Anomaly detection device, anomaly detection system, and anomaly detection method

Abstract

An abnormality detection device (100) comprises a flow collection unit (110) and an abnormality detection unit (140). The flow collection unit (110) collects a flow communication amount, which is information obtained by totaling, with regard to a communication amount, one or more frames classified by a predetermined rule based on header information of network protocol for each of two or more networks of an on-board network system (10) having the two or more networks. The abnormality detection unit (140) calculates an observation ratio, which is a ratio of communication amounts among the two or more networks, on the basis of the flow communication amount, and determines whether the two or more networks are abnormal on the basis of the calculated observation ratio and a normalcy ratio, which is a ratio of the normal communication amounts among the two or more networks.

Description

[Technical field]

[0001] The present disclosure relates to an anomaly detection device, an anomaly detection system, and an anomaly detection method. [Background technology]

[0002] In recent years, systems inside vehicles are equipped with a large number of devices called Electronic Control Units (ECUs). The network that connects these ECUs is called an in-vehicle network.

[0003] Control frames are sent and received on in-vehicle networks to instruct the vehicle to run, stop, turn, etc. For example, if a malicious attacker masquerades as a legitimate ECU and sends control frames, or launches a DoS attack aimed at preventing certain control frames from being received, this poses a risk to not only the vehicle's passengers, but also to pedestrians around the vehicle.

[0004] As a countermeasure, a method is known that detects anomalies on a network using a detection algorithm specialized for a specific protocol. For example, Patent Document 1 describes a method for detecting anomalies based on the reception interval of a specific frame flowing on a network. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 5664799 [Non-patent literature]

[0006] [Non-Patent Document 1] Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information (RFC7011) Summary of the Invention [Problem to be solved by the invention]

[0007] There are many protocols for in-vehicle networks, such as CAN (Control Area Network) defined in ISO11898-1, FlexRay (registered trademark, the same applies below) established by the FlexRay Consortium, and Ethernet (registered trademark, the same applies below) defined in IEEE 802.3.

[0008] However, while the method of Patent Document 1 is effective for detecting abnormalities in CAN, in which the reception interval is disrupted when an abnormality occurs, it is not effective for detecting abnormalities in FlexRay, in which frames are always transmitted at a constant communication interval even when an abnormality occurs.

[0009] As a method for monitoring communications over an entire network, there is a specification called IPFIX, which is described in, for example, Non-Patent Document 1. IPFIX detects anomalies based on information contained in Ethernet or TCP / IP headers, but is not effective for detecting anomalies in CAN or FlexRay.

[0010] In addition, it is possible to install multiple anomaly detection devices specialized for specific protocols in the vehicle, but this would pose a problem in terms of cost.As such, with the conventional technology, it is difficult to detect anomalies in communication in the in-vehicle network with a simple configuration.

[0011] Therefore, the present disclosure provides an anomaly detection device, an anomaly detection system, and an anomaly detection method that are capable of detecting an anomaly in communication in an in-vehicle network with a simple configuration. [Means for solving the problem]

[0012] An anomaly detection device according to one embodiment of the present disclosure includes a flow collection unit that collects flow communication volume, which is information obtained by aggregating communication volume of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of two or more networks of an in-vehicle network system having two or more networks, and an anomaly determination unit that calculates an observation ratio that is a ratio of communication volumes between the two or more networks based on the flow communication volume, and determines whether or not the two or more networks are abnormal based on the calculated observation ratio and a normal ratio that is a ratio of communication volumes between the two or more networks under normal conditions.

[0013] An anomaly detection system according to one embodiment of the present disclosure is an anomaly detection system in an in-vehicle network system having two or more networks, and includes: an anomaly detection device according to any one of claims 1 to 10; and a flow generation device connected to one or more of the two or more networks and aggregating the flow communication volume, wherein the flow generation device includes a frame acquisition unit that acquires frames in the one or more networks, a frame classification unit that classifies the frames acquired according to a predetermined rule based on header information of a protocol used in the one or more networks, a flow aggregation unit that aggregates flow communication volume, which is information obtained by aggregating the one or more frames classified by the frame classification unit in terms of communication volume, and a flow transmission unit that transmits the aggregated flow communication volume to the anomaly detection device.

[0014] An anomaly detection method according to one embodiment of the present disclosure includes a flow collection step of collecting flow communication volume, which is information obtained by aggregating communication volume of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of two or more networks of an in-vehicle network system having two or more networks, and an anomaly determination step of calculating an observation ratio, which is a ratio of communication volumes between the two or more networks, based on the flow communication volume, and determining whether or not the two or more networks are abnormal based on the observation ratio and a normal ratio, which is a ratio of communication volumes between the two or more networks under normal conditions. Effect of the Invention

[0015] According to an anomaly detection device and the like according to one aspect of the present disclosure, an anomaly in communication in an in-vehicle network can be detected with a simple configuration. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram showing an overall configuration of an in-vehicle network system according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration of the anomaly detection device according to the embodiment. [Diagram 3] FIG. 3 is a diagram illustrating a functional configuration of the flow generating device according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of classification rules according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of a CAN frame according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a FlexRay frame according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of an Ethernet (SOME / IP) frame according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of a flow aggregate value according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a detection rule according to the embodiment. [Figure 10] FIG. 10 is a diagram showing a processing sequence from frame reception to flow transmission in the embodiment. [Figure 11] FIG. 11 is a diagram showing a processing sequence from flow reception to abnormality notification in the embodiment. [Figure 12] FIG. 12 is a flowchart of the frame classification process according to the embodiment. [Figure 13] FIG. 13 is a flowchart of the flow counting process according to the embodiment. [Figure 14]FIG. 14 is a flowchart of the flow transmission process according to the embodiment. [Figure 15] FIG. 15 is a flowchart of the abnormality detection process according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] (Background to this disclosure) Prior to describing the embodiments of the present disclosure, the findings that form the basis of the present disclosure will be described.

[0018] As described above in the "Problems to be Solved by the Invention", many protocols exist for in-vehicle networks, but the method of Patent Document 1 has difficulty in accurately detecting anomalies when a protocol other than a specific protocol (for example, a protocol such as CAN that has a characteristic that the reception interval becomes disrupted when an abnormality occurs) is used. Therefore, there is a demand for an abnormality detection device that can detect anomalies on an in-vehicle network regardless of the protocol of the in-vehicle network.

[0019] In addition, in-vehicle networks may use multiple protocols within the same system, depending on communication requirements and costs. For example, the Control Area Network (CAN) defined in ISO11898-1, FlexRay defined by the FlexRay Consortium, and Ethernet defined in IEEE 802.3 may be used within the same in-vehicle system.

[0020] Even in such a case, the method of Patent Document 1 is not effective for detecting anomalies in protocols other than the specific protocol. Also, it is difficult to implement an anomaly detection method that is effective for multiple protocols. Also, although it is possible to implement multiple anomaly detection methods specialized for a specific protocol, there is an issue with the cost.

[0021] As a method for monitoring communications over an entire network, for example, there is a specification called IPFIX, which is described in Non-Patent Document 1. In IPFIX, multiple frames flowing over an Ethernet are classified by an Ethernet switch based on information contained in the Ethernet or TCP / IP header, and statistical information called flows is generated. Then, an anomaly detection device higher than the Ethernet switch collects the flows and monitors them on a flow-by-flow basis, making it possible to monitor communications over an entire network with a low amount of calculation and communication volume.

[0022] However, since an in-vehicle network may contain not only Ethernet but also CAN or FlexRay, it is difficult to monitor communications over the entire in-vehicle network using only the Ethernet or TCP / IP headers.

[0023] As described above, in the conventional technology, it is difficult to detect an anomaly in communication of an in-vehicle network (for example, the entire in-vehicle network) with a simple configuration. Therefore, the inventors of the present application have conducted extensive research into an anomaly detection device etc. that can detect an anomaly in communication of an in-vehicle network with a simple configuration, and have invented the anomaly detection device etc. described below.

[0024] An anomaly detection device according to one embodiment of the present disclosure includes a flow collection unit that collects flow communication volume, which is information obtained by aggregating communication volume of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of two or more networks of an in-vehicle network system having two or more networks, and an anomaly determination unit that calculates an observation ratio that is a ratio of communication volumes between the two or more networks based on the flow communication volume, and determines whether or not the two or more networks are abnormal based on the calculated observation ratio and a normal ratio that is a ratio of communication volumes between the two or more networks under normal conditions.

[0025] This allows the upper level anomaly detection device to handle information uniformly without being aware of the differences in headers and payloads that differ for each protocol by classifying frames in a common classification, eliminating the need to implement multiple anomaly detection methods specialized for each network, and making it possible to monitor communications across the entire in-vehicle network at low cost. Therefore, anomalies in communications across the in-vehicle network can be detected with a simple configuration.

[0026] Also, for example, the abnormality determination unit may determine that the two or more networks are abnormal when the observed ratio and the normal ratio deviate from each other by a ratio equal to or greater than a predetermined value.

[0027] This makes it possible to easily determine whether an abnormality exists based on whether the deviation is equal to or greater than a predetermined value.

[0028] Also, for example, the abnormality determination unit may determine that, of the two or more networks, the network in which the observed ratio and the normal ratio differ by the largest percentage is abnormal.

[0029] This not only makes it possible to know that an anomaly has occurred in one of the networks, but also to identify the network in which the anomaly has occurred. In other words, by being able to identify the network in which the anomaly has occurred, anomalies on the network can be detected more accurately. For example, by identifying the network in which the anomaly has occurred, it becomes possible to quickly take measures against the anomaly, such as changing the routing of frames passing through the abnormal network and switching to another network.

[0030] Also, for example, the two or more networks may communicate using different network protocols, and the observation ratio may be a ratio of communication volumes between the two or more protocols calculated based on the flow communication volume, and the abnormality determination unit may calculate the ratio of communication volumes between the two or more protocols as the observation ratio based on the flow communication volume.

[0031] This means that by using a method of detecting anomalies by comparing the amount of communication between protocols, there is no need to implement multiple anomaly detection methods specialized for each protocol, making it possible to monitor communications across the entire in-vehicle network at low cost.

[0032] Furthermore, for example, the abnormality determination unit may determine that the protocol having the largest deviation between the observation ratio and the normal ratio among the two or more protocols is abnormal.

[0033] This not only makes it possible to know that an anomaly has occurred in one of the protocols, but also to identify the protocol in which the anomaly has occurred. In other words, by being able to identify the protocol in which the anomaly has occurred, anomalies on the network can be detected more accurately. For example, by identifying the protocol in which the anomaly has occurred, it becomes possible to quickly take measures against the anomaly, such as changing the routing of frames through a network that uses the anomalous protocol and sending frames using a different protocol.

[0034] Furthermore, for example, the flow communication volume may be information obtained by aggregating communication volume including at least either the number of frames or the data size of the one or more frames, classified by function based on an ID when the network protocol is CAN, CAN-FD, or J1939, classified by function based on a cycle and a slot when the network protocol is FlexRay, classified by function based on a MAC address, an IP address, or a port number when the network protocol is Ethernet, classified by function based on a message ID when the network protocol is SOME / IP, or classified by function based on a topic ID or a GUID when the network protocol is DDS, in each of the two or more networks.

[0035] This allows the anomaly detection device to compare the communication volume for each specific function for multiple different protocols. In a vehicle, various electronic control devices communicate via in-vehicle networks or protocols to realize specific functions. For example, in autonomous driving, functions are realized by controlling the steering, engine, camera, etc. not only via one in-vehicle network but also via multiple in-vehicle networks. In such a case, when the number of frames related to a specific function increases in one network or protocol, the number of frames related to the same function increases in other networks or protocols. In other words, when the communication volume for each specific function differs from the normal communication volume, it can be determined that an anomaly affecting the communication volume has occurred in a specific network.

[0036] Furthermore, for example, the flow communication volume may be information obtained by aggregating the communication volume including at least either the number of frames or the data size of the one or more frames, classified into source or destination based on an ID when the network protocol is CAN, CAN-FD, or J1939, into source or destination based on a cycle and slot when the network protocol is FlexRay, into source or destination based on a MAC address, an IP address, or a port number when the network protocol is Ethernet, into source or destination based on a message ID when the network protocol is SOME / IP, and into source or destination based on a topic ID or GUID when the network protocol is DDS, in each of the two or more networks.

[0037] This allows the anomaly detection device to compare the traffic volume for each specific source or destination for multiple different protocols. In Ethernet, the source and destination information is stored in the header using the MAC address and IP address, but in protocols such as CAN and FlexRay, the source or destination information is not stored in the header. Therefore, by linking and managing the ID or slot with the source and destination information in advance, the frames can be classified by source and destination. For example, in autonomous driving, the function is realized by controlling the steering, engine, camera, etc. not only through one in-vehicle network but also through multiple in-vehicle networks, and the autonomous driving ECU transmits frames to multiple protocols. In such a case, if the autonomous driving ECU transmits many frames through one network or protocol, many frames are transmitted from the autonomous driving ECU through the other networks or protocols. In other words, if the traffic volume for each specific source or destination is different from the normal traffic volume, it can be determined that an abnormality that affects the traffic volume has occurred in a specific network.

[0038] Furthermore, for example, the flow communication volume may be information obtained by aggregating communication volume, including at least either the number of frames or the data size, of the one or more frames in each of the two or more networks during a period corresponding to a vehicle state including at least one of autonomous driving, autonomous parking, cruise control, software update, vehicle diagnosis, and Internet communication connection.

[0039] This allows the anomaly detection device to compare the communication volume for each specific vehicle state for multiple different protocols. The communication volume of all networks changes temporarily depending on the vehicle state. For example, vehicle control frames increase during autonomous driving, frames related to software updates increase during software updates, frames related to vehicle diagnostics increase during vehicle diagnostics, and frames related to web services increase during Internet communication connections. In such a case, in a network where the communication volume is not increasing, an anomaly can be detected as a possible disruption of vehicle control software updates, vehicle diagnostics, Internet connections, etc., which are executed in a specific vehicle state. In other words, anomalies on the network can be detected in more detail.

[0040] In addition, for example, the vehicle may further include an abnormality notification unit that notifies a passenger or a server outside the vehicle of the abnormality when the abnormality determination unit determines that an abnormality has occurred.

[0041] This allows passengers or an external server to be quickly notified of the danger if an abnormality occurs.

[0042] Also, for example, the device may further include a detection rule update unit that updates the normal ratio based on information acquired via an external network.

[0043] This makes it possible to deal with any change in the normal communication volume ratio due to a software update by simply updating the normal ratio.

[0044] Also, for example, the predetermined rule may be information for assigning a classification label to a frame to classify the frame, and the flow communication volume may be information based on the one or more frames classified according to the classification label.

[0045] This allows the frames to be easily classified using the classification labels.

[0046] Also, for example, the specified rule corresponds, for each network protocol, a field name included in the header information, the classification label, and a valid state indicating whether the assignment of the classification label is valid or not, and the abnormality determination unit may not assign the classification label to the frame if the valid state is invalid.

[0047] This allows for separating frames that are to be classified from frames that are not to be classified, and for example allows for more accurate detection of anomalies on the network by using only desired frames.

[0048] Also, for example, the classification labels may include full frame, autonomous driving ECU, vehicle control, software update, and vehicle diagnostics.

[0049] This makes it possible to detect whether the abnormality is in all frames, the autonomous driving ECU, the vehicle control, the software update, or the vehicle diagnosis. Note that "all frames" refers to, for example, all frames related to autonomous driving.

[0050] Also, for example, the observation ratio may include at least one of a frame number ratio and a data size ratio for each network protocol, and the normal ratio may include the at least one of the frame number ratio and the data size ratio under normal conditions, and the abnormality determination unit may determine that an abnormality has occurred when the at least one of the frame number ratio and the data size ratio included in the observation ratio differs from the at least one of the frame number ratio and the data size ratio included in the normal ratio by a ratio equal to or greater than a predetermined value.

[0051] This makes it possible to determine that a network in which at least one of the frame number ratio and the data size ratio deviates by a ratio equal to or greater than a predetermined value is abnormal.

[0052] Moreover, an anomaly detection system according to one embodiment of the present disclosure is an anomaly detection system in an in-vehicle network system having two or more networks, and includes the above-mentioned anomaly detection device, and a flow generation device connected to one or more of the two or more networks and aggregating the flow communication volume, wherein the flow generation device includes a frame acquisition unit that acquires frames in the one or more networks, a frame classification unit that classifies the frames acquired according to a predetermined rule based on header information of a protocol used in the one or more networks, a flow aggregation unit that aggregates flow communication volume, which is information obtained by aggregating the one or more frames classified by the frame classification unit in terms of communication volume, and a flow transmission unit that transmits the aggregated flow communication volume to the anomaly detection device.

[0053] As a result, the components of the anomaly detection system allow a single system to perform operations from frame classification to detection of anomalies on a network. For example, by mounting an anomaly detection device and a flow generation device in a vehicle, an anomaly can be determined without communicating with an external device. In other words, an anomaly can be determined more reliably regardless of the communication state between the vehicle and an external device.

[0054] Furthermore, for example, the frame classification unit may classify frames by function based on an ID when the network protocol is CAN, CAN-FD, or J1939, when the network protocol is FlexRay, when the network protocol is Ethernet, when the frame classification unit classifies frames by function based on a MAC address, an IP address, or a port number, when the network protocol is SOME / IP, when the network protocol is DDS, and when the network protocol is DDS, when the frame classification unit classifies frames by function based on a topic ID or a GUID.

[0055] This allows the anomaly detection device to compare the communication volume for each specific function for multiple different protocols. In a vehicle, various electronic control devices communicate via in-vehicle networks or protocols to realize specific functions. For example, in autonomous driving, functions are realized by controlling the steering, engine, camera, etc. not only via one in-vehicle network but also via multiple in-vehicle networks. In such a case, when the number of frames related to a specific function increases in one network or protocol, the number of frames related to the same function increases in other networks or protocols. In other words, when the communication volume for each specific function differs from the normal communication volume, it can be determined that an anomaly affecting the communication volume has occurred in a specific network.

[0056] Furthermore, for example, the frame classification unit may classify frames by source or destination based on an ID when the network protocol is CAN, CAN-FD, or J1939, when the network protocol is FlexRay, classify frames by source or destination based on a cycle and slot when the network protocol is Ethernet, classify frames by source or destination based on a MAC address, IP address, or port number when the network protocol is SOME / IP, classify frames by source or destination based on a message ID when the network protocol is SOME / IP, and classify frames by source or destination based on a topic ID or GUID when the network protocol is DDS.

[0057] This allows the anomaly detection device to compare the traffic volume for each specific source or destination for multiple different protocols. In Ethernet, the source and destination information is stored in the header using the MAC address and IP address, but in protocols such as CAN and FlexRay, the source and destination information is not stored in the header. Therefore, by linking and managing the ID or slot with the source and destination information in advance, it is possible to classify by source and destination. For example, in autonomous driving, functions are realized by controlling the steering, engine, camera, etc. not only through one in-vehicle network but also through multiple in-vehicle networks, and the autonomous driving ECU transmits frames to multiple protocols. In such a case, if the autonomous driving ECU transmits many frames through one network or protocol, many frames are transmitted from the autonomous driving ECU through other networks or protocols. In other words, if the traffic volume for each specific source or destination is different from the normal traffic volume, it can be determined that an abnormality that affects the traffic volume has occurred in a specific network.

[0058] Also, for example, the frame classification unit may classify frames based on a vehicle state including at least one of autonomous driving, autonomous parking, cruise control, software update, vehicle diagnosis, and Internet communication connection in each of the two or more networks.

[0059] This allows the anomaly detection device to compare the communication volume for each specific vehicle state for multiple different protocols. The communication volume of all networks changes temporarily depending on the vehicle state. For example, vehicle control frames increase during autonomous driving, frames related to software updates increase during software updates, frames related to vehicle diagnostics increase during vehicle diagnostics, and frames related to web services increase during Internet communication connections. In such cases, in networks where communication volume is not increasing, an anomaly can be detected as a possible disruption to vehicle control software updates, vehicle diagnostics, or Internet connections executed in a specific vehicle state.

[0060] Also, for example, the flow generation device may further include a classification rule update unit that updates the predetermined rules.

[0061] This makes it possible to deal with cases where, for example, the association between IDs and functions has changed due to a software update, or the ratio of normal communication volume has changed, simply by updating the normal ratio in the detection rule.

[0062] Moreover, an anomaly detection method according to one embodiment of the present disclosure includes a flow collection step of collecting flow communication volume, which is information obtained by aggregating communication volume of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of two or more networks of an in-vehicle network system having two or more networks, and an anomaly determination step of calculating an observation ratio, which is a ratio of communication volumes between the two or more networks, based on the flow communication volume, and determining whether or not the two or more networks are abnormal based on a normal ratio, which is a ratio of communication volumes between the two or more networks under normal conditions, and the observation ratio.

[0063] This provides the same effect as the above-mentioned anomaly detection device.

[0064] Furthermore, these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized by any combination of the system, method, integrated circuit, computer program, or recording medium.

[0065] An anomaly detection device according to an embodiment will be described below with reference to the drawings. Each of the embodiments shown here shows a specific example of the present disclosure. Therefore, the numerical values, components, the arrangement and connection form of the components, and the steps and the order of the steps as processing elements shown in the following embodiments are merely examples and do not limit the present disclosure. Among the components in the following embodiments, those not described in the independent claims are components that can be added arbitrarily. Also, each figure is a schematic diagram and is not necessarily a precise illustration.

[0066] (Embodiment) [Overall configuration diagram of in-vehicle network system 10] FIG. 1 is a diagram showing the overall configuration of an in-vehicle network system 10 according to the present embodiment.

[0067] 1, the in-vehicle network system 10 includes an anomaly detection device 100, a flow generation device 210, a steering ECU 220, a body ECU 230, an autonomous driving ECU 240, a flow generation device 310, an engine ECU 320, a brake ECU 330, a flow generation device 410, a car navigation ECU 420, a camera ECU 430, and a switch 440. The anomaly detection system is configured including the anomaly detection device 100, the flow generation device 210, the flow generation device 310, and the flow generation device 410.

[0068] The abnormality detection device 100, the flow generation device 210, the steering ECU 220, the body ECU 230, and the autonomous driving ECU 240 are connected via a CAN network 20, which is a type of in-vehicle network.

[0069] In addition, the abnormality detection device 100, the flow generation device 310, the engine ECU 320, the brake ECU 330, and the autonomous driving ECU 240 are connected via a FlexRay network 30, which is a type of in-vehicle network.

[0070] In addition, the abnormality detection device 100, the flow generation device 410, the car navigation ECU 420, the camera ECU 430, the switch 440, and the autonomous driving ECU 240 are connected via an Ethernet network 40, which is a type of in-vehicle network.

[0071] 1 shows three different in-vehicle networks, the number of in-vehicle networks in the in-vehicle network system 10 is not limited to three, but may be two or more. The three in-vehicle networks are networks using different protocols, but at least two of the in-vehicle networks may use the same protocol.

[0072] The abnormality detection device 100 is connected to a CAN network 20, a FlexRay network 30, an Ethernet network 40, and also to an external network such as the Internet.

[0073] The anomaly detection device 100 detects an anomaly on the network, and notifies a server on the Internet via an external network, or a passenger such as a driver, of the anomaly via the car navigation ECU 420. The anomaly detection device 100 may further have a function of converting the protocol of an acquired frame and transferring it to another network. For example, the anomaly detection device 100 may convert a frame acquired via the CAN network 20 into a protocol used in at least one of the FlexRay network 30 and the Ethernet network 40, and transfer the frame to the network. Details of the anomaly detection device 100 will be described later.

[0074] The flow generation device 210 monitors frames flowing through the CAN network 20, and transmits flow information to the anomaly detection device 100. Details of the flow generation device 210 and the frames flowing through the CAN network 20 will be described later.

[0075] The steering ECU 220 is an ECU that controls the steering angle of a vehicle (for example, an automobile).

[0076] The body ECU 230 is an ECU that controls body functions such as opening and closing the vehicle windows.

[0077] The autonomous driving ECU 240 is an ECU that realizes autonomous driving by instructing the steering ECU 220, the engine ECU 320, the brake ECU 330, and the camera ECU 430 to control the vehicle. Here, the autonomous driving ECU may be an autonomous parking ECU that controls autonomous parking, or a cruise control ECU that controls cruise control.

[0078] The autonomous driving ECU 240 is connected to each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40. The autonomous driving ECU 240 may further have a function of converting the protocol of an acquired frame and transferring the frame to another network.

[0079] The flow generation device 310 monitors frames flowing through the FlexRay network 30, and transmits flow information to the anomaly detection device 100. The flow generation device 310 has the same functions as the flow generation device 210, and therefore may be generally referred to as the flow generation device 210, etc. Furthermore, the frames flowing through the FlexRay network 30 will be described later.

[0080] The engine ECU 320 is an ECU that controls the acceleration of the vehicle speed.

[0081] The brake ECU 330 is an ECU that controls the deceleration of the vehicle speed.

[0082] The flow generation device 410 monitors frames flowing through the Ethernet network 40, and transmits flow information to the anomaly detection device 100. Here, the SOME / IP (Scalable Service-Oriented Middleware over IP) protocol, which is a type of service-oriented communication protocol, is used on the Ethernet network 40. SOME / IP frames will be described later. Furthermore, since the flow generation device 410 has the same functions as the flow generation device 210, it may be generally referred to as the flow generation device 210, etc. The protocol used on the Ethernet network 40 is not limited to SOME / IP.

[0083] The car navigation ECU 420 is an ECU that controls the output of a display mounted in a vehicle.

[0084] The camera ECU 430 is an ECU that controls images captured by a camera mounted on the vehicle.

[0085] The switch 440 is a device that switches frames flowing on the Ethernet.

[0086] [Configuration diagram of anomaly detection device 100] FIG. 2 is a diagram showing a functional configuration of the anomaly detection device 100 according to the present embodiment.

[0087] As shown in FIG. 2, the anomaly detection device 100 includes a flow collection unit 110, a flow storage unit 120, a detection rule storage unit 130, an anomaly detection unit 140, a detection rule update unit 150, and an anomaly notification unit 160.

[0088] The flow collection unit 110 receives flow information from the flow generation device 210 and the like via the networks, ie, the CAN network 20, the FlexRay network 30, and the Ethernet network 40.

[0089] The flow storage unit 120 stores the received flow information for each protocol.

[0090] The detection rule storage unit 130 stores flow information in a normal state as a detection rule.

[0091] The anomaly detection unit 140 detects an anomaly in the in-vehicle network system 10 based on the flow information in a normal state described in the detection rule and the flow information stored in the flow memory unit 120. The anomaly detection unit 140 detects an anomaly, for example, by comparing the flow information in a normal state with the flow information stored in the flow memory unit 120. For example, the anomaly detection unit 140 detects an anomaly in the in-vehicle network system 10 based on whether or not the flow information in a normal state and the flow information stored in the flow memory unit 120 satisfy a predetermined relationship. The anomaly detection unit 140 is an example of an anomaly determination unit.

[0092] The detection rule update unit 150 updates the detection rules stored in the detection rule storage unit 130 via an external network. It can also be said that the detection rule update unit 150 updates the normal ratio based on information acquired via the external network. The information may include, for example, an updated detection rule, or may include information indicating a difference from the detection rule stored in the detection rule storage unit 130.

[0093] When the abnormality detection unit 140 detects an abnormality, the abnormality notification unit 160 notifies at least one of an external server and a passenger such as a driver of the abnormality. It can also be said that when the abnormality detection unit 140 determines that an abnormality exists, the abnormality notification unit 160 notifies the passenger or a server outside the vehicle of the abnormality.

[0094] The anomaly detection device 100 as described above collects flow communication volumes, which are information obtained by tallying up the communication volumes of one or more frames classified based on the header information of a protocol, calculates the ratio of communication volumes between networks based on the flow communication volumes, and compares the ratio with the normal communication volume ratio between the networks, thereby making it possible to determine anomalies safely and at low cost without implementing an anomaly detection method for each protocol. For example, the anomaly detection device 100 is configured as a part of an automatic driving assistance system, an advanced driving assistance system, etc.

[0095] The detection rules and the anomaly detection method will be described in detail later.

[0096] [Configuration diagram of flow generation device 210] 3 is a diagram showing the functional configuration of the flow generation device 210 in this embodiment. Note that the flow generation devices 310 and 410 also have the same functional configuration as the flow generation device 210.

[0097] 3, the flow generation device 210 includes a frame receiving unit 211, a classification rule storage unit 212, a frame classification unit 213, a vehicle state extraction unit 214, a flow aggregation unit 215, a flow storage unit 216, a flow transmission unit 217, and a classification rule update unit 218.

[0098] The frame receiving unit 211 receives frames transmitted over the network.

[0099] The classification rule storage unit 212 stores classification rules that describe a method for classifying frames.

[0100] The frame classification unit 213 classifies the received frames according to classification rules. For example, the frame classification unit 213 classifies the acquired frames using classification rules based on header information of protocols used in one or more networks. In addition, the frame classification unit 213 may classify the frames based on a vehicle state including at least one of automatic driving, automatic parking, cruise control, software update, vehicle diagnosis, and Internet communication connection in each of two or more networks.

[0101] The vehicle state extraction unit 214 extracts the vehicle state from the received frame. The vehicle state includes at least one of automatic driving, automatic parking, cruise control, software update, vehicle diagnosis, and internet communication connection.

[0102] The flow aggregation unit 215 aggregates the flow types in terms of the number of frames or data size, using the classified frames, the extracted vehicle states, and the flows stored in the flow storage unit 216. It can also be said that the flow aggregation unit 215 aggregates flow communication volume, which is information obtained by tallying up the communication volume of one or more frames classified by the frame classification unit 213. Aggregating by flow type is an example of aggregating by function.

[0103] The flow storage unit 216 stores the collected flows.

[0104] The flow transmission unit 217 transmits flow information at a predetermined timing to the anomaly detection device 100. The flow information includes the flow communication volume.

[0105] The classification rule update unit 218 updates the classification rules based on information acquired from an external network via the anomaly detection device 100. The classification rules are an example of predetermined rules.

[0106] The classification rules, the flow counting method, and the flow transmission method will be described in detail later.

[0107] [Example of classification rules] Fig. 4 is a diagram showing an example of classification rules in this embodiment. The classification rules are held in the classification rule storage unit 212 of the flow generation device 210. The classification rules are information for assigning classification labels for classifying frames to frames. Furthermore, the flow communication volume is information based on one or more frames classified for each classification label included in the classification rules shown in Fig. 4 below.

[0108] As shown in FIG. 4, the classification rule includes a classification number, a protocol, a classification field, a classification label, and a valid state.

[0109] The classification number is a unique number that corresponds to one classification rule. The protocol is the name of the protocol used in the network, such as CAN, CAN-FD, J1939, FlexRay, LIN, MOST, Ethernet, Ethernet (TCP / IP), Ethernet (SOME / IP), Ethernet (DDS), etc.

[0110] The classification field includes a field name and a matching value. The field name is a field name included in the header of the network protocol used for classification, and when the value of the field of a received frame is the same as the matching value of the classification rule, the classification label written in the classification label is assigned to the frame.

[0111] For example, the field name is an ID in the CAN protocol, a slot in the FlexRay protocol, and a message ID in the SOME / IP protocol. Since FlexRay identifies frames in two units, cycles and slots, in this disclosure, a slot is described as a slot taking into account a cycle (e.g., a slot in a particular cycle).

[0112] Furthermore, for example, the classification labels include all frames, autonomous driving ECU, vehicle control, software update, vehicle diagnosis, etc. All frames means all frames flowing in the CAN protocol, autonomous driving ECU means all frames transmitted from the autonomous driving ECU, vehicle control means frames related to vehicle control, software update means frames related to software update, and vehicle diagnosis means frames related to vehicle diagnosis.

[0113] In addition, the validity state indicates whether the corresponding classification rule is enabled or disabled, and even if the value of the field of the received frame is identical to the matching value of the classification rule, if the validity state is disabled, no classification label is assigned to the frame.

[0114] As described above, the classification rule associates, for each protocol, a field name included in the header information, a classification label, and a validity state indicating whether the assignment of the classification label is valid or not. If the validity state is invalid, the frame classification unit 213 does not assign a classification label to the frame.

[0115] For example, in the CAN protocol, when a frame with an ID field of 21 is received, the classification rule for classification number 1 stipulates that a classification label is to be assigned to all frames, but since the validity state is invalid, a classification label is not assigned to the frame.

[0116] In addition, the classification rule for classification number 3 describes a rule for assigning classification labels of vehicle control and autonomous driving ECU, and the valid state is valid, so that the two classification labels of vehicle control and autonomous driving ECU are assigned to the frame. In this way, the number of classification labels assigned to a frame is not limited to one, and may be multiple.

[0117] Also, for example, for a frame whose FlexRay protocol slot is 34, the classification rule for classification number 6 describes a rule that a classification label is assigned to all frames, and the validity state is enabled, so that a classification label is assigned to all frames.

[0118] In this way, by assigning classification labels that are unified across protocols to frames of each protocol, it becomes possible for the higher-level anomaly detection device 100 to perform integrated analysis of frames classified with the same classification label or flows, which are aggregated information of such classified frames.

[0119] However, since the information in the header for identifying frames differs between protocols, the flow generating device 210 etc. needs to hold classification rules for each protocol as shown in Fig. 4. Each of the flow generating devices 210 etc. may store the classification rules shown in Fig. 4, or may store only the part of the classification rules shown in Fig. 4 that corresponds to the protocol used in the connected network.

[0120] In the above, an example of the classification rule is described in which a classification label is assigned according to the function of the frame, that is, a rule that classifies frames by function. However, the classification rule is not limited to this, and may be a rule that classifies frames by their source or destination.

[0121] [Example of a CAN frame] 5 is a diagram showing an example of a CAN frame in this embodiment. The CAN frame is a frame that flows through the CAN network 20.

[0122] A CAN frame is composed of an ID, a data length, and a payload. The ID is used to identify the frame. The data length is used to determine the data size of the payload of the frame. The ID and data length are examples of header information. The payload describes the contents of the data in the frame identified by the ID.

[0123] For example, a CAN frame with an ID of 20 has a data length of 8 bytes, with a counter stored in the first byte, an automatic driving status stored in the second byte, and bytes 3 to 8 unused. A CAN frame with an ID of 22 has a data length of 8 bytes, with a counter stored in the first byte, update software data stored in the second to fifth bytes, and a flag value indicating that the update has been completed stored in the eighth byte.

[0124] In this way, when the flow generating device 210 receives a CAN frame, it can obtain the ID, data length, and payload.

[0125] Also, for example, when a CAN frame with an ID of 20 is received, information on whether the vehicle is in an autonomous driving state, which is one of the vehicle states, can be obtained, and when a CAN frame with an ID of 20 is received, the vehicle state, whether the vehicle is in an autonomous driving state or a manual driving state, can be obtained. Also, when a CAN frame with an ID of 21 is received, a speed instruction for accelerating or decelerating the vehicle to a target speed and the target speed can be obtained, when a CAN frame with an ID of 22 is received, update software data and an update completion flag indicating that the software update has been completed can be obtained, and when a CAN frame with an ID of 23 is received, a diagnosis instruction for instructing a vehicle diagnosis and a diagnosis completion flag indicating that the vehicle diagnosis has been completed can be obtained.

[0126] Also, if the protocol is not CAN but CAN-FD or J1939, a frame similar to the CAN frame shown in Figure 5 is sent and received on the network.

[0127] [Example of a FlexRay frame] 6 is a diagram showing an example of a FlexRay frame in this embodiment. The FlexRay frame is a frame that flows through the FlexRay network 30.

[0128] A FlexRay frame is composed of a slot, a data length, and a payload. The slot is used to identify the frame. The data length is used to grasp the data size of the payload. The slot and data length are examples of header information. The payload describes the contents of the data in the frame identified by the ID. Here, the cycle, which is one of the identifiers used in FlexRay, is omitted, and the slot is described as a slot that takes the cycle into consideration. Also, in Figure 6, the Xth byte represents the last byte of each payload.

[0129] For example, a FlexRay frame with slot 31 has a data length of 16 bytes, with the first byte containing a counter, the second byte containing a steering instruction to steer the vehicle to the target steering angle, and the third byte containing the angle which is the target steering angle, and the fourth byte through the sixteenth byte being unused.

[0130] In this way, when the flow generating device 310 receives a FlexRay frame, it can obtain the slot, data length, and payload.

[0131] [An example of an Ethernet (SOME / IP) frame] 7 is a diagram showing an example of an Ethernet (SOME / IP) frame in this embodiment. The Ethernet frame is a frame that flows through an Ethernet network 40. Here, an example will be described in which the Ethernet frame is communicated using the SOME / IP protocol.

[0132] An Ethernet frame is composed of a MAC address, an IP address, a port, a message ID in the SOME / IP protocol, a data length, and a payload. The MAC address is uniquely assigned to a network device, and the source (Src) MAC address and destination (Dst) MAC address are recorded. The IP address is assigned to a network device by the TCP / IP protocol, and the source (Src) IP address and destination (Dst) IP address are recorded. The port is assigned to an application of the network device, and the source (Src) port and destination (Dst) port are recorded.

[0133] The payload in the TCP / IP protocol is described as a SOME / IP protocol header and payload. The SOME / IP header describes a message ID and a data length, and the contents of the payload are identified by the message ID. The message ID and the data length are examples of header information.

[0134] The payload describes, for example, an autonomous driving state, a camera control instruction, video data, update software data, an update completion flag, a diagnostic instruction, a diagnostic code, a diagnostic completion flag, etc. For example, a frame with a SOME / IP message ID of 41 has a source (Src) MAC address of M1, a destination (Dst) MAC address of M2, a source (Src) IP address of IP1, a destination (Dst) IP address of IP2, a source (Src) port of P13, a destination (Dst) port of P22, a SOME / IP data length of 512 bytes, and a camera control instruction and video data are included in the payload.

[0135] Also, if the DDS protocol is used instead of the SOME / IP protocol, a topic number or GUID is listed instead of the message ID.

[0136] In this way, when the flow generating device 410 receives an Ethernet frame, it can obtain the MAC address, IP address, port, message ID in the SOME / IP protocol, data length, and payload.

[0137] [Example of flow aggregate value] Fig. 8 is a diagram showing an example of a flow aggregate value in this embodiment. The flow aggregate value is held by the flow generation device 210 etc. and transmitted to the anomaly detection device 100. Note that Fig. 8 shows the flow aggregate values ​​acquired from each of the flow generation devices 210 etc. and stored in the flow storage unit 120 of the anomaly detection device 100.

[0138] As shown in FIG. 8, the flow aggregate value includes a protocol, a type of flow, an aggregate value of the number of frames, an aggregate value of the data size, and a transmission condition.

[0139] The protocols used in the network, such as CAN, FlexRay, and Ethernet's SOME / IP, are listed in advance.

[0140] The flow type is a type of flow that is unified among protocols used in the upper level anomaly detection device 100 and is described in advance. For example, the flow types are all frames during autonomous driving, autonomous driving ECU, vehicle control, software update, vehicle diagnosis, etc. The flow type is an example of the function of the flow.

[0141] The total number of frames is the total number of frames received by the flow generating device 210 that correspond to the type of flow.

[0142] The aggregated value of the data size is the sum of the data lengths of the payloads of frames received by the flow generating device 210 and corresponding to the flow type, and the flow type is recorded in advance. Then, the classification label of the received frame is used to determine whether the received frame matches the flow type. For example, the classification label of the received frame and the vehicle state may be used to determine whether the received frame matches the flow type. The flow aggregation process will be described in detail later.

[0143] The transmission conditions are set in advance for each type of flow, and include, for example, "10 minutes passed," which transmits a flow 10 minutes after the initial tally, "update completed," which transmits a flow after a software update is completed, and "diagnosis completed," which transmits a flow after a vehicle diagnosis is completed.

[0144] For example, a flow called "all frames during automatic operation of the FlexRay protocol" has a count value of 100 frames, a total data size of 1600 bytes, and is sent to the anomaly detection device 100 10 minutes after the initial count time.

[0145] Also, for example, in the flow of software update of Ethernet (SOME / IP), the total number of frames is 10, the total data size is 1280, and is transmitted to the anomaly detection device 100 at the timing when the software update is completed.

[0146] As such, because Ethernet (SOME / IP) has a larger maximum data length that can be transmitted in one frame than CAN and FlexRay, the total number of frames may be small even if the total data size is large. Also, with Ethernet (SOME / IP), if no frames related to vehicle control are transmitted, the total number of frames and data size are always 0.

[0147] The anomaly detection device 100 receives and stores the flow aggregate values ​​for each protocol from the flow generation devices 210, 310, and 410, and can therefore use the flow aggregate values ​​aggregated by protocol for anomaly detection.

[0148] For example, the aggregate frame count of the flow "All frames during automatic operation of the CAN protocol" is 10 and the aggregate data size is 80 bytes, the aggregate frame count of the flow "All frames during automatic operation of the FlexRay protocol" is 100 and the total data size is 1600 bytes, and the aggregate frame count of the flow "All frames during automatic operation of the Ethernet (SOME / IP) protocol" is 10,000 and the aggregate data size is 320,000 bytes, so the ratio of the aggregate frame counts between the CAN, FlexRay, and Ethernet (SOME / IP) protocols can be calculated to be 1:10:1000.

[0149] Similarly, the ratio of the aggregated values ​​of data sizes between CAN, FlexRay, and Ethernet (SOME / IP) protocols can be calculated as 1:20:4000. In this way, by aggregating the flow aggregated values ​​of each protocol in one place, it is possible to calculate the ratio of the aggregated value of the number of frames between protocols to the aggregated value of data sizes.

[0150] In addition, when there are multiple networks using the same protocol, by aggregating the flows for each network, it is possible to calculate the ratio of the aggregated number of frames and the aggregated data size for each network, even if the protocol is the same.

[0151] The total number of frames and the total data size shown in FIG. 8 are calculated based on frames acquired during a predetermined period.

[0152] Note that FIG. 8 shows classification rules when classifying by flow type (an example of flow function), but when classifying by frame source or destination, the classification rules include information indicating the source or destination instead of the flow type of the classification rules shown in FIG. 8.

[0153] [Example of detection rules] 9 is a diagram showing an example of detection rules in the present embodiment. The detection rules are rules used by the anomaly detection device 100 for anomaly detection.

[0154] As shown in Fig. 9, the detection rule includes a flow type, a protocol-specific frame number ratio, and a protocol-specific data size ratio. The detection rule describes the protocol-specific frame number ratio and protocol-specific data size ratio under normal conditions for each flow type, and the normal ratio is set in advance or acquired in advance by mechanical learning, and is stored in the detection rule storage unit 130. The protocol-specific frame number ratio and protocol-specific data size ratio shown in Fig. 9 are determined based on frames acquired in a predetermined period.

[0155] 9 indicates the ratio of the number of frames for each protocol transmitted and received by the in-vehicle network system 10 when no abnormality is detected (e.g., no cyber-attack). Also, the ratio of data size for each protocol for normal operation indicates the ratio of data size for each protocol transmitted and received by the in-vehicle network system 10 when no abnormality is detected (e.g., no cyber-attack).

[0156] The protocol-specific frame number ratio and the protocol-specific data size ratio are examples of normal ratios. The detection rule may include at least one of the protocol-specific frame number ratio and the protocol-specific data size ratio.

[0157] The anomaly detection device 100 receives the flow aggregate values ​​by protocol, and calculates at least one of the current protocol-specific frame number ratio (one example of an observed ratio) and the current protocol-specific data size ratio (one example of an observed ratio) for each flow type, or in this embodiment, both the protocol-specific frame number ratio and the protocol-specific data size ratio.The anomaly detection device 100 then detects an anomaly by, for example, comparing the calculated ratio with a normal ratio described in the detection rule.

[0158] For example, in the example of the flow aggregate value shown in Fig. 8, for the flow of all frames during autonomous driving, the ratio of the aggregate values ​​of the number of frames between the CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1:10:1000, and the ratio of the aggregate values ​​of the data sizes is 1:20:4000. The ratio of the aggregate values ​​of the number of frames: 1:10:1000 and the ratio of the aggregate values ​​of the data sizes: 1:20:4000 are examples of observed ratios.

[0159] In contrast, in the detection rule, the ratio of the aggregated values ​​of the number of frames between the CAN, FlexRay, and Ethernet (SOME / IP) protocols in the flow of all frames during autonomous driving is 1:10:1000, and the ratio of the aggregated values ​​of the data sizes is 1:20:4000. The ratio of the aggregated values ​​of the number of frames: 1:10:1000 and the ratio of the aggregated values ​​of the data sizes: 1:20:4000 are examples of normal ratios. In this case, the abnormality detection unit 140 can determine that all protocols are normal because the observed ratio and the normal ratio match.

[0160] 8, for the vehicle diagnosis flow, the ratio of the aggregated values ​​of the number of frames between the CAN, FlexRay, and Ethernet (SOME / IP) protocols is 1:2:1, and the ratio of the aggregated values ​​of the data sizes is 1:2:1. The ratio of the aggregated values ​​of the number of frames: 1:2:1 and the ratio of the aggregated values ​​of the data sizes: 1:2:1 are examples of observed ratios.

[0161] In contrast, in the detection rule, the ratio of the aggregated values ​​of the number of frames between the CAN, FlexRay, and Ethernet (SOME / IP) protocols in the flow of all frames during autonomous driving is 1:1:1, and the ratio of the aggregated values ​​of the data sizes is 1:1:1. The ratio of the aggregated values ​​of the number of frames: 1:1:1 and the ratio of the aggregated values ​​of the data sizes: 1:1:1 are examples of normal ratios.

[0162] The number of frames and data size in the vehicle diagnosis of the FlexRay protocol are larger than normal. In other words, the ratio of CAN and Ethernet (SOME / IP) is correct, so the anomaly detection unit 140 can determine that there is a high possibility that an anomaly has occurred in FlexRay and that FlexRay is abnormal.

[0163] For example, the anomaly detection unit 140 may calculate a value by dividing the current ratio by the ratio between protocols in normal times, and may determine that an anomaly has occurred when the difference between the protocols is equal to or greater than a threshold value. The anomaly detection unit 140 may also determine that an anomaly has occurred in the protocol with the largest difference. For example, if the ratio of the aggregated values ​​of the number of frames of CAN, FlexRay, and Ethernet (SOME / IP) in normal times is 1:10:1000, and the current ratio is 1:20:950, the ratio value ratio is (1 / 1):(20 / 10):(950 / 1000)=1:2:0.95.

[0164] For example, if the threshold value is 1, the anomaly detection unit 140 determines that an anomaly has occurred because there is a difference of 1 or more between the protocols, and can determine that the anomaly has occurred in the FlexRay protocol, which has the largest difference. A difference of 1 or more is an example of a deviation of a predetermined value or more.

[0165] The anomaly detection unit 140 may only determine the presence or absence of an anomaly, without identifying the protocol of the anomaly.

[0166] As described above, the anomaly detection device 100 includes a flow collection unit 110 that collects flow communication volumes, which are information obtained by aggregating the communication volumes of one or more frames classified according to classification rules (an example of a predetermined rule) based on header information of a protocol (network protocol) in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40 of the in-vehicle network system 10 having the CAN network 20, the FlexRay network 30, and the Ethernet network 40 (an example of two or more networks), and an anomaly detection unit 140 that calculates an observation ratio, which is the ratio of the communication volumes between the CAN network 20, the FlexRay network 30, and the Ethernet network 40, based on the flow communication volumes, and determines whether the CAN network 20, the FlexRay network 30, and the Ethernet network 40 are abnormal based on the calculated observation ratio and a normal ratio, which is the ratio of the communication volumes between the CAN network 20, the FlexRay network 30, and the Ethernet network 40 under normal conditions.

[0167] With this configuration, it is possible to detect anomalies in communication in the in-vehicle network system 10 with a simple configuration. Furthermore, by collecting only the aggregated values ​​of communication volume, it is expected to have an effect of suppressing the communication volume of frames flowing through the network for anomaly detection. Furthermore, by comparing the communication volume between networks, it is expected to have an effect of detecting anomalies by capturing an increase in communication volume when an attack that transmits frames by masquerading as a legitimate ECU, a DDoS attack that interferes with the execution of services, or the like is executed.

[0168] As described above, the anomaly detection unit 140 may determine that the CAN network 20, the FlexRay network 30, and the Ethernet network 40 are abnormal when the observed ratio and the normal ratio are different from each other by a ratio equal to or greater than a predetermined value. The CAN network 20, the FlexRay network 30, and the Ethernet network 40 may communicate using different network protocols. The observed ratio may be a ratio of the communication volume between two or more protocols calculated based on the flow communication volume. For example, the anomaly detection unit 140 may determine that the protocol among the two or more protocols, which has the largest difference between the observed ratio and the normal ratio, is abnormal. The normal ratio may be a ratio of the communication volume between the two or more protocols calculated based on the flow communication volume in a normal state. By determining that a protocol is abnormal, for example, the CAN network 20, the FlexRay network 30, or the Ethernet network 40 that employs the protocol can be determined to be abnormal.

[0169] The anomaly detection unit 140 may determine that a network is abnormal based on a detection rule. For example, the anomaly detection unit 140 may determine that the network in which the observed ratio and the normal ratio deviate the largest from each other among the CAN network 20, the FlexRay network 30, and the Ethernet network 40 is abnormal.

[0170] As described above, the anomaly detection system is an anomaly detection system in an in-vehicle network system 10 having a CAN network 20, a FlexRay network 30, and an Ethernet network 40, and includes an anomaly detection device 100, a flow generation device 210 connected to one or more of the CAN network 20, the FlexRay network 30, and the Ethernet network 40, and tallying up flow communication traffic, etc. The flow generation device 210, etc. includes a frame receiving unit 211 (an example of a frame acquiring unit) that acquires frames in one or more networks, a frame classification unit 213 that classifies the acquired frames according to a classification rule (an example of a predetermined rule) based on header information of a protocol used in the one or more networks, a flow aggregation unit 215 that aggregates flow communication traffic, which is information obtained by tallying up the one or more frames classified by the frame classification unit 213 in terms of communication traffic, and a flow transmission unit 217 that transmits the aggregated flow communication traffic to the anomaly detection device 100.

[0171] [Processing sequence] Fig. 10 is a diagram showing a processing sequence from frame reception to flow transmission in this embodiment. Fig. 11 is a diagram showing a processing sequence from flow reception to abnormality notification in this embodiment. Figs. 10 and 11 show a processing sequence in this embodiment from when the flow generation device 210 receives a frame and transmits a flow aggregate value to the abnormality detection device 100, until the abnormality detection device 100 receives the flow aggregate value and notifies of an abnormality. The processing performed in the flow generation device 210 will be described below, but the processing from steps S1001 to S1006 shown in Fig. 10 is also performed in the flow generation devices 310 and 410 in the same way.

[0172] First, FIG. 10 will be described.

[0173] (S1001) The frame receiving unit 211 of the flow generating device 210 receives a frame transmitted over a network, and transmits it to the vehicle state extracting unit 214.

[0174] (S1002) Next, if the frame includes a vehicle state, the vehicle state extraction unit 214 extracts the vehicle state and stores it as a current vehicle state. The vehicle state includes at least one of, for example, automatic driving, automatic parking, cruise control, software update, vehicle diagnosis, and Internet communication connection, and is extracted from the received frame.

[0175] (S1003) Frame reception unit 211 receives a frame transmitted over the network in the same manner as in S1001, and transmits the frame to frame classification unit 213 if the frame does not include a vehicle state.

[0176] In this manner, the frame receiving unit 211 determines whether or not the received frame includes the vehicle state, and determines the transmission destination of the frame according to the determination result.

[0177] (S1004) Next, frame classification unit 213 classifies frames in accordance with the classification rules (for example, assigns a classification label to the received frame) and transmits the frames to flow aggregation unit 215. Frame classification unit 213 also discards frames that do not conform to the classification rules. In other words, frames that do not conform to the classification rules are not transmitted to flow aggregation unit 215.

[0178] (S1005) Next, the flow aggregation unit 215 receives the frame with the classification label attached, acquires the current vehicle state stored by the vehicle state extraction unit 214, and if the received frame matches the type of flow, aggregates it in terms of at least one of the number of frames and data size, and updates the flow aggregate value held in the flow storage unit 216. In step S1005, the flow aggregation unit 215 aggregates at least one of the number of frames and data size.

[0179] For example, when the current vehicle state is autonomous driving, the flow aggregation unit 215 aggregates the number of frames and the aggregated data size of all frames received during the period from when the autonomous driving state is turned ON to when it is turned OFF in the vehicle state (in the case of CAN frames, the vehicle state based on the field shown in Fig. 5), as the aggregated value of the number of frames and the aggregated data size of the flow type "all frames during autonomous driving" shown in Fig. 8. Note that similar aggregation is performed for other vehicle states.

[0180] (S1006) The flow transmitting unit 217 transmits a flow (flow aggregate value) under a predetermined condition to the anomaly detection device 100. For example, the flow transmitting unit 217 checks the transmission condition stored in the flow storage unit 216 every time the flow aggregate value is updated, and transmits the flow aggregate value to the anomaly detection device 100 if the transmission condition is met. Then, the flow transmitting unit 217 updates the aggregate value of the transmitted flow to zero.

[0181] (S1007) Next, the flow collection unit 110 of the anomaly detection device 100 receives the flows (flow aggregate values) from the flow generation device 210.

[0182] The flow aggregate value may be information obtained by aggregating one or more frames in terms of communication volume including at least either the number of frames or the data size, classified by function based on ID when the protocol (network protocol) is CAN, CAN-FD, or J1939, classified by function based on cycle and slot when the protocol is FlexRay, classified by function based on MAC address, IP address, or port number when the protocol is Ethernet, classified by function based on message ID when the protocol is SOME / IP, and classified by function based on topic ID or GUID when the protocol is DDS, in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40 (an example of two or more networks).

[0183] Also, as described above, the flow aggregate value may be information obtained by aggregating one or more frames in terms of communication volume, including at least the number of frames or the data size, in the CAN network 20, the FlexRay network 30, and the Ethernet network 40, classified into sources or destinations based on IDs when the protocol is CAN, CAN-FD, or J1939, classified into sources or destinations based on cycles and slots when the protocol is FlexRay, classified into sources or destinations based on MAC addresses, IP addresses, or port numbers when the protocol is Ethernet, classified into sources or destinations based on message IDs when the protocol is SOME / IP, and classified into sources or destinations based on topic IDs or GUIDs when the protocol is DDS. The flow aggregate value can also be said to classify frames by ECU.

[0184] The function, source, or destination is determined in advance.

[0185] In addition, the flow communication volume may be information obtained by aggregating communication volume, including at least either the number of frames or the data size, of one or more frames in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40 during a period corresponding to a vehicle state including at least one of autonomous driving, autonomous parking, cruise control, software update, vehicle diagnosis, and Internet communication connection.

[0186] Next, FIG. 11 will be described.

[0187] (S1101) The flow collection unit 110 of the anomaly detection device 100 receives the flow aggregate value transmitted in step S1006, and stores the flow aggregate value for each protocol in the flow storage unit 120. Receiving the flow aggregate value is an example of collecting flows.

[0188] (S1102) The anomaly detection unit 140 determines an anomaly from the flow aggregate value according to the detection rule stored in the detection rule storage unit 130. Determining an anomaly includes, for example, determining whether or not an anomaly exists. Then, when an anomaly is detected, the flow transmission unit 217 notifies the anomaly notification unit 160 of the anomaly (for example, information indicating that an anomaly has been detected).

[0189] (S1103) Next, the abnormality notification unit 160 notifies the passenger or an external server of the abnormality.

[0190] [Flowchart of frame classification process] 12 is a diagram showing a flowchart of the frame classification process according to this embodiment. The frame classification process is executed by the flow generating device 210.

[0191] (S1201) The frame receiving unit 211 of the flow generation device 210 receives a frame transmitted through a network.

[0192] (S1202) Next, frame classification unit 213 determines whether the received frame is a frame transmitted from an ECU in automatic driving according to classification rules defined for each protocol. If the received frame is a frame transmitted from an ECU in automatic driving (Yes in S1202), frame classification unit 213 performs step S1203, and if the received frame is not a frame transmitted from an ECU in automatic driving (No in S1202), it performs step S1204.

[0193] (S1203) Next, the frame classification unit 213 assigns an autonomous driving ECU label to the received frame, and executes step S1204.

[0194] (S1204) Next, frame classification unit 213 determines whether the received frame is a frame related to vehicle control according to classification rules defined for each protocol. If the received frame is a frame related to vehicle control (Yes in S1204), frame classification unit 213 performs step S1205, and if the received frame is not a frame related to vehicle control (No in S1204), it performs step S1206.

[0195] (S1205) Next, frame classification unit 213 assigns a vehicle control label to the received frame, and executes step S1206.

[0196] (S1206) Next, frame classification unit 213 determines whether the received frame is a frame related to software update according to classification rules defined for each protocol. If the received frame is a frame related to software update (Yes in S1206), frame classification unit 213 performs step S1207, and if the received frame is not a frame related to software update (No in S1206), it performs step S1208.

[0197] (S1207) The frame classification unit 213 adds a software update label to the received frame, and executes S1208.

[0198] (S1208) Frame classification unit 213 determines whether the received frame is a frame related to vehicle diagnosis, contrary to classification rules defined for each protocol. If the received frame is a frame related to vehicle diagnosis (Yes in S1208), frame classification unit 213 performs step S1209, and if the received frame is not a frame related to vehicle diagnosis (No in S1208), ends the process.

[0199] (S1209) The frame classification unit 213 assigns a vehicle diagnosis label to the received frame, and ends the process.

[0200] The determination processes in steps S1202, S1204, S1206, and S1208 are each performed using the classification rules shown in Fig. 4. For example, in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40, the frame classification unit 213 may classify frames by function based on ID when the network protocol is CAN, CAN-FD, or J1939, classify frames by function based on cycle and slot when the network protocol is FlexRay, classify frames by function based on MAC address, IP address, or port number when the network protocol is Ethernet, classify frames by function based on message ID when the network protocol is SOME / IP, and classify frames by function based on topic ID or GUID when the network protocol is DDS. Furthermore, for example, in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40, the frame classification unit 213 may classify frames by source or destination based on an ID when the network protocol is CAN, CAN-FD, or J1939, classify frames by source or destination based on a cycle and slot when the network protocol is FlexRay, classify frames by source or destination based on a MAC address, an IP address, or a port number when the network protocol is Ethernet, classify frames by source or destination based on a message ID when the network protocol is SOME / IP, and classify frames by source or destination based on a topic ID or GUID when the network protocol is DDS.

[0201] If at least one of steps S1202 and S1204 is Yes, frame classification section 213 may not perform the processes from step S1206 onwards. Of the determination processes of steps S1202, S1204, S1206 and S1208, it is preferable that the determination processes of steps S1202 and S1204 are performed before the determination processes of steps S1206 and S1208, but the order of the determination processes is not limited to this.

[0202] The processes from step S1202 onwards may be performed every time a frame is received, or may be performed when a predetermined number of frames have been accumulated.

[0203] Note that classifying frames according to the type of flow as described above is one example of classifying frames according to the function of the flow.

[0204] [Flow chart of flow aggregation process] 13 is a diagram showing a flowchart of the flow tallying process in this embodiment. The process performed in the flow generating device 210 will be described below, but the process shown in FIG. 13 is also performed in the flow generating devices 310 and 410.

[0205] (S1301) The flow aggregation unit 215 of the flow generation device 210 receives a classified frame to which a classification label has been added from the frame classification unit 213, and executes step S1302.

[0206] (S1302) Next, the flow aggregation unit 215 obtains the data length of the classification frame, and executes step S1303.

[0207] (S1303) Next, the flow aggregation unit 215 acquires the current vehicle state from the vehicle state extraction unit 214, and executes step S1304. The current vehicle state may be, for example, the latest vehicle state.

[0208] (S1304) Next, the flow aggregation unit 215 determines whether the vehicle state is autonomous driving or not. If the vehicle state is autonomous driving (Yes in S1304), the flow aggregation unit 215 performs step S1305, and if the vehicle state is not autonomous driving (No in S1304), the flow aggregation unit 215 performs step S1306.

[0209] In step S1304, as long as a determination is made regarding the vehicle state, it is not limited to determining whether or not the vehicle is in autonomous driving mode, but may be a determination process regarding at least one of autonomous driving mode, autonomous parking mode, cruise control mode, software update mode, vehicle diagnosis mode, and Internet communication mode, or a combination of two or more of these modes.

[0210] (S1305) Next, the flow aggregation unit 215 adds 1 to the aggregated value of the number of frames of the flow type “all frames during autonomous driving” among the flow aggregated values ​​stored in the flow memory unit 216, and adds the data length of the classified frame to the aggregated value of the frame size, and performs step S1306.

[0211] (S1306) Next, the flow aggregation unit 215 determines whether the classification label of the classification frame is an autonomous driving ECU. If the classification label of the classification frame is an autonomous driving ECU (Yes in S1306), the flow aggregation unit 215 performs step S1307, and if the classification label of the classification frame is not an autonomous driving ECU (No in S1306), the flow aggregation unit 215 performs step S1308.

[0212] (S1307) Next, the flow aggregation unit 215 adds 1 to the aggregated value of the number of frames of the flow type “Autonomous Driving ECU” among the flow aggregated values ​​stored in the flow memory unit 216, and adds the data length of the classification frame to the aggregated value of the frame size, and performs step S1308.

[0213] (S1308) Next, the flow aggregation unit 215 determines whether the classification label of the classification frame is vehicle control. If the classification label of the classification frame is vehicle control (Yes in S1308), the flow aggregation unit 215 performs step S1309, and if the classification label of the classification frame is not vehicle control (No in S1308), the flow aggregation unit 215 performs step S1310.

[0214] (S1309) Next, the flow aggregation unit 215 adds 1 to the aggregated value of the number of frames of the flow type “vehicle control” among the flow aggregated values ​​stored in the flow memory unit 216, adds the data length of the classification frame to the aggregated value of the frame size, and performs step S1310.

[0215] (S1310) Next, the flow aggregation unit 215 determines whether the classification label of the classification frame is software update. If the classification label of the classification frame is software update (Yes in S1310), the flow aggregation unit 215 performs step S1311, and if the classification label of the classification frame is not software update (No in S1310), the flow aggregation unit 215 performs step S1312.

[0216] (S1311) Next, the flow aggregation unit 215 adds 1 to the aggregated value of the number of frames of the flow type “software update” among the flow aggregated values ​​stored in the flow memory unit 216, and adds the data length of the classified frame to the aggregated value of the frame size, and performs step S1312.

[0217] (S1312) Next, the flow aggregation unit 215 determines whether the classification label of the classification frame is vehicle diagnosis. If the classification label of the classification frame is vehicle diagnosis (Yes in S1312), the flow aggregation unit 215 performs step S1313, and if the classification label of the classification frame is not vehicle diagnosis (No in S1312), the flow aggregation unit 215 ends the aggregation process.

[0218] (S1313) Next, the flow aggregation unit 215 adds 1 to the aggregated value of the number of frames of the flow type “vehicle diagnosis” among the flow aggregated values ​​stored in the flow memory unit 216, and adds the data length of the classification frame to the aggregated value of the frame size, and terminates the aggregation process.

[0219] As a result, the number of frames of all frames received during the period from when the autonomous driving state is turned ON to when it is turned OFF and the aggregated value of the data size of all frames can be aggregated as the aggregated value of the number of frames and the aggregated value of the data size of the flow type "all frames during autonomous driving" shown in FIG. 8. In addition, the number of frames of all frames received during the period from when the software update state is turned ON to when it is turned OFF and the aggregated value of the data size of all frames can be aggregated as the aggregated value of the number of frames and the aggregated value of the data size of the flow type "software update" shown in FIG. 8. In addition, the number of frames of all frames received during the period from when the vehicle diagnosis is turned ON to when it is turned OFF and the aggregated value of the data size of all frames can be aggregated as the aggregated value of the number of frames and the aggregated value of the data size of the flow type "vehicle diagnosis" shown in FIG. 8. Note that the period from when the autonomous driving state is turned ON to when it is turned OFF, the period from when the software update state is turned ON to when it is turned OFF, and the period from when the vehicle diagnosis is turned ON to when it is turned OFF are each an example of a period corresponding to a vehicle state.

[0220] In addition, the aggregated values ​​of the number of frames and the data size of all frames related to the autonomous driving ECU and vehicle control can be calculated as the aggregated values ​​of the number of frames and the aggregated values ​​of data sizes of the flow types "autonomous driving ECU" and "vehicle control" shown in Figure 8.

[0221] At least one of the number of frames and the frame size may be added in at least one of steps S1305, S1307, S1309, S1311, and S1313.

[0222] If at least one of steps S1304 and S1306 is Yes, the flow aggregation unit 215 may not perform the processes in and after step S1308. Of the determination processes in steps S1304, S1306, S1308, S1310, and S1312, it is preferable that the determination processes in steps S1304 and S1306 are performed before the determination processes in steps S1308, S1310, and S1312, but the order of the determination processes is not limited to this.

[0223] As described above, the flow communication volume may include the number of frames and the frame size added up depending on whether the vehicle state is one of autonomous driving, autonomous parking, cruise control, software update, vehicle diagnosis, and Internet communication connection, or a combination of two or more of these, in each of the CAN network 20, the FlexRay network 30, and the Ethernet network 40.

[0224] [Flow sending process flowchart] 14 is a diagram showing a flowchart of the flow transmission process in this embodiment. The flow transmission process is executed by the flow generating device 210.

[0225] (S1401) When the flow aggregate value is updated, the flow transmission unit 217 of the flow generation device 210 acquires the transmission condition for each type of flow from the flow storage unit 216, and executes step S1402.

[0226] (S1402) Next, if the transmission condition is a 10-minute interval (Yes in S1402), the flow transmission unit 217 performs step S1403, and if the transmission condition is not a 10-minute interval (No in S1402), the flow transmission unit 217 performs step S1406.

[0227] (S1403) Next, the flow transmitting unit 217 judges whether or not 10 minutes have passed since the first reception time. If 10 minutes have passed (Yes in S1403), the flow transmitting unit 217 performs step S1404, and if not (No in S1403), ends the flow transmission process. Here, if there is no first reception time, the flow transmitting unit 217 stores the current system time as the first reception time.

[0228] (S1404) Next, the flow transmitting unit 217 transmits the flow to the anomaly detection device 100, and executes step S1405.

[0229] (S1405) Next, the flow transmitting unit 217 changes the count value of the number of frames and the count value of the frame size of the transmitted flow to 0, and ends the flow transmission process. In other words, the flow transmitting unit 217 resets the count value of the number of frames and the count value of the frame size.

[0230] (S1406) Next, the flow transmission unit 217 acquires (eg, extracts) the vehicle state from the vehicle state extraction unit 214, and executes step S1407.

[0231] (S1407) Next, the flow transmitting unit 217 determines whether the transmission condition is "update complete" and the vehicle state is "update complete". If the transmission condition is "update complete" and the vehicle state is "update complete" (Yes in S1407), the flow transmitting unit 217 performs step S1404, and otherwise (No in S1407), the flow transmitting unit 217 performs step S1408.

[0232] (S1408) Next, the flow transmitting unit 217 determines whether the transmission condition is diagnosis completion and the vehicle state is diagnosis completion. If the transmission condition is diagnosis completion and the vehicle state is diagnosis completion (Yes in S1408), the flow transmitting unit 217 performs step S1404, and otherwise (No in S1408), ends the flow transmission process.

[0233] [Flowchart of abnormality detection process] 15 is a flowchart of the anomaly detection process according to the present embodiment. The anomaly detection process is executed by the anomaly detection device 100.

[0234] (S1501) In advance, the flow collection unit 110 of the anomaly detection device 100 receives flows from each of the flow generation devices 210, etc., and stores them in the flow storage unit 120. Then, the anomaly detection unit 140 acquires the flows of each protocol stored in the flow storage unit 120, calculates, for each type of flow, the ratio of the aggregated values ​​of the number of frames between the protocols (frame number ratio) and the ratio of the aggregated values ​​of the data sizes (data size ratio), and performs step S1502.

[0235] (S1502) Next, the anomaly detection unit 140 judges whether or not there is a protocol that differs from at least one of the normal frame number ratio and normal data size ratio. The anomaly detection unit 140 may judge whether or not there is an anomaly based on whether or not the frame number ratio and data size ratio calculated in step S1501 differ from the normal ratio of the frame number ratio and data size ratio by a ratio of a predetermined value or more. For example, the anomaly detection unit 140 calculates a normal ratio of the aggregated values ​​of the frame numbers between the protocols described in the detection rule (normal frame number ratio) and the current ratio of the aggregated values ​​of the frame numbers between the protocols calculated in step S1501, and judges whether or not there is a protocol whose ratio value ratio differs by a difference of a predetermined value or more. In addition, the anomaly detection unit 140 compares the normal ratio of the aggregated values ​​of the data sizes between the protocols described in the detection rule and the current ratio of the aggregated values ​​of the data sizes between the protocols calculated in step S1501, and judges whether or not there is a protocol whose ratio value differs by a difference of a predetermined value or more. Then, if the protocol exists (Yes in S1502), the abnormality detection unit 140 performs step S1503, and otherwise (No in S1502), ends the abnormality detection process. For example, if both the frame number ratio calculated in step S1501 and the data size ratio calculated in step S1501 are normal, the abnormality detection unit 140 ends the abnormality detection process.

[0236] The frame number ratio and the data size ratio are examples of an observation ratio. The frame number ratio is an example of a frame number ratio, and the data size ratio is an example of a data size ratio.

[0237] (S1503) Next, the anomaly detection unit 140 determines that the protocol whose ratio calculated in step S1501 differs by a difference equal to or greater than a predetermined value is an abnormal protocol, and ends the anomaly detection process.

[0238] As described above, the observation ratio includes at least one of the frame number ratio and the data size ratio by protocol, and the normal ratio includes at least one of the frame number ratio and the data size ratio in a normal state. Then, the anomaly detection unit 140 determines that an anomaly has occurred when at least one of the frame number ratio and the data size ratio included in the observation ratio differs from at least one of the frame number ratio and the data size ratio included in the normal ratio by a ratio equal to or greater than a predetermined value.

[0239] In step S1502, it is only necessary to determine at least one of whether or not a protocol different from the normal frame number ratio exists and whether or not a protocol different from the normal data size ratio exists.

[0240] (Other embodiments) As described above, the embodiment has been described as an example of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and can be applied to an embodiment in which appropriate changes, substitutions, additions, omissions, etc. are made. For example, the following modified examples are also included in the embodiment of the present disclosure.

[0241] (1) In the above embodiment, the security measures for vehicles (for example, automobiles) have been described, but the scope of application is not limited to this. The present invention may be applied to mobility such as construction machinery, agricultural machinery, ships, trains, and airplanes, in addition to automobiles.

[0242] (2) In the above embodiment, the flow storage unit 120 stores flows for each protocol, but it may store flows for each network. This makes it possible to detect anomalies by comparing the traffic between networks that use the same protocol.

[0243] (3) In the above embodiment, the anomaly detection unit 140 calculates the ratio between the observed ratio value and the normal ratio value for each protocol, and determines the protocol with the calculated ratio that is the most different from the observed ratio to be an anomaly. However, the calculation method is not limited as long as the method detects an anomaly by comparing the observed ratio with the normal ratio. For example, the anomaly detection device 100 may determine an anomaly based on the difference between the observed ratio and the normal ratio.

[0244] (4) In the above embodiment, the vehicle state is described as, for example, "automated driving," "software update," and "vehicle diagnosis," but the vehicle state may be "connected to the Internet." In this case, the car navigation ECU transmits a frame including the vehicle state "connected to the Internet" to the network, and the vehicle state extraction unit 214 extracts the vehicle state from the frame.

[0245] (5) In the above embodiment, the abnormality notification unit 160 has been described as notifying the driver or an external server of an abnormality, but the notification destination may be the police or the Ministry of Transport, a nearby vehicle, the transport system, or an institution that shares vulnerability information, etc.

[0246] (6) In the above embodiment, it has been described simply that the flow transmitting unit 217 transmits the flow to the anomaly detection device 100. However, the flow may be transmitted in the IPFIX format. In this case, a field for Enterprise prepared in the IPFIX format is used.

[0247] (7) Some or all of the components constituting each device in the above embodiments may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, it is a computer system including a microprocessor, a ROM, a RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its function by the microprocessor operating according to the computer program. Also, each part of the components constituting each device may be individually integrated into one chip, or may be integrated into one chip including some or all of them. Also, although the system LSI is used here, it may be called an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Also, the method of integration is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after LSI manufacture, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells inside the LSI. Furthermore, if a new integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a derivative technology, it is possible to integrate the functional blocks using that technology. The application of biotechnology is also a possibility.

[0248] (8) Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that can be attached to each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunction LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. This IC card or module may be tamper-resistant.

[0249] (9) As an aspect of the present disclosure, the method of anomaly detection shown in any one of Figs. 10 to 15 may be realized by a computer (computer program), or may be a digital signal consisting of a computer program. As an aspect of the present disclosure, the computer program or digital signal may be recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blue-ray (registered trademark) Disc), a semiconductor memory, or the like. It may also be a digital signal recorded on these recording media. As an aspect of the present disclosure, the computer program or digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like. As an aspect of the present disclosure, a computer system having a microprocessor and a memory, in which the memory records the computer program, and the microprocessor operates according to the computer program. It may also be implemented by another independent computer system by recording the program or digital signal on a recording medium and transferring it, or by transferring the program or digital signal via a network, or the like.

[0250] (10) The order in which each step is executed in the flowcharts shown in the above embodiments is merely an example for specifically explaining the present disclosure, and an order other than the above may be used. In addition, some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0251] In addition, the division of functional blocks in the block diagrams shown in the above embodiments is merely an example, and multiple functional blocks may be realized as one functional block, one functional block may be divided into multiple blocks, or some functions may be transferred to another functional block. Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in a time-division manner by a single piece of hardware or software.

[0252] (11) The scope of the present disclosure also includes configurations realized by arbitrarily combining the components and functions described in the above embodiment and modified examples. [Industrial Applicability]

[0253] An anomaly detection device according to an embodiment of the present disclosure is useful for detecting an anomaly in an in-vehicle network having two or more networks mounted on a vehicle or the like. [Explanation of symbols]

[0254] 10 In-vehicle network system 20 CAN Networks 30 FlexRay Networks 40 Ethernet Networks 100 Anomaly detection device 110 Flow collector 120 Flow Memory Unit 130 Detection rule memory unit 140 Abnormality detection unit (abnormality determination unit) 150 Detection rule update unit 160 Abnormality notification section 210 Flow Generator 211 Frame receiving section 212 Classification rule memory unit 213 Frame Classification Unit 214 Vehicle state extraction unit 215 Flow Aggregation Unit 216 Flow Memory Unit 217 Flow Transmitter 218 Classification Rule Update Section 220 Steering ECU 230 Body ECU 240 Autonomous Driving ECU 310 Flow Generator 320 Engine ECU 330 Brake ECU 410 Flow Generator 420 Car navigation ECU 430 Camera ECU 440 Switch

Claims

1. a flow collection unit that collects flow communication volume, which is information obtained by tallying up communication volumes of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of the two or more networks of an in-vehicle network system having two or more networks; an abnormality determination unit that calculates an observation ratio, which is a ratio of the traffic volumes between the two or more networks, based on the flow traffic volumes, and determines whether or not the two or more networks are abnormal, based on the calculated observation ratio and a normal ratio, which is a ratio of the traffic volumes between the two or more networks under normal conditions. Anomaly detection device.

2. the abnormality determination unit determines that the two or more networks are abnormal when the observed ratio and the normal ratio differ from each other by a ratio equal to or greater than a predetermined value. The anomaly detection device according to claim 1 .

3. the abnormality determination unit determines that a network having the largest difference between the observation ratio and the normal ratio is abnormal among the two or more networks. The anomaly detection device according to claim 1 or 2.

4. The two or more networks communicate using different network protocols; the observed ratio is a ratio of communication volumes between the two or more protocols calculated based on the flow communication volumes; the abnormality determination unit calculates a ratio of communication volumes between the two or more protocols as the observation ratio based on the flow communication volumes; The anomaly detection device according to claim 1 .

5. the abnormality determination unit determines that a protocol having the largest deviation between the observation ratio and the normal ratio among the two or more protocols is abnormal. The anomaly detection device according to claim 4.

6. The flow communication volume is information obtained by aggregating communication volume including at least either the number of frames or the data size of the one or more frames, which are classified by function based on ID when the network protocol is CAN, CAN-FD, or J1939, classified by function based on cycle and slot when the network protocol is FlexRay, classified by function based on MAC address, IP address, or port number when the network protocol is Ethernet, classified by function based on message ID when the network protocol is SOME / IP, and classified by function based on topic ID or GUID when the network protocol is DDS, in each of the two or more networks. The anomaly detection device according to claim 1 .

7. The flow communication volume is information obtained by aggregating communication volume including at least either the number of frames or the data size of the one or more frames, which are classified for each source or destination based on an ID when the network protocol is CAN, CAN-FD, or J1939, classified for each source or destination based on a cycle and a slot when the network protocol is FlexRay, classified for each source or destination based on a MAC address, an IP address, or a port number when the network protocol is Ethernet, classified for each source or destination based on a message ID when the network protocol is SOME / IP, and classified for each source or destination based on a topic ID or GUID when the network protocol is DDS, in each of the two or more networks. The anomaly detection device according to claim 1 .

8. The flow communication volume is information obtained by tallying up communication volumes, including at least either the number of frames or the data size, of the one or more frames during a period corresponding to a vehicle state including at least one of an automatic driving state, an automatic parking state, an automatic cruise control state, a software update state, a vehicle diagnosis state, and an Internet communication connection state, in each of the two or more networks. The anomaly detection device according to claim 1 .

9. The vehicle further includes an abnormality notification unit that notifies a passenger or a server outside the vehicle of the abnormality when the abnormality determination unit determines that an abnormality has occurred. The anomaly detection device according to claim 1 .

10. and a detection rule update unit that updates the normal ratio based on information acquired via an external network. The anomaly detection device according to claim 1 .

11. the predetermined rule is information for assigning a classification label for classifying a frame to the frame, The flow communication volume is information based on the one or more frames classified by the classification label. The anomaly detection device according to any one of claims 1 to 10.

12. the predetermined rule associates, for each of the network protocols, a field name included in the header information, the classification label, and a validity state indicating whether or not the assignment of the classification label is valid; When the validity state is invalid, the abnormality determination unit does not assign the classification label to the frame. The anomaly detection device according to claim 11.

13. The classification labels include full frame, autonomous driving ECU, vehicle control, software update, and vehicle diagnosis; The anomaly detection device according to claim 11 or 12.

14. The observation ratio includes at least one of a frame number ratio and a data size ratio for each of the network protocols; the normal ratio includes at least one of the frame number ratio and the data size ratio in a normal state, the abnormality determination unit determines that an abnormality has occurred when the at least one of the frame number ratio and the data size ratio included in the observation ratio differs from the at least one of the frame number ratio and the data size ratio included in the normal ratio by a ratio equal to or greater than a predetermined value. The anomaly detection device according to any one of claims 11 to 13.

15. An anomaly detection system in an in-vehicle network system having two or more networks, The anomaly detection device according to any one of claims 1 to 10, a flow generation device connected to one or more of the two or more networks and configured to aggregate the flow traffic, The flow generating device comprises: a frame acquisition unit for acquiring frames in the one or more networks; a frame classification unit that classifies the acquired frames according to a predetermined rule based on header information of a protocol used in the one or more networks; a flow counting unit that counts a flow traffic volume, which is information obtained by counting the traffic volume of one or more of the frames classified by the frame classifying unit; A flow transmission unit that transmits the aggregated flow communication volume to an anomaly detection device. Anomaly detection system.

16. the frame classification unit classifies frames by function based on ID when the network protocol is CAN, CAN-FD, or J1939, classifies frames by function based on cycle and slot when the network protocol is FlexRay, classifies frames by function based on MAC address, IP address, or port number when the network protocol is Ethernet, classifies frames by function based on message ID when the network protocol is SOME / IP, and classifies frames by function based on topic ID or GUID when the network protocol is DDS; The anomaly detection system according to claim 15.

17. The frame classification unit classifies frames for each source or destination based on an ID when the network protocol is CAN, CAN-FD, or J1939, when the network protocol is FlexRay, classifies frames for each source or destination based on a cycle and a slot, when the network protocol is Ethernet, classifies frames for each source or destination based on a MAC address, IP address, or port number, when the network protocol is SOME / IP, classifies frames for each source or destination based on a message ID, and when the network protocol is DDS, classifies frames for each source or destination based on a topic ID or GUID. The anomaly detection system according to claim 15.

18. The frame classification unit classifies frames based on a vehicle state including at least one of an autonomous driving state, an autonomous parking state, an autonomous cruise control state, a software update state, a vehicle diagnosis state, and an Internet communication connection state, in each of the two or more networks; The anomaly detection system according to claim 15.

19. The flow generation device further includes a classification rule update unit that updates the predetermined rules.

19. The anomaly detection system according to any one of claims 15 to 18.

20. a flow collection step of collecting flow traffic, which is information obtained by tallying up traffic of one or more frames classified according to a predetermined rule based on header information of a network protocol in each of the two or more networks of an in-vehicle network system having two or more networks; an abnormality determination step of calculating an observation ratio, which is a ratio of traffic volumes between the two or more networks, based on the flow traffic volumes, and determining whether or not the two or more networks are abnormal, based on a normal ratio, which is a ratio of traffic volumes between the two or more networks under normal conditions, and the observation ratio; Anomaly detection methods.

Images