalidate the message being received by transmitting an error frame.

[0205] This makes it possible to prevent other ECUs 100 connected to the network in which the abnormality message was found from receiving the abnormality message. This can also be applied to messages that are not to be forwarded.

[0206] Furthermore, the gateway 300 may notify the user that an abnormality has occurred, may transition the vehicle into a fail-safe mode, may record the abnormality in a log, or may notify a server of the abnormality via a mobile phone network, etc.

[0207] This allows for flexible response after fraud detection. For a sequence determined to be an abnormal message, a set of data values ​​or reception intervals may be learned as an abnormal label.

[0208] Furthermore, the ECU 100 may perform a fraud detection process while receiving a message, and when it determines that the message is an abnormal message, it may invalidate the message being received by transmitting an error frame. This makes it possible to prevent other ECUs connected to the network in which the abnormal message was found from receiving the abnormal message.

[0209] (7) In the above embodiment, an example of a standard format ID is shown, but an extended format ID may also be used.

[0210] (8) In the above embodiment, the message is sent in plain text, but it may be encrypted. Also, the message may include a message authentication code.

[0211] (9) In the above embodiment, an example was shown in which the information regarding normal messages and the information regarding reference messages were stored without encryption. However, these may be encrypted and stored, or may be stored using a mechanism that can detect tampering.

[0212] (10) In the above embodiment, an in-vehicle network is shown as an example of a network communication system that communicates according to the CAN protocol. The technology according to the present disclosure is not limited to use in in-vehicle networks, and may be used in networks that communicate according to the CAN protocol other than in-vehicle networks, such as networks for robots, industrial equipment, etc.

[0213] In addition, the CAN protocol is used as the in-vehicle network, but the present invention is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc. may be used. Alternatively, a network may be a combination of these networks as sub-networks.

[0214] (11) Each device in the above embodiments is specifically a computer system consisting of a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is recorded in the RAM or the hard disk unit. Each device achieves its function by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0215] (12) In each of the above embodiments, some or all of the constituent elements may be configured from a single system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0216] Furthermore, each of the components constituting each of the above devices may be individually implemented as a single chip, or some or all of them may be included in a single chip.

[0217] In addition, although we refer to it as a system LSI here, it may also be called an IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Also, the method of integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connections and settings of the circuit cells inside the LSI.

[0218] Furthermore, if a new integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a derivative technology, it is possible to integrate the functional blocks using that technology. The application of biotechnology is also a possibility.

[0219] (13) Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that can be attached to each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. This IC card or module may be tamper-resistant.

[0220] (14) The present disclosure may be embodied as any of the methods described above. It may also be embodied as a computer program for implementing these methods by a computer, or as a digital signal comprising a computer program.

[0221] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0222] The present disclosure may also involve transmitting a computer program or a digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0223] The present disclosure may also provide a computer system having a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating according to the computer program.

[0224] Furthermore, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so that the program or digital signal may be implemented by another independent computer system.

[0225] (15) The above-described embodiments and modifications may be combined with each other.

[0226] (16) The division of functional blocks in the block diagram is one example, and multiple functional blocks may be realized as one functional block, one functional block may be divided into multiple blocks, or some functions may be moved to other functional blocks. Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in a time-sharing manner by a single piece of hardware or software.

[0227] (17) The order of the processes described in the above embodiment is merely an example. The order of the processes may be changed, the processes may be executed in parallel, or some of the processes may not be executed.

[0228] (18) A system for determining a reference message that executes the method for determining a reference message in the above embodiment includes one or more processors and a storage unit. The system for determining a reference message may be configured by a plurality of devices or may be configured by a single device.

[0229] (19) In the above embodiment, the method for determining a reference message has been described as being used to detect unauthorized communication in an in-vehicle network system, but the present invention is not limited to this. The method for determining a reference message may be used to detect unauthorized communication in a network system within a building (e.g., in a home or a building). The method for determining a reference message may be used to detect unauthorized communication in a network system in which the timing of message transmission is predetermined, for example.

[0230] The above describes a technique for determining a message used as a criterion for detecting fraudulent communication for the purpose of fraudulent control by a fraudulent message in an in-vehicle network according to one or more aspects, based on embodiments and modifications thereof. In each of these embodiments and modifications thereof, a message used as a criterion for detecting fraudulent communication is determined by a gateway or ECU connected to the in-vehicle network system for communication, or a combination of these with a server computer. In this disclosure, a system including one or more processors and a storage unit that performs such fraudulent communication detection is called a fraudulent communication detection criterion determination system. Therefore, the fraudulent communication detection criterion determination system includes a system realized by a single device, such as a single gateway connected to the in-vehicle network system, and a system realized by multiple devices, such as a combination of such a gateway and an ECU, or a combination of a gateway or ECU and a remote server computer.

[0231] In addition, this technology can be realized as a method that includes some or all of the processing steps executed by each component in each of the above-mentioned embodiments or their variations, or as a program that is executed by a processor of the fraudulent communication detection criteria determination system to cause the fraudulent communication detection criteria determination system to implement the method.

[0232] In addition, in the above embodiment or its modified example, the process executed by a specific component may be executed by another component instead of the specific component. Furthermore, the order of multiple processes may be changed, or multiple processes may be executed in parallel. [Industrial Applicability]

[0233] The determination method and the like according to the present disclosure determine a reference message for detecting anomalies by selecting a reference message from among reference message candidates using a determination result of a determination method that provides high accuracy among the determination results of multiple determination methods. This makes it possible to accurately identify normal messages even for messages that were previously difficult to distinguish between normal and abnormal messages, thereby making it possible to protect the network. [Explanation of symbols]

[0234] 1 vehicle 10, 10a In-vehicle network system 100, 100a, 100b, 100c, 100d, 100e, 100f, 100g ECU 101 Engine 102 Brake 103 Door opening / closing sensor 104 Window opening / closing sensor 110, 310 Frame transmitter / receiver 120, 320 Frame Interpretation Section 130, 330 Reception ID determination unit 140, 340 Reception ID list storage section 150, 350 frame processing section 170 Data Acquisition Section 171 Transmission data acquisition unit 180, 380 Frame Generation Unit 200, 200a, 200b bus 300, 300b Gateway 360 Transfer rule storage unit 370, 370b, 370c, 370d, 370e Fraud detection processing function group 371 Fraud Detection Department 372 Standard Message Information Storage Unit 373, 373b Message storage processing unit 374, 374b Normal message information storage unit 375 Reference Message Determination Unit 376 Judgment Type Decision Unit 377, 377b Period determination section 378, 378b Data judgment section 379 Prediction Model Generation Unit 390 External Communications Department 400 External Network 500 servers

Claims

1. A method for determining a reference message used to detect unauthorized communication in an in-vehicle network system including a network and one or more electronic control units connected to the network, comprising: the reference message is a message used as a criterion for determining whether a message sent to the network is an abnormal message; The method of determining the storing candidate information for one or more candidate reference messages that are candidates for the reference message; a first determination step of determining a rule for determining the reference message from among a plurality of rules, based on the one or more reference message candidates included in the candidate information stored in the storage step; a second determination step of determining the reference message from the one or more reference message candidates using the rule determined in the first determination step; In the first determination step, an appropriateness indicating an appropriateness of determining the reference message from among the one or more reference message candidates for each of the plurality of rules is calculated, and a rule for determining the reference message is determined based on the appropriateness calculated for each of the plurality of rules; The appropriateness is calculated by calculating a first difference between a predicted value for the message to be sent to the network and each of values ​​indicated by the one or more reference message candidates, and calculating the appropriateness as a second difference which is a difference between two or more of the calculated first differences. How to decide.

2. In the first determination step, a rule having the highest appropriateness among the plurality of rules is determined as a rule for determining the reference message from the one or more reference message candidates. The method of claim 1 .

3. In the first determination step, when there are three or more values ​​indicated by the one or more reference message candidates, two of the values ​​close to the predicted value are extracted, and two of the first differences are calculated based on the two extracted values ​​and the predicted value. The method according to claim 1 or 2.

4. The predicted value is calculated based on a value indicated by the reference message determined in the past. The method according to any one of claims 1 to 3.

5. The prediction value is obtained by inputting the one or more reference message candidates having the same ID into a prediction model created in advance. The method according to any one of claims 1 to 3.

6. the plurality of rules include at least one of a periodicity determination rule for determining the reference message based on a period in which a message sent to the network is transmitted, and a data determination rule for determining the reference message based on a value of data included in the message sent to the network; The method according to any one of claims 1 to 5.

7. Further, the method includes a step of determining whether the message sent to the network is an abnormal message, The one or more reference message candidates include the abnormal message determined to be abnormal in the determining step, In the second determination step, a message other than the abnormal message is determined as the reference message from among the one or more reference message candidates. The method according to any one of claims 1 to 6.

8. Further, the method includes a step of determining whether the message sent to the network is an abnormal message, In the second determination step, one or more messages determined to be normal in a current receiving cycle are set as reference message candidates, and a reference message in a next receiving cycle is determined before the next receiving cycle. The method according to any one of claims 1 to 6.

9. A system for determining a reference message used to detect unauthorized communication in an in-vehicle network system including a network and one or more electronic control units connected to the network, comprising: one or more processors; A storage unit, the reference message is a message used as a criterion for determining whether a message sent to the network is an abnormal message; The one or more processors, using the storage unit, storing candidate information for one or more candidate reference messages that are candidates for the reference message; determining a rule for determining the reference message from among a plurality of rules based on the one or more reference message candidates included in the stored candidate information; determining the reference message from the one or more candidate reference messages using the determined rules; In determining the rule for determining the reference message, a suitability indicating a degree of suitability of determining the reference message from among the one or more reference message candidates is calculated for each of the plurality of rules, and the rule for determining the reference message is determined based on the suitability calculated for each of the plurality of rules; The appropriateness is calculated by calculating a first difference between a predicted value for the message to be sent to the network and each of values ​​indicated by the one or more reference message candidates, and calculating the appropriateness as a second difference which is a difference between two or more of the calculated first differences. Decision system.

10. A program for causing a computer to execute the determination method according to any one of claims 1 to 8.

Images