Abnormal determination method, abnormal determination device, and program

Abstract

To provide an anomaly determination method which enables effective anomaly detection processing.SOLUTION: An anomaly determination method includes: receiving a plurality of messages which include messages that are periodic, each of the messages including a first field having a fixed value and a second field having a variable value, as the received messages; calculating available time for anomaly determination in the received messages; and selecting one of the following options, employing all n anomaly determinations, employing k anomaly determinations of the n anomaly determinations, and employing no anomaly determination so as to finish within the calculated time. The n anomaly determinations include an anomaly determination utilizing a reception timing based on the periodicity or the number of received messages, an anomaly determination utilizing the first field, and an anomaly determination utilizing the second field.SELECTED DRAWING: Figure 12

Description

Technical Field

[0001] The present disclosure relates to a method for determining a detection function according to a processing load when detecting an abnormal message in a vehicle network, and the like.

Background Art

[0002] In recent years, a large number of devices called electronic control units (ECUs) have been arranged in the systems of automobiles. The communication network connecting these ECUs is called a vehicle network. There are a number of communication standards in the vehicle network. Among them, Controller Area Network (hereinafter referred to as CAN) is one of the most mainstream vehicle network standards.

[0003] In a network based on the CAN standard (hereinafter also referred to as a CAN network), the communication path (bus) is composed of two cables, and the ECU connected to the bus is also called a node. Each node connected to the bus transmits and receives data in units called frames or messages. Also in CAN, an identifier indicating the transmission destination or transmission source of data is not used.

[0004] A node that transmits a frame (hereinafter also referred to as a transmitting node) attaches an ID called a message ID indicating the type of message to each message and transmits the message, that is, sends a signal to the bus. A node that receives a message (hereinafter also referred to as a receiving node) receives only messages including a predetermined message ID, that is, reads a signal from the bus. Messages with the same ID are transmitted at regular intervals.

[0005] As described above, a large number of ECUs arranged in the systems of automobiles are each connected to a CAN network and operate while exchanging various messages with each other.

[0006] Here, an ECU with a communication function external to the CAN network may be illegally controlled by someone due to being illegally accessed from the outside, etc., and may send abnormal messages (also referred to as attack messages) to the CAN network. Such an ECU illegally controlled by someone (also referred to as an illegal ECU) can, for example, masquerade as another ECU and send abnormal messages to illegally control the vehicle. A method for detecting such a so-called masquerade attack is disclosed in, for example, Patent Document 1.

Prior Art Documents

Patent Documents

[0007]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0008] However, in the method disclosed in Patent Document 1, there is a problem that the abnormality detection process is not executed when the time during which the abnormality detection process for detecting abnormal messages sent to the in-vehicle network can be executed is short.

[0009] Therefore, the present disclosure provides an abnormality determination method capable of performing an effective abnormality detection process, an abnormality determination device, and the like.

Means for Solving the Problems

[0010] In order to solve the above problems, an abnormality determination method according to an aspect of the present disclosure is an abnormality determination method for determining an abnormality in a received message, the method including: receiving, as the received message, each of a plurality of messages including a plurality of periodic messages, each of the plurality of messages including a first field having a fixed value and a second field having a changing value; calculating a time available for determining an abnormality in the received message; and selecting one of (i) selecting all n abnormality determinations (where n is a positive integer) so as to fall within the calculated time, (ii) selecting k abnormality determinations (where k is a positive integer and k ≤ n) out of the n abnormality determinations, and (iii) not selecting any of the n abnormality determinations. The n abnormality determinations include an abnormality determination using reception timing based on the periodicity, an abnormality determination using the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field.

[0011] These general or specific aspects may be implemented in a system, apparatus, method, integrated circuit, computer program, or non-transitory recording medium such as a computer-readable CD-ROM, or may be implemented in any combination of a system, apparatus, method, integrated circuit, computer program, and recording medium.

Advantages of the Invention

[0012] According to the abnormality determination method and the like according to an aspect of the present disclosure, an appropriate abnormality detection process can be performed according to the detection processing time.

Brief Description of the Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Figure 23

Figure 24

Figure 25

Figure 26

Figure 27

Figure 28

Figure 29

Figure 30

Figure 31

Figure 32

Figure 33

Figure 34

Figure 35

Figure 36

Figure 37

Figure 38

Figure 39

Figure 40

Figure 41

MODE FOR CARRYING OUT THE INVENTION

[0014] (Knowledge on which the present disclosure is based) When a function for detecting that an abnormal message has been transmitted on the CAN network generates and outputs the detection result and information related to the detection result as a log, a lot of data is required in order to make a detailed post-check of the situation that led to the detection of the abnormality. However, if the storage capacity of the log output destination or the communication volume for sending the detection result to the log output destination is large, it takes a great deal of time or resource costs.

[0015] Therefore, an abnormality determination method according to an aspect of the present disclosure is an abnormality determination method for determining an abnormality in a received message, the method being for a plurality of messages including a plurality of messages having periodicity, each of the plurality of messages including a first field having a fixed value and a second field having a changing value, receiving each of the plurality of messages as the received message, and selecting, according to one or more criteria among the time during which the abnormality determination method can be executed, the load, the data volume, or the number of messages, which of a plurality of combinations each constituted by one or more of an abnormality determination using the reception timing based on the periodicity or the number of the received messages, an abnormality determination using the first field, and an abnormality determination using the second field, the determination is made in.

[0016] Thereby, the abnormality determination method according to an aspect of the present disclosure can perform an appropriate abnormality detection process according to the detection processing time, which is a limited time.

[0017] Further, an abnormality determination device according to an aspect of the present disclosure is an abnormality determination device in a vehicle-mounted network system including a network and one or more electronic control units connected to the network, the device including one or more processors and a storage unit accessible from the one or more processors, the one or more processors receiving, from the network, each of a plurality of messages including a plurality of messages having periodicity, each of the plurality of messages including a first field having a fixed value and a second field having a changing value, as the received message, and selecting, according to one or more criteria among the time during which the abnormality determination method can be executed, the load, the data volume, or the number of messages, which of a plurality of combinations each constituted by one or more of an abnormality determination using the reception timing based on the periodicity or the number of the received messages, an abnormality determination using the first field, and an abnormality determination using the second field, the determination is made in.

[0018] As a result, the abnormality determination device according to one aspect of the present disclosure can perform appropriate abnormality detection processing according to the detection processing time, which is a limited time.

[0019] In addition, a program according to one aspect of the present disclosure is a program for causing the one or more processors to execute the above-described abnormality determination method in the above-described abnormality determination device.

[0020] As a result, appropriate abnormality detection processing can be performed according to the detection processing time.

[0021] Hereinafter, embodiments will be specifically described with reference to the drawings.

[0022] Note that each of the embodiments described below shows comprehensive or specific examples. Numerical values, shapes, materials, components, arrangements and connection forms of components, steps, order of steps, etc. shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Among the components in the following embodiments, components not described in the independent claims indicating the most superior concept are described as optional components.

[0023] (Embodiment 1) [1. Overview] In the present embodiment, in an in-vehicle network system, the execution of a function for determining an abnormality is appropriately controlled according to the time during which abnormality detection processing can be executed, and the case of determining an abnormality will be described in detail with reference to the drawings.

[0024] [1.1 Overall Configuration of In-Vehicle Network System] FIG. 1 is a block diagram showing the overall configuration of the in-vehicle network system in the present embodiment.

[0025] In FIG. 1, the in-vehicle network system 10 is composed of a CAN network and includes ECUs 100a, 100b, 100c, and 100d, buses 200a and 200b, and a gateway 300. Note that ECUs 100a, 100b, 100c, and 100d are examples of electronic control units.

[0026] Hereinafter, ECUs 100a, 100b, 100c, and 100d may be collectively referred to as ECU 100, or a part thereof may be referred to without specifying them.

[0027] Also, hereinafter, buses 200a and 200b may be collectively referred to as bus 200, or one of them may be referred to without specifying them.

[0028] ECU 100a is connected to the engine 101, ECU 100b is connected to the brake 102, ECU 100c is connected to the door opening / closing sensor 103, and ECU 100d is connected to the window opening / closing sensor 104.

[0029] ECU 100 acquires a message representing the state of the connected device and periodically sends the message representing the acquired state to the bus 200. For example, ECU 100a acquires information regarding the rotational speed, which is one of the states of the engine 101, attaches a predetermined ID to a message including the data value representing this rotational speed, and sends it to the bus 200.

[0030] Also, each ECU 100 reads out the message sent by another ECU 100 from the bus 200 and selectively receives it according to the ID attached to the message. This selective reception will be described later.

[0031] The gateway 300 connects bus 200a to which ECUs 100a and 100b are connected and bus 200b to which ECUs 100c and 100d are connected. The gateway 300 has a function of transferring a message received from one bus 200 to the other bus 200. The gateway 300 is also a node on the CAN network.

[0032] Note that the in-vehicle network system is an example for explaining the determination of whether a message is an abnormal message and the applicable object of an abnormality determination method or the like, and the applicable object thereof is not limited to the in-vehicle network system.

[0033] [1.2 Message Data Format] FIG. 2 is a diagram showing the format of a CAN protocol message (data frame). Here, a message in the standard ID format in the CAN protocol is shown.

[0034] A message is composed of a Start Of Frame (SOF), an ID field, a Remote Transimission Request (RTR), an IDE (IDentifier Extension), a reserved bit (r), a data length code (DLC), a data field, a CRC (Cycric Redundancy Check) sequence, a CRC delimiter (DEL on the left in the figure), an ACK (Acknowledgement) slot, an ACK delimiter (DEL on the right in the figure), and an EOF (End Of Frame).

[0035] The SOF is 1-bit dominant. Dominant means dominant in the sense of being superior. In a CAN network where a digital method is used for data transmission, dominant refers to the state in which voltage is applied to two cables that form the bus to transmit a "0" value, or this "0" value to be transmitted. In contrast, the state in which voltage is applied to two cables that form the bus to transmit a "1" value, or this "1" value to be transmitted is called recessive. Recessive means inferior. When a "0" value and a "1" value are simultaneously transmitted to the bus from two nodes, the "0" value takes precedence. The bus is in a recessive state during idle. Each ECU100 starts transmitting a message by changing the state of the bus 200 from recessive to dominant, and other ECU100s read this change and synchronize. In Figure 2, the part where the lines indicating dominant or recessive that make up the message are solid lines shows that each value of dominant or recessive can be taken. Since the SOF is fixed in a dominant state, the dominant line is solid and the recessive line is dashed.

[0036] The ID is an 11-bit value indicating the type of data included in the message. Also in CAN, in the communication arbitration among messages where multiple nodes start transmitting simultaneously, the message with a smaller ID value is designed to have a higher priority. The ID is synonymous with the message ID and the CAN ID.

[0037] The RTR is 1-bit dominant indicating that the frame is a message.

[0038] The IDEs are each 1-bit dominant. The message is also called a data frame.

[0039] The DLC is a 4-bit value indicating the length of the subsequent data field.

[0040] The data field is a value indicating the content of the data to be transmitted, with a maximum length of 64 bits and the length adjustable in 8-bit units. The specifications regarding the allocation to this part of the data to be sent depend on the vehicle type or manufacturer.

[0041] The CRC sequence is a 15-bit value calculated from the transmitted values of the SOF, ID field, control field, and data field.

[0042] The CRC delimiter is a 1-bit recessive delimiter symbol indicating the end of the CRC sequence. The receiving node determines the presence or absence of anomalies by comparing the result calculated from the values of the SOF, ID field, control field, and data field of the received message with the value of the CRC sequence.

[0043] The ACK slot is 1 bit long, and the transmitting node transmits the recessive in this part. If the receiving node can receive normally up to the CRC sequence, it transmits the dominant as an acknowledgment response. Since the dominant is prioritized, if the communication of one message is performed normally up to the CRC sequence, the bus 200 during the transmission of the ACK slot is dominant.

[0044] The ACK delimiter is fixed to 1 bit recessive and is a delimiter symbol indicating the end of the ACK slot.

[0045] The EOF is fixed to 7 bit recessive and indicates the end of the message.

[0046] [1.3 Configuration of the Gateway] Figure 3 is a block diagram showing an example of the gateway 300 included in the in-vehicle network system 10 in Embodiment 1. In Figure 3, the gateway 300 includes a frame transceiver unit 310, a frame interpretation unit 320, a received ID determination unit 330, a received ID list holding unit 340, a frame processing unit 350, a transfer rule holding unit 360, an anomaly detection processing function group 370, and a frame generation unit 380.

[0047] Note that these configurations are configurations showing functions, and the gateway 300 is provided as an information processing device including, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory or the like, and an input / output unit realized by an input / output port.

[0048] The configuration showing the above functions is realized by the processing unit reading out and executing a program held in the storage unit and recording predetermined data in the storage unit. Alternatively, instead of recording predetermined data in the storage unit, these configurations may be realized by executing data transmission and reception via the input / output unit. Or, the configuration showing the above functions may be realized by a combination of these.

[0049] The frame transmission / reception unit 310 transmits and receives messages conforming to the CAN protocol to / from each of the buses 200a and 200b.

[0050] More specifically, the frame transmission / reception unit 310 reads out the message sent to the bus 200 bit by bit and transfers the read message to the frame interpretation unit 320.

[0051] Also, the frame transmission / reception unit 310 sends out the message bit by bit to the buses 200a and 200b according to the bus information transmitted from the frame generation unit 380.

[0052] The frame transmission / reception unit 310 transfers the message received from the bus 200a to the bus 200b and transfers the message received from the bus 200b to the bus 200a, thereby executing the transfer of the message between the buses 200.

[0053] The frame interpretation unit 320 receives the value of the message from the frame transmission / reception unit 310, maps it to each field in the CAN protocol, and interprets the received message. The frame interpretation unit 320 transfers the value of the ID field and the interpreted series of values to the received ID determination unit 330.

[0054] The frame interpretation unit 320 further determines whether to transfer the value of the ID field of the message and the data fields that appear after the ID field to the frame processing unit 350 or to abort the reception of the message according to the determination result sent from the received ID determination unit 330.

[0055] In addition, when the frame interpretation unit 320 determines that the received message does not conform to the CAN protocol, it requests the frame generation unit 380 to transmit an error frame.

[0056] An error frame is a frame in a predetermined format defined by the CAN protocol, which is different from the above-mentioned message and is transmitted from a node when an error occurs on the CAN network. When the error frame is sent to the bus, the transmission of messages on that network is interrupted.

[0057] In addition, when the frame interpretation unit 320 interprets that it has received an error frame sent by another node, it discards the message being read.

[0058] The received ID determination unit 330 receives the value of the ID field from the frame interpretation unit 320 and determines whether to receive the read message according to the list of message IDs held by the received ID list holding unit 340. The received ID determination unit 330 sends the result of this determination to the frame interpretation unit 320.

[0059] The received ID list holding unit 340 holds a list of message IDs (also referred to as the received ID list) received by the gateway 300. FIG. 4 is a diagram showing an example of the received ID list in the first embodiment. The details of the received ID list in FIG. 4 will be described later.

[0060] The frame processing unit 350 determines the destination bus 200 according to the rules regarding data transfer held by the transfer rule holding unit 360, based on the ID of the received message, and sends the information indicating the destination bus 200, the message ID sent from the frame interpretation unit 320, and the data to be transferred to the frame generation unit 380.

[0061] Also, the frame processing unit 350 sends the message received from the frame interpretation unit 320 to the anomaly detection processing function group 370, and requests the anomaly detection processing function group 370 to determine whether the message is an abnormal message. The frame processing unit 350 does not transfer the message determined to be an abnormal message in the anomaly detection processing function group 370.

[0062] The transfer rule holding unit 360 holds rules regarding data transfer for each bus 200 (hereinafter also referred to as transfer rules). FIG. 5 is a diagram showing an example of transfer rules in Embodiment 1. The details of the transfer rules in FIG. 5 will be described later.

[0063] The anomaly detection processing function group 370 is a function group that determines whether the received message is an abnormal message. The details of the functional configuration included in the anomaly detection processing function group 370 will be described later. The anomaly detection processing function group 370 sends the determination result to the frame processing unit 350.

[0064] The frame generation unit 380 generates an error frame according to the request for error frame transmission from the frame interpretation unit 320, and causes the frame transceiver unit 310 to send the error frame.

[0065] Also, the frame generation unit 380 generates a message frame using the message ID and data received from the frame processing unit 350, and sends the message frame to the frame transceiver unit 310 together with the bus information.

[0066] [1.4 Received ID List] As shown in FIG. 4, the received ID list is a list of message IDs of messages received and processed by the gateway 300, and is held by the received ID list holding unit 340.

[0067] In FIG. 4, the received ID list has the message IDs stored in each row. The received ID list in FIG. 4 has the message IDs of "1", "2", "3", and "4", and the gateway 300 receives the messages with these message IDs. The gateway 300 stops receiving messages with message IDs not included in the received ID list.

[0068] Note that the value of the ID and the number of IDs included in the received ID list are an example for explanation purposes, and the configuration of the received ID list used in the gateway 300 is not limited thereto.

[0069] [1.5 Transfer Rules] The transfer rules are held by the transfer rule holding unit 360. In FIG. 5, the transfer rules have the combination of the source bus 200 and the destination bus 200 of the message and the message ID to be transferred stored in each row.

[0070] Specifically, the first row of the transfer rules has the source "bus 200a", the destination "bus 200b", and the ID "*", and the gateway 300 transfers the messages received from the bus 200a to the bus 200b regardless of the ID. The second row of the transfer rules has the source "bus 200b", the destination "bus 200a", and the ID "3", and the gateway 300 transfers the messages received from the bus 200b to the bus 200a if the ID is the message with "3".

[0071] [1.6 Configuration of Abnormality Detection Function Group] FIG. 6 is a block diagram showing an example of the abnormality detection function group in the first embodiment. In FIG. 6, the abnormality detection function group 370 includes a determination function selection unit 371, a control unit 372, an abnormality detection unit 373, and a detection rule holding unit 381.

[0072] Note that these configurations are configurations indicating functions, and these configurations are realized in the gateway 300 by the processing unit reading and executing a program held in the storage unit, the processing unit storing predetermined data in the storage unit, or the processing unit executing data transmission and reception via the input / output unit, or realized by a combination thereof.

[0073] The determination function selection unit 371 selects which determination function to execute among the determination functions provided in the abnormality detection unit 373 and sends it to the control unit. The determination function selection unit 371 calculates the time (detection processing time) available for the abnormality detection processing of the abnormality detection unit 373, and selects a determination function so as to fit within the detection processing time. FIG. 7 is a diagram showing an example of the relationship between the determination function and the processing time / detection performance in the first embodiment. For example, the determination function selection unit 371 holds the processing time for each determination function and the detection performance (for example, false detection rate and detection rate) as shown in FIG. 7, obtains a combination of determination functions that fits within the detection processing time calculated by the determination function selection unit 371, and selects the determination function. At this time, if there are a plurality of combinations of determination functions that fit within the detection processing time calculated by the determination function selection unit 371, select the combination with the best detection performance (for example, a combination with a low false detection rate and a high detection rate).

[0074] The control unit 372 controls the abnormality detection unit 373 to execute the function selected by the determination function selection unit 371 among the determination functions provided in the abnormality detection unit 373.

[0075] The abnormality detection unit 373 includes at least seven types of determination functions. Specifically, as determination functions, it includes a function of determining whether a DoS attack has occurred based on the amount of messages transmitted per unit time (the amount of messages is also referred to as the amount of data), a function of checking the ID field of the message, a function of checking the data length of the message, a function of checking the period (the period may be a time interval) at which the message is transmitted for each CAN ID, a function of checking the frequency at which the message is transmitted for each CAN ID, and a function of checking the value of the data field of the message (the value of the data field is referred to as the data value).

[0076] The functions described above are, in order, referred to as the DoS attack determination function, the ID determination function, the data length determination function, the transmission period determination function, the transmission frequency determination function, and the data value determination function. Abnormality determinations that use the reception timing based on periodicity or the number of received messages are the DoS attack determination function, the transmission period determination function, the transmission frequency determination function, etc. Also, abnormality determinations that use fields with fixed values are the ID determination function, etc. Fields with fixed values such as the ID field are specific examples of the first field. In addition, abnormality determinations that use fields with changing values are the data length determination function and the data value determination function, etc. Fields with changing values such as the data field are specific examples of the second field.

[0077] Furthermore, it includes a function of recognizing the state of the vehicle based on the determination results of these determination functions, the transmission period, frequency, data value, or the amount of change in the data value, etc., and checking the vehicle state. This function is referred to as the vehicle state determination function. Furthermore, the abnormality detection unit 373 includes an overall determination function of comprehensively determining whether the message received from the frame processing unit 350 is an abnormal message based on the determination results by these determination functions. And the result determined by the overall determination function becomes the result of the detection process by the abnormality detection unit 373.

[0078] The detection rule holding unit 381 holds the criteria necessary for executing each determination function. The detection rule holding unit 381 holds individual criteria for each CAN ID. Also, the abnormality detection unit 373 may not execute the determination function because no detection rule is set. The control unit 372 controls the execution of the determination function according to the criteria stored in the detection rule holding unit 381.

[0079] Note that the criteria held by the detection rule holding unit 381 exist for each CAN ID as described above, and the criteria differ for each determination function. Also, for each CAN ID, the determination functions for which the criteria exist are different. And there may be a plurality of criteria existing for each CAN ID for one determination function. Thus, the determination function preferentially selected by the determination function selection unit 371 differs for each CAN ID of the received message.

[0080] Note that the determination function selection unit 371 is assumed to select the combination of determination functions with the best detection performance if there are a plurality of combinations of determination functions that fall within the calculated detection processing time, but it is not limited to this. For example, it is assumed to select a combination with a low false detection rate and a high detection rate, but it is not limited to this. The determination function selection unit 371 may select a combination of determination functions using only one of the false detection rate and the detection rate as the detection performance, or may use evaluation indices representing detection performance such as detection accuracy (Precision), F-measure, Infomedness, or Markedness, or a combination thereof, instead of the false detection rate or the detection rate. Therefore, the determination function selection unit 371 can select an effective combination of determination functions according to the target system by adopting an appropriate index for each system.

[0081] Note that although the determination function selection unit 371 is assumed to obtain a combination of determination functions that fall within the calculated detection processing time and select an appropriate combination from among the combinations of the determination functions, it is not limited to this. FIG. 8 is a diagram showing an example of the relationship between the determination functions and the processing time / detection performance in the first embodiment. As shown in FIG. 8, for example, when processing is performed in the order of the DoS attack determination function, the ID determination function, the data length determination function, the transmission cycle determination function, the data value (range) determination function, and the vehicle state determination function, it is also possible to select between the range of determination functions to be executed and the range of determination functions not to be executed. Here, the order of processing of the determination functions is an example and is not limited to this. The order of execution of the determination functions may be different, or other determination functions may be added to the determination functions described.

[0082] Also, FIG. 9 is a diagram showing an example of the relationship between the determination functions and the processing time / detection performance in the first embodiment. The determination function selection unit 371 may previously hold the processing time and detection performance for each combination of determination functions as shown in FIG. 9 and select one of the held combinations. As a result, the abnormality detection unit 373 can perform the processing of the determination functions in an appropriate order for each system and appropriately select the determination functions to be executed. Further, by determining in advance the determination functions selected by the determination function selection unit 371 at the time of design or the like, the time required for the selection can be reduced.

[0083] Note that although the determination function selection unit 371 is assumed to obtain a combination of determination functions that fall within the calculated detection processing time and select that determination function, it is not limited to this. For example, when the abnormality detection unit 373 detects some abnormality, the abnormality detection unit 373 always selects the determination function in which the abnormality is detected, and may not select some or all of the determination functions in which no abnormality is detected. When the abnormality detection unit 373 does not detect an abnormality, the abnormality detection unit 373 may select the minimum necessary determination functions within the range that falls within the detection processing time. As a result, since the abnormality determination process by the determination function in which an abnormality is detected continues to be selected by the abnormality detection unit 373, it is possible to continue to detect an abnormality continuously. Also, when the abnormality detection unit 373 does not detect an abnormality, it is possible to shorten the abnormality detection processing time.

[0084] Note that when the frame transmission / reception unit 310 is receiving messages from a plurality of networks connected to the gateway 300, the abnormality detection unit 373 may select a determination function so that the abnormality detection process for the messages of the network in which a message that does not affect the operation of the vehicle is transmitted becomes longer than the network in which a message that affects the operation of the vehicle is transmitted when an abnormality occurs. Also, the abnormality detection unit 373 may determine which determination function to select for each message. As a result, since it is highly likely that the abnormality detection unit 373 can sufficiently secure the detection processing time for important messages, the in-vehicle network system 10 becomes safer.

[0085] Note that, in order to calculate the detection processing time, the determination function selection unit 371 may use, as the detection processing time, the time obtained by excluding the transfer processing time required for transfer processing such as the determination of the destination bus 200 or the processing in which the frame transmission / reception unit 310 actually transmits a message to each bus 200 from the time allowed (permission time) from when the gateway 300 receives a message until the transfer is completed. Further, the determination function selection unit 371 may calculate, as the detection processing time, the time obtained by excluding the transfer time from the permission time and further excluding other necessary processing. Thereby, the in-vehicle network system 10 can execute the abnormality detection processing with priority over other processing, and conversely, can also execute other processing with priority over the abnormality detection processing.

[0086] Note that although the determination function selection unit 371 is assumed to calculate the detection processing time, it is not limited thereto. There may be a processing time calculation unit in the abnormality detection processing function group 370 that calculates the detection processing time, and the determination function selection unit 371 may acquire the processing time from the processing time calculation unit and select the determination function, or the abnormality detection processing function group 370 may receive the detection processing time from the frame processing unit 350 and select the determination function based on it. Thereby, when calculating the processing time is also performed outside the abnormality detection processing function group 370, the calculation of the processing time can be made more efficient.

[0087] [1.7 Configuration of ECU] FIG. 10 is a block diagram showing an example of an ECU included in the in-vehicle network system according to Embodiment 1. In FIG. 10, the ECU 100 includes a frame transmission / reception unit 110, a frame interpretation unit 120, a reception ID determination unit 130, a reception ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180.

[0088] Note that these configurations indicate functions, and these configurations are realized in the gateway 300 when the processing unit reads and executes a program held in the storage unit, stores predetermined data in the storage unit, or the processing unit transmits and receives data via the input / output unit, or realized by a combination thereof.

[0089] The frame transceiver unit 110 transmits and receives messages conforming to the CAN protocol to and from the bus 200.

[0090] More specifically, the frame transceiver unit 110 reads out the message sent to the bus 200 bit by bit and transfers the read message to the frame interpreter unit 120.

[0091] Also, the frame transceiver unit 110 sends out the message sent from the frame generation unit 180 to the bus 200.

[0092] The frame interpreter unit 120 receives the value representing the message from the frame transceiver unit 110, maps it to each field in the CAN protocol, and interprets the message. The frame interpreter unit 120 transfers the interpreted series of values in the ID field to the received ID determination unit 130.

[0093] The frame interpreter unit 120 further determines whether to transfer the value of the ID field and the value of the data field appearing after the ID field included in the message to the frame processing unit 150 or to abort the reception of the message according to the determination result sent from the received ID determination unit 130.

[0094] Also, when the frame interpreter unit 120 determines that the target message does not conform to the CAN protocol, it requests the frame generation unit 180 to send an error frame.

[0095] Also, when the frame interpreter unit 120 interprets that it has received an error frame sent by another node, it discards the message being read.

[0096] The received ID determination unit 130 receives the value of the ID field from the frame interpretation unit 120, and determines whether to receive the read message according to the list of message IDs held by the received ID list holding unit 140. The received ID determination unit 130 sends the result of this determination to the frame interpretation unit 120.

[0097] The received ID list holding unit 140 holds the received ID list that the ECU 100 receives. Since the received ID list has the same format as that shown in FIG. 4, the description thereof is omitted here.

[0098] The frame processing unit 150 performs processing according to the data of the received message. The content of the processing varies for each ECU 100.

[0099] For example, in the ECU 100a, when receiving a message indicating that the door is open while the vehicle speed of the automobile exceeds 30 km / h, it executes processing for sounding an alarm tone. When the ECU 100c receives a message indicating that the brake is not applied and the door opens, it executes processing for sounding an alarm tone.

[0100] These processes are an example for explanation, and the ECU 100 may execute processes other than the above. The frame processing unit 150 causes the frame generation unit 180 to generate a frame to be sent for executing such processing.

[0101] The data acquisition unit 170 acquires output data indicating the state of the device connected to the ECU 100 or measurement values by sensors, etc., and transfers the acquired output data to the frame generation unit 180.

[0102] The frame generation unit 180 configures an error frame according to the request for error frame transmission from the frame interpretation unit 120, and sends it to the frame transceiver unit 110.

[0103] In addition, the frame generation unit 180 attaches a predetermined message ID to the value of the data received from the data acquisition unit 170 to generate a message frame, and sends the generated message frame to the frame transceiver unit 110.

[0104] [1.8 Transfer Process] FIG. 11 is a flowchart showing an example of the transfer process in Embodiment 1. Since the transfer process performed by the gateway 300 is common regardless of the transfer direction, here, the case where the gateway 300 transfers the message received from the bus 200a to the bus 200b will be described as an example.

[0105] First, the frame transceiver unit 310 reads a message from the bus 200a (step S1001). The frame transceiver unit 310 sends the data of each field of the read message to the frame interpretation unit 320.

[0106] Next, the frame interpretation unit 120, in cooperation with the reception ID determination unit 130, determines whether the message read is a message to be processed based on the value of the ID field (message ID) of the read message (step S1002).

[0107] When the frame interpretation unit 120 determines that the read message is not a message to be processed (No in step S1002), the transfer of the message is not performed.

[0108] When the frame interpretation unit 120 determines that the read message is a message to be processed (Yes in step S1002), the frame interpretation unit 120 transfers the value of each field in the message to the frame processing unit 350. Thereafter, the frame processing unit 350 determines the destination bus according to the transfer rule held in the transfer rule holding unit 360 (step S1003).

[0109] The frame processing unit 350 sends the values of each field in the message received from the frame interpretation unit 320 to the abnormality detection processing function group 370 and requests a determination as to whether the message is an abnormal message. The abnormality detection processing function group 370 determines whether the sent message is an abnormal message from the values of each field of the sent message, and sends the result of the determination to the frame processing unit 350 (step S1004).

[0110] When the abnormality detection processing function group 370 determines that the message is an abnormal message (Yes in step S1005), the transfer of the message is not performed.

[0111] When the abnormality detection processing function group 370 determines that the message is not an abnormal message but a normal message (No in step S1005), the frame processing unit 350 requests the frame generation unit 380 to transfer the message to the bus of the transfer destination determined in step S1003.

[0112] The frame generation unit 380 receives the request from the frame processing unit 350, generates a message so that the specified transfer destination can receive it, and causes the frame transmission / reception unit 310 to send the message (step S1006).

[0113] In the above example, after the determination of the transfer destination of the received message (step S1003), the determination as to whether the message is an abnormal message (step S1004) is made, but it is not limited to this. The determination of the transfer destination of the received message may be made after the determination as to whether the message is an abnormal message. Also, the determination of the transfer destination of the received message and the determination as to whether the message is an abnormal message may be performed in parallel.

[0114] [1.9 Abnormality Detection Processing] FIG. 12 is a flowchart showing another example of the abnormality detection processing in the first embodiment.

[0115] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (step S1101). Here, the time available for the abnormality detection processing is referred to as the detection processing time. The detection processing time is calculated according to the amount of messages sent to the network, the amount of data included in the messages, the number of message transfer destinations, or the like.

[0116] Next, the determination function selection unit 371 determines whether the calculated detection processing time is shorter than the time required for the detection processing (step S1102).

[0117] When the determination function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 selects a determination function to execute the processing (step S1103).

[0118] Subsequently, the determination function selection unit 371 sends information regarding the selected determination function to the control unit 372.

[0119] Subsequently, the control unit 372 controls each determination function so that only the function selected by the determination function selection unit 371 in step S1103 is executed, and the abnormality detection unit 373 executes the abnormality detection processing (step S1104).

[0120] When the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the control unit 372 controls each determination function of the abnormality detection unit 373 to execute all the detection processing that should originally be executed.

[0121] When individually selecting the determination functions executed by the determination function selection unit 371, the process performed in the step of executing the abnormality detection process of FIG. 12 (step S1104) becomes the process performed from step S1110 to step S1119 of FIG. 13. FIG. 13 is a flowchart showing still another example of the abnormality detection process in the first embodiment. Further, the process performed in step S1103 of selecting the determination function executed by the determination function selection unit 371 in FIG. 12 becomes the process performed in step S1105 of FIG. 13.

[0122] When the determination function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 selects a determination function that can be executed within the detection processing time (step S1105). Then, the determination function selection unit 371 sends information regarding the selected determination function to the control unit 372.

[0123] When the determination function selection unit 371 determines that the calculated detection processing time is longer than the time required for the detection processing (No in step S1102), step S1110 described below is performed.

[0124] The control unit 372 determines whether the determination function selection unit 371 has selected the DoS attack determination function (step S1110).

[0125] When the control unit 372 determines that the DoS attack determination function has been selected by the determination function selection unit 371 (Yes in step S1110), the control unit 372 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0126] When the control unit 372 determines that the DoS attack determination function has not been selected (No in step S1110), the control unit 372 does not execute the DoS attack determination function of the abnormality detection unit 373.

[0127] Subsequently, the control unit 372 determines whether the determination function selection unit 371 has selected the ID determination function (step S1112).

[0128] When the control unit 372 determines that the ID determination function has been selected by the determination function selection unit 371 (Yes in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0129] When the control unit 372 determines that the ID determination function has not been selected by the determination function selection unit 371 (No in step S1112), the control unit 372 does not execute the ID determination function of the abnormality detection unit 373.

[0130] Next, the control unit 372 determines whether the determination function selection unit 371 has selected the data length determination function (step S1114).

[0131] When the control unit 372 determines that the data length determination function has been selected by the determination function selection unit 371 (Yes in step S1114), the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0132] When the control unit 372 determines that the data length determination function has not been selected by the determination function selection unit 371 (No in step S1114), the control unit 372 does not execute the data length determination function of the abnormality detection unit 373.

[0133] The control unit 372 determines whether the determination function selection unit 371 has selected the transmission cycle determination function (step S1116).

[0134] When the control unit 372 determines that the transmission cycle determination function has been selected by the determination function selection unit 371 (Yes in step S1116), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0135] When the control unit 372 determines that the transmission cycle determination function has not been selected by the determination function selection unit 371 (No in step S1116), the control unit 372 does not execute the transmission cycle determination function of the abnormality detection unit 373.

[0136] The control unit 372 determines whether the determination function selection unit 371 has selected the data value determination function (step S1118).

[0137] When the control unit 372 determines that the data value determination function has been selected by the determination function selection unit 371 (Yes in step S1118), the control unit 372 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0138] When the control unit 372 determines that the data value determination function has not been selected by the determination function selection unit 371 (No in step S1118), the control unit 372 does not execute the data value determination function of the abnormality detection unit 373.

[0139] Here, although the abnormality detection processes related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission cycle determination, and data value determination have been described, the abnormality detection process may further include the abnormality detection processes related to transmission frequency determination and vehicle state determination. Also, the abnormality detection process may include some combinations of the above determination functions, or other determination processes not described. For example, the control unit 372 may determine whether the determination function selection unit 371 has selected each determination function, and the control unit 372 may control the execution of the determination function according to the determination result. Thereby, the determination function to be executed can be controlled flexibly.

[0140] Note that when selecting the range of the determination function executed by the determination function selection unit 371 and the range of the determination function not executed, the process performed in step (S1104) of executing the abnormality detection process in FIG. 12 becomes the process shown in FIG. 14. Also, the process performed in step S1103 where the determination function selection unit 371 in FIG. 12 selects a function becomes the process performed in step S1106 in FIG. 14.

[0141] Figure 14 is a flowchart showing another example of the abnormality detection process in Embodiment 1. When the determination function selection unit 371 determines that the detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 determines the determination function that can be executed within the detection processing time, and selects the determination function at the time of ending the abnormality detection processing (step S1106).

[0142] Then, the determination function selection unit 371 sends it to the control unit 372.

[0143] When the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), step S1120 described below is performed.

[0144] The control unit 372 determines whether the determination function selection unit 371 has selected to end the processing before the DoS attack determination function (step S1120).

[0145] When the control unit 372 determines that the determination function selection unit 371 has not selected to end the processing before the DoS attack determination function (in the case of No in step S1120), the control unit 372 executes the DoS attack determination function of the abnormality detection unit 373 (S1111).

[0146] When the control unit 372 determines that the determination function selection unit 371 has selected to end the processing before the DoS attack determination function (in the case of Yes in step S1120), the control unit 372 ends the abnormality detection processing.

[0147] Subsequently, the control unit 372 determines whether the determination function selection unit 371 has selected to end the processing before the ID determination function (step S1112).

[0148] When the control unit 372 determines that the determination function selection unit 371 has selected not to end the process before the ID determination function (No in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0149] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the ID determination function (Yes in step S1112), the control unit 372 ends the abnormality detection process.

[0150] Next, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the data length determination function (step S1122).

[0151] When the control unit 372 determines that the determination function selection unit 371 has selected not to end the process before the data length determination function (No in step S1122), the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0152] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the data length determination function (Yes in step S1122), the control unit 372 ends the abnormality detection process.

[0153] Then, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the transmission cycle determination function (step S1123).

[0154] When the control unit 372 determines that the determination function selection unit 371 has selected not to end the process before the transmission cycle determination function (No in step S1123), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0155] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the transmission cycle determination function (Yes in step S1123), the control unit 372 ends the abnormality detection process.

[0156] Next, the control unit 372 determines whether the determination function selection unit 371 has selected to end the process before the data value determination function (step S1124).

[0157] When the control unit 372 determines that the determination function selection unit 371 has selected not to end the process before the data value determination function (No in step S1124), the control unit 372 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0158] When the control unit 372 determines that the determination function selection unit 371 has selected to end the process before the data value determination function (Yes in step S1124), the control unit 372 ends the abnormality detection process.

[0159] Here, although the abnormality detection processes related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission cycle determination, and data value determination have been described, the process described in FIG. 14 may further include abnormality detection processes related to transmission frequency determination and vehicle state determination. Also, the process described in FIG. 14 may be a combination of some of the determination functions described above, or may include other determination functions. The process described in FIG. 14 may include a process in which the control unit 372 determines whether the determination function selection unit 371 has selected the range of determination functions to be executed and the range of determination functions not to be executed, and the control unit 372 controls the execution of the determination functions according to the determination result. Thereby, it is not necessary to check one by one whether each determination function is selected, and it is possible to reduce the processing time.

[0160] Note that when the determination function selection unit 371 only selects whether to execute the transmission cycle determination function and the data value determination function, the step of executing the abnormality detection process shown in FIG. 12 (step S1104) becomes the process shown in FIG. 15.

[0161] FIG. 15 is a flowchart showing still another example of the abnormality detection process in Embodiment 1. Further, the process performed in step S1103 where the determination function selection unit 371 shown in FIG. 12 selects a determination function is the process performed in step S1107 shown in FIG. 15.

[0162] The determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for the abnormality detection processing by the transmission cycle determination function and the data value determination function (step S1102).

[0163] When the determination function selection unit 371 determines that the detection processing time is shorter than the above required time (Yes in step S1102), the determination function selection unit 371 does not select the transmission cycle determination function and the data value determination function (step S1107).

[0164] When the determination function selection unit 371 determines that the detection processing time is longer than the above required time (No in step S1102), step S1111 described below is performed.

[0165] The control unit 372 executes the process of the DoS attack determination function (step S1111).

[0166] Then, the control unit 372 executes the process of the ID determination function (step S1113).

[0167] Next, the control unit 372 executes the process of the data length determination function (step S1115).

[0168] Thereafter, the control unit 372 determines whether the determination function selection unit 371 has selected the transmission cycle determination function and the data value determination function (step S1130).

[0169] When the control unit 372 determines that the transmission cycle determination function and the data value determination function have been selected by the determination function selection unit 371 (Yes in step S1130), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0170] Subsequently, the control unit 372 executes a data value determination function (step S1119).

[0171] When the control unit 372 determines that the transmission cycle determination function and the data value determination function are not selected by the determination function selection unit 371 (No in step S1130), the control unit 372 does not execute the transmission cycle determination function and the data value determination function of the abnormality detection unit 373.

[0172] Here, although the abnormality detection processing related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission cycle determination, and data value determination has been described, the processing described in FIG. 15 may further include abnormality detection processing related to transmission frequency determination and vehicle state determination. The processing described in FIG. 15 may be a combination of some of the determination processes described above, or may include other determination functions. The processing described in FIG. 15 is not only to select whether to execute the transmission cycle determination function and the data value determination function, but also the control unit 372 determines whether the determination function selection unit 371 has selected a combination of some functions of each determination function, and the control unit 372 controls the execution of the determination function according to the determination result. Thereby, at the time of design, etc., it is possible to determine in advance the combination of processes to be executed, and it is possible to collectively check whether the determination function is selected, so that the processing time can be shortened.

[0173] FIG. 16 is a flowchart showing another example of the abnormality detection processing in the first embodiment.

[0174] Note that when the determination function selection unit 371 not only selects whether to execute the transmission cycle determination function and the data value determination function, but also makes a selection not to execute all the determination functions, between the processing performed in step S1107 shown in FIG. 15 and the processing performed in step S1131, the processing performed in step S1108 and the processing performed in step S1109 shown in FIG. 16 are added.

[0175] Next, the determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for the anomaly detection processing by the DoS attack determination function, the ID determination function, and the data length determination function (step S1108).

[0176] If the determination function selection unit 371 determines that the detection processing time is shorter than the required time described above, the determination function selection unit 371 does not select all the determination functions (step S1109).

[0177] Subsequently, the control unit 372 determines whether the determination function selection unit 371 has selected all the determination functions (step S1131). That is, the control unit 372 determines whether the determination function selection unit 371 has not selected the DoS attack determination function, the ID determination function, or the data length determination function.

[0178] If the control unit 372 determines that the DoS attack determination function, the ID determination function, and the data length determination function have been selected by the determination function selection unit 371 (Yes in step S1131), the control unit 372 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0179] After that, the control unit 372 executes the ID determination function of the anomaly detection unit 373 (step S1113).

[0180] Then, the control unit 372 executes the data length determination function of the anomaly detection unit 373 (step S1115).

[0181] Since the subsequent processing related to the transmission cycle determination function and the data value determination function is the same as the processing described in FIG. 15, the description is omitted.

[0182] If the control unit 372 determines that the DoS attack determination function, the ID determination function, and the data length determination function have not been selected by the determination function selection unit 371 (No in step S1131), the control unit 372 does not execute each determination function of the anomaly detection unit 373.

[0183] Here, the anomaly detection process related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination has been described as the process illustrated in FIG. 16. However, the process illustrated in FIG. 16 may further include anomaly detection processes related to transmission frequency determination and vehicle state determination. Also, the process illustrated in FIG. 16 may be a combination of some of the above determination processes, or may include other determination functions. The process illustrated in FIG. 16 has been described by being divided into a process of determining whether or not to select the DoS attack determination function, the ID determination function, and the data length determination function, and a process of only selecting whether or not to execute the transmission period determination function and the data value determination function, but is not limited thereto. The process illustrated in FIG. 16 may be a process in which the control unit 372 determines that the determination function selection unit 371 has selected all the determination functions, and the control unit 372 controls the execution of the determination functions according to the determination result. Thereby, the anomaly determination method in the present embodiment can perform anomaly determination even when there is no time to perform the anomaly detection process.

[0184] Note that the anomaly detection processes of the determination function selection unit 371 and the control unit 372 are not limited to the above, and may be the above combination.

[0185] Note that when the determination function selection unit 371 determines that the detection processing time is shorter than the time required for the detection processing (step S1102), it has been assumed that the determination function to be executed for the processing is selected, but it is not limited thereto. The determination function selection unit 371 may select all the determination functions if the detection processing time is longer than the time required for the detection processing when selecting the determination function to be executed without performing the determination process in step S1102. Thereby, the processing by the determination function selection unit 371 can be simplified.

[0186] When the control unit 372 executes each determination function, the control unit 372 refers to the detection rules set for each CAN ID. Then, the control unit 372 performs control so as to execute the determination function selected by the determination function selection unit 371 and described in the detection rules. That is, even if it is selected by the determination function selection unit 371, a determination function not described in the detection rules is not executed. Further, when it is determined that the detection processing time calculated in step S1102 is longer than the time required for the detection processing, the control unit 372 regards that all determination functions are selected by the determination function selection unit 371 and executes the functions described in the detection rules.

[0187] [1.10 Reset Processing] In the abnormality detection process, depending on the type of determination function not selected when the determination function selection unit 371 selects the function to be executed, there is a possibility that a determination result different from normal will occur when any of the following determination functions is executed next. For example, the transmission cycle determination function assumes that the in-vehicle network system 10 periodically receives messages, records the reception time at the previous reception (referred to as the previous reception time), and determines whether the message received this time is an abnormal message based on the difference between the previous reception time and the current reception time.

[0188] At this time, if the transmission cycle determination function is not selected by the determination function selection unit 371 even though the message has come normally, the previous reception time cannot be recorded, so the reception time two times before and the current reception time will be compared, and there is a possibility that a normal determination cannot be made. In particular, when the transmission cycle determination function is not selected continuously, the section where the reception time cannot be recorded becomes longer, so the possibility that a normal determination cannot be made becomes higher. The same concern also applies to the data value determination function when determining whether a message is normal or abnormal based on the amount of change between the previous data value and the current data value.

[0189] Therefore, when a certain determination function is not selected by the determination function selection unit 371 and the process is skipped, it is necessary to perform a reset process on the determination function before executing the determination function next time, so as to avoid an unexpected determination result. In particular, for functions that perform determination by comparing the previous value and the current value, such as the transmission cycle determination function or the data value determination function that determines the amount of change in data, or functions that perform cumulative calculations, such as the transmission frequency determination function, when the process is not selected by the determination function selection unit 371 and the process is skipped, it is necessary to perform a reset process in advance to clear the previous value or the cumulative value.

[0190] FIG. 17 is a flowchart showing an example of the abnormality detection process including the reset process in the first embodiment. FIG. 18 is a flowchart showing another example of the abnormality detection process including the reset process in the first embodiment, and FIG. 19 is a flowchart showing still another example of the abnormality detection process including the reset process in the first embodiment. It is a flowchart in which a reset process is added to the abnormality detection process when the determination function selection unit 371 shown in FIG. 15 only selects whether to execute the transmission cycle determination function and the data value determination function. Therefore, the description of the same processes as those in FIG. 15 other than the reset process is omitted.

[0191] First, the determination function selection unit 371 determines whether the previous process was skipped by checking a flag indicating that the processes of the transmission cycle determination function and the data value determination function were skipped (step S1140).

[0192] When the determination function selection unit 371 determines that the previous process was skipped (Yes in step S1140), the determination function selection unit 371 requests the control unit 372 to execute the reset process for the transmission cycle determination function and the data value determination function.

[0193] Then, the control unit 372 receives the request from the determination function selection unit 371 and executes the reset process for the transmission cycle determination function (step S1141).

[0194] Next, the control unit 372 executes the reset process of the data value determination function (step S1142).

[0195] Also, after steps S1101 and S1102, the determination function selection unit 371 sets a flag indicating that the processes of the transmission cycle determination function and the data value determination function have been skipped after performing the process of not selecting the transmission cycle determination function and the data value determination function in step S1107 (step S1143). Here, the flag indicating that the processes of the transmission cycle determination function and the data value determination function have been skipped is set for each CAN ID.

[0196] Note that as the reset process, for example, after clearing the stored previous value, the value at the time when the determination function was first executed may be stored as the previous value, or after clearing the stored previous value, the message that the determination function without a previous value first determined to be a normal message may be stored as the previous value. Here, when the previous value is stored for each CAN ID, the time when the first message with the same CAN ID as when the previous value was cleared was first received is the time when the determination function was first executed, or when the determination function without a previous value for the message with the same CAN ID as when the previous value was cleared first determines that the received message is a normal message, it is stored as the previous value. Also, instead of a message with the same CAN ID, it may be determined whether to store it as the previous value based on a message having a different CAN ID.

[0197] For example, it may be determined whether to store it as the previous value based on a message with a correct message authentication code (MAC: Message Authentication Code), or it may be determined whether to store it as the previous value based on a message having a different CAN ID with a close or the same transmission cycle.

[0198] FIG. 20 is a diagram showing an example of reset processing in a modified example. In FIG. 20, an example of a message having another CAN ID with the same transmission period is shown. For example, in the abnormality determination method according to the present disclosure, when the load factor falls below the threshold value immediately before time T2, when messages of ID1, ID2, and ID3 are received at substantially the same timing, the reception times of the messages of ID1, ID2, and ID3 are stored as the previous values. Further, in the abnormality determination method according to the present disclosure, the stored cumulative value may be initialized, or the held vehicle state may be initialized. Thereby, it is possible to more accurately perform the determination by the determination function after the reset processing.

[0199] Note that, in the abnormality determination method according to the present disclosure, although the reset processing is performed on the transmission period determination function and the data value determination function, the present invention is not limited to this, and the reset processing may be performed on other determination functions having the previous values, or the reset processing may be performed on the transmission frequency determination function or the vehicle state determination function that stores the cumulative value or the vehicle state. Further, the reset processing does not need to be performed at the timing shown in FIG. 17, and may be performed, for example, at the timing shown in FIGS. 18 and 19.

[0200] Furthermore, although the processing shown in FIGS. 17 to 19 has the reset processing added to the flowchart shown in FIG. 15, the present invention is not limited to this, and the reset processing may be added to the flowcharts of other abnormality detection processes (for example, the flowcharts shown in FIGS. 12 to 14, FIGS. 16, and FIGS. 21 and later). Also, for each CAN ID, the timing at which the reset processing is executed may be changed. Thereby, in the abnormality determination method in the embodiment of the present disclosure, it is possible to execute the reset processing at an appropriate timing according to the stored information.

[0201] In addition, when the determination function selection unit 371 does not select the transmission cycle determination function and the data value determination function, it is assumed that a flag indicating that the process has been skipped is set, but the present invention is not limited to this. For example, the determination function selection unit 371 also refers to the detection rules set for each CAN ID. When the determination function not selected by the determination function selection unit 371 is not executed as a detection rule, it is not necessary to set a flag indicating that the process has been skipped, or even if a flag indicating that the process has been skipped is set, it is not necessary to execute the reset process during the reset process. Thereby, unnecessary reset processing can be reduced, and the processing time can be shortened, or a decrease in detection performance due to the reset processing can be prevented.

[0202] [1.11 Effect] In the present embodiment, the abnormality detection processing function group 370 can select a combination of determination functions that can exhibit a large abnormality detection effect according to the detection processing time even when the detection processing time is short by selecting a determination function to be executed according to the time (detection processing time) available for abnormality detection processing. Further, by performing a reset process on some or all of the determination functions, it is possible to mitigate the adverse effects caused by not executing the determination function, so that the abnormality detection performance can be further improved.

[0203] (Embodiment 2) [2. Overview] In Embodiment 1, in the abnormality detection processing function group 370, the determination function selection unit 371 selects a determination function to perform the process, and the control unit 372 controls the execution of each determination function according to the selection result of the determination function selection unit 371. In the present embodiment, in the in-vehicle network system, a case where the control unit 372 determines which determination function to execute according to the detection processing time will be described with reference to the drawings.

[0204] [2.1 Configuration of Abnormality Detection Processing Function Group] FIG. 21 is a block diagram showing an example of the abnormality detection processing function group in Embodiment 2. In FIG. 21, the abnormality detection processing function group 370 includes a control unit 374 and an abnormality detection unit 373. Note that descriptions of the same components as those in Embodiment 1 are omitted.

[0205] Note that these configurations are configurations showing functions, and are realized by the processing unit reading and executing a program held in the storage unit in the gateway 300, storing predetermined data in the storage unit, or transmitting and receiving data via the input / output unit, or a combination of these processes.

[0206] The control unit 374 determines a determination function that can be executed within the detection processing time among the determination functions provided in the abnormality detection unit 373, and controls the execution of the determination function. The control unit 374 calculates the time (detection processing time) available for the abnormality detection processing of the abnormality detection unit 373, and controls the execution of the determination function so as to fit within the detection processing time.

[0207] For example, similar to the determination function selection unit 371 in Embodiment 1, the control unit 374 holds data on the processing time for each determination function and the detection performance (e.g., false detection rate and detection rate) as shown in FIG. 7, obtains a combination of determination functions that fits within the calculated detection processing time, and controls to execute only that determination function. At this time, if there are a plurality of combinations of determination functions that fit within the calculated detection processing time, the combination of determination functions with the best detection performance (e.g., a combination with a low false detection rate and a high detection rate) is executed.

[0208] Note that although the control unit 374 calculates the detection processing time, it is not limited thereto. The abnormality detection processing function group 370 has a processing time calculation unit that calculates the detection processing time. The control unit 374 may acquire the processing time from the processing time calculation unit and select a determination function, or the abnormality detection processing function group 370 may acquire information regarding the detection processing time from the frame processing unit 350 and select a determination function to be executed based thereon. Thereby, since the control unit 374 only needs to manage the processing time related to the abnormality detection processing, the abnormality detection processing can be loosely coupled with other functions, and the influence of other functions on the abnormality detection processing can be suppressed.

[0209] [2.2 Abnormality Detection Processing] FIG. 22 is a flowchart showing an example of the abnormality detection processing in the second embodiment.

[0210] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (detection processing time) (step S1101).

[0211] Next, the control unit 374 determines whether the detection processing time calculated in step S1101 is longer than the time required for the detection processing to be executed (step S1200).

[0212] If the control unit 374 determines in step S1200 that the detection processing time is longer than the time required for the detection processing to be executed (Yes in step S1200), the control unit 374 executes the abnormality detection processing (step S1104).

[0213] Note that when the control unit 374 individually controls the determination function to be executed, the step of executing the abnormality detection processing shown in FIG. 22 (step S1104) becomes the processing shown in FIG. 23. FIG. 23 is a flowchart showing another example of the abnormality detection processing in the second embodiment, and FIG. 24 is a flowchart showing yet another example of the abnormality detection processing in the second embodiment.

[0214] After calculating the detection processing time in step S1101, the control unit 374 determines whether there is time to execute the DoS attack determination function (step S1210).

[0215] If the control unit 374 determines that there is time to execute the DoS attack determination function (Yes in step S1210), the control unit 374 executes the DoS attack determination function of the abnormality detection unit 373 (S1111).

[0216] If the control unit 374 determines that there is no time to execute the DoS attack determination function (No in step S1210), the control unit 374 does not execute the DoS attack determination function of the abnormality detection unit 373.

[0217] Subsequently, the control unit 374 determines whether there is time to execute the ID determination function for the remaining detection processing time after executing the DoS attack determination function (step S1211).

[0218] If the control unit 374 determines that there is time to execute the ID determination function (Yes in step S1211), the control unit 374 executes the ID determination function of the abnormality detection unit 373 (S1113).

[0219] If the control unit 374 determines that there is no time to execute the ID determination function (No in step S1211), the control unit 374 does not execute the ID determination function of the abnormality detection unit 373.

[0220] Next, the control unit 374 determines whether there is time to execute the data length determination function for the remaining detection processing time after executing the ID determination function (step S1212).

[0221] If the control unit 374 determines that there is time to execute the data length determination function (Yes in step S1212), the control unit 374 executes the data length determination function of the abnormality detection unit 373 (S1115).

[0222] When the control unit 374 determines that there is no time to execute the data length determination function (No in step S1212), the control unit 374 does not execute the data length determination function of the abnormality detection unit 373.

[0223] Then, the control unit 374 determines whether there is time to execute the transmission cycle determination function with respect to the remaining detection processing time after executing the data length determination function (step S1213).

[0224] When the control unit 374 determines that there is time to execute the transmission cycle determination function (Yes in step S1213), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (S1117).

[0225] When the control unit 374 determines that there is no time to execute the transmission cycle determination function (No in step S1213), the control unit 374 does not execute the transmission cycle determination function of the abnormality detection unit 373.

[0226] Subsequently, the control unit 374 determines whether there is time to execute the data value determination function with respect to the remaining detection processing time after executing the transmission cycle determination function (step S1214).

[0227] When the control unit 374 determines that there is time to execute the data value determination function (Yes in step S1214), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (S1119).

[0228] When the control unit 374 determines that there is no time to execute the data value determination function (No in step S1214), the control unit 374 does not execute the data value determination function of the abnormality detection unit 373. Thus, the abnormality determination method according to the present disclosure can flexibly control the selection of the determination function to be executed.

[0229] In addition, when determining the scope of the determination function executed by the control unit 374, the processing of the flowchart shown in FIG. 14 in the first embodiment becomes the processing of the flowchart shown in FIG. 24. As a result, it is not necessary to check one by one whether each determination function is selected, and the processing time for the check can be reduced.

[0230] Also, when only determining whether the control unit 374 executes the transmission cycle determination function and the data value determination function, the processing of the flowchart shown in FIG. 15 in the first embodiment becomes the processing of the flowchart shown in FIG. 25. FIG. 25 is a flowchart showing another example of the abnormality detection process in the second embodiment.

[0231] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (step S1101).

[0232] Next, the control unit 374 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0233] Subsequently, the control unit 374 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0234] Then, the control unit 374 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0235] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be executed (step S1230).

[0236] Subsequently, when the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0237] When the control unit 374 determines that the detection processing time is longer than the time required for the process to be executed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0238] When the control unit 374 determines that the detection processing time is shorter than the time required for the process to be executed (No in step S1230), the control unit 374 ends the operation.

[0239] Accordingly, when it is possible to determine in advance at the time of design or the like the combination of processes to be executed, it is possible to collectively check whether or not the determination function is selected, and the processing time can be shortened. In addition, not only does the control unit 374 determine whether to execute the transmission cycle determination function and the data value determination function, but when it is determined that not all the determination functions are to be executed, the processing of the flowchart shown in FIG. 16 in the first embodiment becomes the processing of the flowchart shown in FIG. 26. FIG. 26 is a flowchart showing still another example of the abnormality detection processing in the second embodiment. Thereby, the abnormality determination method according to the present disclosure can also cope with the case where there is no time for performing the abnormality detection processing.

[0240] First, the abnormality detection processing function group 370 receives a request for abnormality detection processing from the frame processing unit 350 and calculates the time available for the abnormality detection processing (step S1101).

[0241] Subsequently, the control unit 374 determines whether the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (step S1231).

[0242] Next, when the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the DoS attack determination function of the abnormality detection unit 373 (step S1111).

[0243] Subsequently, when the control unit 374 determines that the detection processing time is longer than the minimum time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0244] And when the control unit 374 determines that the detection processing time is longer than the minimum time required for the minimum processing performed by the control unit 374 (Yes in step S1231), the control unit 374 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0245] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be executed (step S1230).

[0246] Subsequently, when the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0247] And when the control unit 374 determines that the detection processing time is longer than the time required for the processing to be executed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0248] When the control unit 374 determines that the detection processing time is shorter than the minimum time required for the minimum processing performed by the control unit 374 (No in step S1231), the control unit 374 ends the operation.

[0249] Also, when the control unit 374 determines that the detection processing time is shorter than the time required for the processing to be executed (No in step S1230), the control unit 374 ends the operation.

[0250] Note that although the abnormal detection processing related to the five determination functions of DoS attack determination, ID determination, data length determination, transmission period determination, and data value determination has been described, the abnormal determination method according to the present disclosure may further include abnormal detection processing related to transmission frequency determination and vehicle state determination. Further, the abnormal determination method according to the present disclosure may include some combinations of the above-described processing, or may include other determination functions.

[0251] Note that the abnormal detection processing performed by the control unit 374 is not limited to the above, and may be the above combination.

[0252] Note that the processing related to the DoS attack determination function, ID determination function, data length determination function, transmission period determination function, and data value determination function shown in FIGS. 13 to 19 and FIGS. 23 to 26 may be performed in a different order for each message ID.

[0253] [2.3 Reset Processing] In the abnormal detection processing, when the control unit 374 determines whether to execute each determination function, depending on the determination function that is not executed, there is a possibility that a determination result different from normal will be obtained when the determination function is executed next. Therefore, similar to the first embodiment, it is necessary to perform a reset process for the determination function determined not to be executed by the control unit 374.

[0254] In the first embodiment, when the determination function selection unit 371 performs the process of selecting a determination function, a flag indicating that the process has been skipped is set. In the second embodiment, when the control unit 374 determines not to execute each determination function, it is necessary to set a flag indicating that the process has been skipped. The determination as to whether to execute the reset process performed by the control unit 374 according to the flag indicating that the process has been skipped is the same as the process shown in FIGS. 17 to 19 of the first embodiment, and thus the description is omitted.

[0255] [2.4 Effects] In the present embodiment, the abnormality detection processing function group 370 can accurately reflect the execution time of each determination function in determining whether to execute the determination function by determining whether to execute the determination function immediately before the execution of each determination function, and can execute a combination of determination functions that can exhibit a great abnormality detection effect.

[0256] (Embodiment 3) [3. Overview] In Embodiment 1, in the abnormality detection processing function group 370, the determination function selection unit 371 selects the determination function to perform the processing, and the control unit 372 controls the execution of each determination function according to the selection result of the determination function selection unit 371. In the present embodiment, in the in-vehicle network system, when the determination function is not executed, the message at that time is saved, and when there is a margin in the detection processing time, the abnormality detection processing for the message is described with reference to the drawings for the case of executing it later.

[0257] [3.1 Configuration of Abnormality Detection Processing Function Group] FIG. 27 is a block diagram showing an example of the abnormality detection processing function group in Embodiment 3. In FIG. 27, the abnormality detection processing function group 370 includes a determination function selection unit 371, an abnormality detection unit 373, a non-selection information holding unit 375, and a control unit 376. Alternatively, as shown in FIG. 28, it may be configured to include an abnormality detection unit 373, a non-selection information holding unit 375, and a control unit 377 without including the determination function selection unit 371 as in Embodiment 2. FIG. 28 is a block diagram showing another example of the abnormality detection processing function group in Embodiment 3. Note that the description of the same components as in Embodiment 1 is omitted.

[0258] Note that these configurations are configurations showing functions, and are realized by the processing unit reading and executing a program stored in the storage unit in the gateway 300, holding predetermined data in the storage unit, or transmitting and receiving data via the input / output unit, or executing a combination of these.

[0259] When some of the determination functions of the abnormality detection unit 373 are not executed, the non-selection information holding unit 375 sends and holds the information of the received message. Further, the non-selection information holding unit 375 sends the held message to the control unit 376 in response to a request from the control unit 376.

[0260] In addition to the functions of the control unit 372 in the first embodiment, the control unit 376 has a determination function that was not selected in past processing, and a message is held in the non-selection information holding unit 375. When it can be determined that there is time to execute the abnormality detection process for the message, the control unit 376 acquires the message from the non-selection information holding unit 375 and executes the abnormality detection process for the message.

[0261] Note that the control unit 377 has the same functions as the control unit 376, except that instead of the functions of the control unit 372 in the first embodiment, it has the functions of the control unit 374 in the second embodiment.

[0262] Note that when some of the determination functions of the abnormality detection unit 373 are not executed, the non-selection information holding unit 375 not only holds the received message, but also holds information regarding the determination function that was not executed, for example, as shown in FIG. 28. When the control unit 376 or the control unit 377 executes the abnormality detection process, the abnormality detection process may be executed only for the determination function that was not executed. FIG. 29 is a diagram showing an example of non-selection information in the third embodiment. As a result, in the abnormality determination method according to the present disclosure, only necessary determination functions can be executed, so that the processing time can be shortened.

[0263] [3.2 Abnormality Detection Process] FIG. 30 is a flowchart showing an example of the abnormality detection process in Embodiment 3, and FIG. 31 is a flowchart showing another example of the abnormality detection process in Embodiment 3. In the abnormality detection process in Embodiment 1 shown in FIG. 12, when a certain determination function is not executed, the message received at that time is saved (step S1300). Then, when there is a margin in the detection processing time, the abnormality detection process for the message is executed later (step S1302). Here, the description of the same process as the process shown in FIG. 12 is omitted.

[0264] The determination function selection unit 371 requests the non-selection information holding unit 375 to save information regarding the message after selecting the determination function to be processed (after step S1103), since the detection processing time is shorter than the time required for the determination process that should originally be executed. The non-selection information holding unit 375 saves the information regarding the message in response to the request from the determination function selection unit 371 (step S1300).

[0265] Thereafter, the control unit 376 executes the abnormality detection process, inquires of the non-selection information holding unit 375 whether there is non-selection information, and determines whether there is non-selection information (step S1301).

[0266] When the control unit 376 determines that there is non-selection information (Yes in step S1301), the control unit 376 executes the non-selection information follow-up process (step S1302). The non-selection information follow-up process will be described later.

[0267] When the control unit 376 determines that there is no non-selection information (No in step S1301), the control unit 376 ends the abnormality detection process.

[0268] In addition, when a message (received message) having the same CAN ID as the CAN ID of the abnormality detection process requested from the frame processing unit 350 is held in the non-selection information holding unit 375, if there is a process that uses the previous value in some determination functions, there is a possibility that the abnormality detection process may not be correctly performed. Therefore, when a message having the same CAN ID as the CAN ID of the received message is held in the non-selection information holding unit 375, the determination function selection unit 371 does not select a determination function that uses the previous value, and after the non-selection information follow-up process for the message having the same CAN ID as the CAN ID of the received message is completed, the abnormality detection process by all the determination functions may be executed.

[0269] The above process is shown in FIG. 31.

[0270] When the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the determination function selection unit 371 determines whether a message having the same CAN ID as the CAN ID of the received message is held in the non-selection information holding unit 375 (step S1310).

[0271] When the determination function selection unit 371 determines that a message having the same CAN ID as the CAN ID of the received message is held in the non-selection information holding unit 375 (Yes in step S1310), the determination function selection unit 371 selects only the determination functions that do not require the previous value (step S1311).

[0272] And since the determination function selection unit 371 will skip some determination functions, it saves the non-selection information (step S1300).

[0273] When the determination function selection unit 371 determines that the message having the same CAN ID as the received message is not held in the non-selection information holding unit 375 (No in step S1310), the control unit 376 executes an abnormality detection process (step S1104). As a result, at the timing when the non-selection information follow-up process ends, the states of the respective determination functions become the same as those when the selection process of the determination functions is not performed, so that there is no need to perform a reset process.

[0274] [3.3 Non-selection information follow-up process] FIG. 32 is a flowchart showing an example of the non-selection information follow-up process in the third embodiment. In FIG. 32, the above-described non-selection information follow-up process is explained.

[0275] First, the control unit 376 calculates the time (detection process time) available for the abnormality detection process for the message included in the non-selection information (step S1320).

[0276] Next, the control unit 376 acquires one piece of non-selection information from the non-selection information holding unit 375 (step S1321).

[0277] Subsequently, the control unit 376 calculates the time required for the abnormality detection process for the message included in the acquired non-selection information, and determines whether it is shorter than the detection process time (step S1322).

[0278] When the control unit 376 determines that the time required for the abnormality detection process for the message included in the acquired non-selection information is shorter than the detection process time and there is a margin in time (Yes in step S1322), the control unit 376 executes an abnormality detection process for the message included in the non-selection information (step S1323).

[0279] Thereafter, the process returns to step S1320.

[0280] When the control unit 376 determines that the time required for the abnormality detection process of the message included in the acquired non-selection information is longer than the detection process time and there is no margin in time (No in step S1322), the control unit 376 returns the non-selection information to the non-selection information holding unit 375 (step S1324).

[0281] Here, the control unit 376 ends the non-selection information follow-up process.

[0282] In addition, when performing the abnormality detection process on the message included in the non-selection information in step S1323, the control unit 376 may execute only the determination functions that were not selected in the previously performed abnormality detection process. At this time, in the determination as to whether there is a margin in time in step S1322, it is determined whether there is a margin with respect to the time required for the process of the determination functions that were not selected in the previously performed abnormality detection process. Thereby, in the abnormality determination method according to the present disclosure, since only the necessary determination functions can be executed, the processing time can be shortened.

[0283] [3.4 Effects] In the present embodiment, when the determination function is not executed, the abnormality detection processing function group 370 stores the message received at that time, and when there is a margin in the detection processing time, the abnormality detection process for the message is executed later. Thereby, the abnormality detection processing function group 370 can not only make a determination that can exhibit the maximum abnormality detection effect while satisfying the time constraint at the time of message reception, but also execute the abnormality detection process by the determination function as originally planned although the timing is delayed. Thereby, in the abnormality determination method and the like according to the present disclosure, the abnormality detection performance does not deteriorate and the processing time constraint is satisfied.

[0284] [4. Other Modification Examples] The present disclosure is not limited to each of the embodiments described above. Further, as long as the gist of the present disclosure is not deviated from, various modifications conceived by those skilled in the art applied to the embodiments, and forms constituted by combining components in different embodiments are also included in the scope of the present disclosure. For example, the following modification examples are also included in the present disclosure.

[0285] (1) In the above-described embodiment, the abnormality detection processing function group 370 calculates the time available for the abnormality detection processing (detection processing time), and determines whether or not to select the determination function to be executed in the abnormality detection processing, or determines the determination function to be selected, depending on whether the detection processing time is longer than the time required for the detection processing that should originally be executed. However, the present disclosure is not limited to this. For example, whether or not to select the determination function to be executed in the abnormality detection processing, or determine the determination function to be selected, may be determined from the load rate, data amount, or message amount of the in-vehicle network system 10. Here, the load rate is the ratio of the data amount or message amount transmitted per unit time to the maximum value of the data amount or message amount that can be transmitted to the in-vehicle network.

[0286] FIG. 33 is a table showing the determination functions and the selection conditions of the determination functions in the modification example. Further, FIG. 34 is a flowchart showing an example of the abnormality detection processing in the modification example. For example, in FIG. 34, an example of the determination function selected according to the load rate is shown. The determination function selection unit 371 may determine the determination function to be selected based on the information described in FIG. 33 instead of the information of the first embodiment described in FIG. 7.

[0287] For example, when the case where the load rate is 60% or more is defined as high load, in the abnormality detection processing shown in FIG. 34, the determination function selection unit 371 determines that it is "high load" when the load rate calculated in step S1400 is a value of 60% or more (step S1401).

[0288] Subsequently, the determination function selection unit 371 selects the determination function for performing the process based on the information shown in FIG. 33 (step S1402).

[0289] Next, the control unit 374 executes an abnormality detection process (step S1104).

[0290] Also, when the determination function selection unit 371 does not determine that it is "high load" (No in step S1401), the control unit 374 executes an abnormality detection process (step S1104).

[0291] FIG. 35 is a flowchart showing another example of the abnormality detection process in the modified example. The processes performed are the same except that the load factor shown in FIG. 34 is used as the message volume. Also, although not shown, the same applies when determining the determination function selected by the determination function selection unit 371 according to the data volume.

[0292] Note that instead of selecting the determination function only when it is high load, the states determined by the load factor are defined in three levels: "high load", "medium load", and "low load", and depending on which level it is, the determination function selected by the determination function selection unit 371 may be determined, or by combining each level, the determination function selected by the determination function selection unit 371 may be determined based on conditions such as "high load", "high load" + "medium load", and "full load". Also, the state determined by the load factor may be defined in two levels or four or more levels instead of three levels.

[0293] Note that indicators other than the load factor, data volume, or message volume may be used, or when calculating the load factor, data volume, or message volume, it may be calculated from the entire in-vehicle network. Also, for example, in the case of the gateway 300, values related to indicators such as the load factor, data volume, or message volume may be calculated for the messages transferred by the gateway 300, or values related to indicators such as the load factor, data volume, or message volume may be calculated for the messages input to the gateway 300.

[0294] Note that the abnormality detection processing function group 370 may receive the load rate, data volume, or message volume from the frame processing unit 350, select a determination function based on this, and control the execution of the determination function. Also, instead of receiving the load rate, data volume, or message volume every time a message is received, it may be received when there is a change in stages. At this time, when the abnormality detection processing function group 370 does not receive the load rate, data volume, or message volume from the frame processing unit 350, it determines that their values are the same as the previous time.

[0295] Also, the determination function selection unit 371 may select a determination function based on the state of the vehicle, such as whether the vehicle is stopped, running, running at high speed, running at a constant speed, in autonomous driving, has started autonomous driving, has ended autonomous driving, whether the driving support function is operating, has started the driving support function, or has ended the driving support function, and the control unit 377 may control the execution of the determination function.

[0296] Note that the determination function selection unit 371 may select a determination function from the determination function used in the detection rule set for each CAN ID, the detection processing time, the load rate, the data volume, and the message volume, and the control unit 377 may control the execution of the determination function. That is, the determination function selection unit 371 or the control units 374 and 377 select a determination function from the combination of functions used in the detection rule.

[0297] Note that the determination function selection unit 371 determines the determination function to be selected based on the information shown in FIG. 33, but is not limited to this. For example, as shown in FIG. 41, the determination function selection unit 371 may determine the determination function to be selected from the combination of determination functions and selection conditions.

[0298] FIG. 35 is a flowchart showing another example of the abnormality detection processing in the modification example.

[0299] First, the control unit 374 calculates the message volume (step S1410).

[0300] Next, the control unit 374 determines whether the amount of messages is large (step S1411).

[0301] When the control unit 374 determines that the amount of messages is larger than a predetermined value (Yes in step S1411), the control unit 374 selects a determination function to perform the process (step S1412).

[0302] Then, the control unit 374 executes the abnormality detection process (step S1104).

[0303] Also, when the control unit 374 determines that the amount of messages is smaller than a predetermined value (No in step S1411), the control unit 374 executes the abnormality detection process (step S1104).

[0304] Thereby, the abnormality determination method and the like according to the present disclosure can select a determination function using another index such as a load factor, a data amount, and an amount of messages even when it is difficult to calculate the detection processing time or when the detection processing time cannot be uniquely obtained.

[0305] (2) In the above embodiment, the ECU 100 has been described as including the frame transmission / reception unit 110, the frame interpretation unit 120, the reception ID determination unit 130, the reception ID list holding unit 140, the frame processing unit 150, the data acquisition unit 170, and the frame generation unit 180. However, the configuration of the ECU included in the in-vehicle network system according to the present disclosure is not limited to this.

[0306] FIG. 36 is a block diagram showing an example of an ECU in a modification. In FIG. 36, the ECU 100f includes a frame transmission / reception unit 110, a frame interpretation unit 120, a frame generation unit 180, and an abnormality detection processing function group 370. The frame interpretation unit 120 may receive all messages regardless of, for example, the ID, and request the abnormality detection processing function group 370 to determine whether each message is an abnormal message.

[0307] In addition to the configuration shown in FIG. 36, the ECU 100f includes a received ID determination unit 130 and a received ID list holding unit 140, and receives only messages having a message ID described in the received ID list held by the received ID list holding unit, and regarding the message, it may request the abnormality detection processing function group 370 to determine whether it is an abnormal message.

[0308] Note that the ECU 100g may further include an external communication unit 390.

[0309] Thereby, not only the gateway but also the ECU can analyze whether a message transmitted to the in-vehicle network is an abnormal message. As a result, for example, the function for abnormality detection in the in-vehicle network system is improved, and safety is ensured more highly.

[0310] FIG. 37 is a block diagram showing another example of the ECU in a modification. The ECU 100g shown in FIG. 37 may include a transmission data acquisition unit 171 that acquires data to be transmitted to the bus 200 from other connected devices or the outside, etc., and an abnormality detection processing function group 370g. The abnormality detection processing function group 370g included in the ECU 100g also determines whether the data received from the transmission data acquisition unit 171 is an abnormal message, and requests the frame generation unit 180 to transmit a message only when it is determined that the received data is not an abnormal message.

[0311] Note that the ECU 100g may further include an external communication unit 390.

[0312] Thereby, the abnormality determination method and the like according to the present disclosure can suppress the diffusion of the message to the in-vehicle network including the ECU 100g when, for example, an abnormal message is transmitted from a car navigation system that has been illegally operated from the outside to an ECU used together with the car navigation. Further, the abnormality determination method and the like according to the present disclosure can suppress the intrusion of an abnormal message whose transmission is attempted from outside the vehicle into the in-vehicle network system.

[0313] (3) In the above-described embodiment, the determination function selection unit 371 determines the selected determination function or the determination function to be executed using one criterion, but is not limited thereto. For example, the determination function selection unit 371 may use different criteria for each CAN ID. Further, when a plurality of buses are connected to the gateway 300 or the ECU, the determination function selection unit 371 may use different criteria for each of the plurality of buses. Further, the determination function selection unit 371 may use different criteria for each state of the vehicle, such as whether the vehicle is stopped, running, traveling at high speed, traveling at a constant speed, in autonomous driving, has started autonomous driving, has ended autonomous driving, whether the driving support function is operating, has started the driving support function, or has ended the driving support function.

[0314] In addition, when there is a criterion for each CAN ID, the determination function selection unit 371 may not select a determination function for important CAN IDs and may select a determination function for unimportant CAN IDs. Further, the determination function selection unit 371 may change the determination function to be selected according to the importance.

[0315] Accordingly, the abnormality determination method and the like according to the present disclosure can control the execution of the determination function more flexibly, and thus can perform optimal execution according to various systems and various situations.

[0316] (4) In the above-described embodiment, the abnormality detection processing function group 370 returns the determination result to the frame processing unit 350, but is not limited thereto, and information regarding the selected determination function or information regarding the executed determination function may be returned together with the determination result.

[0317] Accordingly, the frame processing unit 350 or the like that has called the abnormality detection processing function group 370 can confirm the reliability of the determination result of the abnormality detection processing function group 370.

[0318] (5) In the above-described embodiment, an in-vehicle network is shown as an example of a network communication system that communicates according to the CAN protocol. The technology according to the present disclosure is not limited to use in an in-vehicle network, and may be used in networks such as those of robots and industrial equipment, or other network communication systems that communicate according to the CAN protocol other than the in-vehicle network.

[0319] Also, although the CAN protocol has been used as the in-vehicle network, it is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc. may be used. Alternatively, these networks may be combined networks as sub-networks.

[0320] For example, in the case of Ethernet, the determination function selection unit 371 selects a determination function from functions such as a DoS attack determination function, a transmission source address determination function, a transmission destination address determination function, a protocol determination function, a transmission source port number determination function, a transmission destination port number determination function, or a data value determination function. Alternatively, the determination function selection unit 371 may select one or more determination functions from among the above-described multiple determination functions as the determination function executed by the control unit 377. Even in network standards other than Ethernet, the same processing as in the case of CAN or Ethernet is performed for functions such as determining the header information or the value of the payload.

[0321] (6) The gateway 300 in the above-described embodiment includes a first processing unit and a second processing unit. Among the abnormal detection processing function groups 370, the function of the determination function selection unit 371 may be processed by the first processing unit, and the functions of the control unit 372 and the abnormal detection unit 373 may be processed by the second processing unit. At this time, the result selected by the determination function selection unit 371 is sent from the first processing unit to the second processing unit. Then, in the second processing unit, the control unit 372 may control the determination function of the abnormal detection unit 373 according to the selection result sent from the determination function selection unit 371.

[0322] Further, the gateway 300 may include a third processing unit, a fourth processing unit, and a fifth processing unit. The third processing unit includes a processing time calculation unit that calculates the detection processing time for which the determination function selection unit 371 has performed processing, and the detection processing time calculated by the processing time calculation unit is sent to the fourth processing unit. In the fourth processing unit, the determination function selection unit 371 selects a determination function according to the detection processing time, and the selected result is sent to the fifth processing unit. In the fifth processing unit, the control unit 372 may control the determination function of the abnormal detection unit 373 according to the sent selection result.

[0323] Also, the first processing unit may include the determination function selection unit 371, the control unit 372, and the abnormal detection unit 373, and the second processing unit may include the control unit 372 and the abnormal detection unit 373. In the first processing unit, when the determination function selection unit 371 performs abnormal detection processing using the abnormal detection unit 373 of the first processing unit, the determination function not selected by the determination function selection unit 371 is selected and sent to the second processing unit, and the control unit 372 and the abnormal detection unit 373 of the second processing unit perform abnormal detection processing, so that the abnormal detection processing that was originally desired to be executed may be performed.

[0324] Note that, in the gateway 300, not only is the processing unit divided, but the gateway 300 also has a second processing unit and a fifth processing unit, and the first processing unit, the third processing unit, and the fourth processing unit may be in other ECUs. Further, FIG. 38 is a block diagram showing the overall configuration of the in-vehicle network system in the modification example, and FIG. 39 is a block diagram showing an example of the communication ECU included in the in-vehicle network system in the modification example. As shown in FIG. 37, the in-vehicle network system includes a communication ECU 100e, communicates with the server 500 via the external network 400, and the communication ECU 100e includes an external communication unit 390 as shown in FIG. 39, and may send the message received from the in-vehicle network, the abnormality detection processing result by the abnormality detection function group 370, and the information regarding the executed determination function to the server 500.

[0325] FIG. 40 is a block diagram showing an example of the server in the modification example, and FIG. 41 is a table showing the determination function and the selection conditions of the determination function in the modification example. The server 500 includes a reception unit 510, a message holding unit 520, and a processing unit 530 as shown in FIG. 40, and the first processing unit and the fourth processing unit described above may be the processing unit 530. Further, the processing unit 530 includes a display unit and an input unit, displays the detection processing time, the load factor, the data amount, the message amount, or the vehicle state, etc., and the operator may select the determination function to be executed from the displayed information or the information obtained from others, and input the selection result via the input unit.

[0326] The input result is sent from the server 500 to the control unit 372, and the control unit 372 may control the determination function of the abnormality detection unit 373 according to the input result. Further, when the server 500 determines from the information regarding the determination function executed by the abnormality detection unit 373 that the determination function that should originally be executed is not executed, the server 500 may perform the abnormality detection processing for the message in the processing unit 530.

[0327] As a result, the in-vehicle network system of the present disclosure can be realized with a flexible configuration, and thus can be configured in consideration of various system constraints.

[0328] (7) Each device in the above-described embodiment is specifically a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is recorded in the RAM or the hard disk unit. By operating according to the computer program, the microprocessor enables each device to achieve its function. Here, the computer program is configured by combining a plurality of instruction codes indicating instructions for the computer to achieve a predetermined function.

[0329] (8) Some or all of the components constituting each device in the above-described embodiment may be configured from one system LSI (Large Scale Integration). The system LSI is a super multifunctional LSI manufactured by integrating a plurality of components on one chip, and specifically, is a computer system including a microprocessor, a ROM, a RAM, and the like. A computer program is recorded in the RAM. By operating according to the computer program, the microprocessor enables the system LSI to achieve its function.

[0330] Also, each part of the components constituting each of the above devices may be individually formed into one chip, or may be formed into one chip so as to include some or all of them.

[0331] Also, here, although some or all of the components constituting each device in the embodiment are implemented by a system LSI, depending on the degree of integration, it may also be referred to as an IC, LSI, super LSI, or ultra LSI. Further, the method of integrating circuits is not limited to LSI, and may also be a method implemented by a dedicated circuit or a general-purpose processor. After manufacturing the LSI, an FPGA (Field Programmable Gate Array) that can be programmed or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.

[0332] Furthermore, if a technology for integrating circuits that replaces the LSI appears due to the progress of semiconductor technology or another derived technology, naturally, the technology may be used to integrate the functional blocks. As a technology for integrating circuits that replaces the LSI, the possibility of applying biotechnology, etc. is also assumed.

[0333] (9) Some or all of the components constituting each of the above devices may be configured from an IC card or a single module that can be detached from each device. The IC card or module is a computer system composed of a microprocessor, ROM, or RAM, etc. The IC card or module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

[0334] (10) The present disclosure may be a computer program that realizes the method shown above by a computer, or may be a digital signal composed of a computer program.

[0335] In addition, the present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (registered trademark) Disc), or semiconductor memory. Further, it may be a digital signal recorded on these recording media.

[0336] In addition, the present disclosure may also transmit a computer program or a digital signal via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, or data broadcasting or the like.

[0337] In addition, the present disclosure may be a computer system including a microprocessor and a memory, where the memory stores the above computer program, and the microprocessor operates according to the computer program.

[0338] Further, it may be implemented by another independent computer system by recording and transferring the program or digital signal to a recording medium, or by transferring the program or digital signal via a network or the like.

[0339] (11) It is also possible to combine the above embodiments and the above modifications.

[0340] As described above, based on the embodiments and their modifications, a technique for determining a message used as a criterion for detecting unauthorized communication for the purpose of unauthorized control by an unauthorized message in an in-vehicle network according to one or more aspects has been described.

[0341] In each of these embodiments and their modifications, a message used as a criterion for detecting unauthorized communication is determined by a gateway or ECU connected to and communicating with the in-vehicle network system, or a combination of these and a server computer.

[0342] In the present disclosure, a system including one or more processors and a storage unit that performs such unauthorized communication detection is referred to as an unauthorized communication detection criteria determination system.

[0343] Therefore, the unauthorized communication detection criteria determination system may be implemented by a single device such as a single gateway connected to the in-vehicle network system, or may be implemented by a combination of such a gateway and an ECU, or a combination of a gateway or an ECU and a server computer located remotely by a plurality of devices.

[0344] Further, this technology can also be realized as a method including some or all of the steps of the processing executed by each component in each of the above embodiments or its modified examples, or as a program executed by the processor of the unauthorized communication detection criteria determination system for causing the unauthorized communication detection criteria determination system to implement this method.

[0345] Also, in the above embodiments or their modified examples, the processing executed by a specific component may be executed by another component instead of the specific component. Also, the order of a plurality of processes may be changed, or a plurality of processes may be executed in parallel.

[0346] The above abnormality determination method may be executed by an abnormality determination device including one or more processors and a storage unit accessible from the one or more processors. This abnormality determination device may be, for example, the gateway 300 or the server 500, or may be included therein.

[0347] [Effects, etc.] The abnormality determination method in the present disclosure is an abnormality determination method for determining an abnormality in a received message. The method receives, as the received message, each of a plurality of messages having periodicity, the plurality of messages each having a first field including a fixed value and a second field including a changing value. According to one or more criteria among the time during which the abnormality determination method can be executed, the load, the data volume, or the number of messages, the reception timing based on the periodicity or the abnormality determination using the number of received messages, the abnormality determination using the field in which the value is fixed, and the abnormality determination using the field in which the value changes are each configured to select which of a plurality of combinations is used for the determination.

[0348] Thereby, the abnormality determination method according to the present disclosure can proceed with the process while selecting the abnormality determination to be executed within a limited time. Therefore, the abnormality determination method according to the present disclosure can effectively determine an abnormality in the received message.

[0349] Also, the abnormality determination method in the present disclosure may execute the abnormality determination in the selected combination.

[0350] Thereby, the abnormality determination method according to the present disclosure can effectively determine an abnormality in the received message within a limited time by executing a pre-selected combination of abnormality determinations.

[0351] Also, when the abnormality determination method according to the present disclosure is performed, if the abnormality determination using the previous information among the plurality of abnormality determinations has not been executed, when the abnormality determination method is performed next time, the previous information used for the abnormality determination using the previous information may be reset.

[0352] As a result, in the abnormality determination method according to the present disclosure, when the same abnormality determination is performed after a certain abnormality determination is skipped, due to the fact that normal data has not been recorded because the abnormality determination was skipped, it is possible to avoid the situation where a normal determination is not made when the same abnormality determination is performed. Therefore, the abnormality determination method according to the present disclosure can effectively determine the abnormality of the received message.

[0353] In addition, in the abnormality determination method according to the present disclosure, when the load rate of the network for receiving the received message is lower than a predetermined threshold value, the information of the received messages of different types received immediately before may be used as information in place of the reset previous information.

[0354] As a result, in the abnormality determination method according to the present disclosure, when the same abnormality determination is performed after a certain abnormality determination is skipped, due to the fact that normal data has not been recorded because the abnormality determination was skipped, it is possible to avoid the situation where the abnormality determination process cannot be performed when the same abnormality determination is performed. That is, in the case described above, the abnormality determination method according to the present disclosure can perform the same abnormality determination process as the skipped abnormality determination process by using the information of the received messages with different IDs received immediately before.

[0355] In addition, in the abnormality determination method according to the present disclosure, when there is time left for executing the abnormality determination method after the selected determination process is executed, the unselected abnormality determination may be executed.

[0356] As a result, the abnormality determination method according to the present disclosure can perform more abnormality determinations. Therefore, the abnormality determination method according to the present disclosure can more effectively determine the abnormality of the received message.

[0357] The abnormality determination device according to the present disclosure is an abnormality determination device in an in-vehicle network system including a network and one or more electronic control units connected to the network, and includes one or more processors and a storage unit accessible from the one or more processors. The one or more processors receive, as received messages, each of a plurality of messages including a plurality of periodic messages from the network, each of the plurality of messages including a first field having a fixed value and a second field having a changing value, and select which of a plurality of combinations each constituted by one or more of the abnormality determinations including the abnormality determination based on the reception timing based on the periodicity or the number of the received messages, the abnormality determination using the first field, and the abnormality determination using the second field is performed according to one or more criteria among the time, load amount, data amount, or number of messages during which the abnormality determination method performed by the abnormality determination device can be executed.

[0358] Thereby, the abnormality determination device according to the present disclosure can achieve the same effects as the above-described abnormality determination method.

[0359] Further, the program according to the present disclosure may be a program for causing a computer to execute the abnormality determination method according to the present disclosure.

[0360] Thereby, the program according to the present disclosure can achieve the same effects as the above-described abnormality determination method.

[0361] In addition, in the abnormality determination method according to the present disclosure, when it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, one or more combinations of abnormality determinations having a lower false detection rate and a higher detection rate than a predetermined criterion are selected from among the abnormality determination based on the reception timing based on the periodicity or the number of the received messages, the abnormality determination using the first field, or the abnormality determination using the second field, and the abnormality determination may be executed.

[0362] As a result, the abnormality determination method according to the present disclosure can more effectively determine the abnormality of the received message.

[0363] In addition, in the abnormality determination method according to the present disclosure, when it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, the abnormality determination based on the periodic reception timing, the abnormality determination using the number of received messages, and the abnormality determination using the second field may not be executed.

[0364] As a result, the abnormality determination method according to the present disclosure can more effectively determine the abnormality of the received message within a limited time by performing only the abnormality determination using the field having a changing value.

[0365] In the abnormality determination method according to the present disclosure, when it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, it may be selected to end the process before any one of the abnormality determination based on the periodic reception timing, the abnormality determination using the number of received messages, the abnormality determination using the first field, or the abnormality determination using the second field. As a result, the abnormality determination method according to the present disclosure can more effectively determine the abnormality of the received message within a limited time.

[0366] In the abnormality determination method according to the present disclosure, when it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, information regarding the abnormality determination determined not to be executed, or information regarding the message to be the subject of the abnormality determination determined not to be executed, among the abnormality determination based on the periodic reception timing, the abnormality determination using the number of received messages, the abnormality determination using the field in which the value is fixed, or the abnormality determination using the field in which the value changes, may be stored in the memory.

[0367] As a result, the abnormality determination method according to the present disclosure can execute the abnormality determination determined not to be executed later according to the situation. Thereby, the abnormality determination method according to the present disclosure can more effectively determine the abnormality of the received message.

Industrial Applicability

[0368] The abnormality detection method and the like according to the present disclosure can be used for abnormality detection of messages in an in-vehicle network. Further, the abnormality detection method and the like according to the present disclosure can perform an appropriate abnormality detection process according to the detection process time available for the abnormality detection process. Thereby, the abnormality detection method and the like according to the present disclosure can accurately identify normal messages even at a timing when the abnormality detection process could not be executed conventionally, and protect the network.

Description of Symbols

[0369] 10 In-vehicle network system 100, 100a, 100b, 100c, 100d, 100e, 100f, 100g ECU 101 Engine 102 Brake 103 Door opening / closing sensor 104 Window opening / closing sensor 110 Frame transmission / reception unit 120 Frame interpretation unit 130 Received ID determination unit 140 Received ID list holding unit 150 Frame processing unit 170 Data acquisition unit 171 Transmission data acquisition unit 180, 380 Frame generation unit 200, 200a, 200b Bus 300 Gateway 310 Frame transmission / reception unit 320 Frame interpretation unit 330 Received ID determination unit 340 Received ID list holding unit 350 Frame processing unit 360 Transfer Rule Retention Unit 370 Abnormality Detection Processing Function Group 371 Judgment Function Selection Unit 372, 374, 376, 377 Control Unit 373 Abnormality Detection Unit 375 Non-selection Information Retention Unit 381 Detection Rule Retention Unit 390 External Communication Unit 400 External Network 500 Server 510 Receiver 520 Message Retention Unit 530 Processing Unit

Claims

1. An abnormality determination method for determining an abnormality in a received message, comprising: receiving, as the received message, a plurality of messages including a plurality of messages having periodicity, each of the plurality of messages including a first field having a fixed value and a second field having a varying value; Calculating a time available for determining an anomaly in the received message; To fit within the calculated time, (i) selecting all n abnormality judgments out of n abnormality judgments (n is a positive integer); (ii) selecting k abnormality judgments (k is a positive integer and k≦n) from the n abnormality judgments; (iii) selecting none of the n abnormality judgments; Select one of the the n abnormality determinations include an abnormality determination using a reception timing based on the periodicity or the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field. Abnormality determination method.

2. The abnormality determination using the reception timing based on the periodicity or the number of received messages includes a DoS attack determination. The method for determining an abnormality according to claim 1 .

3. The k abnormality determinations include a DoS attack determination. The method for determining an abnormality according to claim 1 .

4. The k abnormality determinations are only DoS attack determinations. The method for determining an abnormality according to claim 1 .

5. Furthermore, when the k abnormality judgments are selected, the selected abnormality judgments are notified. The method for determining an abnormality according to claim 1 .

6. If the calculated time is longer than the time required to process all of the n abnormality determinations, all of the n abnormality determinations are selected. The method for determining an abnormality according to claim 1.

7. Execute the selected anomaly judgment, The method for determining an abnormality according to claim 1 .

8. If there is time remaining to perform another abnormality determination after the k abnormality determinations have been performed, perform the abnormality determination that was not selected. The method for determining an abnormality according to claim 7.

9. resetting the previous information used for the abnormality determination using the previous information when an abnormality determination using the previous information is performed on the next received message, among the n abnormality determinations; The method for determining an abnormality according to any one of claims 1 to 8.

10. When a load factor of the network for receiving the received message falls below a predetermined threshold, information of the received message of a different type that was received immediately before is used as information in place of the previous information that was reset. The method for determining an abnormality according to claim 9.

11. An abnormality determination device in an in-vehicle network system including a network and one or more electronic control units connected to the network, one or more processors; a storage unit accessible by the one or more processors; The one or more processors: receiving, as received messages, a plurality of messages including a plurality of periodic messages from the network, each of the plurality of messages including a first field having a fixed value and a second field having a varying value; Calculating a time available for determining an anomaly in the received message; To fit within the calculated time, (i) selecting all n abnormality judgments out of n abnormality judgments (n is a positive integer); (ii) selecting k abnormality judgments (k is a positive integer and k≦n) from the n abnormality judgments; (iii) selecting none of the n abnormality judgments; Select one of the the n abnormality determinations include an abnormality determination using a reception timing based on the periodicity or the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field. Abnormality determination device.

12. A program for causing a computer to execute the abnormality determination method according to any one of claims 1 to 10.

Images