Vehicle log transmission device, vehicle log collection system, vehicle log transmission method, and storage priority change device

Abstract

This vehicle log transmission device (10) is provided with: an abnormality detection unit (420) that acquires a vehicle log from one or more electronic control devices, detects abnormalities on the basis of at least one set of log information included in the acquired vehicle log, and extracts log information in which an abnormality was detected as an abnormality log; an abnormality log notification unit (470) that transmits the abnormality log to a vehicle log collection server (20); a vehicle log preservation priority change instruction unit (450) that, on the basis of a vehicle state extracted from the vehicle log, transmits to the one or more electronic control devices an instruction to change a preservation priority that indicates the priority of retaining the log information in at least one set of log information included in the vehicle log; and a vehicle log request response unit (480) which, when a vehicle log request that requests transmission of a vehicle log is received from the vehicle log collection server (20), acquires from the one or more electronic control devices a vehicle log that includes log information preserved on the basis of a preservation priority changed due to the change instruction and transmits the acquired vehicle log to the vehicle log collection server (20).

Description

[Technical field]

[0001] The present disclosure relates to a vehicle log transmission device, a vehicle log collection system, a vehicle log transmission method, and a storage priority change device. [Background technology]

[0002] In recent years, systems inside automobiles are equipped with many devices called Electronic Control Units (ECUs). The network that connects these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. One of the most mainstream standards for in-vehicle networks is the CAN (Controller Area Network) standard defined in ISO11898-1.

[0003] In CAN, the communication path consists of two buses, and the ECUs connected to the buses are called nodes. Each node connected to the bus sends and receives messages called frames. In CAN, there are no identifiers that indicate the destination node or the source node. The sending node attaches an ID called a message ID to each frame and sends it, and each receiving node receives only predetermined message IDs. Therefore, there is a threat that an ECU connected to the CAN bus and sending frames containing abnormal control commands disguised as a legitimate ECU could be used to illegally control a car.

[0004] In response to such threats, Patent Document 1 discloses a method for detecting the intrusion of unauthorized data into an in-vehicle network or the like. When a server outside the vehicle monitors and analyzes data from an in-vehicle system using the technology of Patent Document 1, a large amount of data may be transmitted from the in-vehicle system to the server outside the vehicle. Patent Document 2 discloses a method for reducing the amount of communication data for large amounts of data (logs) by switching the logs to be transmitted to the server depending on the level of anomaly detected. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2014-146868 A [Patent Document 2] JP 2019-125867 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the techniques disclosed in Patent Documents 1 and 2, logs to be transmitted to a server must be stored in the vehicle for a long period of time, but it is not easy to prepare resources (storage capacity of a storage device) inside the vehicle to store such logs for a long period of time. Also, when the stored logs are deleted in order from the oldest one, data necessary for analysis on a server outside the vehicle may be deleted.

[0007] Therefore, the present disclosure relates to a vehicle log transmission device, a vehicle log collection system, and a vehicle log transmission method that can accumulate logs necessary for analysis on a server even when resources for storing logs are limited. [Means for solving the problem]

[0008] In order to solve the above problem, a vehicle log transmission device according to one embodiment of the present disclosure is a vehicle log transmission device that transmits a vehicle log including one or more log information related to the vehicle, which is stored in one or more electronic control units mounted on a vehicle, to a vehicle log collection server, and includes an abnormality detection unit that acquires the vehicle log from the one or more electronic control units, detects an abnormality based on the one or more log information included in the acquired vehicle log, and extracts the log information in which the abnormality is detected as an abnormality log; an abnormality notification unit that transmits the abnormality log to the vehicle log collection server; a change instruction unit that transmits to the one or more electronic control units a change instruction for a storage priority indicating the priority of keeping the log information for the one or more log information included in the vehicle log based on the vehicle state extracted from the vehicle log; and a vehicle log request response unit that, upon receiving a vehicle log request requesting the transmission of the vehicle log from the one or more electronic control units, acquires the vehicle log including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control units, and transmits the acquired vehicle log to the vehicle log collection server.

[0009] In addition, in order to solve the above problem, a vehicle log collection system according to one embodiment of the present disclosure includes the vehicle log transmission device described above, one or more electronic control devices mounted on the vehicle, and a vehicle log collection server, wherein each of the one or more electronic control devices has a vehicle log priority setting unit that changes the storage priority of the vehicle log in accordance with an instruction to change the storage priority of the vehicle log received from the vehicle log transmission device, a vehicle log deletion unit that deletes log information corresponding to the storage priority from one or more log information included in the vehicle log in accordance with the storage priority of the vehicle log, and a vehicle log request response unit that transmits the vehicle log stored in the electronic control device to the vehicle log transmission device in response to the vehicle log request received from the vehicle log transmission device, and the vehicle log collection server has an abnormality log receiving unit that receives the abnormality log from the vehicle log transmission device, a vehicle log request unit that transmits the vehicle log request to the vehicle log transmission device, and a vehicle log receiving unit that receives the vehicle log based on the vehicle log request from the vehicle log transmission device.

[0010] In addition, in order to solve the above problem, a vehicle log transmission method according to one embodiment of the present disclosure is a vehicle log transmission method for transmitting a vehicle log, which is stored in one or more electronic control devices mounted on a vehicle, and includes one or more log information related to the vehicle, to a vehicle log collection server, the method including: an abnormality detection step of acquiring the vehicle log from the one or more electronic control devices, detecting an abnormality based on the one or more log information included in the acquired vehicle log, and extracting the log information in which the abnormality is detected as an abnormality log; a first transmission step of transmitting the abnormality log to the vehicle log collection server; a second transmission step of transmitting to the one or more electronic control devices a change instruction for a storage priority indicating a priority for keeping the log information in the one or more log information included in the vehicle log based on a vehicle state extracted from the vehicle log; and a third transmission step of, upon receiving a vehicle log request requesting the transmission of the vehicle log from the one or more electronic control devices, acquiring the vehicle log including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices, and transmitting the acquired vehicle log to the vehicle log collection server.

[0011] In addition, in order to solve the above problem, a storage priority change device according to one embodiment of the present disclosure includes an abnormality detection unit that stores a vehicle log including one or more log information related to a vehicle, acquires the vehicle log from one or more electronic control units installed in the vehicle, detects an abnormality based on the one or more log information included in the acquired vehicle log, and extracts the log information in which the abnormality is detected as an abnormality log, an abnormality notification unit that transmits the abnormality log to a vehicle log collection server, and a change instruction unit that transmits a storage priority change instruction to the one or more electronic control units indicating the priority of keeping the log information for the one or more log information included in the vehicle log based on the vehicle state extracted from the vehicle log. Effect of the Invention

[0012] According to a vehicle log transmission device and the like according to one embodiment of the present disclosure, even if there is a limit to resources for storing logs, logs necessary for analysis on a server can be accumulated. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram showing the overall configuration of a vehicle log collection system according to an embodiment. [Diagram 2] FIG. 2 is a configuration diagram of the vehicle log transmitting device according to the embodiment. [Diagram 3] FIG. 3 is a configuration diagram of an abnormality detection device according to an embodiment. [Figure 4] FIG. 4 is a configuration diagram of the Zone ECU in the embodiment. [Diagram 5] FIG. 5 is a configuration diagram of the vehicle log collection server according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a vehicle log in the in-vehicle network according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of a vehicle log in the ECU according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of an error log according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a related vehicle log list according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of vehicle log storage priority settings according to the embodiment. [Figure 11] FIG. 11 is a diagram showing a sequence of an abnormality log notification process according to the embodiment. [Figure 12] FIG. 12 is a diagram showing a sequence of a vehicle log request response process in the embodiment. [Figure 13] FIG. 13 is a flowchart of the vehicle log storage priority change process according to the embodiment. [Figure 14] FIG. 14 is a flowchart of a process for determining whether or not a vehicle log request is required in the embodiment. [Figure 15] FIG. 15 is a flowchart of the vehicle log deletion process in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] (Background to this disclosure) In recent years, automobiles have become electronically controlled, and there is a threat that control commands can be spoofed to allow unauthorized operation. To counter such threats, a system is being considered that collects logs from multiple in-vehicle systems (multiple vehicles) on a server outside the vehicle for monitoring and analysis. When the server determines the level of an abnormality based on the logs of multiple vehicles or abnormalities detected in multiple vehicles, the in-vehicle system must transmit the logs after receiving a response (vehicle log request) from the server, and therefore the logs must be stored in the vehicle for a long period of time.

[0015] Since the resources (storage capacity of the storage device) for storing logs in a vehicle are limited, it is desirable to store (leave) data necessary for monitoring and analysis on a server. The inventors of the present application conducted extensive research into a vehicle log transmission device or the like that can effectively store data necessary for monitoring and analysis on a server, and discovered that by switching the logs to be preferentially stored depending on the vehicle state when an abnormality is detected, it is possible to preferentially leave logs necessary for analysis on a server in the vehicle even if the amount of data stored in the vehicle log exceeds the upper limit.

[0016] A vehicle log transmission device according to one embodiment of the present disclosure is a vehicle log transmission device that transmits a vehicle log, which is stored in one or more electronic control devices mounted on a vehicle, to a vehicle log collection server, and which includes one or more log information related to the vehicle. The vehicle log transmission device includes an abnormality detection unit that acquires the vehicle log from the one or more electronic control devices, detects an abnormality based on the one or more log information included in the acquired vehicle log, and extracts the log information in which the abnormality is detected as an abnormality log; an abnormality notification unit that transmits the abnormality log to the vehicle log collection server; a change instruction unit that transmits to the one or more electronic control devices a change instruction for a storage priority indicating the priority of keeping the log information in the one or more log information included in the vehicle log based on the vehicle state extracted from the vehicle log; and a vehicle log request response unit that, upon receiving a vehicle log request requesting the transmission of the vehicle log from the one or more electronic control devices, acquires the vehicle log including the log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices, and transmits the acquired vehicle log to the vehicle log collection server.

[0017] As a result, when an abnormality is detected, the vehicle log transmitting device can transmit a vehicle log including log information that has been left (not deleted) based on the storage priority according to the vehicle state to a vehicle log collection server (server). Since log information according to the vehicle state is preferentially left in the electronic control device, log information useful for analysis in the vehicle log collection server is accumulated. Therefore, even if there is a limit to the resources for storing logs, the vehicle log transmitting device can accumulate logs necessary for analysis in the server.

[0018] Also, for example, the abnormality detection unit may further store the abnormality detection time when the abnormality is detected, and the change instruction unit may further send an instruction to change the storage priority to the one or more electronic control devices based on the abnormality detection time.

[0019] This allows the vehicle log transmitting device to transmit an instruction to change the storage priority at a timing corresponding to the time when the abnormality was detected. In other words, even if no abnormality is detected, the vehicle log transmitting device can transmit an instruction to change the storage priority at that timing. Therefore, the vehicle log transmitting device can accumulate (save) log information corresponding to the vehicle state at that timing.

[0020] Also, for example, the change instruction unit may transmit an instruction to change the storage priority to the one or more electronic control devices when a first time has elapsed since the abnormality detection time.

[0021] As a result, even if no abnormality is detected after the abnormality detection time, the vehicle log transmitting device can change the storage priority after the first time has elapsed from the abnormality detection time. Therefore, even if no abnormality is detected, the vehicle log transmitting device can set the storage priority according to the situation at that time, so that useful logs can be accumulated by analyzing the server.

[0022] Also, for example, the change instruction unit may set the changed storage priority based on a communication ID included in an in-vehicle message in the vehicle's in-vehicle network, a process ID of an operating system or application executed on the one or more electronic control units, and the vehicle state.

[0023] This allows the vehicle log transmission device to manage the storage priority of the vehicle logs by checking the IDs included in the vehicle logs, and to identify the necessary vehicle logs. Also, the vehicle log transmission device can set the storage priority in the device itself based on the communication ID, the process ID, and the vehicle state.

[0024] Also, for example, the vehicle state may include a plurality of states of the vehicle, and the change instruction unit may set the changed storage priority for each of the plurality of states based on a degree indicating whether to preferentially retain log information corresponding to the communication ID related to the vehicle state and log information corresponding to the process ID related to the vehicle state.

[0025] This allows the vehicle log transmitting device to determine whether or not to leave a vehicle log based on at least one of the vehicle conditions, such as the driving mode, the Internet connection status, and the status of each vehicle control function, etc. Therefore, the vehicle log transmitting device can set an appropriate storage priority.

[0026] In addition, for example, the change instruction unit may use as the vehicle state a state including at least one of a driving mode indicating whether the vehicle is in automatic driving or manual driving, a driving status indicating whether the vehicle is driving or stopped, an Internet connection status indicating whether the vehicle is connected to the Internet or not connected to the Internet, a first vehicle control function status indicating whether an automatic parking function is ON or OFF, a second vehicle control function status indicating whether a cruise control function is ON or OFF, and a third vehicle control function status indicating whether an emergency brake is ON or OFF.

[0027] This allows the vehicle log transmitting device to set a storage priority according to the vehicle state. For example, in an in-vehicle system, the vehicle log transmitting device can determine whether to leave a vehicle log based on whether important functions related to vehicle body control, such as automatic driving and automatic parking, and functions that are important when an attacker takes over the vehicle, such as the presence or absence of an Internet connection, are enabled. This allows the vehicle log transmitting device to set a more appropriate storage priority.

[0028] Further, for example, the change instruction unit changes the storage priority for a function related to automatic driving to a second priority higher than the first priority when the driving mode is an automatic driving mode, changes the storage priority for the function related to automatic driving to a third priority lower than the first priority when the driving mode is a manual driving mode, changes the storage priority for a function related to a vehicle body control function including a door lock function to a fifth priority lower than the fourth priority when the vehicle is traveling, changes the storage priority for a function related to the vehicle body control function to a sixth priority higher than the fourth priority when the vehicle is stopped, changes the storage priority for a function using an Internet connection to an eighth priority higher than the seventh priority when the Internet is connected, changes the storage priority for a function using the Internet connection to an eighth priority lower than the seventh priority when the Internet is disconnected, and changes the storage priority for a first vehicle control function related to the automatic parking function when an automatic parking function is ON. the storage priority for the first vehicle control function associated with the automatic parking function to a tenth priority higher than the ninth priority, when the automatic parking function is OFF, changing the storage priority for the first vehicle control function associated with the automatic parking function to an eleventh priority lower than the ninth priority when the automatic parking function is OFF, changing the storage priority for the second vehicle control function associated with the cruise control function to a thirteenth priority higher than the twelfth priority when the cruise control function is ON, changing the storage priority for the second vehicle control function associated with the cruise control function to a fourteenth priority lower than the twelfth priority when the cruise control function is OFF, changing the storage priority for the third vehicle control function associated with the emergency braking function to a sixteenth priority higher than the fifteenth priority when the emergency braking function is ON, and changing the storage priority for the third vehicle control function associated with the emergency braking function to an eighteenth priority lower than the fifteenth priority when the emergency braking function is OFF.

[0029] This allows the vehicle log transmission device to set a storage priority according to the vehicle state. For example, when the driving mode is manual driving, the vehicle log transmission device can lower the storage priority of vehicle logs such as camera images related to automatic driving because they are less useful than the accelerator pedal position, steering angle, etc. during manual driving. In addition, the vehicle log transmission device can increase the storage priority of logs of functions related to vehicle body control, such as door lock or door open, when the vehicle is stopped, since there is a higher risk of vehicle theft compared to when the vehicle is running. In addition, the vehicle log transmission device can increase the storage priority of functions that use an Internet connection, such as online software update, when the Internet is connected. In addition, the vehicle log transmission device can increase the storage priority of functions that use an Internet connection, such as online software update, when a specific vehicle control function is ON, since the importance of the function in analysis is higher than when the specific vehicle control function is OFF.

[0030] Also, for example, the abnormality notification unit may further generate an identifier of an abnormality log that corresponds one-to-one with the abnormality log, and transmit the abnormality detection time and the identifier of the abnormality log to the vehicle log collection server, and the vehicle log request response unit may receive the identifier of the abnormality log from the vehicle log collection server, collect log information from the one or more electronic control devices for a certain period before and after the abnormality detection time that corresponds to the identifier of the abnormality log, and transmit the vehicle log including the collected log information to the vehicle log collection server.

[0031] This enables the vehicle log collection server to collect vehicle logs that occurred before and after the abnormality, which are useful for analyzing the abnormality, simply by notifying the vehicle log transmission device of the identifier of the abnormality log.

[0032] Moreover, a vehicle log collection system according to one embodiment of the present disclosure includes the vehicle log transmission device described above, one or more electronic control units mounted on the vehicle, and a vehicle log collection server, wherein each of the one or more electronic control units has a vehicle log priority setting unit that changes the storage priority of the vehicle log in accordance with an instruction to change the storage priority of the vehicle log received from the vehicle log transmission device, a vehicle log deletion unit that deletes log information corresponding to the storage priority from one or more log information included in the vehicle log in accordance with the storage priority of the vehicle log, and a vehicle log request response unit that transmits the vehicle log stored in the electronic control unit to the vehicle log transmission device in accordance with the vehicle log request received from the vehicle log transmission device, and the vehicle log collection server has an abnormality log receiving unit that receives the abnormality log from the vehicle log transmission device, a vehicle log request unit that transmits the vehicle log request to the vehicle log transmission device, and a vehicle log receiving unit that receives the vehicle log based on the vehicle log request from the vehicle log transmission device.

[0033] As a result, in the vehicle log collection system, the vehicle log storage device changes the storage priority of important vehicle logs in a specific vehicle state, so that even if a long period of time passes between the detection of an abnormality and the reception of a vehicle log request, a vehicle log with a high storage priority can be left when the electronic control unit periodically deletes the vehicle logs. Therefore, the vehicle log collection system can store vehicle logs necessary for the analysis of the vehicle log collection server without the electronic control unit using abundant resources, and can provide the vehicle logs to the vehicle log collection server.

[0034] Also, for example, the vehicle log deletion unit may delete log information with a low storage priority when a second time has elapsed or when the capacity of the stored vehicle log is equal to or greater than a certain value.

[0035] This allows the vehicle log deletion unit to continue storing vehicle logs with a high storage priority without exceeding the limit of the memory size held by the electronic control unit.

[0036] Also, for example, when the capacity of the vehicle log after deleting log information with a low storage priority is equal to or greater than the certain value, the vehicle log deletion unit may further delete log information with a higher storage priority in chronological order.

[0037] In this way, when the volume of the stored logs is still large even after deleting logs with low storage priority, the vehicle log deletion unit can continue to hold logs with higher storage priority among the logs with higher storage priority by using the time. The vehicle log deletion unit may delete logs in such a way that, for example, logs close to the abnormality detection time or new logs are preferentially retained.

[0038] Also, for example, the vehicle log deletion unit may delete the transmitted vehicle log after the vehicle log request response unit transmits the vehicle log to the vehicle log transmission device.

[0039] This allows the vehicle log deletion unit to delete vehicle logs that have already been sent to the server, even if they have a high storage priority, thereby enabling unnecessary logs to be deleted and freeing up storage capacity in the electronic control unit.

[0040] Also, for example, the vehicle log collection server may further include a vehicle log request determination unit that determines whether or not the vehicle log request is necessary based on the abnormality log.

[0041] As a result, the vehicle log collection system can reduce communication traffic by determining whether the vehicle log is necessary on the server side, compared to sending the vehicle log every time an abnormality is detected in the vehicle. For example, if the module in which the abnormality log occurred is a safety-related module, the vehicle log collection server can collect only important vehicle logs by requesting the vehicle log.

[0042] Also, for example, the vehicle log request determination unit may determine whether or not the vehicle log request is necessary based on the number of times the abnormality log has been received.

[0043] This allows the vehicle log collection server to send a vehicle log request when, for example, the same abnormal log is sent multiple times from other vehicles, which indicates a high possibility of a specific attack or widespread malware compared to an abnormal log that occurred only once and requires urgent analysis.

[0044] Furthermore, a vehicle log transmission method according to one embodiment of the present disclosure is a vehicle log transmission method for transmitting a vehicle log, which is stored in one or more electronic control devices mounted on a vehicle, to a vehicle log collection server, the vehicle log including one or more log information related to the vehicle, and includes an abnormality detection step of acquiring the vehicle log from the one or more electronic control devices, detecting an abnormality based on the one or more log information included in the acquired vehicle log, and extracting the log information in which the abnormality is detected as an abnormality log; a first transmission step of transmitting the abnormality log to the vehicle log collection server; a second transmission step of transmitting to the one or more electronic control devices a change instruction for a storage priority indicating a priority for retaining the one or more log information included in the vehicle log based on a vehicle state extracted from the vehicle log; and a third transmission step of, upon receiving a vehicle log request requesting the transmission of the vehicle log from the one or more electronic control devices, acquiring the vehicle log including the log information stored based on the storage priority changed by the change instruction, and transmitting the acquired vehicle log to the vehicle log collection server.

[0045] This provides the same effects as the vehicle log transmitting device described above.

[0046] In addition, a storage priority change device according to one embodiment of the present disclosure includes an abnormality detection unit that stores a vehicle log including one or more log information related to a vehicle, acquires the vehicle log from one or more electronic control units installed in the vehicle, detects an abnormality based on the one or more log information included in the acquired vehicle log, and extracts the log information in which the abnormality is detected as an abnormality log, an abnormality notification unit that transmits the abnormality log to a vehicle log collection server, and a change instruction unit that transmits a storage priority change instruction to the one or more electronic control units indicating the priority of keeping the log information for the one or more log information included in the vehicle log based on the vehicle state extracted from the vehicle log.

[0047] In this way, when an abnormality is detected, the storage priority change device transmits a storage priority according to the vehicle state, so that log information useful for analysis in the vehicle log collection server (server) can be left in the electronic control device. Therefore, even if there is a limit to the resources for storing logs, the storage priority change device can accumulate logs necessary for analysis in the server.

[0048] These general or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized as any combination of the system, method, integrated circuit, computer program, or recording medium.

[0049] Hereinafter, a vehicle log transmission device and the like according to the embodiments will be described with reference to the drawings. Each of the embodiments shown here shows a specific example of the present disclosure. Therefore, the numerical values, components, the arrangement and connection form of the components, and the steps and the order of the steps as processing elements shown in the following embodiments are merely examples and do not limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in the independent claims are components that can be added arbitrarily. Furthermore, each figure is a schematic diagram and is not necessarily a precise illustration.

[0050] (Embodiment) [Overall configuration of the vehicle log collection system] FIG. 1 is a diagram showing the overall configuration of a vehicle log collection system according to the present embodiment.

[0051] 1, a vehicle log collection system 1 includes a vehicle log transmission device 10 and a vehicle log collection server 20, and the vehicle log transmission device 10 and the vehicle log collection server 20 are communicatively connected to each other via an external network such as the Internet. The vehicle log transmission device 10 is mounted on, for example, a vehicle 10a. In addition, the vehicle log hereinafter includes one or more pieces of log information related to the vehicle 10a.

[0052] The vehicle log transmission device 10 is connected to an in-vehicle network, acquires vehicle logs from devices connected to the in-vehicle network, and detects abnormalities that are security threats from the vehicle logs. The vehicle log transmission device 10 then transmits an abnormality log, which is a portion of the vehicle log where an abnormality has been detected, to the vehicle log collection server 20, and transmits the vehicle log in response to a request (vehicle log request) from the vehicle log collection server 20. Details of the vehicle log and the abnormality log will be described later. The abnormality log includes at least one piece of log information. The request includes a request to transmit a vehicle log used for analyzing the abnormality log. The portion where an abnormality has been detected is an example of log information where an abnormality has been detected.

[0053] The vehicle log collection server 20 is a server that receives abnormality logs and vehicle logs from the vehicle log transmission device 10 and is used for the purpose of providing the logs to the security incident response team at the security operation center in order to analyze the cause of the abnormality.

[0054] [Vehicle log transmission device configuration diagram] FIG. 2 is a configuration diagram of the vehicle log transmitting device 10 in this embodiment.

[0055] 2, the vehicle log transmission device 10 includes a central ECU 300, an abnormality detection device 400, a ZoneECU 500a, a ZoneECU 500b, a ZoneECU 500c, a ZoneECU 500d, a car navigation ECU 600a, a brake ECU 600b, a steering ECU 600c, and a body ECU 600d. The central ECU 300, the ZoneECU 500a, the ZoneECU 500b, the ZoneECU 500c, and the ZoneECU 500d are connected via an Ethernet (registered trademark, the same applies below) 11, which is an in-vehicle network. The car navigation ECU 600a and the ZoneECU 500a are connected via an Ethernet 12, and the brake ECU 600b and the ZoneECU 500b are connected via an Ethernet 13. The steering ECU 600c and the Zone ECU 500c are connected via a CAN 14, and the body ECU 600d and the Zone ECU 500d are connected via a CAN-FD 15. The central ECU 300 and the abnormality detection device 400 are also connected to an external network. In the following, the Zone ECUs 500a to 500d are also referred to as an ECU group 500a. Each of the Zone ECUs 500a to 500d stores a vehicle log including log information corresponding to the Zone ECU. For example, the vehicle logs in the Zone ECUs 500a to 500d include different log information from each other.

[0056] In FIG. 2, the vehicle log transmission device 10 is illustrated as an example including each ECU, etc., but it is sufficient if the vehicle log transmission device 10 includes at least the abnormality detection device 400. In the following, an example in which the vehicle log transmission device 10 is realized by the abnormality detection device 400 will be described. That is, in this embodiment, the vehicle log collection system 1 can also be said to include the vehicle log transmission device 10, the ECU group 500a, and the vehicle log collection server 20. In addition, in this embodiment, the vehicle log collection system 1 includes the vehicle log transmission device 10 and the ECU group 500a mounted on the vehicle 10a and connected to an in-vehicle network. The vehicle log collection system 1 includes one or more vehicles 10a equipped with the vehicle log transmission device 10 and the ECU group 500a. The vehicle log collection system 1 includes, for example, a plurality of the vehicles 10a.

[0057] The vehicle log transmitting device 10 transmits a vehicle log including one or more pieces of log information related to the vehicle 10a, which is stored in an ECU group 500a (an example of one or more electronic control devices) mounted on the vehicle 10a, to the vehicle log collecting server 20. The vehicle log transmitting device 10 collects vehicle logs stored in the central ECU 300 and the ECU group 500a via the Ethernet 11, and detects abnormalities from the vehicle logs. If an abnormality is detected, the vehicle log transmitting device 10 transmits the abnormality log to the vehicle log collecting server 20 via an external network. Furthermore, when the vehicle log transmitting device 10 receives a request (vehicle log request) to transmit a vehicle log corresponding to the abnormality log from the vehicle log collecting server 20, the vehicle log transmitting device 10 acquires the vehicle log from the central ECU 300 and the ECU group 500a, and transmits it to the vehicle log collecting server 20.

[0058] The central ECU 300 is connected to the abnormality detection device 400 and the ECU group 500a via Ethernet 11. The central ECU 300 controls the ECU group 500a and controls the entire vehicle system. The central ECU 300 controls vehicle control functions such as automatic parking and automatic driving.

[0059] The abnormality detection device 400 is connected to the central ECU 300 and the ECU group 500a via the Ethernet 11. The abnormality detection device 400 acquires a vehicle log from the ECU group 500a, and detects an abnormality that is a security threat to the vehicle 10a based on one or more pieces of log information included in the acquired vehicle log. When an abnormality is detected, the abnormality detection device 400 extracts log information in which the abnormality is detected as an abnormality log. When an abnormality is detected, the abnormality detection device 400 notifies the ECU group 500a of the vehicle log to be preferentially stored. When a vehicle log request is received from the vehicle log collection server 20, the abnormality detection device 400 collects the vehicle log from the ECU group 500a and transmits it to the vehicle log collection server 20.

[0060] Each of the ZoneECU500a, ZoneECU500b, ZoneECU500c, and ZoneECU500d communicates with the central ECU300 and other ZoneECUs via the Ethernet 11. The ZoneECU500a communicates with the car navigation ECU600a via the Ethernet 12 and controls the display of the car navigation. The ZoneECU500b communicates with the brake ECU600b via the Ethernet 13 and controls the brakes. The ZoneECU500c communicates with the steering ECU600c via the CAN 14 and controls the steering of the steering wheel. The ZoneECU500d communicates with the body ECU600d via the CAN-FD 15 and controls functions related to the vehicle body of the vehicle 10a, such as the lock or wipers.

[0061] The car navigation ECU 600a is an ECU that controls the display of the car navigation system installed in the vehicle 10a. The brake ECU 600b is an ECU that controls the brakes installed in the vehicle 10a. The steering ECU 600c is an ECU that controls the steering of the steering wheel installed in the vehicle 10a. The body ECU 600d is an ECU that controls functions related to the vehicle body, such as the locks and wipers, installed in the vehicle 10a.

[0062] [Configuration of the anomaly detection device] 3 is a configuration diagram of an abnormality detection device 400 in this embodiment. In this embodiment, FIG. 3 is also a configuration diagram of a vehicle log transmission device 10.

[0063] 3, abnormality detection device 400 includes an internal network communication unit 410, an abnormality detection unit 420, an abnormality log storage unit 430, a vehicle state extraction unit 440, a vehicle log storage priority change instruction unit 450, a related vehicle log list storage unit 460, an abnormality log notification unit 470, a vehicle log request response unit 480, and an external network communication unit 490. The abnormality detection unit 420, the vehicle log storage priority change instruction unit 450, and the abnormality log notification unit 470 configure a storage priority change device.

[0064] The internal network communication unit 410 has a function of communicating with the ECU group 500a via the Ethernet 11. The internal network communication unit 410 includes, for example, a communication circuit (communication module).

[0065] The abnormality detection unit 420 has a function of collecting vehicle logs from the ECU group 500a, detecting an abnormality that is a security threat based on one or more pieces of log information included in the acquired vehicle logs, extracting log information at which the abnormality is detected from the vehicle logs as an abnormality log, and storing the log information in the abnormality log storage unit 430. Here, the vehicle log is a log that includes at least one of the log (log information) of the operating system of the ECU group 500a, the log (log information) of the application, and the communication log (log information) of the in-vehicle network. The communication log is a log that includes at least one of the in-vehicle networks Ethernet 11, Ethernet 12, Ethernet 13, CAN 14, and CAN-FD 15.

[0066] The abnormality detection unit 420 may further detect an abnormality detection time, which is the time when the abnormality was detected, and store the detected abnormality in the abnormality log storage unit 430 .

[0067] The error log storage unit 430 has a function of storing logs detected by the error detection unit 420. The error log storage unit 430 is realized by a semiconductor memory or the like, but is not limited to this.

[0068] The vehicle state extraction unit 440 has a function of collecting a vehicle log from the ECU group 500a and extracting a vehicle state from the vehicle log. Here, the vehicle state includes a plurality of states of the vehicle 10a (see FIG. 9 described later). The vehicle state includes at least one of the driving mode, driving status, Internet connection status, and vehicle control function status (for example, the status of the automatic driving function, the status of the cruise control function, and the status of the emergency brake) of the vehicle 10a. The driving mode indicates a mode in the current driving of the vehicle 10a, and includes whether the vehicle 10a is in automatic driving (automatic driving mode) or in manual driving (manual driving mode). The driving mode may also include whether the vehicle 10a is remotely controlled (remote control mode). The driving status includes whether the vehicle 10a is driving or stopped. The Internet connection status includes whether the vehicle is connected to the Internet or not. The status of the automatic driving function includes whether the automatic parking function is ON or OFF. The status of the cruise control function includes whether the cruise control function (CC function) is ON or OFF. The emergency brake status includes whether the emergency brake is ON or OFF.

[0069] In addition, the status of the autonomous driving function is an example of a first vehicle control function status, the status of the cruise control function is an example of a second vehicle control function status, and the status of the emergency braking is an example of a third vehicle control function status.

[0070] The vehicle log storage priority change instruction unit 450 has a function of acquiring a vehicle state from the vehicle state extraction unit 440, acquiring a related vehicle log list, which is a list of IDs of vehicle logs prioritized for each vehicle state stored in the related vehicle log list storage unit 460, and notifying (transmitting) the ECU group 500a. The vehicle log storage priority change instruction unit 450 transmits a change instruction of the storage priority indicating the priority of leaving the log information in one or more log information included in the vehicle log based on the vehicle state extracted from the vehicle log to the ECU group 500a. The storage priority can also be said to be, for example, the priority of leaving the log information. When the abnormality detection unit 420 detects the abnormality detection time, the vehicle log storage priority change instruction unit 450 may further transmit a change instruction of the storage priority to the ECU group 500a based on the abnormality detection time. Details of the related vehicle log list and a method of changing the vehicle log storage priority will be described later. The vehicle log storage priority change instruction unit 450 is an example of a change instruction unit.

[0071] The related vehicle log list storage unit 460 has a function of storing a related vehicle log list. The related vehicle log list storage unit 460 is realized by a semiconductor memory or the like, but is not limited to this.

[0072] The abnormality log notification unit 470 has a function of transmitting an abnormality log detected by the abnormality detection unit 420 to the vehicle log collection server 20. The abnormality log notification unit 470 is an example of an abnormality notification unit.

[0073] The vehicle log request response unit 480 has a function of collecting the vehicle logs from the ECU group 500a and transmitting the vehicle logs to the vehicle log collection server 20 when the vehicle log request is received from the vehicle log collection server 20 via the external network communication unit 490. When the vehicle log request response unit 480 receives a vehicle log request for a vehicle log from the vehicle log collection server 20, it can also be said that the vehicle log response unit 480 acquires the vehicle log including log information stored based on the storage priority changed by the change instruction from the ECU group 500a, and transmits the acquired vehicle log to the vehicle log collection server 20. The acquired vehicle log is, for example, log information stored based on the change instruction for the storage priority.

[0074] The external network communication unit 490 has a function of communicating with the vehicle log collection server 20 via an external network. The external network communication unit 490 includes, for example, a communication circuit (communication module).

[0075] [ZoneECU configuration diagram] FIG. 4 is a configuration diagram of Zone ECU 500a in this embodiment.

[0076] 4, ZoneECU 500a includes an internal network communication unit 510, a vehicle log priority setting unit 520, a vehicle log storage unit 530, a vehicle log deletion unit 540, a vehicle log request response unit 550, and an ECU communication unit 560.

[0077] The internal network communication unit 510 has a function of communicating with the abnormality detection device 400 and the ECU group 500a via the Ethernet 11. The internal network communication unit 510 is configured to include, for example, a communication circuit (communication module).

[0078] The vehicle log priority setting unit 520 has a function of receiving a vehicle log priority change instruction transmitted by the abnormality detection device 400, and changing the priority setting of the vehicle log according to the instruction.

[0079] The vehicle log storage unit 530 has a function of storing a vehicle log. The vehicle log storage unit 530 is realized by a semiconductor memory or the like, but is not limited to this.

[0080] The vehicle log deletion unit 540 has a function of deleting the vehicle log periodically or when the amount of stored data of the vehicle log reaches an upper limit. For example, the vehicle log deletion unit 540 deletes log information according to the storage priority of the vehicle log from one or more pieces of log information included in the vehicle log. Note that the log information deleted here is, for example, log information that has not been transmitted to the vehicle log collection server 20. In addition, the vehicle log deletion unit 540 may delete the transmitted vehicle log after the vehicle log request response unit 550 transmits the vehicle log to the vehicle log transmission device 10. Details of the method of deleting the vehicle log will be described later.

[0081] The vehicle log request response unit 550 has a function of receiving a vehicle log request transmitted by the abnormality detection device 400, and transmitting (responding to) the vehicle log stored in the vehicle log storage unit 530 to the abnormality detection device 400. It can also be said that the vehicle log request response unit 550 transmits the vehicle log stored in the vehicle log storage unit 530 to the vehicle log transmission device 10 in response to the vehicle log request received from the vehicle log transmission device 10.

[0082] ECU communication unit 560 has a function of communicating with car-navigation ECU 600a via Ethernet 12. ECU communication unit 560 is configured to include, for example, a communication circuit (communication module).

[0083] 4. The ZoneECU500b to 500d and the central ECU300 may have the same configuration as that shown in FIG. 4. The ZoneECU500b has an ECU communication unit 560 connected to the brake ECU600b, the ZoneECU500c has an ECU communication unit 560 connected to the steering ECU600c, and the ZoneECU500d has an ECU communication unit 560 connected to the body ECU600d. The central ECU300 has an ECU control unit instead of the ECU communication unit 560, and controls the ECU group 500a to control the entire vehicle system, thereby achieving vehicle control functions such as automatic driving, automatic parking, and cruise control. The central ECU300 has an external network communication unit and has a function of mediating the Internet connection of the car navigation ECU600a.

[0084] [Vehicle log collection server configuration diagram] FIG. 5 is a configuration diagram of the vehicle log collection server 20 in this embodiment.

[0085] In FIG. 5, the vehicle log collection server 20 has an external network communication unit 210, an abnormality log receiving unit 220, an abnormality log storage unit 230, a vehicle log necessity determination unit 240, a vehicle log request unit 250, a vehicle log storage unit 260, and a log providing unit 270.

[0086] The external network communication unit 210 has a function of communicating with the vehicle log transmitting device 10 via an external network. The external network communication unit 210 includes, for example, a communication circuit (communication module).

[0087] The abnormality log receiving unit 220 has a function of receiving an abnormality log from the abnormality detection device 400. It can also be said that the abnormality log receiving unit 220 receives a vehicle log in response to a vehicle log request from the vehicle log transmitting device 10. In this embodiment, the abnormality log receiving unit 220 further has a function of receiving a vehicle log based on the vehicle log request from the abnormality detection device 400. In other words, the abnormality log receiving unit 220 also functions as a vehicle log receiving unit.

[0088] The error log storage unit 230 has a function of storing the error log received by the error log receiving unit 220. The error log storage unit 230 is realized by a semiconductor memory or the like, but is not limited to this.

[0089] The vehicle log necessity determination unit 240 has a function of determining whether or not a vehicle log is necessary based on the abnormality log stored in the abnormality log storage unit 230. The vehicle log necessity determination unit 240 may determine whether or not a vehicle log is necessary, for example, according to the number of times an abnormality log is received. The vehicle log necessity determination unit 240 may determine whether or not a vehicle log is necessary, for example, according to the number of times the same type of abnormality log is received. The same type of abnormality log may be a log indicating an abnormality related to the same process ID or communication ID, or may be an abnormality in the same device. The method for determining whether or not a vehicle log is necessary will be described in detail later.

[0090] The vehicle log request unit 250 has a function of transmitting a vehicle log request to the abnormality detection device 400 and receiving the vehicle log when the vehicle log necessity determination unit 240 determines that a vehicle log is necessary. It can also be said that the vehicle log request unit 250 transmits a vehicle log request to the vehicle log transmission device 10.

[0091] The vehicle log storage unit 260 has a function of storing the vehicle log received by the vehicle log request unit 250. The vehicle log storage unit 260 is realized by a semiconductor memory or the like, but is not limited to this.

[0092] The log providing unit 270 has a function of providing the abnormal log stored in the abnormal log storage unit 230 and the vehicle log stored in the vehicle log storage unit 260 to a user of the vehicle log collection server 20. For example, the user is a member of a security incident response team of a security operation center that uses the vehicle log collection server 20. For example, the method of providing the logs includes, but is not limited to, downloading the logs and visualizing and displaying them using a graphical interface. The log providing unit 270 is configured by a display device, an audio output device, and the like.

[0093] [An example of a vehicle log in an in-vehicle network] 6 is a diagram showing an example of a vehicle log of an in-vehicle network in this embodiment. The vehicle log is classified into a vehicle log in the in-vehicle network and a vehicle log in the ECU. The vehicle log in the ECU will be described later with reference to FIG. 7.

[0094] In Fig. 6, the vehicle log in the in-vehicle network is a log of communication messages flowing on the in-vehicle network, and the log of one communication message includes a communication ID, a time, and payload data (also referred to as data). The communication ID is an identifier that indicates the type of the communication message. The payload data is a hexadecimal value, and the contents can be read by referring to a definition that is predefined for each communication ID.

[0095] For example, it can be seen that a communication message with a communication ID of "M1" was sent at time "T11." Furthermore, a communication message with a communication ID of "M1" contains information indicating the Internet connection status in the third byte of the payload data. For example, if the third byte of the payload data is "00," it can be determined that it is "OFF," indicating that there is no Internet connection, and if it is "01," it can be determined that it is "ON," indicating that there is an Internet connection.

[0096] Similarly, the driving speed can be read from the payload data in the third and fourth bytes of the communication message with the communication ID "M2." For example, if the speed is faster than 0 km / h, it can be determined that the vehicle is moving, and if the time is 0 km, it can be determined that the vehicle is stopped. Also, the fifth byte of payload data can be used to read whether or not an emergency brake command is issued.

[0097] Similarly, the door lock state can be read from the communication message with the communication ID "M3", and the driving mode, vehicle control function, steering instruction, and steering instruction angle can be read from the communication message with the communication ID "M4". Here, the vehicle control function CC indicates the cruise control mode, which is a mode in which the vehicle 10a automatically drives by following the vehicle ahead. In this way, the current vehicle state can be grasped by using the vehicle log. Note that the communication message is an example of an in-vehicle message.

[0098] The vehicle log in the in-vehicle network can be used to detect security anomalies. For example, the steering instruction angle with the communication ID "M4" is used to mechanically move the steering wheel when the driving mode is automatic driving or the vehicle control function is automatic parking. The communication message with the communication ID "M4" is received by the steering ECU 600c via the Zone ECU 500c. Then, when the steering instruction is ON, the steering ECU 600c operates the steering wheel according to the steering instruction angle. However, if a malicious attacker illegally transmits a communication message in which the steering instruction angle has been rewritten to an abnormal value onto the in-vehicle network while the steering instruction is ON, there is a risk that a dangerous steering operation unintended by the control side will be performed. In order to detect such an attack as an anomaly, the anomaly detection device 400 monitors the communication message with the communication ID "M4" and monitors the difference between the steering instruction angles included in two consecutive communication messages. If the difference is equal to or greater than a predetermined value, there is a possibility that the rewriting has been performed by an attack, and therefore the anomaly is detected. For example, when the steering instruction angle suddenly changes from 0 degrees to 90 degrees, the anomaly detection device 400 detects this as an anomaly since there is a possibility that rewriting has been performed as an attack.

[0099] Furthermore, the vehicle log in the in-vehicle network can be used to analyze the cause of the abnormality. The vehicle log in the in-vehicle network is used, for example, by a security incident response team in a security operation center. For example, when a communication message before and after the occurrence of the abnormality is a communication message with a communication ID of "M4", the vehicle log collection server 20 can obtain the time when the abnormality occurred from the log of the communication message, and can obtain the vehicle state at the time of the abnormality detection from the communication message with the communication ID of "M1", "M2", or "M3" immediately before the occurrence of the abnormality. Then, for example, when the driving state at the time of the abnormality detection is while the vehicle is driving and the Internet connection state is OFF, the security incident response team can infer the cause that it is highly likely that the device was physically attached to the vehicle 10a by the attacker before the vehicle 10a was driven, or that the device was highly likely to have been rewritten, since it is difficult for an attacker to be near the vehicle 10a while the vehicle is driving, and an attack via the Internet is also difficult.

[0100] The abnormality detection device 400 may obtain the vehicle state at the time of abnormality detection by using the log of the communication message with the communication ID "M4" before and after the occurrence of the abnormality. Also, the set of the time and the payload data for each communication ID is an example of the log information.

[0101] [Example of vehicle log in ECU] FIG. 7 is a diagram showing an example of a vehicle log in the ECU in this embodiment.

[0102] 7, the vehicle log in the ECU is a system log output by the operating system or application process of the ECU, and one system log includes a process ID, a time, an ECU name, and data. The vehicle log is stored in the ZoneECU or an ECU connected to the ZoneECU.

[0103] The process ID is an identifier for the process that output the log, and the ECU name is the name of the ECU on which the process that output the log is running. The data describes the start, result, end, etc. of the process operation. For example, a system log with a process ID of "P1" is a process executed on the car navigation ECU 600a at time "T21", and the data describes that an attempt to connect to the Internet failed. Also, for example, a system log with a process ID of "P5" is a process executed on the body ECU 600d at time "T25", and the data describes that a secure boot was executed and was successful.

[0104] The vehicle log in the ECU can be used to detect security abnormalities. For example, the abnormality detection device 400 monitors the process log with the process ID "P7" and, when a secure boot failure is confirmed, detects an abnormality that may indicate that unauthorized software rewriting has been performed on the central ECU 300.

[0105] The vehicle log in the ECU can be used to analyze the cause of the abnormality. The vehicle log in the ECU is used, for example, by a security incident response team of a security operation center. For example, the vehicle log collection server 20 can obtain the time when the secure boot failure was confirmed from the vehicle log with the process IDs "P1", "P2", "P6", and "P7", and can obtain that immediately before that, the car navigation ECU 600a logged in to the central ECU 300 and that the software update was performed even though the car navigation ECU 600a was not connected to the network. Then, the security incident response team can infer the cause that it is highly likely that the car navigation ECU 600a installed unauthorized software in the car navigation ECU 600a and attempted to tamper with the software of the central ECU 300 via the car navigation ECU 600a, but an abnormality was detected in the secure boot.

[0106] Note that the set of time, ECU name, and data for each process ID is an example of log information.

[0107] [Example of an error log] 8 is a diagram showing an example of an abnormality log in this embodiment. The abnormality log is a log (log information) extracted from the vehicle log by abnormality detection unit 420 of abnormality detection device 400 as being abnormal.

[0108] 8, the abnormality log includes an abnormality identifier, an abnormality detection time, a log type, a log ID, and data. The abnormality identifier is an identifier that corresponds one-to-one with one abnormality log, and for example, a log type, a log ID, and a hash value of the data of the abnormality log are used. The abnormality detection time is described with reference to the time of the vehicle log at which the abnormality was detected by the abnormality detection device 400. The log type is described as "vehicle network" if the log at which the abnormality was detected is a vehicle log in an in-vehicle network, and as "ECU" if the log at which the abnormality was detected is a vehicle log in an ECU. The data is stored as payload data of a communication message in the case of a vehicle log in an in-vehicle network, and as system log data in the case of a vehicle log in an ECU.

[0109] For example, an abnormality log with an abnormality identifier "A1" has an abnormality detection time of "T14", a log type of "vehicle network", a log ID of "M4", and data of "00 01 00 01 FF 00 00 00". Also, for example, an abnormality log with an abnormality identifier "A2" has an abnormality detection time of "T26", a log type of "ECU", a log ID of "P7", and data of "secure boot failure". In other words, by referring to the data of the abnormality log, it is possible to know when, where, and what kind of abnormality occurred. However, it is difficult to know the cause of the abnormality from only the abnormality log, and vehicle logs other than the abnormality log are also required.

[0110] [Example of related vehicle log list] 9 is a diagram showing an example of a related vehicle log list in this embodiment. The abnormality detection device 400 acquires and stores in advance, for example, the related vehicle log list shown in FIG.

[0111] 9, the related vehicle log list includes a vehicle state, a related communication ID, a related process ID, a vehicle state at the time of abnormality detection, and a storage priority. The vehicle state is an item of the vehicle state extracted from the vehicle log, and the related communication ID and related process ID are a communication ID and a process ID that are highly related to the vehicle state item that are determined in advance for each item of the vehicle state. The vehicle state at the time of abnormality detection indicates the vehicle state when the abnormality detection device 400 detects the abnormality log, and the storage priority is a priority that indicates whether the vehicle log of the related communication ID and related process ID is to be saved with priority, and "high" is recorded when the storage priority is high, and "low" is recorded when the storage priority is low.

[0112] For example, in the related vehicle log list in which the vehicle state is "driving mode", the related communication IDs are "M2, M4" and the related process IDs are "P3, P4, P7". If the vehicle state at the time of abnormality detection is "automatic driving", the storage priority is "high", and if the vehicle state at the time of abnormality detection is "manual driving", the storage priority is "low". It can be said that the storage priority is "high" indicates that the log is of high importance related to the vehicle state at the time of abnormality detection (log of high importance in analyzing the cause of the abnormality), and the storage priority is "low" indicates that the log is of low importance related to the vehicle state at the time of abnormality detection (log of low importance in analyzing the cause of the abnormality). By referring to the related vehicle log list, it is possible to grasp the communication messages and process logs of high importance related to the vehicle state at the time of abnormality detection, and these logs are likely to be useful in analyzing the cause of the abnormality.

[0113] The vehicle log storage priority change instruction unit 450 sets the changed storage priority based on the related vehicle log list shown in Fig. 9. The vehicle log storage priority change instruction unit 450 sets the changed storage priority based on, for example, a communication ID included in an in-vehicle message in the in-vehicle network of the vehicle 10a, a process ID of an operating system or an application executed on the ECU group 500a, and a vehicle state (for example, a vehicle state at the time of abnormality detection). The vehicle log storage priority change instruction unit 450 sets the changed storage priority based on, for example, a degree (storage priority) indicating whether log information corresponding to a communication ID related to the vehicle state and log information corresponding to a process ID related to the vehicle state are to be preferentially saved for each vehicle state item.

[0114] [An example of vehicle log storage priority setting] FIG. 10 is a diagram showing an example of vehicle log storage priority settings in this embodiment.

[0115] In FIG. 10, the vehicle log storage priority setting includes a log ID, a storage priority, and a priority setting time. The log ID indicates a communication ID or a process ID included in the vehicle log. The storage priority indicates the priority for storing the vehicle log, and is set to one of "high," "medium," or "low" in descending order of priority. For example, "medium" is set in the initial state. A vehicle log (log information) with a log ID having a low storage priority is preferentially deleted when the vehicle log is deleted in the ECU group 500a. The priority setting time indicates the time when the storage priority was changed for the log ID, and if the storage priority has not been changed, "-" is set.

[0116] For example, the vehicle log storage priority setting for a log ID of "M1" is a storage priority of "low" and the priority setting time is "T40". In other words, it can be seen that the storage priority of the vehicle log with log ID of "M1" was changed to "low" at time T40. Also, for example, the vehicle log storage priority setting for a log ID of "M3" is a storage priority of "medium" and the priority setting time is "-". In other words, it can be seen that the storage priority of the vehicle log with log ID of M3 has not been changed from the initial state. Also, for example, the vehicle log storage priority setting for a log ID of "P7" is a storage priority of "high" and the priority setting time is "T41". In other words, it can be seen that the storage priority of the vehicle log with log ID of "P7" was changed to "high" at time T41.

[0117] By referring to the vehicle log storage priority setting, it is possible to prioritize saving (accumulating without deleting) logs required for analyzing the cause of an abnormality.

[0118] [Processing sequence] 11 is a diagram showing the sequence of an abnormality log notification process (part of a vehicle log transmission method) in this embodiment. FIG. 11 shows a processing sequence from when the vehicle log transmission device 10 detects an abnormality from the vehicle log to when it transmits the abnormality log to the vehicle log collection server 20.

[0119] (S1101) The abnormality detection unit 420 of the abnormality detection device 400 acquires vehicle logs from each of the ECU group 500a via the internal network and detects an abnormality. That is, the abnormality detection unit 420 judges the presence or absence of an abnormality based on one or more pieces of log information included in the acquired vehicle log. Then, when the abnormality detection unit 420 detects an abnormality, it extracts the log information in which the abnormality is detected as an abnormality log, stores the extracted abnormality log in the abnormality log storage unit 430, and transmits the abnormality detection time and the vehicle log (log information) to the vehicle state extraction unit 440. An example of an abnormality detection method is described in an example of a vehicle log in an in-vehicle network (FIG. 6) and an example of a vehicle log in an ECU (FIG. 7). In addition, the abnormality detection unit 420 may store the abnormality log shown in FIG. 8 in the abnormality log storage unit 430 and transmit it to the vehicle state extraction unit 440. Step S1101 is an example of an abnormality detection step and a first transmission step.

[0120] (S1102) Vehicle state extraction unit 440 receives the vehicle log of step S1101 and extracts the vehicle state at the abnormality detection time. For example, vehicle state extraction unit 440 extracts the vehicle state at the abnormality detection time from the vehicle log (log information) excluding the vehicle log (log information) in which the abnormality was detected in step S1101. Then, vehicle state extraction unit 440 transmits the vehicle state to vehicle log storage priority change instruction unit 450. An example of a method for extracting the vehicle state is described in an example of a vehicle log in an in-vehicle network (FIG. 6).

[0121] (S1103) The vehicle log storage priority change instruction unit 450 refers to the related vehicle log list held in the related vehicle log list storage unit 460, and identifies vehicle logs (log information) whose storage priorities need to be changed.

[0122] (S1104) The vehicle log storage priority change instruction unit 450 transmits an instruction to change the storage priority of the vehicle log identified in step S1103 to the ECU group 500a. The vehicle log storage priority change instruction unit 450 transmits, for example, an instruction to change to a common storage priority to each of the multiple Zone ECUs 500a to 500d included in the ECU group 500a. That is, the storage priority of the vehicle log changed by the change instruction is the same for each of the multiple Zone ECUs 500a to 500d. Note that the vehicle log storage priority change instruction unit 450 may transmit, for example, an instruction to change to a storage priority different from each other to each of the multiple Zone ECUs 500a to 500d. Step S1104 is an example of a second transmission step.

[0123] In addition, the vehicle log save priority change instruction unit 450 may transmit an instruction to change the save priority to the ECU group 500a when a first time has elapsed since the abnormality detection time in step S1104. In other words, the vehicle log save priority change instruction unit 450 may transmit an instruction to change the save priority to the ECU group 500a even if no other abnormality has been detected since the previous detection of the abnormality until now.

[0124] (S1105) The ECU group 500a changes the priority setting of the vehicle log. The method of changing the priority setting of the vehicle log will be described later.

[0125] (S1106) Abnormality log notification unit 470 receives the abnormality log from abnormality detection unit 420, and transmits the abnormality log to vehicle log collection server 20. Abnormality log notification unit 470 may further generate an identifier of the abnormality log that has one-to-one correspondence with the abnormality log, and transmit the abnormality detection time and the identifier of the abnormality log to vehicle log collection server 20.

[0126] (S1107) The vehicle log collection server 20 receives the abnormality log and stores it in the abnormality log storage unit 230.

[0127] [Vehicle log request processing sequence] Fig. 12 is a diagram showing a vehicle log request response processing sequence (part of a vehicle log transmission method) in this embodiment. Fig. 12 shows a processing sequence from when the vehicle log collection server 20 receives an abnormality log, to when it requests a vehicle log from the vehicle log transmission device 10 (in this embodiment, the abnormality detection device 400) and receives a response (the vehicle log from the abnormality detection device 400).

[0128] (S1201) The vehicle log collection server 20 determines whether or not an abnormality log has been received a certain number of times or more. The vehicle log collection server 20 receives the abnormality log in step S1107 and stores it in the abnormality log storage unit 230. The vehicle log collection server 20 may determine whether or not an abnormality log identical to the stored abnormality log has been received a certain number of times or more. Here, if the vehicle log necessity determination unit 240 determines that a vehicle log is necessary, it requests the vehicle log request response unit 480 of the vehicle log collection server 20 to send a vehicle log. The method of determining whether or not a vehicle log is necessary will be described in detail later.

[0129] (S1202) When the vehicle log necessity determination unit 240 has received the abnormality log a certain number of times or more, the vehicle log necessity determination unit 240 requests the vehicle log request response unit 480 to transmit a vehicle log. That is, the vehicle log necessity determination unit 240 transmits a vehicle log request. The vehicle log necessity determination unit 240 may transmit, for example, a vehicle log request including an identifier of the abnormality log to the vehicle log request response unit 480.

[0130] (S1203) The vehicle log request response unit 480 receives the vehicle log request of step S1202. The vehicle log request response unit 480 receives the vehicle log request including the identifier of the abnormality log from the vehicle log collection server 20, for example.

[0131] (S1204) Vehicle log request response unit 480 refers to abnormality log storage unit 430, and requests vehicle logs for one hour before and after the abnormality detection time corresponding to the identifier of the abnormality log from vehicle log request response unit 550 of ECU group 500a. Here, the one hour before and after is a predetermined value and does not have to be one hour.

[0132] (S1205) The vehicle log request response unit 550 of the ECU group 500a receives the vehicle log request of step S1205.

[0133] (S1206) Vehicle log request response unit 550 of ECU group 500a responds (transmits) vehicle logs for one hour before and after the abnormality detection time to vehicle log request response unit 480. After vehicle log request response unit 550 transmits the vehicle log to vehicle log request response unit 480 in step S1206, vehicle log deletion unit 540 may delete the transmitted vehicle log.

[0134] (S1207) The vehicle log request response unit 480 receives the vehicle log of step S1206 from the ECU group 500a.

[0135] (S1208) The vehicle log request response unit 480 responds (transmits) the vehicle log to the vehicle log collection server 20. It can also be said that the vehicle log request response unit 480 collects log information from the ECU group 500a for a certain period before and after the abnormality detection time corresponding to the identifier of the abnormality log, and transmits a vehicle log including the collected log information to the vehicle log collection server 20. Step S1208 is an example of a third transmission step.

[0136] (S1209) The vehicle log collection server 20 receives the vehicle log of step S1208.

[0137] This allows the vehicle log collection server 20 to acquire, from the abnormality detection device 400, vehicle logs required for monitoring or analyzing an abnormality.

[0138] [Flowchart of vehicle log storage priority change process] 13 is a flowchart of the vehicle log storage priority change process (part of the vehicle log transmission method) in this embodiment.

[0139] (S1301) Abnormality detection unit 420 extracts an abnormality log from the vehicle log. Then, vehicle state extraction unit 440 refers to the abnormality detection time included in the abnormality log and extracts the vehicle state at the abnormality detection time. Then, step S1302 is performed.

[0140] (S1302) Vehicle log storage priority change instruction unit 450 determines whether the driving mode of the vehicle state is autonomous driving or not. If the driving mode is autonomous driving (Yes in S1302), vehicle log storage priority change instruction unit 450 performs step S1303, and if the driving mode is manual driving (No in S1302), performs step S1304.

[0141] (S1303) The vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the autonomous driving function among the vehicle logs to "high" and executes step S1305. For example, the vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the log of the autonomous driving function to "high" regardless of the storage priority immediately before the processing of step S1303.

[0142] (S1304) The vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the autonomous driving function among the vehicle logs to "low" and executes step S1305. For example, the vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the log of the autonomous driving function to "low" regardless of the storage priority immediately before the processing of step S1304.

[0143] In this way, in steps S1302 to S1304, the vehicle log storage priority change instruction unit 450 can be said to change the storage priority for functions related to autonomous driving to a second priority higher than the first priority when the driving mode is an autonomous driving mode, and to change the storage priority for functions related to autonomous driving to a third priority lower than the first priority when the driving mode is a manual driving mode.

[0144] (S1305) Vehicle log storage priority change instruction unit 450 determines whether the vehicle is stopped among the vehicle states. If the vehicle is stopped (Yes in S1305), vehicle log storage priority change instruction unit 450 performs step S1306, and if the vehicle is moving (No in S1305), it performs step S1307.

[0145] (S1306) Vehicle log storage priority change instruction unit 450 changes the storage priority of the door lock function among the vehicle logs to "high" and executes step S1308. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the door lock function to "high" regardless of the storage priority immediately before the processing of step S1306, for example.

[0146] (S1307) Vehicle log storage priority change instruction unit 450 changes the storage priority of the door lock function among the vehicle logs to "low" and executes step S1308. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the door lock function to "low" regardless of the storage priority immediately before the processing of step S1307, for example.

[0147] In this way, in steps S1305 to S1307, the vehicle log storage priority change instruction unit 450 may change the storage priority for functions related to vehicle body control functions, including the door lock function, to a fifth priority lower than the fourth priority when the vehicle 10a is moving, and may change the storage priority for functions related to vehicle body control functions to a sixth priority higher than the fourth priority when the vehicle 10a is stopped.

[0148] (S1308) Vehicle log storage priority change instruction unit 450 determines whether or not the Internet connection status is ON among the vehicle states. If the Internet connection status is ON (Yes in S1308), vehicle log storage priority change instruction unit 450 performs step S1309, and if the Internet connection status is OFF (No in S1308), it performs step S1309.

[0149] (S1309) Vehicle log storage priority change instruction unit 450 changes the storage priority of the logs of the functions that require an Internet connection among the vehicle logs to "high" and executes step S1311. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the logs of the functions that require an Internet connection to "high" regardless of the storage priority immediately before the processing of step S1309, for example.

[0150] (S1310) Vehicle log storage priority change instruction unit 450 changes the storage priority of the logs of the functions that require an Internet connection among the vehicle logs to "low" and executes step S1311. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the logs of the functions that require an Internet connection to "low" regardless of the storage priority immediately before the processing of step S1310, for example.

[0151] In this way, in steps S1308 to S1310, the vehicle log save priority change instruction unit 450 may change the save priority for functions that utilize an Internet connection when the Internet is connected to an eighth priority that is higher than the seventh priority, and may change the save priority for functions that utilize an Internet connection when the Internet is not connected to the eighth priority that is lower than the seventh priority.

[0152] (S1311) The vehicle log storage priority change instruction unit 450 judges whether or not the vehicle control function is ON among the vehicle states. If the vehicle control function is ON (Yes in S1311), the vehicle log storage priority change instruction unit 450 executes step S1312, and if the vehicle control function is OFF (No in S1311), the vehicle log storage priority change instruction unit 450 executes step S1313. Here, for example, in an example of a vehicle log in an in-vehicle network (see FIG. 6), automatic parking and CC are described as vehicle control functions, but if the vehicle control function (automatic parking) is ON, the vehicle log storage priority change instruction unit 450 changes the storage priority of logs related to the vehicle control function (automatic parking) to "high," and if the vehicle control function (CC) is ON, the vehicle log storage priority change instruction unit 450 changes the storage priority of logs related to the vehicle control function (CC) to "high."

[0153] (S1312) Vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the corresponding vehicle control function among the vehicle logs to "high" and ends the process. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the corresponding vehicle control function to "high" regardless of the storage priority immediately before the process of step S1312, for example.

[0154] (S1313) Vehicle log storage priority change instruction unit 450 changes the storage priority of the log of the corresponding vehicle control function among the vehicle logs to "low" and ends the process. Vehicle log storage priority change instruction unit 450 uniformly changes the storage priority of the corresponding vehicle control function to "low" regardless of the storage priority immediately before the process of step S1313, for example.

[0155] In this way, in steps S1311 to S1313, vehicle log storage priority change instruction unit 450 may change the storage priority for a first vehicle control function related to the automatic parking function to a tenth priority higher than the ninth priority when the automatic parking function is ON, and may change the storage priority for the first vehicle control function related to the automatic parking function to an eleventh priority lower than the ninth priority when the automatic parking function is OFF. Also, in steps S1311 to S1313, vehicle log storage priority change instruction unit 450 may change the storage priority for a second vehicle control function related to the cruise control function to a thirteenth priority higher than the twelfth priority when the cruise control function is ON, and may change the storage priority for the second vehicle control function related to the cruise control function to a fourteenth priority lower than the twelfth priority when the cruise control function is OFF.

[0156] The vehicle control function may include emergency braking. For example, when the vehicle control function (sudden braking) is ON (Yes in S1311), the vehicle log storage priority change instruction unit 450 may change the storage priority of the log related to the vehicle control function (sudden braking) to "high" (S1312), and when the vehicle control function (sudden braking) is OFF (No in S1311), the vehicle log storage priority change instruction unit 450 may change the storage priority of the log related to the vehicle control function (sudden braking) to "low."

[0157] In this way, in steps S1311 to S1313, the vehicle log storage priority change instruction unit 450 may change the storage priority for the third vehicle control function related to the emergency braking function to a 16th priority, which is higher than the 15th priority, when the emergency braking function is ON, and may change the storage priority for the third vehicle control function related to the emergency braking function to an 18th priority, which is lower than the 15th priority, when the emergency braking function is OFF.

[0158] Vehicle log save priority change instruction unit 450 only needs to perform at least one process (change of save priority) of steps S1302 to S1304, steps S1305 to S1307, steps S1308 to S1310, and steps S1311 to S1313. In other words, vehicle log save priority change instruction unit 450 only needs to instruct ECU group 500a to change the save priority.

[0159] 13, the storage priority of a log (log information) whose storage priority was set to "high" in one determination process may be reset to "low" in a determination process following the one determination process. In such a case, the vehicle log storage priority change instruction unit 450 may set the determination result with the higher storage priority as the storage priority of the log. In other words, in the above case, the vehicle log storage priority change instruction unit 450 may set the storage priority of the log to "high" that was set in one determination result.

[0160] In this way, the abnormality detection device 400 can store important vehicle logs in the vehicle 10a for a long period of time by changing the storage priority of important vehicle logs in the vehicle state when the abnormality detection device 400 detects the abnormality (for example, by setting the storage priority to "high"). As a result, the abnormality detection device 400 can provide important logs to the external vehicle log collection server 20 without deleting them, without having to prepare resources in the vehicle 10a that can store a large amount of logs. The vehicle log collection server 20 can analyze the cause of the abnormality using the important logs, thereby contributing to the safety of the vehicle 10a.

[0161] [Flowchart of vehicle log deletion process] Fig. 14 is a flowchart (part of a vehicle log transmission method) of determining whether or not a vehicle log request is required in this embodiment. Fig. 14 shows a flowchart of a vehicle log deletion process by the vehicle log deletion unit 540 of the ECU group 500a.

[0162] (S1401) The vehicle log deletion unit 540 waits for a predetermined log deletion time to elapse, and after the log deletion time has elapsed, executes step S1402. For example, the log deletion time is 24 hours after the log information is acquired. Also, for example, the log deletion time may be the time elapsed from the most recent abnormality detection time. By checking the difference between the abnormality detection time and the current time, the vehicle log deletion unit 540 can determine that there has been no vehicle log request even though a long time has passed since the occurrence of the abnormality, and can determine that the priority of the vehicle log related to the abnormality is not high. Then, the vehicle log deletion unit 540 sets the storage priority of the vehicle log related to the abnormality to a low value (S1404 described later), so that the log is deleted preferentially, and it becomes possible to leave a more useful vehicle log.

[0163] (S1402) Vehicle log deletion unit 540 determines whether the vehicle log unnecessary time has passed. Vehicle log deletion unit 540 refers to the vehicle log storage priority setting set by vehicle log priority setting unit 520, and if there is a log ID for which a predetermined vehicle log unnecessary time has passed from the priority setting time to the current time (Yes in S1402), it performs step S1404, and if there is no log ID for which a predetermined vehicle log unnecessary time has passed from the priority setting time to the current time (No in S1402), it performs step S1403. The vehicle log unnecessary time is a time longer than the log deletion time, and for example, the vehicle log unnecessary time is 72 hours. The vehicle log unnecessary time is an example of the second time.

[0164] (S1403) Vehicle log deletion unit 540 refers to the vehicle log storage priority setting, and deletes vehicle logs (log information) corresponding to log IDs with a storage priority of "low" from among the vehicle logs stored in vehicle log storage unit 530. Then, step S1405 is performed.

[0165] (S1404) The vehicle log deletion unit 540 instructs the vehicle log priority setting unit 520 to change the storage priority of a log ID for which a predetermined vehicle log unnecessary time has elapsed from the priority setting time to the current time to "low". Then, step S1403 is performed.

[0166] The vehicle log deletion unit 540 may also execute the process of step S1403 when the capacity of the vehicle logs stored in the vehicle log storage unit 530 is equal to or greater than a certain value. That is, the vehicle log deletion unit 540 may delete log information with a low storage priority when the second time has elapsed or when the capacity of the stored vehicle logs is equal to or greater than a certain value.

[0167] (S1405) The vehicle log deletion unit 540 judges whether the current log size is equal to or smaller than the allowable amount. If the data size of the current log is equal to or smaller than the predetermined allowable amount (Yes in S1405), the vehicle log deletion unit 540 ends the process, and if the data size of the current log exceeds the allowable amount (No in S1405), the vehicle log deletion unit 540 executes step S1406.

[0168] (S1406) Vehicle log deletion unit 540 refers to the vehicle log storage priority setting, and deletes vehicle logs corresponding to log IDs with medium storage priority from among the vehicle logs stored in vehicle log memory unit 530, starting with the oldest one, and terminates the processing.

[0169] In this way, if the capacity of the vehicle log after deleting log information with a storage priority of "low" is equal to or greater than a certain value, the vehicle log deletion unit 540 may further delete log information with a storage priority higher than "low" (for example, log information with a storage priority of "high") in chronological order.

[0170] As described above, the vehicle log deletion unit 540 deletes the vehicle logs (log information) based on the changed storage priority in response to a change instruction from the vehicle log storage priority change instruction unit 450. As a result, the abnormality detection device 400 can accumulate logs required for analyzing the cause of the abnormality in the vehicle log collection server 20 even if the amount of stored data of the vehicle logs exceeds the upper limit, by switching the logs to be stored with priority according to the vehicle state when the abnormality is detected, without providing abundant log storage resources in the vehicle 10a.

[0171] [Flowchart of vehicle log deletion process] 15 is a flowchart of the vehicle log deletion process in this embodiment. FIG 15 shows a flowchart of the vehicle log necessity determination process of the vehicle log necessity determination unit 240.

[0172] (S1501) The abnormality log receiving unit 220 receives an abnormality log from the vehicle log collecting server 20, and executes step S1502.

[0173] (S1502) Vehicle log necessity determination unit 240 determines whether or not an identical abnormality log has been received in the past. If an identical abnormality log has already been stored in abnormality log storage unit 230 (Yes in S1502), step S1503 is executed, and if not (No in S1502), step S1504 is executed. Here, if an identical abnormality log has been received even once, it is determined that a vehicle log is necessary, but it may also be determined that a vehicle log is necessary when an abnormality log has been received a predetermined number of times or more, or it may be determined that a vehicle log is necessary based on the number of times an abnormality has occurred within a predetermined period of time.

[0174] (S1503) The vehicle log necessity determining unit 240 determines that a vehicle log is necessary, and ends the process.

[0175] (S1504) The vehicle log necessity determining unit 240 determines that a vehicle log is not necessary, and ends the process.

[0176] (Other embodiments) As described above, the embodiment has been described as an example of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and can be applied to an embodiment in which appropriate changes, substitutions, additions, omissions, etc. are made. For example, the following modified examples are also included in one embodiment of the present disclosure.

[0177] (1) In the above embodiment, the security measures for automobiles have been described, but the scope of application is not limited to this. The present invention may be applied not only to automobiles, but also to mobility such as construction machinery, agricultural machinery, ships, trains, and airplanes. The present invention may also be applied to communication networks used in industrial control systems such as factories and buildings, communication networks for controlling embedded devices, or home networks connecting household appliances.

[0178] (2) In the above embodiment, the abnormality detection device 400 is described as being connected to the vehicle log collection server 20 via an external network. However, the central ECU 300 may be connected to the vehicle log collection server 20 and act as an intermediary for communication between the abnormality detection device 400 and the vehicle log collection server 20.

[0179] (3) In the above embodiment, the related vehicle log list held by the abnormality detection device 400 has been described as being stored in advance. However, the related vehicle log list may be changed in response to a request from the vehicle log collection server 20.

[0180] (4) In the above embodiment, it has been described that the ECU group 500a holds the time of the vehicle log, and the vehicle log deletion unit 540 changes the storage priority to a lower value after a certain period of time or when the log size reaches a certain capacity. However, the abnormality detection unit 420 may hold the time of abnormality detection and instruct the storage priority of the vehicle log to be lowered if a certain period of time has passed since the abnormality detection time.

[0181] (5) In the above embodiment, the vehicle log deletion unit 540 of the ECU group 500a is described as changing the storage priority to a lower value when a certain period of time has elapsed or when the log size reaches a certain capacity. However, the transmitted vehicle log may be deleted after being transmitted to the abnormality detection device 400.

[0182] (6) In the above embodiment, the vehicle log storage priority has been described as being in the form of "high," "medium," and "low" levels. However, the vehicle log storage priority may be expressed by a numerical value indicating the level of the storage priority.

[0183] (7) In the above embodiment, several examples of vehicle conditions were given. However, in addition to personal conditions such as the driving or running conditions of the vehicle, conditions outside the vehicle 10a, such as traffic congestion information or weather information, may also be used.

[0184] (8) In the above embodiment, the vehicle log necessity determination unit 240 of the vehicle log collection server 20 has been described as determining whether a vehicle log is necessary based on whether the same abnormality log has been received in the past, but this is not limited to the above. The vehicle log necessity determination unit 240 may determine that a vehicle log is necessary, for example, when the same abnormality log has been received a certain number of times or more, when the same abnormality log has been received from a certain number of vehicles, when an abnormality log of an important module related to vehicle control has been received, etc.

[0185] (9) A part or all of the components constituting each device in the above embodiments may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on one chip, and specifically, a computer system including a microprocessor, a ROM, a RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its function by the microprocessor operating according to the computer program. Also, each part of the components constituting each device may be individually integrated into one chip, or may be integrated into one chip including some or all of them. Also, although the system LSI is used here, it may be called an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Also, the method of integration is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after LSI manufacture, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells inside the LSI may be used. Furthermore, if an integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a different derived technology, it is natural that such technology may be used to integrate the functional blocks. The application of biotechnology, etc. is also a possibility.

[0186] (10) Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that can be attached to each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. This IC card or module may be tamper-resistant.

[0187] (11) As an aspect of the present disclosure, the vehicle log transmission method may be a program (computer program) that is realized by a computer, or may be a digital signal consisting of a computer program. As an aspect of the present disclosure, the computer program or digital signal may be recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, or the like. Also, the vehicle log transmission method may be a digital signal recorded on such a recording medium. As an aspect of the present disclosure, the computer program or digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like. As an aspect of the present disclosure, a computer system having a microprocessor and a memory, in which the memory records the computer program, and the microprocessor operates according to the computer program. Also, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network, or the like, to be implemented by another independent computer system.

[0188] (12) In the above embodiment, the vehicle log transmission device 10 is mounted on the vehicle 10a, but the present invention is not limited to this. As long as the vehicle log transmission device 10 is communicably connected to the vehicle network and the vehicle log collection server 20, the vehicle log transmission device 10 is not limited to being mounted on the vehicle 10a.

[0189] (13) The abnormality detection device 400 (vehicle log transmission device 10) in the above embodiment may be realized by multiple devices. In this case, the components of the abnormality detection device 400 may be distributed in any manner among the multiple devices. In addition, the communication method between the multiple devices is not particularly limited.

[0190] (14) In the above embodiment, in FIG. 9, an example was described in which a related communication ID and a related process ID are set for each vehicle status item. However, it is sufficient that at least one of a related communication ID and a related process ID is set.

[0191] (15) In Fig. 9 in the above embodiment, the storage priority is shown as the changed storage priority, but is not limited thereto. The storage priority in Fig. 9 may be information indicating the degree of change from the current storage priority. The storage priority in Fig. 9 may be associated with information indicating, for example, that the storage priority is to be increased by one step from the current storage priority when the vehicle state at the time of abnormality detection is autonomous driving, and that the storage priority is to be decreased by one step from the current storage priority when the vehicle state at the time of abnormality detection is manual driving.

[0192] (16) In the above embodiment, the security measures have been described as measures for a cyber-physical system targeting an automobile. However, at least one of the judgment results and output results of each process of the security function may be displayed as a user interface (UI) for visualizing attacks in the cyber-physical system.

[0193] (17) The scope of the present disclosure also includes configurations realized by arbitrarily combining the components and functions described in the above embodiment and modified examples. [Industrial Applicability]

[0194] A vehicle log transmission device according to one embodiment of the present disclosure is effective for mobility such as a vehicle that stores log information. [Explanation of symbols]

[0195] 1. Vehicle log collection system 10 Vehicle log transmission device 10a Vehicle 20 Vehicle log collection server 210 External Network Communication Section 220 Error log receiver 230 Error log storage unit 240 Vehicle Log Necessity Determination Department 250 Vehicle log request section 260 Vehicle log storage unit 270 Log provider 300 Central ECU 400 Anomaly Detection Device 410 Internal Network Communication Department 420 Anomaly detection unit 430 Error log storage unit 440 Vehicle state extraction unit 450 Vehicle log storage priority change instruction unit (change instruction unit) 460 Related vehicle log list storage unit 470 Error log notification section (Error notification section) 480 Vehicle Log Request Response Part 490 External Network Communication Section 500a~500d ZoneECU 510 Internal Network Communication Department 520 Vehicle log priority setting unit 530 Vehicle log storage unit 540 Vehicle Log Deletion Department 550 Vehicle log request response part 560 ECU communication department 600a Car navigation ECU 600b Brake ECU 600c steering ECU 600d Body ECU

Claims

1. A vehicle log transmission device that transmits a vehicle log, which is stored in one or more electronic control devices mounted on a vehicle, and which includes one or more pieces of log information related to the vehicle, to a vehicle log collection server, comprising: an abnormality detection unit that acquires the vehicle log from the one or more electronic control units, detects an abnormality based on the one or more log information included in the acquired vehicle log, and extracts log information in which the abnormality is detected as an abnormality log; an abnormality notification unit that transmits the abnormality log to the vehicle log collection server; a change instruction unit that transmits to the one or more electronic control units a change instruction for a storage priority indicating a priority for storing the one or more pieces of log information included in the vehicle log based on a vehicle state extracted from the vehicle log acquired from the one or more electronic control units; a vehicle log request response unit that, when receiving a vehicle log request requesting transmission of the vehicle log from the vehicle log collection server, acquires the vehicle log including log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices, and transmits the acquired vehicle log to the vehicle log collection server. Vehicle log transmitter.

2. The abnormality detection unit further stores an abnormality detection time when the abnormality is detected, The change instruction unit further transmits an instruction to change the storage priority to the one or more electronic control devices based on the abnormality detection time. The vehicle log transmitting device according to claim 1 .

3. the change instruction unit transmits an instruction to change the storage priority to the one or more electronic control devices when a first time has elapsed since the abnormality detection time. The vehicle log transmitting device according to claim 2 .

4. the change instruction unit sets the changed storage priority based on a communication ID included in an in-vehicle message in an in-vehicle network of the vehicle, a process ID of an operating system or an application executed on the one or more electronic control units, and the vehicle state; The vehicle log transmitting device according to claim 2 or 3.

5. The vehicle state includes a plurality of states of the vehicle, the change instruction unit sets the storage priority after the change based on a degree indicating whether to preferentially retain log information corresponding to the communication ID related to the vehicle state and log information corresponding to the process ID related to the vehicle state for each of the plurality of states; The vehicle log transmitting device according to claim 4.

6. The change instruction unit uses, as the vehicle state, at least one of a driving mode indicating whether the vehicle is in automatic driving or manual driving, a driving status indicating whether the vehicle is driving or stopped, an Internet connection status indicating whether the vehicle is connected to the Internet or not connected to the Internet, a first vehicle control function status indicating whether an automatic parking function is ON or OFF, a second vehicle control function status indicating whether a cruise control function is ON or OFF, and a third vehicle control function status indicating whether an emergency brake is ON or OFF. The vehicle log transmitting device according to any one of claims 2 to 5.

7. the change instruction unit changes the storage priority for a function related to automatic driving to a second priority higher than the first priority when the driving mode is an automatic driving mode, changes the storage priority for the function related to automatic driving to a third priority lower than the first priority when the driving mode is a manual driving mode, changes the storage priority for a function related to a vehicle body control function including a door lock function to a fifth priority lower than the fourth priority when the vehicle is traveling, changes the storage priority for a function related to the vehicle body control function to a sixth priority higher than the fourth priority when the vehicle is stopped, changes the storage priority for a function using an Internet connection to an eighth priority higher than the seventh priority when the Internet is connected, changes the storage priority for a function using the Internet connection to an eighth priority lower than the seventh priority when the Internet is disconnected, and changes the storage priority for a first vehicle control function related to the automatic parking function when an automatic parking function is ON. to instruct the one or more electronic control devices to make at least one of the following changes: when the automatic parking function is OFF, change the storage priority for the first vehicle control function associated with the automatic parking function to a tenth priority higher than the ninth priority; when the automatic parking function is OFF, change the storage priority for the first vehicle control function associated with the automatic parking function to an eleventh priority lower than the ninth priority; when the cruise control function is ON, change the storage priority for the second vehicle control function associated with the cruise control function to a thirteenth priority higher than the twelfth priority; when the cruise control function is OFF, change the storage priority for the second vehicle control function associated with the cruise control function to a fourteenth priority lower than the twelfth priority; when the emergency brake function is ON, change the storage priority for the third vehicle control function associated with the emergency brake function to a sixteenth priority higher than the fifteenth priority; and when the emergency brake function is OFF, change the storage priority for the third vehicle control function associated with the emergency brake function to an eighteenth priority lower than the fifteenth priority. The vehicle log transmitting device according to claim 6.

8. The abnormality notification unit further generates an identifier of the abnormality log having one-to-one correspondence with the abnormality log, and transmits the abnormality detection time and the identifier of the abnormality log to the vehicle log collection server. the vehicle log request response unit receives an identifier of the abnormality log from the vehicle log collection server, collects log information from the one or more electronic control devices for a certain period before and after the abnormality detection time corresponding to the identifier of the abnormality log, and transmits the vehicle log including the collected log information to the vehicle log collection server. The vehicle log transmitting device according to any one of claims 2 to 7.

9. A vehicle log transmission device according to any one of claims 1 to 8, One or more electronic control units mounted on the vehicle; A vehicle log collection server; Each of the one or more electronic control units comprises: a vehicle log priority setting unit that changes the storage priority of the vehicle log in accordance with an instruction to change the storage priority of the vehicle log received from the vehicle log transmission device; a vehicle log deletion unit that deletes log information corresponding to the storage priority from one or more pieces of log information included in the vehicle log in accordance with the storage priority of the vehicle log; a vehicle log request response unit that transmits the vehicle log stored in the electronic control unit to the vehicle log transmission device in response to the vehicle log request received from the vehicle log transmission device, The vehicle log collection server includes: an abnormality log receiving unit that receives the abnormality log from the vehicle log transmitting device; a vehicle log request unit that transmits the vehicle log request to the vehicle log transmission device; a vehicle log receiving unit that receives the vehicle log based on the vehicle log request from the vehicle log transmitting device, Vehicle log collection system.

10. the vehicle log deletion unit deletes log information having a low storage priority when a second time period has elapsed or when a capacity of the stored vehicle log is equal to or greater than a certain value. The vehicle log collection system according to claim 9.

11. the vehicle log deletion unit, when a capacity of the vehicle log after deleting the log information having a low storage priority is equal to or larger than the certain value, further deletes log information having a high storage priority in chronological order. The vehicle log collection system according to claim 10.

12. the vehicle log deletion unit deletes the transmitted vehicle log after the vehicle log request response unit transmits the vehicle log to the vehicle log transmission device. The vehicle log collection system according to any one of claims 9 to 11.

13. The vehicle log collection server further includes a vehicle log request determination unit that determines whether the vehicle log request is necessary based on the abnormality log. The vehicle log collection system according to any one of claims 9 to 12.

14. the vehicle log request determination unit determines whether the vehicle log request is necessary based on the number of times the abnormality log has been received. The vehicle log collection system according to claim 13.

15. A vehicle log transmission method for transmitting a vehicle log, which is stored in one or more electronic control devices mounted on a vehicle and includes one or more pieces of log information related to the vehicle, to a vehicle log collection server, comprising: an abnormality detection step of acquiring the vehicle log from the one or more electronic control units, detecting an abnormality based on the one or more log information included in the acquired vehicle log, and extracting log information in which the abnormality is detected as an abnormality log; a first transmission step of transmitting the abnormality log to the vehicle log collection server; a second transmission step of transmitting, to the one or more electronic control devices, a change instruction for a storage priority indicating a priority for storing the one or more pieces of log information included in the vehicle log based on a vehicle state extracted from the vehicle log acquired from the one or more electronic control devices; a third transmission step of, when receiving a vehicle log request requesting transmission of the vehicle log from the vehicle log collection server, acquiring the vehicle log including log information stored based on the storage priority changed by the change instruction from the one or more electronic control devices, and transmitting the acquired vehicle log to the vehicle log collection server. How to send vehicle logs.

16. an abnormality detection unit that saves a vehicle log including one or more pieces of log information related to a vehicle, acquires the vehicle log from one or more electronic control units mounted on the vehicle, detects an abnormality based on the one or more pieces of log information included in the acquired vehicle log, and extracts log information in which the abnormality has been detected as an abnormality log; an abnormality notification unit that transmits the abnormality log to a vehicle log collection server; and a change instruction unit that transmits to the one or more electronic control units a change instruction for a storage priority indicating a priority for storing the one or more pieces of log information included in the vehicle log based on a vehicle state extracted from the vehicle log acquired from the one or more electronic control units. Storage priority change device.

Images