Communication log aggregation device and communication log aggregation method

Abstract

A communication log aggregation device in a control network system configured from two or more subnetworks, said communication log aggregation device being an aggregation device that is disposed in the control network system and that aggregates a flow record containing flow identification information included in a message flowing to an observation unit disposed in the control network system, and first statistical information for each of flows categorized on the basis of the flow identification information, and comprising: a communication unit (103) that acquires, from each of aggregation devices disposed respectively in the two or more subnetworks, flow information containing one or more flow records and the first statistical information for each flow; and a flow aggregation unit (104) that performs at least one from among selecting the one or more flow records contained in the acquired one or more pieces of flow information, adding second statistical information based on the first statistical information, and deleting the one or more flow records, thereby generating aggregated flow information, and outputs the aggregated flow information that was generated.

Description

[Technical field]

[0001] The present disclosure relates to a communication log aggregating device and a communication log aggregating method. [Background technology]

[0002] In recent years, systems inside automobiles have been equipped with numerous devices called electronic control units (ECUs). The network that connects these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks, but one of the most mainstream standards is the Controller Area Network (CAN). In addition, with the spread of autonomous driving and connected cars, an increase in in-vehicle network traffic is expected, and in-vehicle Ethernet is becoming more widespread.

[0003] On the other hand, with the spread of connected cars, there is a growing threat that attackers could infiltrate the in-vehicle network from networks external to the vehicle and take unauthorized control of the vehicle, and security considerations are currently being considered.

[0004] Approaches proposed for improving the security of in-vehicle networks include methods for preventing communication by unauthorized nodes using encrypted communication, which have been used in conventional Internet Protocol (IP) communication, as described in Non-Patent Documents 1 and 2, and protection of the control network by domain separation. On the other hand, a method has been disclosed for collecting statistical information on packets with the same attributes, called flows, from header information etc. contained in communication packets in order to monitor network traffic trends (Non-Patent Document 3). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] RFC5406:Guidelines for Specifying the Use of IPsec Version2 [Non-Patent Document 2] IEEE 802.1AE:MAC Security [Non-Patent Document 3] RFC7011:Specification of the IP Flow Information Export(IPFIX) Protocol for the Exchange of Flow Information Summary of the Invention [Problem to be solved by the invention]

[0006] Incidentally, when IP communication becomes widespread in control network systems such as in-vehicle networks, it is expected that technology similar to that described in Non-Patent Document 3 will be used to grasp traffic trends in each domain and check for intrusions by attackers.

[0007] However, Non-Patent Document 3 only discloses a means for notifying flow information (e.g., communication logs), so if it is applied directly to a control network system such as an in-vehicle network, flow information collected in a plurality of different domains will be notified. This leads to an increase in the amount of traffic in the control network due to the communication of flow information. In addition, from the viewpoint of an analyst who analyzes network logs, this leads to an increase in the number of logs to be analyzed and the complication of the analysis work, which is undesirable.

[0008] Therefore, the present disclosure provides a communication log aggregating device and a communication log aggregating method that can appropriately aggregate communication logs in a control network system. [Means for solving the problem]

[0009] A communication log aggregation device according to one embodiment of the present disclosure is a communication log aggregation device in a control network system consisting of two or more subnetworks, wherein the communication log aggregation device is a collection device arranged on the control network system and collects flow records including flow identification information included in messages flowing to an observation unit arranged on the control network system, and first statistical information for each flow classified based on the flow identification information, and includes an acquisition unit that acquires flow information including one or more of the flow records and the first statistical information for each of the flows from each of the collection devices arranged on each of the two or more subnetwork systems, and an information processing unit that generates aggregated flow information by performing at least one of selecting one or more of the flow records included in the acquired one or more pieces of flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputs the generated aggregated flow information.

[0010] A communication log aggregation method according to one embodiment of the present disclosure is a communication log aggregation method in a control network system consisting of two or more subnetworks, comprising a collection device that collects flow records including flow identification information contained in messages flowing to an observation unit arranged in the control network system, and first statistical information for each flow classified based on the flow identification information, and acquires flow information including one or more of the flow records and the first statistical information for each of the flows from each of the collection devices arranged in each of the two or more subnetwork systems, generates aggregated flow information by performing at least one of selecting one or more of the flow records included in the acquired one or more flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputs the generated aggregated flow information. Effect of the Invention

[0011] According to a communication log aggregation device and the like according to an embodiment of the present disclosure, communication logs can be appropriately aggregated in a control network system. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a configuration diagram of an in-vehicle network monitoring system according to the first embodiment. [Diagram 2] FIG. 2 is a configuration diagram of the TCU in the first embodiment. [Diagram 3] FIG. 3 is a configuration diagram of the ECU in the first embodiment. [Figure 4] FIG. 4 is a configuration diagram of the Ethernet switch according to the first embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of latest flow information in the first embodiment. [Figure 6] FIG. 6 is a diagram showing an example of a vehicle state in the first embodiment. [Figure 7] FIG. 7 is a diagram showing a flow aggregation sequence in a TCU in the first embodiment. [Figure 8] FIG. 8 is a flowchart of flow information aggregation by the TCU in the first embodiment. [Figure 9] FIG. 9 is a flowchart of a first flow aggregation method by a TCU in the first embodiment. [Figure 10] FIG. 10 is a diagram showing an example of output of aggregated flow information by the first flow aggregation method in the first embodiment. [Figure 11] FIG. 11 is a flowchart of a second flow aggregation method by the TCU in the first embodiment. [Figure 12] FIG. 12 is a diagram showing an example of output of aggregated flow information according to the second flow aggregation method in the first embodiment. [Figure 13] FIG. 13 is a flowchart of a third flow aggregation method by the TCU in the first embodiment. [Figure 14] FIG. 14 is a diagram showing an example of output of aggregated flow information according to the third flow aggregation method in the first embodiment. [Figure 15]FIG. 15 is a configuration diagram of an in-vehicle network monitoring system according to the second embodiment. [Figure 16] FIG. 16 is a configuration diagram of a TCU in the second embodiment. [Figure 17] FIG. 17 is a diagram illustrating an example of latest flow information in the second embodiment. [Figure 18] FIG. 18 is a flow chart of a flow collection process by the TCU in the second embodiment. [Figure 19] FIG. 19 is a flowchart of flow information aggregation by a TCU in the second embodiment. [Figure 20] FIG. 20 is a detailed flowchart of the flow aggregation process in the second embodiment. [Figure 21] FIG. 21 is a diagram showing an output example of aggregated flow information (while stopped) in the second embodiment. [Figure 22] FIG. 22 is a diagram showing an example of aggregated flow information output (while driving) in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] A communication log aggregation device according to one embodiment of the present disclosure is a communication log aggregation device in a control network system consisting of two or more subnetworks, wherein the communication log aggregation device is a collection device arranged on the control network system and collects flow records including flow identification information included in messages flowing to an observation unit arranged on the control network system, and first statistical information for each flow classified based on the flow identification information, and includes an acquisition unit that acquires flow information including one or more of the flow records and the first statistical information for each of the flows from each of the collection devices arranged on each of the two or more subnetwork systems, and an information processing unit that generates aggregated flow information by performing at least one of selecting one or more of the flow records included in the acquired one or more pieces of flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputs the generated aggregated flow information.

[0014] This makes it possible to aggregate communication logs (flow information) collected at multiple observation units (observation points) in the control network, which is effective in reducing the size of the logs (e.g., the amount of information). Therefore, even if the control network system has a configuration with multiple different domains, the communication logs can be appropriately aggregated.

[0015] Also, for example, the control network system may be arranged with two or more observation units including a first observation unit and a second observation unit, the acquisition unit acquires first flow information collected by the first observation unit and second flow information collected by the second observation unit, and the information processing unit may generate the aggregated flow information without including one of the first flow record and the second flow record when the flow identification information of a first flow record included in the first flow information and the flow identification information of a second flow record included in the second flow information are identical.

[0016] This prevents messages transferred to multiple sub-networks from being duplicated and recorded as logs, which is effective in reducing network communication logs.

[0017] Also, for example, each of the one or more pieces of flow information may include observation unit identification information that identifies the observation unit that collected it, and the information processing unit may add the observation unit identification information included in one of the first flow information and the second flow information to the other of the first flow information and the second flow information.

[0018] This makes it possible to prevent the observation unit identification information from being deleted even when the flow information is aggregated, and therefore makes it possible to generate aggregated flow information that is useful when analyzing anomalies and the like in the control network system.

[0019] Also, for example, the first statistical information includes a statistic based on the reception volume of the message, and the information processing unit may generate the aggregated flow information without including one of the first flow record and the second flow record when the one or more flow identification information of the first flow record included in the first flow information and the one or more flow identification information of the second flow record included in the second flow information are identical, and further, when the first reception volume included in the first flow information and the second reception volume included in the second flow information satisfy a predetermined relationship.

[0020] This makes it possible to check the consistency between flow information collected by different observation units and output it as an aggregated flow, making it possible to consolidate it into a network communication log that is useful from a security standpoint.

[0021] Also, for example, if the first receiving amount and the second receiving amount do not satisfy the specified relationship, the information processing unit may further add an anomaly identification flag indicating that an abnormality has occurred to at least one of the first flow record and the second flow record.

[0022] This makes it possible to easily distinguish between abnormal flow records and normal flow records by referring to the aggregated flow information, thereby enabling efficient analysis of network communication logs.

[0023] Furthermore, for example, the predetermined relationship may include a condition that a difference between the first reception amount and the second reception amount is within a predetermined value.

[0024] This makes it possible to add an abnormality identification flag when the difference between the first reception amount and the second reception amount is within a predetermined value.

[0025] Also, for example, the communication log aggregation device may be mounted on a vehicle and further include a vehicle state determination unit that determines a vehicle state of the vehicle, and the information processing unit may further perform at least one of selecting one or more of the flow records, adding the second statistical information, and deleting one or more of the flow records based on the vehicle state determined by the vehicle state determination unit.

[0026] This makes it possible to output a network communication log suitable for communication of the control network that changes according to the vehicle state of the vehicle. Therefore, since flow information can be aggregated according to the vehicle state, communication logs can be more appropriately aggregated.

[0027] Also, for example, the vehicle state may include either a stopped state or an autonomous driving state.

[0028] This allows communication logs to be appropriately aggregated depending on whether the vehicle is stopped or in autonomous driving mode.

[0029] Also, for example, when the vehicle state is stopped, the information processing unit may select the flow record related to at least one of a diagnosis command and an update command, and generate the aggregated flow information including the selected flow record.

[0030] This makes it possible to generate aggregated flow information including flow information corresponding to the stopped state.

[0031] Also, for example, when the vehicle state is in the autonomous driving state, the information processing unit may select the flow record related to autonomous driving control, and generate the aggregated flow information including the selected flow record.

[0032] This makes it possible to generate aggregated flow information that includes flow information corresponding to the autonomous driving state.

[0033] Also, for example, when the vehicle state is neither stopped nor in the autonomous driving state, the information processing unit may generate the aggregated flow information including one or more of the acquired flow information.

[0034] This makes it possible to generate aggregated flow information that includes flow information corresponding to the vehicle state when the vehicle is stopped and not in autonomous driving mode.

[0035] Also, for example, the observation unit may be placed in each of the two or more subnetworks, and the information processing unit may change the priority of the two or more observation units depending on the vehicle state, and change the proportion of the one or more flow records collected by the two or more observation units to be included in the aggregated flow information based on the changed priority.

[0036] This makes it possible to aggregate the necessary flow records at an appropriate ratio according to the communication of the control network, which changes according to the vehicle state of the vehicle.

[0037] Also, for example, the observation unit may include a third observation unit that observes communication with an outside-vehicle network, a fourth observation unit that observes communication between apps, and a fifth observation unit that observes communication on the in-vehicle network.

[0038] This makes it possible to effectively reduce the size (e.g., amount of information) of communication logs (flow information) for communication with an external network, communication between apps, and communication on an in-vehicle network.

[0039] Also, for example, the one or more pieces of flow information may further include the previous first statistical information, and the information processing unit may generate the aggregated flow information based on a vehicle state of the vehicle and difference information that is a difference between the first statistical information and the previous first statistical information.

[0040] This makes it possible to generate aggregated flow information based on the difference information. For example, by aggregating flow information having an abnormality based on the difference information, communication logs can be effectively aggregated.

[0041] Also, for example, the information processing unit may generate the aggregated flow information including the third flow information when the vehicle state is stopped, the previous first statistical information is zero, and there is a first number or more of third flow information whose first statistical information is other than zero, and may generate the aggregated flow information including the fourth flow information when the vehicle state is not stopped, the previous first statistical information is zero, and there is a second number or more of fourth flow information whose first statistical information is other than zero that is less than the first number.

[0042] This makes it possible to generate aggregated flow information including flow information whose previous statistical information was zero and whose current statistical information has increased by a predetermined amount or more. In other words, it is possible to generate aggregated flow information including flow information that may have an abnormality. Therefore, communication logs can be appropriately aggregated in terms of including flow information that may have an abnormality.

[0043] Also, for example, the information processing unit may further add different flags to the third flow information and the fourth flow information.

[0044] This makes it possible to easily distinguish between the third flow information and the fourth flow information by referring to the aggregated flow information, thereby enabling efficient analysis of the network communication log.

[0045] Furthermore, for example, the flow identification information may include at least one or a set of two or more of a source IP address, a destination IP address, a source port number, a destination port number, a protocol number, and a message ID.

[0046] This makes it possible to properly identify flows from the information contained in messages, and is useful as a network communication log (communication log).

[0047] Furthermore, for example, the observation unit may be an Ethernet switch included in the control network system and to which one or more electronic control devices are connected.

[0048] This makes it possible to obtain flow information without adding any new components when the control network system uses Ethernet.

[0049] Also, for example, the aggregated flow information may be output in an Internet Protocol Flow Information Export (IPFIX) or NetFlow format.

[0050] This makes it possible to communicate the aggregated flow information in a commonly used format, thus increasing the versatility of the communication log aggregating device.

[0051] Furthermore, a communication log aggregation method according to one embodiment of the present disclosure is a communication log aggregation method in a control network system consisting of two or more subnetworks, comprising a collection device that collects flow records including flow identification information contained in messages flowing to an observation unit arranged in the control network system, and first statistical information for each flow classified based on the flow identification information, and acquires flow information including one or more of the flow records and the first statistical information for each of the flows from each of the collection devices arranged in each of the two or more subnetwork systems, generates aggregated flow information by performing at least one of selecting one or more of the flow records included in the acquired one or more flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputs the generated aggregated flow information.

[0052] This provides the same effects as the above-mentioned communication log aggregation device. For example, communication logs (flow information) collected at multiple monitoring points in a control network can be aggregated, which is effective in reducing the size of the log (e.g., the amount of information).

[0053] Hereinafter, a network communication log aggregation device (communication log aggregation device) according to an embodiment of the present disclosure will be described with reference to the drawings. Note that each of the embodiments described below shows a preferred specific example of the present disclosure. In other words, the numerical values, shapes, materials, components, arrangement and connection form of the components, steps, order of steps, etc. shown in the following embodiments are examples of the present disclosure and are not intended to limit the present disclosure. The present disclosure is specified based on the description of the claims. Therefore, among the components in the following embodiments, components that are not described in the independent claims showing the highest concept of the present disclosure are not necessarily required to achieve the objectives of the present disclosure, but are described as components constituting a more preferred form.

[0054] (Embodiment 1) The following describes a network communication log aggregating device (communication log aggregating device) in a vehicle equipped with an in-vehicle network (in-vehicle network system) in which multiple electronic control units (ECUs: Electronic Control Units) communicate via Ethernet (registered trademark).

[0055] [1.1 Configuration of in-vehicle network monitoring system] 1 is a configuration diagram of an in-vehicle network monitoring system according to the present embodiment. The in-vehicle network monitoring system is mounted on a vehicle 10. The in-vehicle network monitoring system is an example of a control network system.

[0056] As shown in FIG. 1, the in-vehicle network monitoring system includes a TCU (Telematics Control Unit) 100, an ECU 200a, an ECU 200b, an ECU 200c, an ECU 200d, an ECU 200e, an ECU 200f, an ECU 200g, an Ethernet switch 300a, an Ethernet switch 300b, an Ethernet switch 300c, and an Ethernet switch 300d.

[0057] The TCU 100 has a connection interface with an external network and communicates with, for example, an external server. The TCU 100 also has a function of aggregating flow information (communication logs) notified from the Ethernet switches 300a, 300b, 300c, and 300d. The TCU 100 is an example of a communication log aggregation device. The TCU 100 is disposed on an in-vehicle network. The TCU 100 is disposed on, for example, a sub-network to be described later.

[0058] The ECU 200a, ECU 200b, ECU 200c, ECU 200d, ECU 200e, and ECU 200f communicate with each other via a network to exchange control instructions, sensor data, and the like, thereby achieving control of the vehicle. Although omitted in FIG. 1, the in-vehicle network may include many more ECUs.

[0059] The ECU 200a, the ECU 200b, the ECU 200c, the ECU 200d, the ECU 200e, and the ECU 200f are connected to sensors, actuators, and the like, and perform operations such as obtaining sensor information and controlling the actuators.

[0060] The ECU 200a, ECU 200b, ECU 200c, ECU 200d, ECU 200e, and ECU 200f are devices including, for example, a processor (microprocessor), digital circuits such as memory, analog circuits, communication circuits, etc. The memory is a ROM or RAM, and can store a control program (computer program) executed by the processor.

[0061] For example, the ECUs 200a, 200b, 200c, 200d, 200e, and 200f realize various functions by the processors operating according to the control programs. A computer program is configured by combining multiple instruction codes for the processors to realize a predetermined function.

[0062] The Ethernet switch 300a receives a message from the ECU 200a and transfers the received message to an appropriate port according to the contents of the message. The Ethernet switch 300b receives a message from the ECUs 200b and 200c and transfers the received message to an appropriate port according to the contents of the message. The Ethernet switch 300c receives a message from the ECUs 200d and 200e and transfers the received message to an appropriate port according to the contents of the message. The Ethernet switch 300d receives a message from the ECUs 200f and 200g and transfers the received message to an appropriate port according to the contents of the message.

[0063] Furthermore, the Ethernet switches 300a, 300b, 300c, and 300d collect statistical information on the communication contents from the received messages, and transmit to the TCU 100 flow information including the collected statistical information.

[0064] In Fig. 1, all the networks are Ethernet-based, but other networks may be included. For example, the control system network may use CAN, or other protocols.

[0065] The Ethernet switch 300a and the ECU 200a form one sub-network. The Ethernet switch 300b, the ECU 200b, and the ECU 200c form one sub-network. The Ethernet switch 300c, the ECU 200d, and the ECU 200e form one sub-network. The Ethernet switch 300d, the ECU 200f, and the ECU 200g form one sub-network. In this manner, the in-vehicle network monitoring system is configured to include one or more sub-networks. For example, the in-vehicle network monitoring system may be configured to include two or more sub-networks.

[0066] Each Ethernet switch functions as an observation unit that observes messages flowing in the in-vehicle network monitoring system and as a collection device for collecting flow records. For example, the observation unit may be realized by an Ethernet switch included in the in-vehicle network monitoring system and connected to one or more ECUs. The observation unit and the collection device are not limited to being the same device, and may be different devices. Also, the observation unit is disposed in each of two or more sub-networks, for example. The observation unit may be realized by another device disposed on the in-vehicle network monitoring system. For example, the observation unit may be realized by a router (not shown) or the like.

[0067] [1.2 Configuration of TCU100] FIG. 2 is a configuration diagram of the TCU 100 in this embodiment.

[0068] As shown in FIG. 2, the TCU 100 includes an exterior communication unit 101, an application unit 102, a communication unit 103, a flow aggregation unit 104, a flow verification unit 105, a latest flow holding unit 106, and a vehicle state holding unit 107.

[0069] The external communication unit 101 serves as a communication interface with the outside of the vehicle 10, for example the Internet, and communicates with an external server located outside the vehicle, notifying the external server of information about the vehicle 10, receiving firmware from the external server, and transferring it to the vehicle network.

[0070] The application unit 102 operates an application for notifying an external server of in-vehicle network information, an application for transferring firmware received from an external server to the in-vehicle network, and the like.

[0071] The application unit 102 also has a role of notifying the flow information received from the in-vehicle network to the flow aggregation unit 104, receiving the aggregated flow information, and notifying an external server.

[0072] A plurality of applications can run in the application section 102 .

[0073] The communication unit 103 is connected to the Ethernet switch 300a, and receives messages transferred from the Ethernet switch 300a.

[0074] Furthermore, in response to a transmission request from the application unit 102, the communication unit 103 transmits a message to the Ethernet switch 300a.

[0075] The flow aggregation unit 104 receives flow information notified from the Ethernet switches 300 a , 300 b , 300 c , and 300 d , and stores the information in the latest flow storage unit 106 .

[0076] In addition, the flow aggregation unit 104 aggregates flows received from the Ethernet switches 300a, 300b, 300c, and 300d at a predetermined interval (for example, 60 seconds) and generates a new aggregated flow (aggregated flow information). It can also be said that the flow aggregation unit 104 aggregates flow information collected in multiple different domains.

[0077] The aggregated flow may be generated based on, for example, at least one of the vehicle state stored in the vehicle state storage unit 107 and the flow verification result of the flow verification unit 105. The generated aggregated flow is notified to, for example, an external server located outside the vehicle as a communication log of the in-vehicle network.

[0078] The flow verifier 105 detects inconsistencies between the flow information collected from the Ethernet switches 300a, 300b, 300c, and 300d stored in the latest flow holder 106, detects changes in the flow information, etc., at the timing notified by the flow aggregater 104. For example, when there is a mismatch between the flow information collected by the Ethernet switch 300a and the flow information collected by the Ethernet switch 300b with respect to the number of observed messages included in the flow information of messages transferred from the Ethernet switch 300a to the Ethernet switch 300b, the flow verifier 105 notifies the flow aggregater 104.

[0079] The latest flow storage unit 106 stores the flow information received from the Ethernet switches 300a, 300b, 300c, and 300d. The latest flow information will be described in detail later.

[0080] The vehicle state storage unit 107 stores the latest vehicle state notified from the application unit 102. The vehicle state will be described in detail later.

[0081] It should be noted that the flow verification unit 105 and the vehicle state storage unit 107 are not essential components.

[0082] The information processing unit includes at least the flow aggregation unit 104. The information processing unit may include, for example, the application unit 102, the flow aggregation unit 104, and the flow verification unit 105.

[0083] [1.3 ECU configuration] 3 is a configuration diagram of the ECU 200a in this embodiment. Note that the ECUs 200b to 200g have the same configuration, so a description thereof will be omitted.

[0084] As shown in FIG. 3, the ECU 200a includes a communication unit 201 and an application unit 202.

[0085] The communication unit 201 is connected to the Ethernet switch 300a and is a communication interface for transmitting and receiving frames.

[0086] The application unit 202 executes applications such as reading sensor values ​​connected to the ECU 200a and controlling actuators.

[0087] [1.4 Ethernet switch configuration] 4 is a configuration diagram of the Ethernet switch 300a in this embodiment. Note that the Ethernet switches 300b, 300c, and 300d have the same configuration, so a description thereof will be omitted.

[0088] As shown in FIG. 4, the Ethernet switch 300 a includes a communication unit 301 and a flow collection unit 302 .

[0089] The communication unit 301 has a plurality of communication ports, each connected to the TCU 100 and the ECU 200a, and transfers a message according to the contents of the received message. The communication unit 301 also notifies the flow collection unit 302 of the message in order to extract information for monitoring the received message.

[0090] The flow collection unit 302 collects flow information based on header information included in a message notified from the communication unit 301 .

[0091] The flow collection unit 302 holds statistics such as the number of received messages and the number of received bytes for each predefined flow, and updates the flow information corresponding to the received messages.

[0092] In addition, the flow information is transmitted as a message at a predetermined interval, and the held flow information is reset. The predetermined interval is, for example, 60 seconds, and after collecting flow information for 60 seconds, the Ethernet switch 300a transmits the flow information, resets the flow information, and starts collecting flow information again for 60 seconds.

[0093] [1.5 An example of the latest flow] Fig. 5 is a diagram showing an example of latest flow information in this embodiment. The latest flow information is stored in latest flow storage unit 106. Fig. 5 shows an example in which one row is information for one flow, and the number of messages received for each flow is stored. A flow has the same flow identification information, that is, it has the same attributes.

[0094] Each flow stores the location where it was collected (collection point), for example the identification information of the Ethernet switch that collected the flow information, information for identifying the flow (flow identification information, which is a combination of source IP address, destination IP address, source port number, destination port number, and transport protocol), and the number of messages received.

[0095] The collection location is information for identifying the observation unit, and is an example of observation unit identification information.

[0096] The flow identification information may include one or more of a source IP address, a destination IP address, a source port number, a destination port number, a protocol number, a message ID, and a transport protocol. The flow identification information may also include at least one or a combination of two or more of a source IP address, a destination IP address, a source port number, a destination port number, a protocol number, a message ID, and a transport protocol. The flow record includes at least the flow identification information.

[0097] The number of messages is an example of the first statistical information. The number of messages shown in Fig. 5 is, for example, the number of messages acquired during the same period.

[0098] Moreover, the flow information includes, for example, information indicating a collection point and one or more flow records.

[0099] The first line of the flow indicates that the collection point is "300a", the source IP address is "192.168.1.1", the destination IP address is "192.168.1.10", the source port number is "5000", the destination port number is "6001", the transport protocol is "UDP", and the number of messages received is "2000".

[0100] The flow in the second line indicates that the collection point is "300a", the source IP address is "192.168.1.2", the destination IP address is "192.168.1.1", the source port number is "5000", the destination port number is "5001", the transport protocol is "UDP", and the number of messages received is "300".

[0101] The flows in the first and second rows are flow information acquired from the Ethernet switch 300a. It can also be said that the flow information includes two flow records.

[0102] The flow information in between is omitted, and the flow in the last line (line 4) indicates that the collection point is "300d", the source IP address is "192.168.1.1", the destination IP address is "192.168.1.10", the source port number is "5000", the destination port number is "6001", the transport protocol is "UDP", and the number of messages received is "2000".

[0103] The flow in the last row is the flow information acquired from the Ethernet switch 300d. It can also be said that the flow information includes one flow record.

[0104] [1.6 Example of vehicle condition] Fig. 6 is an example of a vehicle state in this embodiment. The vehicle state is stored in the vehicle state storage unit 107. Fig. 6 shows that the current vehicle state is in autonomous driving. The vehicle state can be updated based on information included in messages, etc. of the in-vehicle network.

[0105] The vehicle state is not limited to an automatic driving state. The vehicle state may be, for example, a state in which the vehicle is stopped, charging, running, running at high speed, in a diagnostic mode, firmware update, etc. The vehicle state may also include at least a running state such as a stopped state and an automatic driving state. In addition, the state in which the vehicle is running may include a state in which the vehicle is automatically driven or manually driven.

[0106] Based on the above description, the configuration of the TCU 100 according to the present embodiment will now be described. The TCU 100 according to the present embodiment is a communication log aggregation device in an in-vehicle network monitoring system (an example of a control network system) that is composed of two or more sub-networks, and is disposed on the in-vehicle network monitoring system. The TCU 100 is an Ethernet switch (an example of a collection device) that collects flow records including flow identification information included in messages flowing through an Ethernet switch (an example of an observation unit, such as the Ethernet switch 300a) arranged on an in-vehicle network monitoring system, and the number of messages for each flow (an example of first statistical information) to be classified based on the flow identification information, and is equipped with a communication unit 103 (an example of an acquisition unit) that acquires flow information including one or more flow records and the number of messages for each flow from each of the Ethernet switches arranged on two or more sub-network systems, and a flow aggregation unit 104 (an example of an information processing unit) that generates aggregated flow information by performing at least one of selecting one or more flow records included in the acquired one or more flow information, adding second statistical information based on the number of messages (for example, abnormality flag information described later), and deleting one or more flow records, and outputs the generated aggregated flow information.

[0107] Note that selecting one or more flow records includes, for example, selecting a desired flow record from one or more flow records, and deleting one or more flow records includes, for example, deleting a desired flow record from one or more flow records.

[0108] [1.7 Flow Aggregation Sequence in TCU] Fig. 7 is a diagram showing a flow aggregation sequence in the TCU 100 according to the present embodiment. Specifically, Fig. 7 is a diagram showing a sequence in which the TCU 100 aggregates flow information notified from the Ethernet switches 300a, 300b, 300c, and 300d.

[0109] The Ethernet switch 300a notifies the TCU 100 of the flow information (S101). The communication unit 103 of the TCU 100 receives the flow information from the Ethernet switch 300a. The communication unit 103 functions as an acquisition unit.

[0110] The TCU 100 updates the latest flow information based on the received flow information (S102). The flow aggregation unit 104 of the TCU 100 updates the flow information corresponding to the Ethernet switch 300a (flow information collected from the Ethernet switch 300a) stored in the latest flow storage unit 106 based on the received flow information. For example, the flow aggregation unit 104 replaces the flow information corresponding to the Ethernet switch 300a with the flow information received from the Ethernet switch 300a at a predetermined interval (for example, 60 seconds). It can also be said that the flow aggregation unit 104 replaces the number of messages of the flow information corresponding to the Ethernet switch 300a with the number of messages of the flow information received from the Ethernet switch 300a at a predetermined interval (for example, 60 seconds). The update processes in steps S105, S109, and S112 described below are performed in a similar manner.

[0111] The predetermined interval is, for example, the same time interval in each Ethernet switch, but may be different from each other.

[0112] The Ethernet switch 300b transmits the flow information to the Ethernet switch 300a (S103).

[0113] The Ethernet switch 300a transfers the flow information received from the Ethernet switch 300b to the TCU 100 (S104). The communication unit 103 of the TCU 100 receives the flow information from the Ethernet switch 300b via the Ethernet switch 300a.

[0114] The TCU 100 updates the latest flow information based on the received flow information (S105). In step S105, the flow information corresponding to the Ethernet switch 300b is updated.

[0115] The Ethernet switch 300c transmits the flow information to the Ethernet switch 300b (S106).

[0116] The Ethernet switch 300b transfers the flow information received from the Ethernet switch 300c to the Ethernet switch 300a (S107).

[0117] The Ethernet switch 300a transfers the flow information received from the Ethernet switch 300b (the flow information transmitted from the Ethernet switch 300c) to the TCU 100 (S108). The communication unit 103 of the TCU 100 receives the flow information from the Ethernet switch 300c via the Ethernet switch 300a.

[0118] The TCU 100 updates the latest flow information based on the flow information received from the Ethernet switch 300a (the flow information transmitted from the Ethernet switch 300c) (S109). In step S109, the flow information corresponding to the Ethernet switch 300c is updated.

[0119] The Ethernet switch 300d transmits the flow information to the Ethernet switch 300a (S110).

[0120] The Ethernet switch 300a transfers the flow information received from the Ethernet switch 300d to the TCU 100 (S111). The communication unit 103 of the TCU 100 receives the flow information from the Ethernet switch 300d via the Ethernet switch 300a.

[0121] The TCU 100 updates the latest flow information based on the flow information received from the Ethernet switch 300a (the flow information transmitted from the Ethernet switch 300d) (S112). Step S112 is executed by, for example, the flow aggregation unit 104 of the TCU 100. In step S112, the flow information corresponding to the Ethernet switch 300d is updated.

[0122] Next, the TCU 100 aggregates the latest flow information based on whether a predetermined relationship is satisfied (S113). Step S113 is executed by the flow aggregation unit 104, for example.

[0123] Next, the TCU 100 outputs the aggregated flow information (aggregated flow information) (S114). The TCU 100 transmits the aggregated flow information to, for example, an external server.

[0124] [1.8 Flow chart of TCU flow information collection] 8 is a flow chart of flow information aggregation in the present embodiment by the TCU 100. The process shown in FIG.

[0125] The TCU 100 determines whether or not flow information has been received (S201).

[0126] If the flow information has been received (YES in S201), the TCU 100 updates the corresponding latest flow information (S202) and executes step S203.

[0127] Moreover, if the flow information has not been received (NO in S201), the TCU 100 executes step S203.

[0128] Next, the TCU 100 determines whether it is a predetermined timing for performing flow aggregation (S203). For example, the TCU 100 may determine whether the current time is the predetermined timing based on the elapsed time since the previous flow aggregation was performed, but the determination method is not limited thereto, and may determine whether it is a predetermined time, for example.

[0129] If it is time to perform flow aggregation (YES in S203), the TCU 100 executes step S204.

[0130] If it is not time to perform flow aggregation (NO in S203), the TCU 100 ends the process.

[0131] Next, the TCU 100 performs a flow aggregation process (S204). A specific flow aggregation process flow will be described with reference to Fig. 9 (first flow aggregation method), Fig. 11 (second flow aggregation method), and Fig. 13 (third flow aggregation method). The TCU 100 aggregates flow information using at least one of the first to third flow aggregation methods.

[0132] Thereafter, the TCU 100 outputs the aggregated flow information (aggregated flow information) (S205), and ends the process.

[0133] [1.9 Processing flow chart of the first flow aggregation method] Fig. 9 is a flowchart of a first flow aggregation method of the TCU 100 in this embodiment. Fig. 9 is a flowchart showing one processing method (first flow aggregation method) of the variation of the flow aggregation in step S204 in Fig. 8. The process shown in Fig. 9 is executed by, for example, the flow aggregation unit 104.

[0134] The TCU100 checks (determines) whether the same flow (same flow) exists between different collection points in the latest flow information (S301). If the same flow is confirmed in different collection points (e.g., different Ethernet switches) (YES in S301), the TCU100 aggregates the corresponding flow information into one piece of flow information, and sets it as aggregated flow information (S302). If the same flow does not exist in different collection points (NO in S301), the TCU100 sets the latest flow information as aggregated flow information (S303). For example, the TCU100 sets all flow information included in the latest flow information as aggregated flow information. Note that whether the flows are the same is determined based on whether the flow information matches. Whether the same flow exists is an example of whether a predetermined relationship is satisfied.

[0135] FIG. 10 is a diagram showing an example of output of aggregated flow information by the first flow aggregation method in this embodiment. FIG. 10 shows aggregated flows (aggregated flow information) output by the first flow aggregation method in the case of the latest flow information shown in FIG. 5. The flow (first flow) in the first row and the flow (second flow) in the fourth row in the latest flow information are the same flow, that is, they have the same source IP address, destination IP address, source port, destination port, and transport protocol, so the information is aggregated into one. As for the aggregated flow information, the aggregated points of the information of the flow are 300a and 300d, and the number of messages refers to one of them (for example, the number of messages in 300a). In other words, the aggregated flow information is generated without including the flow record of one of the first flow (for example, the first flow information) and the second flow (for example, the second flow information).

[0136] As described above, the observation unit may include the Ethernet switch 300a (an example of a first observation unit) and the Ethernet switch 300d (an example of a second observation unit). The communication unit 103 of the TCU 100 acquires from the Ethernet switch 300a the first flow information collected by the Ethernet switch 300a, and acquires from the Ethernet switch 300d the second flow information collected by the Ethernet switch 300d. Then, the flow aggregation unit 104 of the TCU 100 determines whether or not the flow identification information of the flow record (an example of a first flow record) included in the first flow information is the same as the flow identification information of the flow record (an example of a second flow code) included in the second flow information, and when the determination result indicates the same, the aggregated flow information may be generated without including either the flow record included in the first flow information or the flow record included in the second flow information.

[0137] Each of the flow information includes information for identifying the Ethernet switch from which the flow information is collected (an example of observation unit identification information).The flow aggregating unit 104 may add the observation unit identification information included in one of the first flow information and the second flow information (e.g., the second flow information) to the other of the first flow information and the second flow information (e.g., the first flow information).

[0138] This makes it possible to aggregate flow information while retaining information on the collection points. The collection points are used, for example, when an external server performs analysis using the aggregated flow information.

[0139] Note that the same flow is not limited to the same source IP address, destination IP address, source port, destination port, and transport protocol, and may be, for example, the same in a predetermined number of these items.

[0140] Although the above describes an example in which two pieces of flow information are aggregated, the number of flows to be aggregated may be three or more.

[0141] [1.10 Processing flow chart of the second flow aggregation method] Fig. 11 is a flowchart of a second flow aggregation method of the TCU 100 in this embodiment. Fig. 11 is a flowchart showing another processing method (second flow aggregation method) of the variation of the flow aggregation in step S204 in Fig. 8. The processing shown in Fig. 11 is executed by, for example, the flow aggregation unit 104 and the flow verification unit 105.

[0142] The flow verification unit 105 of the TCU 100 checks (determines) whether or not the same flow (same flow) exists between different collection points in the latest flow information (S401).

[0143] If the same flow is found in different collection points (e.g., different Ethernet switches) (YES in S401), the flow verification unit 105 checks whether the difference in the number of received messages of the corresponding flow information is within a predetermined value (e.g., 100) (S402). Whether it is within a predetermined value is an example of whether a predetermined relationship is satisfied.

[0144] If the flow verification unit 105 determines that the same flow does not exist between different collection points (NO in S401), the flow aggregation unit 104 of the TCU 100 sets the latest flow information as aggregated flow information (S405) and ends the process.

[0145] In addition, if the flow verification unit 105 determines that the same flow exists between different collection points (YES in S401) and that the difference in the number of received messages is within a predetermined value (YES in S402), the flow aggregation unit 104 of the TCU 100 aggregates the corresponding flow information into one, sets it as aggregated flow information (S403), and terminates the processing.

[0146] In addition, if the flow verification unit 105 determines that the same flow exists between different collection points (YES in S401) and that the difference in the number of received messages is not within a specified value (NO in S402), the flow aggregation unit 104 of the TCU 100 adds abnormality flag information to the corresponding flow information, sets it as aggregated flow information (S404), and terminates the processing.

[0147] Fig. 12 is a diagram showing an example of aggregated flow output by the second flow aggregation method. Fig. 12 shows aggregated flows output by the second flow aggregation method when the number of messages in the fourth line of the latest flow information shown in Fig. 5 is 5000. In Fig. 12, although the flows in the first and fourth lines of the latest flow information are the same, the difference in the number of messages is 3000, so an abnormality flag is added to the aggregated flow information, and the abnormality flag of the relevant flow information becomes "1". The abnormality flag is an example of an abnormality identification flag.

[0148] In this way, the aggregated flow information may be information in which abnormality flag information is added to the latest flow information. Even if the same flow exists, if the difference in the number of messages is not within a predetermined value, the respective flow information is not aggregated and the aggregated flow information is generated.

[0149] In FIG. 12, each abnormality flag in the same flow is set to "1", but this is not limited thereto, and it is sufficient that at least one abnormality flag in the same flow is set to "1".

[0150] For example, if the answers are YES in steps S401 and S402, the abnormality flag becomes "0", indicating that no abnormality exists.

[0151] When the same flow is confirmed multiple times, the process of steps S402 to S404 is carried out for each of the same flows.

[0152] As described above, the first statistical information includes the number of messages (an example of a statistical amount) based on the amount of received messages. Then, when the flow identification information of the flow record (an example of a first flow record) included in the first flow information and the flow identification information of the flow record (an example of a second flow record) included in the second flow information are the same, and further, the first reception amount included in the first flow information and the second reception amount included in the second flow information satisfy a predetermined relationship, the flow aggregation unit 104 may generate aggregated flow information without including one of the flow record included in the first flow information and the flow record included in the second flow information.

[0153] In addition, it can also be said that the flow aggregation unit 104 outputs aggregated flow information including the first flow record and the second flow record when the flow identification information of the first flow record included in the first flow information collected by Ethernet switch 300a is identical to the flow identification information of the second flow record included in the second flow information collected by Ethernet switch 300d, and the reception volume for the first flow record and the reception volume for the second flow record do not satisfy a specified relationship.

[0154] Furthermore, if the first reception amount and the second reception amount do not satisfy a predetermined relationship, the flow aggregating unit 104 may further add an anomaly identification flag indicating the occurrence of an anomaly to at least one of the first flow record and the second flow record. For example, the flow aggregating unit 104 may add an anomaly identification flag to both the first flow record and the second flow record.

[0155] The predetermined relationship may also include a condition that the difference between the first reception amount and the second reception amount (for example, the difference in the number of messages) is within a predetermined value.

[0156] [1.11 Processing flow chart of the third flow aggregation method] Fig. 13 is a flowchart of a third flow aggregation method of the TCU 100 in this embodiment. Fig. 13 is a flowchart showing yet another processing method (third flow aggregation method) of the variation of the flow aggregation in step S204 in Fig. 8. The processing shown in Fig. 13 is executed by, for example, the flow aggregation unit 104. The flow aggregation unit 104 also functions as a vehicle state determination unit.

[0157] The TCU 100 checks (determines) whether the vehicle state is stopped or not (S501). The TCU 100 may determine whether the vehicle state is stopped or not based on the speed of the vehicle 10, for example.

[0158] If the vehicle state is stopped (YES in S501), the TCU 100 aggregates the flow information related to diagnostic commands or firmware updates from the latest flow information (S502) and ends the process. In step S502, the TCU 100 extracts only the flow information related to updates from the latest flow information, for example, to generate the aggregated flow information.

[0159] If the vehicle state is not stopped (NO in S501), the TCU 100 checks whether the vehicle state is autonomous driving or not (S503). The TCU 100 may determine whether the vehicle state is autonomous driving or not based on whether a message related to autonomous driving control is being transmitted or received within the in-vehicle network monitoring system, for example.

[0160] If the vehicle state is in automatic driving (YES in S503), the TCU 100 sets the flow information related to automatic driving control among the latest flow information as aggregated flow information (S504), and ends the process. In step S504, the TCU 100 extracts, for example, only the flow information related to automatic driving control among the latest flow information, and generates the aggregated flow information.

[0161] If the vehicle state is not in automatic driving (NO in S503), the TCU 100 sets the latest flow information as aggregated flow information (S505) and ends the process. In step S505, the TCU 100 generates aggregated flow information including, for example, all flow information included in the latest flow information. Note that, when NO in step S503, the vehicle state may be, for example, in manual driving or charging.

[0162] Fig. 14 is a diagram showing an example of output of aggregated flows by the third flow aggregation method. Fig. 14 shows an example in which the latest flow information stores a flow related to information system communication in the first line, a flow related to body system control communication in the second line, and a flow related to automatic driving control communication in the third line. At this time, the vehicle state stored in the vehicle state storage unit 107 of the TCU 100 is assumed to be in automatic driving.

[0163] The flow aggregation unit 104 of the TCU 100 extracts only flows related to automatic driving control (flow information collected at 300c) from the latest flow information, and generates aggregated flow information including the extracted flow information. Figure 14 shows an example in which, as a result of flow aggregation, only the flow related to automatic driving control communication in the third row is output as an aggregated flow.

[0164] As described above, the TCU 100 includes the flow aggregation unit 104 (an example of a vehicle state determination unit) that determines the vehicle state of the vehicle 10. The flow aggregation unit 104 may further perform at least one of selecting one or more flow records, adding second statistical information, and deleting one or more flow records based on the vehicle state.

[0165] The vehicle state may include either a stopped state or an autonomous driving state.

[0166] Furthermore, when the vehicle state is stopped, the flow aggregation unit 104 may select a flow record related to at least one of a diagnosis command and an update command from one or more flow records, and generate aggregated flow information including the selected flow record. Furthermore, when the vehicle state is in autonomous driving, the flow aggregation unit 104 may select a flow record related to autonomous driving control from one or more flow records, and generate aggregated flow information including the selected flow record. Furthermore, when the vehicle state is neither stopped nor autonomous driving, the flow aggregation unit 104 may generate aggregated flow information including one or more acquired flow information. Furthermore, the flow aggregation unit 104 may determine the vehicle state including either a stopped state or a running state as the determination of the vehicle state.

[0167] [1.12 Effect of the first embodiment] The TCU 100 according to the present embodiment collects network communication logs (flow information) notified from the flow collection unit 302 of the Ethernet switch arranged in the in-vehicle network, and aggregates the information when the flow information collected at different locations is the same. This makes it possible to aggregate redundant information such as messages transferred in the in-vehicle network, and thus makes it possible to reduce the communication logs.

[0168] Furthermore, the flow aggregation unit 104 checks the consistency of flow information collected at different locations, and adds an abnormality flag to flow information that is inconsistent with the aggregated flow information. This makes it possible to detect abnormalities that are difficult to detect using flow information collected at one location, and to easily check abnormal flow information using the aggregated flow information.

[0169] Furthermore, the flow aggregation unit 104 selects aggregated flow information based on the flow information collected at different locations and the current vehicle state. This makes it possible to check only the flow information that is more appropriate depending on the vehicle state, and thus makes it possible to reduce the in-vehicle network communication log.

[0170] In this manner, the TCU 100 according to the present embodiment can appropriately aggregate communication logs in the in-vehicle network system according to at least one of the presence or absence of the same flow, the detection of an abnormality, and the vehicle state.

[0171] (Embodiment 2) Hereinafter, a network communication log aggregating device (communication log aggregating device) in a vehicle equipped with an in-vehicle network (in-vehicle network system) in which multiple electronic control units (ECUs) communicate via Ethernet will be described. Note that components having the same functions as those in the first embodiment will be given the same reference numerals and will not be described.

[0172] [2.1 Configuration of in-vehicle network monitoring system] 15 is a configuration diagram of an in-vehicle network monitoring system in this embodiment. The in-vehicle network monitoring system is mounted on a vehicle 10a. The in-vehicle network monitoring system is an example of a control network system.

[0173] 15, the in-vehicle network monitoring system includes a TCU 1100, an ECU 200a, an ECU 200b, an ECU 200c, an ECU 200d, an ECU 200e, an ECU 200f, an ECU 200g, an Ethernet switch 300a, an Ethernet switch 300b, an Ethernet switch 300c, and an Ethernet switch 300d. The TCU 1100 has an interface for connecting to an external network and communicates with, for example, an external server.

[0174] [2.2 TCU configuration diagram] FIG. 16 is a configuration diagram of a TCU 1100 in this embodiment.

[0175] As shown in FIG. 16, the TCU 1100 includes an exterior communication unit 101 , an application unit 102 , a communication unit 103 , a flow collection unit 1104 , a flow aggregation unit 1105 , a latest flow holding unit 1106 , and a vehicle state holding unit 107 .

[0176] The flow collection unit 1104 monitors communications on the in-vehicle network sent and received by the communication unit 103, communications between applications in the application unit 102, and messages of communications from the external communication unit 101, and collects flow information based on the header information contained in the messages.

[0177] The flow information is defined by a set of a source IP address, a destination IP address, a source port number, a destination port number, and a transport protocol included in a message, and includes statistical information about the flow, such as the number of messages observed and the total number of bytes of the message.

[0178] The flow collection unit 1104 stores the collected flow information in a latest flow storage unit 1106 .

[0179] In addition, the flow collection unit 1104 updates the vehicle state stored in the vehicle state storage unit 107 based on a notification from the application unit 102 .

[0180] The flow aggregation unit 1105, at a predetermined interval, refers to the latest flow storage unit 1106 in which the flows collected by the flow collection unit 1104 are stored, and the vehicle status stored in the vehicle status storage unit 107, and outputs the aggregated flow information. Note that it is not essential to refer to the vehicle status.

[0181] The aggregated flow information is notified to an external server disposed outside the vehicle via the external communication unit 101 as, for example, a communication log of the in-vehicle network.

[0182] The flow aggregation unit 1105 updates the flow information stored in the latest flow storage unit 1106 after aggregating the flows.

[0183] The latest flow storage unit 1106 stores the flow information collected by the flow collection unit 1104. The latest flow information will be described later in detail.

[0184] [2.3 Example of latest flow information] 17 is a diagram showing an example of the latest flow information in this embodiment. The latest flow information is stored in the latest flow storage unit 1106.

[0185] Fig. 17 shows an example in which the number of messages received for each flow and the number of previous messages are stored. Note that in Fig. 17, communication with an external network (external communication) is described as "external", communication between applications (inter-application communication) is described as "inter-application", and in-vehicle network communication (in-vehicle communication) is described as "in-vehicle".

[0186] 17, each flow in the latest flow information includes information identifying the location where the flow was collected (collection location), i.e., whether the flow is a communication with an external network, a communication between applications, or an in-vehicle network, information for identifying the flow (a combination of a source IP address, a destination IP address, a source port number, a destination port number, and a transport protocol), the number of messages received, and the number of previous messages. The number of previous messages holds the number of messages at the time when the flow was previously aggregated.

[0187] 17 is an example of first statistical information, and the previous message number is an example of previous first statistical information. The previous message number may be past first statistical information. The past first statistical information may be, for example, an average value of multiple past first statistical information.

[0188] The flow in the first line indicates that the collection point is "external network (outside the vehicle)", the source IP address is "200.200.200.10", the destination IP address is "100.100.100.10", the source port number is "80", the destination port number is "50100", the transport protocol is "TCP", the number of messages received is "100", and the number of previous messages is "0".

[0189] The flow in the second line indicates that the collection point is "external network (outside the vehicle)", the source IP address is "100.100.100.10", the destination IP address is "200.200.200.10", the source port number is "50100", the destination port number is "80", the transport protocol is "TCP", the number of messages received is "50", and the number of previous messages is "0".

[0190] The flow on the third line indicates that the collection point is "Inter-app communication (Inter-app)", the source IP address is "127.0.0.1", the destination IP address is "127.0.0.1", the source port number is "50000", the destination port number is "50001", the transport protocol is "UDP", the number of received messages is "10", and the number of previous messages is "9".

[0191] The flow information in between is omitted, and the final flow shows that the collection point is "in-vehicle network (in-vehicle)", the source IP address is "192.168.1.1", the destination IP address is "192.168.1.10", the source port number is "5000", the destination port number is "6001", the transport protocol is "UDP", the number of received messages is "2000", and the number of previous messages is "2000".

[0192] The acquisition of information for identifying whether the communication is with an external vehicle network, between applications, or in-vehicle network communication is realized, for example, by an observation unit. For example, a message acquired by the external vehicle communication unit 101 is subjected to a first determination that it is communication with an external vehicle network, a message communicated between applications inside the application unit 102 is subjected to a second determination that it is communication between applications, and a message transmitted and received on the in-vehicle network is subjected to a third determination that it is in-vehicle network communication. For example, the external vehicle communication unit 101 is an example of a third observation unit that makes the first determination, the application unit 102 is an example of a fourth observation unit that makes the second determination, and the communication unit 103 is an example of a fifth observation unit that makes the third determination.

[0193] In this manner, the TCU 1100 may include a third monitoring unit that monitors communication with an external network, a fourth monitoring unit that monitors communication between applications, and a fifth monitoring unit that monitors communication in the in-vehicle network. The third to fifth monitoring units may be realized by one component, for example, by the flow collection unit 1104.

[0194] The number of previous messages shown in FIG. 17 may be included in the latest flow information shown in FIG. 5 of the first embodiment, for example.

[0195] [2.4 Flow Collection Flowchart] 18 is a flow collection flowchart of the TCU 1100 in this embodiment.

[0196] As shown in Fig. 18, the TCU 1100 checks (determines) whether or not a message has been received (S601). If a message has been received (YES in S601), the TCU 1100 executes step S602. If a message has not been received (NO in S601), the TCU 1100 waits until a message is received (executes S601 again). The message is received by, for example, any one of the exterior communication unit 101, the application unit 102, and the communication unit 103.

[0197] Next, when the TCU 1100 receives a message (YES in S601), the TCU 1100 checks whether the received message was observed through communication outside the vehicle (S602).

[0198] If the communication is outside the vehicle (YES in S602), the TCU 1100 updates the latest flow information by setting the collection point to "external vehicle communication" (S603), and ends the process. The flow collection unit 1104 stores the flow with the collection point set to "external vehicle communication" in the latest flow storage unit 1106 as the latest flow information.

[0199] Moreover, if the received message is not an external-vehicle communication message (NO in S602), the TCU 1100 checks whether the message is a message observed in an internal-vehicle communication message (S604).

[0200] If the received message is in-vehicle communication (YES in S604), the TCU 1100 updates the latest flow information with the collection point set to "in-vehicle communication" (S605) and ends the process. The flow collection unit 1104 stores the flow with the collection point set to "in-vehicle communication" in the latest flow storage unit 1106 as the latest flow information.

[0201] If the received message was not observed in the in-vehicle communication (NO in S604), the TCU 1100 updates the latest flow information by setting the collection point to "inter-application communication" (S606), and ends the process. The flow collection unit 1104 stores the flow with the collection point set to "inter-application communication" in the latest flow storage unit 1106 as the latest flow information.

[0202] [2.5 Flow information aggregation flowchart] 19 is a flowchart of flow information aggregation by the TCU 1100 in this embodiment.

[0203] 19, the TCU 1100 determines whether it is time for flow aggregation to occur at a predetermined interval (S701). If it is not time for flow aggregation (NO in S701), the TCU 1100 ends the process.

[0204] Also, if it is time for flow aggregation (YES in S701), TCU 1100 performs flow information aggregation processing based on the latest flow information stored in the latest flow holding unit 1106 and the vehicle status stored in the vehicle status holding unit 107 (S702).

[0205] Thereafter, the TCU 1100 outputs the aggregated flow information (S703), resets the latest flow information stored in the latest flow storage unit 1106 (S704), and ends the process.

[0206] Specifically, when resetting the latest flow information, the previous message count is updated with the message count (current message count) and the message count (next message count) is set to 0. Furthermore, when resetting the latest flow information, flow information with a message count of 0 may be deleted.

[0207] [2.6 Flow Aggregation Processing Flowchart] Fig. 20 is a detailed flowchart of the flow aggregation process in this embodiment. Fig. 20 is a flowchart specifically showing the flow aggregation process (S702) in Fig. 19. The process shown in Fig. 20 is executed by, for example, the flow aggregation unit 1105.

[0208] As shown in FIG. 20, the TCU 1100 checks (determines) whether the current vehicle state is stopped or not (S801).

[0209] If the vehicle state is stopped (YES in S801), TCU 1100 executes step S802, and if the vehicle state is not stopped (NO in S801), TCU 1100 executes step S804.

[0210] In step S801, if the vehicle state is stopped (YES in S801), TCU1100 checks whether a flow with a previous message count of 0 was observed at multiple collection points, that is, whether a flow that was not observed at the previous timing has been observed at the current timing (S802).

[0211] If a flow with a previous message count of 0 is observed at multiple collection points (YES in S802), the TCU 1100 sets the flow information with a previous message count of 0 as aggregated flow information (S803) and ends the process. If a flow with a previous message count of 0 is not observed at multiple collection points (NO in S802), the process ends. In other words, the aggregated flow information is empty.

[0212] Furthermore, in step S801, if the vehicle state is not stopped (NO in S801), the TCU 1100 checks whether or not a flow with a previous message count of 0 has been observed (S804). For example, in step S804, it checks whether or not a flow with a previous message count of 0 has been observed at one collection point. The number of flows with a previous message count of 0 observed in step S804 is, for example, less than the number of flows with a previous message count of 0 observed in step S802, but is not limited to this.

[0213] As a result, when the vehicle state is not stopped, that is, when the vehicle 10a is moving, the aggregated flow information can be generated even if the number of flows in which the previous message count is 0 is small. Therefore, the aggregated flow information can be transmitted to an external server, etc., in a shorter time.

[0214] Furthermore, if a flow with a previous message count of 0 is observed (YES in S804), the TCU 1100 sets the flow information with a previous message count of 0 as aggregated flow information (S805), and executes step S806.

[0215] Furthermore, if a flow with a previous message count of 0 has not been observed (NO in S804), the TCU 1100 executes step S806.

[0216] Next, the TCU 1100 compares the previous message count with the message count, and checks whether or not there is a flow in which the message count has increased by a predetermined number (e.g., 100) or more (S806). The result of comparing the previous message count with the message count may be, for example, calculating the difference between the previous message count and the message count, and the difference is an example of difference information.

[0217] If the corresponding flow exists (YES in S806), the TCU 1100 adds the corresponding flow information to the aggregated flow information, and further adds information of the message increase flag to the corresponding flow information (S807), and ends the process.

[0218] If there is no corresponding flow (NO in S806), the TCU 1100 ends the process.

[0219] As described above, the one or more pieces of flow information further include the previous message count (an example of the previous first statistical information). Then, the flow aggregation unit 1105 according to the present embodiment generates aggregated flow information based on the vehicle state of the vehicle 10a and difference information that is the difference between the message count and the previous message count.

[0220] Here, examples of aggregated flow information output are shown in Fig. 21 and Fig. 22. Fig. 21 is a diagram showing an example of aggregated flow information output (while the vehicle is stopped) in this embodiment. Fig. 22 is a diagram showing an example of aggregated flow information output (while the vehicle is traveling) in this embodiment. Note that "while the vehicle is traveling" may mean either while the vehicle is automatically driving or while the vehicle is manually driving.

[0221] Fig. 21 shows an example of output of aggregated flow information for the latest flow information stored in the latest flow holding unit 1106 when the vehicle state is stopped. Fig. 21 shows an example in which five pieces of flow information exist as the latest flow information, the number of previous messages is 0 for the flow information in the 1st, 3rd, and 4th lines, and there is flow information with the number of previous messages 0 at three collection points, namely "outside the vehicle," "between applications," and "inside the vehicle," respectively, and the information on the number of previous messages is removed from the flow information in the 1st, 3rd, and 4th lines of the latest flow information, and the information is output as aggregated flow information.

[0222] In step S803, the flow aggregation unit 1105 extracts flow information for which the previous message count is "0" from the latest flow information shown in Fig. 21, and generates aggregated flow information including the extracted flow information. It can also be said that the flow aggregation unit 1105 generates aggregated flow information including flow information that was not observed at the previous flow aggregation timing and was observed at the current flow aggregation timing.

[0223] Fig. 22 shows an example of output of aggregated flow information for latest flow information stored in latest flow holding unit 1106 when the vehicle state is driving. In the example of Fig. 22, there are four pieces of flow information as the latest flow information, with flow information in which the previous message count is 0 in the first line and flow information in which the message count is 100 or more greater than the previous message count in the third line. Therefore, the information on the previous message count is removed from the first and third lines of the latest flow information, and furthermore, information on the increase flag is added (the flow in the first line of the latest flow information is 0, and the flow in the third line is 1), and the result is output as aggregated flow information.

[0224] In steps S805 and S807, the flow aggregation unit 1105 generates aggregated flow information including flow information whose previous message count is "0" and flow information whose increase between the previous message count and the current message count is a predetermined number or more, from the latest flow information shown in Fig. 22. An increase flag of "0" is added to flow information whose previous message count is "0", and an increase flag of "1" is added to flow information whose increase is a predetermined number or more. In other words, aggregated flow information that allows flow information whose previous message count is "0" and flow information whose increase is a predetermined number or more to be distinguished is transmitted to the external server.

[0225] 20 to 22, an example is described in which aggregated flow information including flow information in which the increase between the previous message count and the current message count is equal to or greater than a predetermined number. However, the flow aggregating unit 1105 may generate aggregated flow information including flow information in which the decrease between the previous message count and the current message count is equal to or greater than a predetermined number. For example, the flow aggregating unit 1105 may generate aggregated flow information including flow information in which the difference between the previous message count and the current message count is equal to or greater than a predetermined number. In this case, different increase flags are added to the flow information in which the increase between the previous message count and the current message count is equal to or greater than a predetermined number and the flow information in which the decrease between the previous message count and the current message count is equal to or greater than a predetermined number. The predetermined number for judging the increase and the predetermined number for judging the decrease may be different values ​​or the same value.

[0226] As described above, when the vehicle state is stopped (YES in S801), the previous message count (one example of the previous first statistical information) is zero, and there is a first number or more of third flow information in which the current message count (one example of the first statistical information) is other than zero (YES in S802), the flow aggregating unit 1105 may generate aggregated flow information including the third flow information (S803). Also, when the vehicle state is not stopped (NO in S801), the previous message count is zero, and there is a second number or more of fourth flow information in which the current message count is other than zero that is smaller than the first number, the flow aggregating unit 1105 may generate aggregated flow information including the fourth flow information (S805).

[0227] Furthermore, the flow aggregating unit 1105 may further add different flags to the third flow information and the fourth flow information.

[0228] [Other variations] Although the present disclosure has been described based on the above-mentioned embodiments, the present disclosure is not limited to the above-mentioned embodiments. The following cases are also included in the present disclosure.

[0229] (1) In the above embodiment, an example was shown in which Ethernet was used for the in-vehicle network, but this is not limited to this and the in-vehicle network may be CAN, CAN-FD (Flexible-Datarate), Ethernet, LIN, or FlexRay, or a combination of these may also be used.

[0230] (2) In the above embodiment, the flow information is aggregated on the TCU, but it does not have to be aggregated on the TCU. For example, it may be aggregated on the head unit, the central ECU, or an Ethernet switch, or the flow information may be notified to a server and the server may aggregate the flows. In addition, the flow aggregation may be performed at multiple points on the in-vehicle network. This enables flow aggregation to be performed hierarchically, which is effective in reducing network traffic associated with the transmission of communication logs.

[0231] (3) In the above embodiment, an example of flow information is shown as a network communication log, but the communication format of the flow information is not specified. It is sufficient that network communication messages are classified into flows according to a predetermined rule, and statistical information of the classified flows is included. For example, the communication format of the flow information may be IPFIX (Internet Protocol Flow Information Export) or NetFlow.

[0232] (4) In the above embodiment, a set of source IP address, destination IP address, source port number, destination port number, and transport protocol is used as information for identifying a flow, but this is not limited to the above. For example, the amount of information used may be reduced or new information may be added. The added information may be a VLAN-ID used in a Virtual LAN, or an identifier included in the payload of the application layer. This makes the definition of a flow more flexible, and makes it possible to collect flow information suitable for the network.

[0233] (5) In the above embodiment, an example in which the number of messages is held as flow information has been shown, but the flow information is not limited to the number of messages. For example, the flow information may include information such as the total number of bytes of observed messages, communication time, communication start time, and communication end time. The total number of bytes and communication time are examples of statistical information. In addition, the anomaly flag added after flow verification may be something other than an anomaly flag. For example, the flow information may be information indicating the type of anomaly detected.

[0234] (6) In the above embodiment, the latest flow information is stored in plain text, but it may be encrypted and stored. Similarly, the flow information may be encrypted and communicated. This makes it possible to prevent eavesdropping of the flow information.

[0235] (7) In the above embodiment, no mention is made of how to handle the aggregated flow information. However, the aggregated flow information may be transmitted to an in-vehicle network, notified to an external server, or stored internally (e.g., in a non-volatile memory) as a communication log.

[0236] (8) In the above embodiment, the TCU executes the flow aggregation process at a predetermined interval, but the execution timing of the flow aggregation process is not limited to this. For example, flows may be aggregated only when requested, the flow aggregation process may be omitted or the aggregation timing may be changed depending on the vehicle state, or the flow aggregation process may be executed when specific flow information is received.

[0237] (9) In the above embodiment, an example was shown in which the flow verification unit adds an abnormality flag when the number of messages for the same flow at different collection points differs depending on the collection point, but the method of adding an abnormality flag is not limited to this. For example, the number of messages may change when the collection point is different due to message thinning. Therefore, an abnormality flag may be added when the relationship of the number of messages taking thinning into account is not satisfied. Anomalies may also be detected by other methods. For example, an abnormality detection method based on a rule base or machine learning may be combined to add an abnormality flag when an abnormality is detected from flow information. This makes it possible to detect a wider variety of abnormalities during flow aggregation.

[0238] (10) In the above embodiment, the latest flow information is updated based on notified flow information or messages observed at a predetermined interval, but the latest flow information may be normalized and stored as information per unit time. This makes it possible to compare the flow information even if the collection periods for the flow information differ for each collection point.

[0239] (11) In the above embodiment, the aggregated flow information is output as is, but the amount of aggregated flow information may be further reduced. For example, the aggregated flow information output last time may be retained and only the difference may be transmitted, or a priority may be assigned according to the collection point, or flows may be regrouped based on an identifier indicating a VLAN-ID or other flow attribute, that is, flow information having the same attribute may be grouped together and included in a message to be transmitted and output. Also, the above process may be performed only when the size of the aggregated flow exceeds a predetermined value.

[0240] (12) In the above embodiment, an example was shown in which information such as an abnormality flag and an increase flag was added to the aggregated flow information, but information may be deleted instead of added. For example, information on a collection point may be deleted, or information that is deemed unnecessary depending on the aggregated flow information or the vehicle state may be deleted.

[0241] (13) In the above embodiment, the type of flow to be aggregated is changed according to the vehicle state. However, the flow information to be aggregated may be selected according to the collection point of the flow information, rather than the type of flow to be aggregated. The flow aggregation unit may generate aggregated flow information including flow information acquired from a specific Ethernet switch, for example. The specific Ethernet switch may be set in advance. The flow aggregation unit may also change the priority for each of two or more collection points (observation units) according to the vehicle state. For example, when the vehicle state is in automatic driving (YES in S503), the flow aggregation unit may give a higher priority to flow information related to automatic driving control among the latest flow information, compared to other flow information.

[0242] Then, the flow aggregation unit may change the ratio of one or more flow records collected at a plurality of observation points to be included in the aggregated flow information based on the changed priority. That is, the flow aggregation unit may change the selection ratio of flow information to be included in the aggregated flow information. For example, when generating aggregated flow information including one or more first flow records acquired from a first Ethernet switch (e.g., Ethernet switch 300a) and one or more second flow records acquired from a second Ethernet switch (e.g., Ethernet switch 300d), the flow aggregation unit may change the selection ratio (e.g., 8:2) of the first flow record and the second flow record included in the aggregated flow information. For example, when the vehicle state is in an autonomous driving state, the flow aggregation unit may generate aggregated flow information including more flow information related to the autonomous driving control among the latest flow information than other flow information.

[0243] (14) Each device in the above embodiments is specifically a computer system composed of a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc. A computer program is recorded in the RAM or the hard disk unit. Each device achieves its function by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands for a computer to achieve a specified function.

[0244] (15) In each of the above embodiments, some or all of the constituent elements may be configured from a single system LSI (Large Scale Integration). The system LSI is a super multi-function LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0245] Furthermore, each of the components constituting each of the above devices may be individually implemented as a single chip, or some or all of them may be included in a single chip.

[0246] In addition, although we refer to it as a system LSI here, it may also be called an IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Also, the method of integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connections and settings of the circuit cells inside the LSI.

[0247] Furthermore, if a new integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a derivative technology, it is possible to integrate the functional blocks using that technology. The application of biotechnology is also a possibility.

[0248] (16) Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that is detachable from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the module may include the above-mentioned ultra-multifunction LSI. The microprocessor operates according to a computer program, causing the IC card or the module to achieve its functions. The IC card or the module may be tamper-resistant.

[0249] (17) The present disclosure may be the methods described above. It may also be a computer program that causes a computer to realize these methods, or a digital signal that includes the computer program. For example, one aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the communication log aggregation method shown in any of Figures 7 to 9, 11, 13, and 18 to 20.

[0250] Furthermore, the present disclosure may be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Also, the present disclosure may be a digital signal recorded on such a recording medium.

[0251] Furthermore, the present disclosure may involve transmitting the computer program or the digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0252] The present disclosure may also provide a computer system having a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program.

[0253] In addition, the program or the digital signal may be implemented by another independent computer system by recording it on the recording medium and transferring it, or by transferring the program or the digital signal via the network, etc.

[0254] (18) The order in which each step is executed in the flowcharts shown in the above embodiments is merely an example for specifically explaining the present disclosure, and orders other than those described above may be used. In addition, some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0255] In addition, the division of functional blocks in the block diagrams shown in the above embodiments is merely an example, and multiple functional blocks may be realized as one functional block, one functional block may be divided into multiple blocks, or some functions may be transferred to another functional block. Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in a time-division manner by a single piece of hardware or software.

[0256] (19) In the above embodiment, the control network system is described as an example of an in-vehicle network monitoring system, but is not limited to this and may be a home network system, a facility (e.g., a hospital) network system, a factory network system, etc.

[0257] (20) The above-described embodiments and modifications may be combined with each other. [Industrial Applicability]

[0258] The present disclosure is effective for a communication log aggregation device in a control network system such as an in-vehicle network system. [Explanation of symbols]

[0259] 10, 10a Vehicle 100, 1100 TCU 101 External communication unit 102, 202 Apps 103, 201, 301 Communications Department 104, 1105 Flow Aggregation Unit 105 Flow Verification Unit 106, 1106 Latest flow retention section 107 Vehicle status maintenance unit 200a, 200b, 200c, 200d, 200e, 200f, 200g ECU 300a, 300b, 300c, 300d Ethernet Switches 302, 1104 Flow collector

Claims

1. A communication log aggregating device in a control network system including two or more subnetworks, the communication log aggregating device is disposed on the control network system, a collection device that collects flow records including flow identification information included in messages flowing to an observation unit disposed on the control network system, and first statistical information for each flow classified based on the flow identification information, the collection device acquiring flow information including one or more of the flow records and the first statistical information for each flow from each of the collection devices disposed on each of the two or more subnetworks; an information processing unit that generates aggregated flow information by performing at least one of selecting one or more of the flow records included in the one or more pieces of acquired flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputs the generated aggregated flow information; The communication log aggregating device is mounted on a vehicle, Further, a vehicle state determination unit that determines a vehicle state of the vehicle is provided, The information processing unit further performs at least one of selecting one or more of the flow records, adding the second statistical information, and deleting one or more of the flow records, based on the vehicle state determined by the vehicle state determination unit. Communication log aggregation device.

2. Two or more observation units including a first observation unit and a second observation unit are arranged in the control network system, The acquisition unit acquires first flow information collected by the first observation unit and second flow information collected by the second observation unit, the information processing unit generates the aggregated flow information without including one of the first flow record and the second flow record when the flow identification information of a first flow record included in the first flow information and the flow identification information of a second flow record included in the second flow information are identical; The communication log aggregating device according to claim 1 .

3. Each of the one or more pieces of flow information includes observation unit identification information that identifies the observation unit that collected the flow information; the information processing unit adds the observation unit identification information included in one of the first flow information and the second flow information to the other of the first flow information and the second flow information. The communication log aggregating device according to claim 2 .

4. the first statistical information includes a statistic based on a received amount of the message; the information processing unit generates the aggregated flow information without including one of the first flow record and the second flow record when one or more of the flow identification information of the first flow record included in the first flow information are identical to one or more of the flow identification information of the second flow record included in the second flow information, and further when a first reception amount included in the first flow information and a second reception amount included in the second flow information satisfy a predetermined relationship; The communication log aggregating device according to claim 2 or 3.

5. When the first reception amount and the second reception amount do not satisfy the predetermined relationship, the information processing unit further adds an anomaly identification flag indicating the occurrence of an anomaly to at least one of the first flow record and the second flow record. The communication log aggregating device according to claim 4.

6. the predetermined relationship includes a difference between the first reception amount and the second reception amount being within a predetermined value. The communication log aggregating device according to claim 4 or 5.

7. the information processing unit, when the vehicle state is a stopped state, selects the flow record related to at least one of a diagnosis command and an update command, and generates the aggregated flow information including the selected flow record. The communication log aggregating device according to claim 1 .

8. The information processing unit, when the vehicle state is in an autonomous driving state, selects the flow record related to autonomous driving control, and generates the aggregated flow information including the selected flow record. The communication log aggregating device according to claim 1 .

9. The information processing unit generates the aggregated flow information including the acquired one or more pieces of flow information when the vehicle state is not stopped and not in an autonomous driving state. The communication log aggregating device according to claim 1 .

10. The observation unit is disposed in each of the two or more subnetworks, the information processing unit changes a priority for each of the two or more observation units according to the vehicle state, and changes a ratio of the one or more flow records collected by the two or more observation units to be included in the aggregated flow information based on the changed priority. The communication log aggregating device according to any one of claims 1 and 7 to 9.

11. The observation unit includes a third observation unit that observes communication with an external vehicle network, a fourth observation unit that observes communication between applications, and a fifth observation unit that observes communication in an in-vehicle network. The communication log aggregating device according to any one of claims 1 and 7 to 10.

12. The one or more pieces of flow information further include the first statistical information of the previous time, the information processing unit generates the aggregated flow information based on a vehicle state of the vehicle and difference information that is a difference between the first statistical information and a previous piece of the first statistical information; The communication log aggregating device according to claim 10 or 11.

13. the information processing unit generates the aggregated flow information including the third flow information when the vehicle state is stopped, the previous first statistical information is zero, and there is a first number or more of third flow information whose first statistical information is other than zero, and generates the aggregated flow information including the fourth flow information when the vehicle state is not stopped, the previous first statistical information is zero, and there is a second number or more of fourth flow information whose first statistical information is other than zero that is smaller than the first number. The communication log aggregating device according to claim 12.

14. the information processing unit further adds different flags to the third flow information and the fourth flow information. The communication log aggregating device according to claim 13.

15. The flow identification information includes at least one of a source IP address, a destination IP address, a source port number, a destination port number, a protocol number, and a message ID, or a combination of two or more of the source IP address, a destination IP address, a source port number, a destination port number, a protocol number, and a message ID. The communication log aggregating device according to any one of claims 1 to 14.

16. The observation unit is an Ethernet switch included in the control network system and to which one or more electronic control devices are connected. The communication log aggregating device according to any one of claims 1 to 15.

17. outputting the aggregated flow information in an IPFIX (Internet Protocol Flow Information Export) or NetFlow format; The communication log aggregating device according to any one of claims 1 to 16.

18. A communication log aggregating method used in a communication log aggregating device in a control network system composed of two or more subnetworks, comprising: a collection device that collects flow records including flow identification information included in messages flowing to an observation unit arranged in the control network system, and first statistical information for each flow classified based on the flow identification information, and obtains flow information including one or more of the flow records and the first statistical information for each flow from each of the collection devices arranged in each of the two or more subnetworks; generating aggregated flow information by performing at least one of selecting one or more of the flow records included in the one or more pieces of acquired flow information, adding second statistical information based on the first statistical information, and deleting one or more of the flow records, and outputting the generated aggregated flow information; The communication log aggregating device is mounted on a vehicle, The communication log aggregation method further includes: determining a vehicle state of the vehicle; performing at least one of selecting one or more of the flow records, adding the second statistical information, and deleting one or more of the flow records based on the determined vehicle state; A method for aggregating communication logs.

Images