Monitoring device, vehicle monitoring method, and vehicle monitoring program

Abstract

Provided is a monitoring device installed in a vehicle, the monitoring device comprising a monitoring unit that monitors the count value of a counter for counting the number of occurrence of errors detected in an in-vehicle network of the vehicle, a pattern information generation unit that generates pattern information indicating the temporal change of the count value on the basis the result of monitoring by the monitoring unit, and an abnormality detection unit that detects abnormalities in the in-vehicle network on the basis of the pattern information generated by the pattern information generation unit and reference information based on the temporal change of the count value observed in advance.

Description

Technical Field

[0001] The present disclosure relates to a monitoring device, a vehicle monitoring method, and a vehicle monitoring program. This application claims priority based on Japanese Patent Application No. 2022-78888 filed on May 12, 2022, and incorporates all of the disclosures thereof herein.

Background Art

[0002] Japanese Patent Application Laid-Open No. 2013-131907 (Patent Document 1) discloses the following technology. That is, a vehicle network monitoring device that monitors communication data in a vehicle network in which data communication is performed between a plurality of in-vehicle control devices, and includes a monitoring unit that detects illegal data through monitoring of a data communication format defined in operating a communication protocol used in the vehicle network. The monitoring unit monitors, as the data communication format, the number of transmission times of error frames transmitted by the in-vehicle control device based on detection of an error, and detects that illegal data has been transmitted to the vehicle network when the number of transmission times of the monitored error frames exceeds a specified number of transmission times.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

[0004] The monitoring device of the present disclosure is a monitoring device mounted on a vehicle, and includes a monitoring unit that monitors a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle, a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on the monitoring result of the monitoring unit, and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a temporal change of the count value observed in advance.

[0005] The vehicle monitoring method of the present disclosure is a vehicle monitoring method in a monitoring device mounted on a vehicle, and includes a step of monitoring a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle, a step of generating pattern information indicating a temporal change of the count value based on the monitoring result, and a step of detecting an abnormality in the in-vehicle network based on the generated pattern information and reference information based on a temporal change of the count value observed in advance.

[0006] The vehicle monitoring program of the present disclosure is a vehicle monitoring program used in a monitoring device mounted on a vehicle, and is a program for causing a computer to function as a monitoring unit that monitors a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle, a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on the monitoring result of the monitoring unit, and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a temporal change of the count value observed in advance.

[0007] One aspect of the present disclosure can be realized as a semiconductor integrated circuit that realizes part or all of the monitoring device, or can be realized as a system including the monitoring device.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

[0009] Conventionally, technologies for improving security in in-vehicle networks have been developed.

[0010] [Problems to be Solved by the Present Disclosure] Beyond the technology described in Patent Document 1 as such, a technology that enables a more accurate determination of vehicle abnormalities is desired.

[0011] The present disclosure has been made to solve the above-described problems, and an object thereof is to provide a monitoring device, a vehicle monitoring method, and a vehicle monitoring program capable of more accurately determining vehicle abnormalities.

[0012] [Effects of the Present Disclosure] According to the present disclosure, vehicle abnormalities can be more accurately determined.

[0013] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described. (1) The monitoring device according to an embodiment of the present disclosure is a monitoring device mounted on a vehicle, and includes a monitoring unit that monitors a count value of a counter that counts the number of occurrences of errors detected in the in-vehicle network of the vehicle, a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on the monitoring result of the monitoring unit, and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a temporal change of the count value observed in advance.

[0014] In a vehicle, even during normal operation, errors may occur due to electromagnetic waves or the like generated from various devices and wire harnesses. Therefore, in a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold, there is a possibility of false detection of an abnormality. On the other hand, as described above, with a configuration that detects an abnormality using the temporal change of the count value of error occurrences, false detection due to a natural increase in the number of error occurrences can be prevented, and an abnormality of the vehicle can be determined more accurately.

[0015] (2) In the above (1), the reference information may be pattern information indicating a temporal change of the count value observed in advance, and the abnormality detection unit may compare the pattern information generated by the pattern information generation unit with the reference information and detect an abnormality in the in-vehicle network based on the comparison result.

[0016] With such a configuration, an abnormality of the vehicle can be detected by a simple process of comparing two pieces of pattern information.

[0017] (3) In the above (2), the abnormality detection unit may be capable of performing a first abnormality detection process for detecting the abnormality based on the pattern information generated by the pattern information generation unit and the reference information, and a second abnormality detection process for detecting the abnormality based on a comparison result between the count value and a predetermined threshold, and a maximum value of the count value in the reference information may be smaller than the predetermined threshold.

[0018] With such a configuration, it is possible to detect an abnormality from the increasing tendency of the count value without waiting until the count value reaches a predetermined threshold. That is, an abnormality can be detected at a time before the time when the count value reaches the predetermined threshold. For example, the time during which the in-vehicle network is attacked can be shortened, and the influence of a cyber attack or the like on the vehicle can be suppressed.

[0019] (4) In any one of (1) to (3) above, the abnormality detection unit may perform in parallel a first abnormality detection process for detecting the abnormality based on the pattern information generated by the pattern information generation unit and the reference information, and a second abnormality detection process for detecting the abnormality based on a comparison result between the count value and a predetermined threshold.

[0020] With such a configuration, more comprehensive abnormality detection can be performed using both the method using the threshold value and the method using the pattern information.

[0021] (5) In any one of (1) to (4) above, the error may be an error related to communication in the in-vehicle network.

[0022] With such a configuration, an abnormality due to a cyber attack on the vehicle can be detected more accurately.

[0023] (6) In (5) above, the error may be an error due to CRC (Cyclic Redundancy Check) conforming to the CAN (Controller Area Network) standard.

[0024] With such a configuration, abnormality detection can be easily performed by using an existing mechanism conforming to a bus standard widely used in vehicles.

[0025] (7) In (2) above, the abnormality detection unit may detect the abnormality by performing the comparison using a statistical analysis method.

[0026] With such a configuration, the comparison of the two pattern informations can be performed more accurately using statistical processing.

[0027] (8) In the above (1), the reference information may be a learning model created by machine learning using the time change of the count value observed in advance, and the anomaly detection unit may detect an anomaly in the in-vehicle network by providing the pattern information generated by the pattern information generation unit to the learning model.

[0028] With such a configuration, the two pattern informations can be performed more accurately using machine learning.

[0029] (9) In any one of the above (1) to (8), the monitoring device may further include an anomaly processing unit that performs a predetermined notification process when the anomaly detection unit detects the anomaly.

[0030] With such a configuration, it is possible to analyze the anomaly in an external device that can grasp a wider range of information, or to prevent a user from continuing to use the vehicle without noticing unauthorized access to the vehicle and data tampering, etc., and the vehicle from continuing to be used in a state where it does not notice some malfunctions.

[0031] (10) In any one of the above (1) to (9), when the anomaly detection unit detects the anomaly, the monitoring device may include an anomaly processing unit that performs control to stop data reception in the monitoring device from the in-vehicle network.

[0032] With such a configuration, for example, when the monitoring device is provided in a gateway device or the like in the in-vehicle network, the influence of a cyber attack or the like on the vehicle can be suppressed.

[0033] (11) In the above (10), the anomaly processing unit releases the stop control after a predetermined time has elapsed since the stop control was performed.

[0034] With such a configuration, for example, while suppressing the influence of a cyber attack or the like on the vehicle, the continuity of communication in the in-vehicle network can be achieved.

[0035] (12) In the above (11), the reference information is pattern information indicating a time change of the counted value observed in advance, and the abnormality detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and based on the comparison result, detects an abnormality in the in-vehicle network, and the abnormality processing unit sets the predetermined time according to the comparison result.

[0036] With such a configuration, according to the degree of mismatch between the two pattern information, the stop period of data reception can be set to an appropriate length.

[0037] (13) The vehicle monitoring method according to an embodiment of the present disclosure is a vehicle monitoring method in a monitoring device mounted on a vehicle, including a step of monitoring a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle, a step of generating pattern information indicating a time change of the count value based on the monitoring result, and a step of detecting an abnormality in the in-vehicle network based on the generated pattern information and reference information based on a time change of the count value observed in advance.

[0038] In a vehicle, even during normal operation, errors may occur due to electromagnetic waves or the like generated from various devices and wire harnesses. Therefore, in a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold, there is a possibility of false detection of an abnormality. In contrast, as described above, with a configuration that detects an abnormality using the time change of the count value of error occurrences, false detection due to a natural increase in the number of error occurrences can be prevented, and an abnormality of the vehicle can be determined more accurately.

[0039] (14) The vehicle monitoring program according to an embodiment of the present disclosure is a vehicle monitoring program used in a monitoring device mounted on a vehicle, which causes a computer to function as a monitoring unit that monitors a count value of a counter that counts the number of occurrences of errors detected in the in-vehicle network of the vehicle, a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on the monitoring result of the monitoring unit, and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a temporal change of the count value observed in advance.

[0040] In a vehicle, even during normal operation, errors may occur due to electromagnetic waves or the like generated from various devices and wire harnesses. Therefore, in a method of determining an abnormality when the number of error occurrences exceeds a predetermined threshold, there is a possibility of false detection of an abnormality. On the other hand, as described above, with a configuration that detects an abnormality using the temporal change of the count value of error occurrences, it is possible to prevent false detection due to a natural increase in the number of error occurrences and to more accurately determine an abnormality of the vehicle.

[0041] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals and their description will not be repeated. Also, at least a part of the embodiments described below may be arbitrarily combined.

[0042] [Configuration and Operation] FIG. 1 is a diagram showing a configuration of a vehicle monitoring system according to an embodiment of the present disclosure. Referring to FIG. 1, the vehicle monitoring system 401 includes one or more in-vehicle communication systems 201 and a management server 301 which is an example of an external device. The in-vehicle communication system 201 is mounted on the vehicle 90.

[0043] The in-vehicle communication system 201 monitors the occurrence status of errors in the in-vehicle network of the vehicle 90, and based on the monitoring results, detects abnormalities in the in-vehicle network in the vehicle 90. Then, when the in-vehicle communication system 201 detects an abnormality, it transmits the abnormality occurrence information generated based on the occurrence status to the management server 301 via the external network 501.

[0044] The management server 301 receives the abnormality occurrence information transmitted from the in-vehicle communication system 201, analyzes the abnormality occurrence information, and based on the analysis results, performs a process of notifying the user, for example, that there has been unauthorized access to the vehicle 90 and data tampering.

[0045] FIG. 2 is a diagram showing the configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle communication system 201 includes a gateway device 101, which is an example of a monitoring device, one or more in-vehicle devices 202, and an out-of-vehicle communication device 151. For example, the in-vehicle network 251 is composed of the gateway device 101 and one or more in-vehicle devices 202. FIG. 2 shows an example in which the in-vehicle network 251 includes one gateway device 101 and three in-vehicle devices 202.

[0046] The gateway device 101 is connected to the in-vehicle device via, for example, the bus 81. Specifically, the bus 81 is a bus that conforms to standards such as CAN (Controller Area Network) (registered trademark), CAN FD (CAN with Flexible Data Rate), CAN XL, FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0047] The in-vehicle device 202 includes a sensor, an actuator, a camera, a GPS (Global Positioning System) receiver, a navigation device, an automatic driving processing ECU (Electronic Control Unit), an ADAS (Advanced Driving Assistant System) ECU, a wiper control device, an engine control device, an AT (Automatic Transmission) control device, a HEV (Hybrid Electric Vehicle) control device, a brake control device, a chassis control device, a steering control device, an instrument display control device, a maintenance device, and the like.

[0048] The gateway device 101 is connected to a plurality of in-vehicle devices 202 and an out-vehicle communication device 151, and can communicate with each in-vehicle device 202 and the out-vehicle communication device 151. Note that, not limited to the gateway device 101, in the in-vehicle network 251, for example, an integrated ECU that controls the operation of each in-vehicle device 202 may be provided as an example of the monitoring device.

[0049] The in-vehicle device 202, for example, periodically or irregularly stores vehicle-related information indicating measurement results and the like regarding the vehicle 90 and its own ID in a frame, and transmits it to other in-vehicle devices 202 connected to the bus 81. Note that the in-vehicle device 202 may be configured to transmit the frame to the gateway device 101 or to other in-vehicle devices (not shown) via the gateway device 101 and a cable or bus (not shown).

[0050] FIG. 3 is a diagram showing the configuration of the gateway device in the in-vehicle communication system according to the embodiment of the present disclosure. Referring to FIG. 3, the gateway device 101 includes a communication processing unit 1, a monitoring unit 2, a pattern information generation unit 3, an abnormality detection unit 6, an abnormality processing unit 7, an error counter 8, and a storage unit 9. The storage unit 9 is, for example, a non-volatile memory.

[0051] When a frame is directly transmitted and received between in - vehicle devices 202 via the bus 81, the communication processing unit 1 receives in parallel the frames transmitted from an in - vehicle device 202 to other in - vehicle devices 202 via the bus 81. Note that the communication processing unit 1 may be configured to receive the frames for performing relay processing for relaying the frames transmitted between in - vehicle devices such as the in - vehicle device 202 and the off - vehicle communication device 151.

[0052] The monitoring unit 2 monitors the count value CN of the error counter 8 that counts the number of occurrences of errors, that is, errors or failures, detected in the in - vehicle network 251 of the vehicle 90.

[0053] For example, the error is an error related to communication in the in - vehicle network 251. Specifically, for example, the error is an error due to CRC (Cyclic Redundancy Check) according to the CAN standard.

[0054] More specifically, when the communication processing unit 1 receives a frame from an in - vehicle device 202 via the bus 81, it performs a process of detecting an error related to the received frame. When the communication processing unit 1 detects the error, it outputs an error occurrence notification indicating the reception time of the frame to the monitoring unit 2.

[0055] The monitoring unit 2 receives the error occurrence notification from the communication processing unit 1 and increments the error counter 8. The monitoring unit 2 stores in the storage unit 9 the pair of the count value CN of the error counter 8 after the increment and the reception time indicated by the error occurrence notification. Thereby, a log of the error occurrence status in the in - vehicle network 251 is collected and stored in the storage unit 9. Note that the configuration is not limited to the monitoring unit 2 incrementing the error counter 8, and other units other than the monitoring unit 2 may be configured to increment the error counter 8.

[0056] Based on the monitoring result of the monitoring unit 2, the pattern information generation unit 3 generates pattern information (hereinafter also referred to as error log information), which is time-series data indicating the time change of the count value CN, and outputs it to the abnormality detection unit 6. More specifically, the pattern information generation unit 3 generates error log information based on the above-mentioned log stored in the storage unit 9. The error log information indicates the occurrence situation of errors, for example, the increasing trend of the count value CN. The error log information is time-series data for a period of, for example, 1 second or 10 seconds.

[0057] The abnormality detection unit 6 detects an abnormality in the in-vehicle network 251 based on the error log information generated by the pattern information generation unit 3 and the reference information based on the time change of the count value CN observed in advance. When the abnormality detection unit 6 detects the abnormality, it notifies the abnormality processing unit 7 that the abnormality has occurred, and outputs the error log information corresponding to the abnormality to the abnormality processing unit 7.

[0058] More specifically, the reference information is pattern information indicating the time change of the count value CN observed in advance. The abnormality detection unit 6 compares the error log information received from the pattern information generation unit 3 with the reference information stored in the storage unit 9, and detects an abnormality in the in-vehicle network 251 based on the comparison result.

[0059] As an example, the reference information is created based on the count value CN of the error counter 8 collected by test driving or the like before the shipment of the vehicle 90.

[0060] In the vehicle 90, even during normal times, errors may occur due to electromagnetic waves or the like generated from various devices and wire harnesses. Therefore, it is possible to obtain pattern information indicating some error occurrence situations as reference information.

[0061] For example, the abnormality detection unit 6 detects an abnormality by performing the above comparison using a statistical analysis method. Specifically, the statistical analysis is, for example, analysis of variance or linear regression analysis.

[0062] Note that the reference information may be a learning model created by machine learning using the time change of the previously observed count value CN. That is, the abnormality detection unit 6 may be configured to detect an abnormality in the in-vehicle network 251 by providing the pattern information generated by the pattern information generation unit 3 to the learning model.

[0063] Specifically, as an example of machine learning, the abnormality detection unit 6 uses a learning model along the lines of the Deep Learning method.

[0064] When the abnormality detection unit 6 detects an abnormality, the abnormality processing unit 7 performs a predetermined notification process. More specifically, upon receiving a notification from the abnormality detection unit 6, the abnormality processing unit 7 outputs, for example, abnormality occurrence information indicating error log information received from the abnormality detection unit 6 to the communication processing unit 1.

[0065] Note that the abnormality processing unit 7 may be configured to output information indicating normality to the communication processing unit 1 periodically or irregularly when no abnormality is detected.

[0066] The communication processing unit 1 outputs the abnormality occurrence information received from the abnormality processing unit 7 to the out-vehicle communication device 151.

[0067] The out-vehicle communication device 151 performs wireless communication with a wireless base station (not shown) according to a communication method such as WiFi (registered trademark) or LTE (registered trademark) (Long Term Evolution), and communicates with the management server 301 via the external network 501 shown in FIG. 1.

[0068] For example, the out-vehicle communication device 151 receives the abnormality occurrence information from the communication processing unit 1 in the gateway device 101 and transmits the abnormality occurrence information to the management server 301 via the external network 501.

[0069] The management server 301 receives the abnormality occurrence information transmitted from the off-vehicle communication device 151 via the external network 501, and analyzes the abnormality occurrence information. Then, the management server 301 transmits, for example, analysis information indicating the analysis result to a user terminal (not shown) or the vehicle 90 via the external network 501.

[0070] In addition, as another example of the notification process, the abnormality processing unit 7 may be configured to transmit the abnormality occurrence information to the in-vehicle device 202, which is a navigation device, via the communication processing unit 1, and notify the user of the content of the abnormality occurrence information using the navigation device. Further, the abnormality processing unit 7 may be configured to transmit the abnormality occurrence information to a specific in-vehicle device 202 or broadcast it via the communication processing unit 1.

[0071] Also, the abnormality processing unit 7 may be configured to perform stop control to stop data reception at the gateway device 101 from the in-vehicle network 251 when the abnormality detection unit 6 detects an abnormality.

[0072] More specifically, as an example of the stop control, the abnormality processing unit 7 performs bus interruption, that is, by controlling the communication processing unit 1, all frames arriving from the bus 81 at the communication processing unit 1 are discarded. For example, after the abnormality processing unit 7 performs bus interruption, it releases the bus interruption and returns to the normal state after a predetermined time has elapsed.

[0073] Note that the abnormality processing unit 7 may be configured to set the predetermined time (hereinafter also referred to as the return time) according to the comparison result between the error log information and the reference information by the abnormality detection unit 6. Specifically, for example, when the abnormality detection unit 6 determines that the error log information and the reference information do not match, it notifies the abnormality processing unit 7 that an abnormality has occurred and the degree of mismatch between the two. For example, when the degree of mismatch is large, the abnormality processing unit 7 sets the return time to a large value, and when the degree of mismatch is small, the abnormality processing unit 7 sets the return time to a small value. The degree of mismatch is, for example, a score obtained by the above various analyses or the number of mismatches in pattern comparison.

[0074] FIG. 4 is a diagram showing an example of the transition of the count value of the error counter and the abnormality detection timing in the in-vehicle communication system according to the embodiment of the present disclosure. In FIG. 4, the horizontal axis represents time, and the vertical axis represents the count value CN.

[0075] Referring to FIG. 4, in a comparative example in which an abnormality detection process is performed based on the comparison result between the count value CN and a predetermined threshold ThC, at time t2, the count value CN becomes equal to or greater than the threshold ThC, and an abnormality in the in-vehicle network 251 is detected.

[0076] On the other hand, the gateway device 101 is configured to detect an abnormality based on the error log information indicating the time change of the count value CN and the reference information based on the time change of the count value CN observed in advance. Thus, an abnormality can be detected from the increasing trend of the count value CN without waiting for the count value CN to reach a predetermined threshold. That is, for example, as shown in FIG. 4, an abnormality can be detected at time t1 before time t2 when the count value CN reaches the threshold ThC. For example, when the abnormality processing unit 7 performs the bus interruption as described above, compared with the comparative example, the time during which the in-vehicle network 251 is subjected to a DoS attack (Denial-of-service attack) or the like can be shortened, so that it is possible to make it difficult to attach an unauthorized device to the in-vehicle network 251.

[0077] [Modification Example] The abnormality detection unit 6 may be configured to be capable of performing a first abnormality detection process for detecting an abnormality based on the pattern information generated by the pattern information generation unit 3 and the reference information, and a second abnormality detection process for detecting an abnormality based on the comparison result between the count value CN and a predetermined threshold ThC.

[0078] That is, the abnormality detection unit 6 may be configured to be capable of selectively performing either the first abnormality detection process or the second abnormality detection process.

[0079] Then, the maximum value of the count value CN in the reference information is smaller than a predetermined threshold ThC. For example, in the example shown in FIG. 4, the maximum value is CN1.

[0080] Note that the abnormality detection unit 6 may be configured to perform the first abnormality detection process and the second abnormality detection process in parallel.

[0081] [Operation flow] FIG. 5 is a flowchart defining an example of an operation procedure when the gateway device according to the embodiment of the present disclosure detects an abnormality in the in-vehicle network.

[0082] Referring to FIG. 5, first, the gateway device 101 monitors the count value CN of the error counter 8 in the in-vehicle network 251, collects a log of the error occurrence status in the in-vehicle network 251, and stores it in the storage unit 9 (step S1).

[0083] Next, the gateway device 101 generates pattern information, that is, error log information, which is time-series data indicating the time change of the count value CN, based on the monitoring result, for example, based on the log stored in the storage unit 9 (step S2).

[0084] Next, the gateway device 101 acquires from the storage unit 9 the reference information stored in the storage unit 9, for example, pattern information indicating the time change of the count value CN of the error counter 8 observed in advance (step S3).

[0085] Next, the gateway device 101 compares the generated error log information with the reference information. If it is determined that they do not match (NO in step S4), the above-described abnormality processing is performed (step S5).

[0086] When the gateway device 101 determines that the generated error log information matches the reference information (YES in step S4), or after performing the abnormality processing (step S5), the gateway device 101 continues to monitor the count value CN and collect the log (step S1).

[0087] FIG. 6 is a flowchart defining an example of an operation procedure when the gateway device according to the embodiment of the present disclosure performs stop control.

[0088] Referring to FIG. 6, first, when the gateway device 101 detects an abnormality in the in-vehicle network 251 as described above, the gateway device 101 performs stop control to stop data reception in the gateway device 101 from the in-vehicle network 251 (step S11).

[0089] Next, when the degree of discrepancy between the error log information and the reference information is large (YES in step S12), the gateway device 101 sets the return time to TL (step S13), and when the degree of discrepancy is small (NO in step S12), the gateway device 101 sets the return time to TS smaller than TL (step S14).

[0090] Next, when the return time has elapsed since the start of the stop control (YES in step S15), the gateway device 101 releases the stop control and returns to the normal state (step S16).

[0091] In the in-vehicle communication system according to the embodiment of the present disclosure, although the gateway device 101 is configured to include the error counter 8, the present disclosure is not limited thereto. The gateway device 101 may be configured not to include the error counter 8, and the monitoring unit 2 may acquire the count value CN of the error counter included in the in-vehicle device 202 or the like.

[0092] Further, the error counter is not limited to a configuration indicating the number of occurrences of errors in the received frame. For example, when an error occurs in the received frame of the in-vehicle device 202, the error counter may indicate the number of receptions in the gateway device 101 of the error frame transmitted from the in-vehicle device 202.

[0093] Each process (each function) of the above-described embodiment is realized by a processing circuit including one or more processors. The processing circuit may be configured by, in addition to the one or more processors, an integrated circuit in which one or more memories, various analog circuits, and various digital circuits are combined. The one or more memories store programs (instructions) for causing the one or more processors to execute the respective processes. The one or more processors may execute the respective processes according to the programs read from the one or more memories, or may execute the respective processes according to logic circuits designed in advance to execute the respective processes. The processor may be various processors suitable for controlling a computer, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the plurality of physically separated processors may cooperate with each other to execute the respective processes. For example, the processors mounted on each of the plurality of physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet to execute the respective processes. The program may be installed in the memory via the network from an external server device or the like, or may be distributed in a state stored in a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor memory, and may be installed in the memory from the recording medium.

[0094] The above-described embodiments should be considered illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims rather than the above description, and it is intended to include all modifications within the meaning and scope equivalent to the claims.

[0095] The above description includes the features appended below. [Appendix 1] A monitoring device mounted on a vehicle, comprising a processing circuit, wherein the processing circuit monitors the count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle, generates pattern information indicating the temporal change of the count value based on the monitoring result, and detects an abnormality in the in-vehicle network based on the generated pattern information and reference information based on the temporal change of the count value observed in advance.

Description of Reference Numerals

[0096] 1 Communication processing unit 2 Monitoring unit 3 Pattern information generation unit 6 Abnormality detection unit 7 Abnormality processing unit 8 Error counter 9 Storage unit 81 Bus 90 Vehicle 101 Gateway device 151 Out-of-vehicle communication device 201 In-vehicle communication system 202 In-vehicle device 251 In-vehicle network 301 Management server 401 Vehicle monitoring system

Claims

1. A monitoring device mounted on a vehicle, a monitoring unit that monitors a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle; a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on a monitoring result of the monitoring unit; and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a previously observed temporal change of the count value.

2. The reference information is pattern information indicating a temporal change of the count value observed in advance, and the abnormality detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and detects an abnormality in the in-vehicle network based on a comparison result. The monitoring device according to claim 1.

3. The abnormality detection unit can perform a first abnormality detection process for detecting the abnormality based on the pattern information generated by the pattern information generation unit and the reference information, and a second abnormality detection process for detecting the abnormality based on a comparison result between the count value and a predetermined threshold value, and a maximum value of the count value in the reference information is smaller than the predetermined threshold value. The monitoring device according to claim 2.

4. The abnormality detection unit performs in parallel a first abnormality detection process for detecting the abnormality based on the pattern information generated by the pattern information generation unit and the reference information, and a second abnormality detection process for detecting the abnormality based on a comparison result between the count value and a predetermined threshold value. The monitoring device according to any one of claims 1 to 3.

5. The error is an error related to communication in the in-vehicle network. The monitoring device according to any one of claims 1 to 3.

6. The monitoring device according to claim 5, wherein the error is an error by CRC (Cyclic Redundancy Check) conforming to the CAN (Controller Area Network) standard.

7. The monitoring device according to claim 2, wherein the abnormality detection unit detects the abnormality by performing the comparison using a statistical analysis method.

8. The reference information is a learning model created by machine learning using a time change of the count value observed in advance, The monitoring device according to claim 1, wherein the abnormality detection unit detects an abnormality in the in-vehicle network by providing the pattern information generated by the pattern information generation unit to the learning model.

9. The monitoring device further includes The monitoring device according to any one of claims 1 to 3, further comprising an abnormality processing unit that performs a predetermined notification process when the abnormality detection unit detects the abnormality.

10. The monitoring device further includes The monitoring device according to any one of claims 1 to 3, further comprising an abnormality processing unit that performs stop control to stop data reception in the monitoring device from the in-vehicle network when the abnormality detection unit detects the abnormality.

11. The monitoring device according to claim 10, wherein the abnormality processing unit releases the stop control after a predetermined time has elapsed since the stop control was performed.

12. The reference information is pattern information indicating a time change of the count value observed in advance, The abnormality detection unit compares the pattern information generated by the pattern information generation unit with the reference information, and based on the comparison result, detects an abnormality in the in-vehicle network, The monitoring device according to claim 11, wherein the abnormality processing unit sets the predetermined time according to the comparison result.

13. A vehicle monitoring method for a monitoring device mounted on a vehicle, comprising: monitoring a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle; generating pattern information indicating a temporal change of the count value based on the monitoring result; and detecting an abnormality in the in-vehicle network based on the generated pattern information and reference information based on a temporal change of the count value observed in advance.

14. A vehicle monitoring program used in a monitoring device mounted on a vehicle, comprising: causing a computer to function as a monitoring unit that monitors a count value of a counter that counts the number of occurrences of an error detected in the in-vehicle network of the vehicle; a pattern information generation unit that generates pattern information indicating a temporal change of the count value based on the monitoring result of the monitoring unit; and an abnormality detection unit that detects an abnormality in the in-vehicle network based on the pattern information generated by the pattern information generation unit and reference information based on a temporal change of the count value observed in advance. A vehicle monitoring program for this purpose.

Images