Abnormal detection device, abnormal detection system, and abnormal detection method

Abstract

The purpose of the present invention is to obtain an abnormality detection device, an abnormality detection system, and an abnormality detection method with which it is possible, while preventing a resource shortage even in a resource-limited environment, to achieve abnormality detection by monitoring communication data.　An abnormality detection device (100) comprises: an abnormality detection unit (105) which assesses the presence or absence of an abnormality in communication data (D); a rule update unit (103) which updates a detection rule (R1) on the basis of usage data (P) indicating resource usage, and generates an updated detection rule (R2) in which the scope of the assessment process to be executed has been set to be within the scope of a resource surplus; and an un-executed process management unit (106) which, if there is an un-executed assessment process which is not executed in the updated detection rule (R2) and there is surplus space in storage, executes a temporary storage process for storing an assessment rule of the un-executed assessment process and communication data (D) in the storage.

Description

Technical Field

[0001] The present application relates to an abnormality detection device, an abnormality detection system, and an abnormality detection method.

Background Art

[0002] In recent in-vehicle systems, ECUs (Electronic Control Units) installed in respective vehicles are connected via a wired or wireless network, and each ECU is configured to be communicable. In such a system where a plurality of control devices are connected via a network, it is necessary to timely detect an abnormality such as an unauthorized intrusion due to a cyber attack. For this reason, a function of monitoring data flowing through a communication network and determining whether it is normal or abnormal is also important from the viewpoint of in-vehicle security. On the other hand, since the data flowing through the communication network is enormous, if the monitoring and determination processing of these data are not performed efficiently, the loads on each ECU and the gateway become excessive, and as a result, there is a risk of false detection and detection omission. There is also a risk of interfering with vehicle control, which is the original function of the ECU. Such problems are particularly prominent when the available resources (hardware resources) are limited. Therefore, an in-vehicle network device is disclosed that reduces the processing load for detecting illegal data by changing the method of monitoring communication data according to rules defined in advance according to the vehicle state and data type (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] According to the technology disclosed in Patent Document 1, it may be possible to reduce the processing load by simplifying the monitoring of some communication data according to rules corresponding to the current state of the own vehicle. However, in the technology disclosed in Patent Document 1, the relationship between the above rules and the state of resources is not always clear, and when monitoring and processing communication data according to the above rules, there is a risk of resource shortage. Also, regarding the definition of the above rules, it is difficult to comprehensively define the above rules including vehicle states that are not normally assumed.

[0005] The present application has been made to solve the above problems, and an object thereof is to obtain an abnormality detection device, an abnormality detection system, and an abnormality detection method capable of realizing abnormality detection by monitoring communication data while preventing resource shortage even in an environment where resources are limited.

Means for Solving the Problems

[0006] The abnormality detection device disclosed in the present application includes a communication control unit connected to a network and receiving communication data flowing through the network, a detection rule storage unit storing a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data, an abnormality detection unit determining the presence or absence of an abnormality in the communication data, a resource status management unit managing the usage status of resources used by the abnormality detection unit and outputting usage status data indicating the usage status of resources, a rule update unit updating the detection rule based on the usage status data and generating an updated detection rule with the range of the determination process to be executed within the remaining capacity of the resources, and an unexecuted process management unit executing a temporary storage process of storing the determination rule of the unexecuted determination process and the communication data in the storage when there is an unexecuted determination process in the updated detection rule and there is remaining capacity in the storage. The abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule, and when the temporary storage process is being executed, the abnormality detection unit executes the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured.

[0007] In addition, the abnormality detection system disclosed in the present application includes a communication control unit connected to a network and receiving communication data flowing through the network, a detection rule storage unit storing a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data, a first abnormality detection unit for determining the presence or absence of an abnormality in the communication data, a second abnormality detection unit whose resources used with the first abnormality detection unit are physically or logically separated, a resource status management unit for managing the usage status of the resources used by the first abnormality detection unit and outputting usage status data indicating the usage status of the resources, a rule update unit for updating the detection rule based on the usage status data and generating an updated detection rule with the range of the determination process to be executed within the remaining capacity of the resources, and an unexecuted process management unit for executing a transfer process of transmitting the determination rule of the unexecuted determination process and the communication data to the second abnormality detection unit by the communication device when there is an unexecuted determination process not executed in the updated detection rule and there is remaining capacity in the communication device. The first abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule, and the second abnormality detection unit executes the unexecuted determination process when the transfer process is being executed.

[0008] Further, the anomaly detection method disclosed in the present application is an anomaly detection method for detecting anomalies in communication data flowing through a network, which includes a step of managing the usage status of resources used for determining the presence or absence of anomalies in communication data and outputting usage status data indicating the usage status of resources, and includes a determination rule indicating a determination process used for determining the presence or absence of anomalies in communication data. The detection rule used for detecting anomalies in communication data is updated based on the usage status data, and a step of generating an updated detection rule with the range of the determination process to be executed within the range of the remaining resources; a step of determining the presence or absence of anomalies in communication data based on the updated detection rule by a first anomaly detection unit; and when there is an unexecuted determination process not executed in the updated detection rule and there is remaining capacity in the communication device, a transfer process is executed by the communication device to transmit the determination rule of the unexecuted determination process and the communication data to a second anomaly detection unit in which the resources used by the first anomaly detection unit are physically or logically separated; and a step of executing the unexecuted determination process by the second anomaly detection unit when the transfer process is executed.

Advantages of the Invention

[0009] According to the anomaly detection device, anomaly detection system, or anomaly detection method disclosed in the present application, it is possible to realize anomaly detection by monitoring communication data while preventing resource shortages even in an environment with limited resources.

Brief Description of the Drawings

[0010]

Figure 1

Figure 2A

Figure 2B

Figure 3A

Figure 3B

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10A

Figure 10B

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

DETAILED DESCRIPTION OF THE INVENTION

[0011] Embodiment 1. Embodiment 1 will be described with reference to FIGS. 1 to 8. FIG. 1 is a block diagram showing the configuration of the abnormality detection system in Embodiment 1. The abnormality detection system 1000 is configured by connecting an abnormality detection device 100 and an ECU 110 via an in-vehicle network 120, that is, a network. The number of ECUs 110 in the abnormality detection device 100 is not particularly limited. Each ECU 110 exchanges communication data via the in-vehicle network 120, and a plurality of ECUs 110 and the in-vehicle network 120 constitute one in-vehicle system.

[0012] The abnormality detection device 100 includes a communication control unit 101 that is connected to the in-vehicle network 120, receives communication data D flowing through the in-vehicle network 120, and transmits data such as an abnormality detection result to the in-vehicle network 120 as necessary; a detection rule storage unit 102 that stores a detection rule R1, which is a detection rule for abnormality detection; a rule update unit 103 that updates the detection rule R1 according to the usage status of the resources of the abnormality detection device 100; a resource management unit 104 that manages the usage status of the resources of the abnormality detection device 100; and an abnormality detection unit 105 that detects an abnormality in the communication data D flowing through the in-vehicle network 120 based on the updated detection rule R2. The abnormality detection device 100 also includes an unexecuted process management unit 106 that changes the abnormality detection process based on the updated detection rule R2, and an undetermined information storage unit 107 that stores information about the determination process that has not been executed. Note that the "resources" in Embodiment 1 refer to the hardware resources used to process the functions provided in the abnormality detection device 100, and the details will be described later.

[0013] Note that the configuration and network architecture shown in FIG. 1 are just examples. The communication control unit 101, detection rule storage unit 102, anomaly detection unit 105, resource management unit 104, rule update unit 103, unexecuted process management unit 106, and undetermined information storage unit 107 are provided. As long as it is connected to one or more ECUs 110 via one or more in-vehicle networks 120, it does not necessarily have to be as shown in FIG. 1. For example, instead of having all the configurations in the anomaly detection device 100 as in the example shown in FIG. 1, some of the configurations can be moved to another device connected to the in-vehicle network 120, and the necessary data can be transmitted and received via the in-vehicle network 120. That is, the configuration of each functional unit included in the anomaly detection device 100 can be provided by any of a plurality of devices connected by a network capable of communicating with each other within the anomaly detection system 1000, and the anomaly detection system 1000 as a whole can be configured to include each functional unit of the anomaly detection device 100 shown in FIG. 1. Also, the anomaly detection device 100 can be configured as a dedicated device for anomaly detection, or can be configured to also have the function of an ECU. Further, it may also have functions such as a gateway control device that relays communication between ECUs 110, an engine control device, an EPS (Electric Power Steering) control device, and an ADAS (Advanced Driver Assistance System) control device.

[0014] The communication control unit 101 is realized by a communication device 84 described later, and transmits and receives communication data D to and from the ECU 110 via the in-vehicle network 120. For the in-vehicle network 120, for example, CAN (Control Area Network) and Ethernet (registered trademark) etc. can be considered, but it is not limited to this. Also, the ECU 110 is not particularly limited as long as it transmits and receives communication data D via the in-vehicle network 120. The communication control unit 101 transmits the received communication data D to the anomaly detection unit 105 and the undetermined information storage unit 107 as necessary.

[0015] The detection rule storage unit 102 stores a detection rule R1. The detection rule R1 is predefined and is a rule for determining whether the communication data transmitted and received by the communication control unit 101 is normal. FIG. 2A is a diagram showing an example of a detection rule according to the first embodiment and shows the detection rule R1, which is the detection rule before update. As shown in the figure, the detection rule R1 before update includes, for example, a list of determination rules composed of five determination rules Ra to Re. Each determination rule includes "rule number", "data ID", "source", "destination", "data size", "data", "determination priority", "determination range", and "resource utilization rate", and is used to determine whether there is an abnormality in the communication data D.

[0016] The "rule number" is a number that uniquely indicates each determination rule. The "data ID" is the ID of the communication data D. The "source" and "destination" indicate the device (ECU 110) that is the source and the device (ECU 110) that is the destination when the communication data D is transmitted and received on the in-vehicle network 120. The "data size" is the data size of the communication data D, and the "data" indicates the value or range of specific data.

[0017] The "determination priority" indicates the priority at which the determination process according to the determination rule is executed, indicating that the determination process of the determination rule with a higher determination priority is executed preferentially. The "determination range" indicates whether the determination process of the determination rule is executed by the abnormality detection unit 105. In the case of a circle (○), it is executed, and in the case of a cross (×), it is not executed. However, as will be described later, the determination process that has not been executed is also executed later according to the resource utilization status. The "resource utilization rate" indicates the resource utilization rate required when the determination process according to the determination rule is executed (the resource utilization rate consumed when the determination process is executed).

[0018] The detection rule R1 shown in FIG. 2A shows a so-called "white list method" detection rule and is an example of a rule for normal communication data D. That is, a determination process is performed in which it is sequentially compared from the determination rule with the highest determination priority whether the communication data D to be determined matches the content indicated by each determination rule. If the communication data D to be determined matches the content of any determination rule, the communication data D is determined to be normal. In the comparison between the communication data D and each determination rule, it is considered "matched" only when all items match, and if there is even one item that does not match, it is considered "mismatched". For example, when the data ID of the communication data D to be determined is 0x01, the source is ECU_C, the destination is ECU_A, the data size is 8 bytes, and the value of data x is 7, the determination rule Ra of rule number 1, which has the highest determination priority and is determined first, does not match in terms of the source, etc., and is "mismatched". Thereafter, it is determined by the determination rules Rb and Rc of rule numbers 2 and 3, but it is "mismatched" because the data ID does not match. In the determination by the determination rule Rd of rule number 4, since all items match and it is "matched", the communication data D is determined to be normal and the determination process ends. If the value of data x is 10, it is also "mismatched" in the determination rule Rd of rule number 4, and in the determination by the subsequent determination rule Re, the data ID does not match and it is "mismatched". Therefore, it is "mismatched" for all determination rules, and the communication data D is determined to be "abnormal" and an abnormality is detected.

[0019] Note that the detection rule R1 is not limited to that shown in FIG. 2A as long as it is a detection rule capable of determining whether the communication data D is normal. Also, each item of the determination rules Ra to Re is arbitrary, and each determination rule can be uniquely specified. As long as it is an item capable of determining whether the communication data D is normal and an item that can be used by the abnormality detection unit 105 and the rule update unit 103, other items may also be used.

[0020] The rule update unit 103 updates the detection rule R1 based on the usage status of the resources of the anomaly detection device 100 and generates an updated detection rule R2. FIG. 2B is a diagram showing an example of the detection rule according to the first embodiment and is a diagram showing the updated detection rule. In the updated detection rule R2 shown in FIG. 2B, the rule update unit 103 assumes a case where the remaining capacity of the resources (resources available for anomaly detection) is 30% in terms of the usage rate, and updates the previous detection rule R1 so that the total usage rate of the resources of the determination rules included in the determination range (where the "determination range" is "〇") is within 30%. The rule update unit 103 receives usage status data P indicating the usage status of the resources from the resource management unit 104 to grasp the current usage status of the resources, and updates the detection rule R1 so as to include more determination rules in the determination range within the range executable with the remaining capacity of the resources (here, 30%). Also, the rule update unit 103 preferentially includes determination rules with a higher determination priority in the determination range. In the example shown in FIG. 2B, in the previous detection rule R1, all of the determination rules Ra to Re were included in the determination range, but in the updated detection rule R2, only the determination rules Ra to Rc are included in the determination range, and the determination rules Rd and Re are outside the determination range. Also, thereby, the total usage rate of the resources of the determination rules included in the determination range is 30%. As described above, in the updated detection rule R2, the range of the determination process to be executed is within the range of the remaining capacity of the resources.

[0021] The rule update unit 103 transmits the updated detection rule R2 to the anomaly detection unit 105 and the unexecuted process management unit 106.

[0022] When the rule update unit 103 updates the detection rule R1, the items to be updated are "determination priority" and "determination range". The reason for updating the "determination priority" is that in some cases, it may be more efficient to perform anomaly detection by prioritizing the detection rules with low resource utilization rates. For example, in other examples of the detection rules shown in FIGS. 3A and 3B, the resource utilization rate of the detection rule Rb is 20%, and the resource utilization rate of the detection rule Rc is 10%. In this case, if we simply include the detection rules with high determination priority in the determination range without changing the determination priority, when the detection rule Rc is included in the determination range, the resource utilization rate becomes 40%, so only the detection rules Ra and Rb can be included in the determination range. Also, 10% of the resource margin will remain unused. Therefore, in the updated detection rule R2 shown in FIG. 3B, the determination priority of the detection rule Rc is updated to "2", and the determination priority of the detection rule Rd is updated to "3". As a result, in the updated detection rule R2, the detection rules included in the determination range are the three detection rules Ra, Rb, and Rd. Also, all 30% of the resource margin is utilized. For this reason, anomaly detection can be performed more efficiently than when the determination priority is not updated. In this way, it is also conceivable to update the determination priority to generate a combination of detection rules that minimizes the difference between the resource margin and the total amount of resources required for the executed determination process, and include the determination processes of the detection rules in this combination in the determination range.

[0023] The resource management unit 104 manages the usage status of the resources provided in the anomaly detection device 100. The "resources" in Embodiment 1 indicate the hardware resources used to process the functions provided in the anomaly detection device 100, and are the resources used when the anomaly detection unit 105 executes the determination process. Also, when the anomaly detection device 100 also has functions such as an ECU, it is also used for realizing the functions of the ECU and the like. Specific examples of "resources" are, for example, a processor, a memory, a storage, a communication device, and the like. FIG. 4 is a diagram showing an example of the hardware configuration of the anomaly detection device in Embodiment 1.

[0024] Each function of the abnormality detection device 100 is realized by the hardware configuration as shown in FIG. 4. Specifically, the abnormality detection device 100 mainly includes a processor 81, a memory 82 also serving as a main storage device, and a storage 83 serving as an auxiliary storage device. The processor 81 is composed of, for example, a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), etc. The memory 82 is composed of a volatile storage device such as a RAM (Random Access Memory), and the storage 83 is composed of a non-volatile storage device such as an eMMC (embedded Multi Media Card), a flash memory, or a hard disk.

[0025] The storage 83 stores a predetermined program executed by the processor 81. The processor 81 appropriately reads and executes this program to perform various arithmetic processes. At this time, the above-mentioned predetermined program is temporarily stored from the storage 83 to the memory 82, and the processor 81 reads the program from the memory 82. The arithmetic processes performed by each functional unit shown in FIG. 1 are realized by the processor 81 executing a predetermined program as described above. The result of the arithmetic process by the processor 81 is temporarily stored in the memory 82 and then stored in the storage 83 according to the purpose of the executed arithmetic process.

[0026] The abnormality detection device 100 also includes a communication device 84 that realizes data transmission and reception with external devices via the in-vehicle network 120. The communication device 84 is, for example, a NIC (Network Interface Card), but is not limited thereto.

[0027] Examples of the usage status of the resources managed by the resource management unit 104 include the usage rate and processing speed of the processor 81, the usage amount of the memory 82, the usage amount of the storage 83, the communication bandwidth and communication speed of the communication device 84.

[0028] The resource management unit 104 acquires and stores the usage status of the resources included in the abnormality detection device 100. The resource management unit 104 transmits the stored usage status data as usage status data P to the rule update unit 103 and the unexecuted process management unit 106. The resource management unit 104 updates the stored usage status of the resources each time. The frequency, timing, and range of the update may be determined arbitrarily.

[0029] The abnormality detection unit 105 receives the communication data D via the communication control unit 101, and detects the abnormality of the communication data D by determining whether the communication data D is normal or not by executing a determination process on the communication data D to determine the presence or absence of an abnormality. The abnormality detection unit 105 executes the above determination process based on the updated detection rule R2. The specific description of the determination process is as described above. The abnormality detection unit 105 outputs the determination result as a detection log (not shown). The detection log may be recorded in the abnormality detection device 100, or may be transmitted (notified as an abnormality detection result) to the ECU 110 or the like via the in-vehicle network 120.

[0030] In the updated detection rule R2, some or all of the determination rules are not included in the determination range, and there is a possibility that the determination process by the abnormality detection unit 105 may be unexecuted for some or all. For the unexecuted determination process, it is executed through the processes by the unexecuted process management unit 106 and the undetermined information storage unit 107 as described below.

[0031] The unexecuted process management unit 106 changes the execution method of the determination process based on the resource usage status when there is a determination rule not included in the determination range in the updated detection rule R2 and there is a determination process not executed in the abnormality detection unit 105. The unexecuted process management unit 106 receives the updated detection rule R2 from the rule update unit 103 and receives the usage status data P from the resource management unit 104. Although various situations may occur where some determination processes are not executed due to the resource usage status, in Embodiment 1, a case where some determination processes cannot be executed due to the usage rate or processing speed of the processor 81 or the lack of remaining capacity of the usage amount of the memory 82 will be described as an example. The unexecuted process management unit 106 acquires information regarding the remaining capacity of the storage 83 from the usage status data P, and executes a temporary storage process of storing the unexecuted detection rule R21 and the communication data D to be determined in the undetermined information storage unit 107 according to the remaining capacity of the storage 83. The communication data D to be determined stores what is received by the communication control unit 101. The unexecuted detection rule R21 is a part of the updated detection rule R2, and is obtained by extracting only those with a determination range of "×" among the determination rules Ra to Re of the updated detection rule R2. In the case of the updated detection rule R2 shown in FIG. 2B, the unexecuted detection rule R21 is composed of the determination rules Rd and Re. Note that the determination process of the determination rule with a determination range of "×" in the updated detection rule R2 corresponds to the "unexecuted determination process".

[0032] When the temporary storage process is executed, the unexecuted process management unit 106 periodically receives the subsequent usage status data P and monitors the latest usage status of the resources. The unexecuted process management unit 106 appropriately determines whether it can secure the remaining capacity of the resources (the usage rate or processing speed of the processor 81, or the remaining capacity of the usage amount of the memory 82) necessary for executing the determination processes of the determination rules Rd and Re that constitute the unexecuted detection rule R21. At the timing when it is determined that the remaining capacity of the above resources can be secured, the unexecuted detection rule R21 stored in the undetermined information storage unit 107 and the communication data D to be determined are transmitted to the abnormality detection unit 105. The abnormality detection unit 105 executes the determination processes of the determination rules Rd and Re that were unexecuted. Note that since the undetermined information storage unit 107 is realized by the storage 83, storing in the undetermined information storage unit 107 corresponds to storing in the storage 83.

[0033] As described above, even if there are limitations on the remaining capacity of the resources, first, while executing the determination process within the range possible with the remaining capacity, information on the unexecuted determination process is stored in the undetermined information storage unit 107, and when the necessary resources are secured, the unexecuted determination process is executed, so that all the determination processes to be executed are executed without omission.

[0034] Next, the operation will be described. FIG. 5 is a flowchart showing the operation of the abnormality detection system in the first embodiment. As shown in the figure, the abnormality detection device executes a rule update process (step ST001) and an abnormality detection process (step ST002). Since the abnormality detection process is performed using the updated detection rule R2, the rule update process is performed first. However, since both processes are performed on the continuously received communication data D, the rule update process and the abnormality detection process are independent of each other and are executed at arbitrary timings, so each process is executed at an arbitrary timing. For example, only the rule update process is executed after software update or when the accessory power is turned on, and the abnormality detection process may be executed, for example, after a certain period of time has elapsed.

[0035] First, the rule update process will be described. FIG. 6 is a flowchart showing the rule update process according to Embodiment 1. In the rule update process, first, the information included in the detection rule R1 is acquired (step ST011). The rule update unit 103 acquires information on the rule numbers, determination priorities, and resource usage rates from the determination rules Ra to Re included in the detection rule R1.

[0036] Next, the resource usage status is acquired (step ST012). The rule update unit 103 receives the usage status data P from the resource management unit 104, and acquires the remaining resources of the resources for which the determination process can be performed by the abnormality detection unit 105 as the resource usage status of the abnormality detection device 100. Here, as an example, the remaining resources of the processor 81 and the memory 82 are acquired.

[0037] Next, the determination range of the detection rule is determined (step ST013). Based on the determination priority and resource usage rate information acquired in step ST011 and the resource remaining capacity information acquired in step ST012, the rule update unit 103 determines the determination rules to be included in the determination range in the order of determination priority within the range where the total resource usage rate required for the determination process of each determination rule does not exceed the resource remaining capacity.

[0038] Next, the detection rule is updated (step ST014). The rule update unit 103 updates the determination range ("〇" or "×") of each determination rule as determined in step ST 013 . The rule update unit 103 transmits the detection rule R1 updated as described above to the abnormality detection unit 105 as the updated detection rule R2.

[0039] The rule update process may be executed at any timing. For example, it may be executed at the timing when the resource management unit 104 updates the resource usage status (usage status data P), or it may be executed at the timing when the communication control unit 101 receives the communication data D to be determined.

[0040] Next, the abnormality detection process will be described. FIG. 7 is a flowchart showing the abnormality detection process according to the first embodiment. First, the communication control unit 101 receives communication data D (step ST101).

[0041] Next, the abnormality detection unit 105 refers to the determination range of the detection rule (updated detection rule R2) (step ST102).

[0042] In the updated detection rule R2, if all the determination rules are included in the determination range, the process proceeds to step ST104, and if there is a determination rule not included in the determination range, the process proceeds to step ST106 (step ST103).

[0043] If all the determination rules are included in the determination range (step ST103: Y), the abnormality detection unit 105 determines the target communication data D based on the detection rule (updated detection rule R2) (step ST104), and outputs and records the determination result as a detection log (step ST105).

[0044] If there is a determination rule not included in the determination range (step ST103: N), first, the resource usage status is acquired (step ST106). The unexecuted process management unit 106 receives the usage status data P from the resource management unit 104, and acquires the usage status of the resources provided in the abnormality detection device 100 from the usage status data P. Further, the unexecuted process management unit 106 determines whether there is free space in the storage 83 from the acquired resource usage status. If there is free space in the storage 83, the process proceeds to step ST108, and if there is no free space, the process ends.

[0045] If there is spare capacity in the storage 83 (step ST107: Y), the communication data D to be determined and the determination rules not included in the determination range in the updated detection rule R2 are stored (step ST108: temporary storage process). The undetermined information storage unit 107 stores the communication data D to be determined received from the communication control unit 101 and the unexecuted detection rule R21 received from the unexecuted process management unit 106. As described above, the unexecuted detection rule R21 is composed of the determination rules not included in the determination target among the updated detection rules R2.

[0046] Next, after ensuring the spare capacity of the resources (here, the spare capacity of the processor 81 and the memory 82 as described above), the communication data D is determined (step ST109). The unexecuted process management unit 106 updates the spare capacity of the resources by periodically receiving the usage status data P. When it is determined that the spare capacity of the resources exceeds the usage rate of the resources required for the undetermined determination process, the process proceeds to step ST109. Note that since all the determination processes need to be finally executed, the timing to proceed to step ST109 may be when all the determination processes included in the unexecuted detection rule R21 become executable, or at the stage when some of them become executable, it may be appropriate to proceed to step ST109 as appropriate. Since the process of step ST109 is executed at an uncertain timing where sufficient spare capacity of the resources for performing the determination process is ensured, if there is another abnormality detection process, the process proceeds from step ST108 to step ST104, and step ST109 is executed separately in parallel.

[0047] The details of the process of step ST109 will be described. FIG. 8 is a flowchart showing the operation when executing the undetermined determination process in the first embodiment. First, the communication data D to be determined is acquired (step ST1091). The abnormality detection unit 105 acquires the communication data D to be determined from the undetermined information storage unit 107.

[0048] Next, obtain the determination rules not included in the determination range (step ST1092). The abnormality detection unit 105 obtains the unexecuted detection rule R21 from the undetermined information storage unit 107, thereby obtaining the determination rules not included in the determination range in the updated detection rule R2.

[0049] Next, determine the communication data based on the detection rules (step ST1093). The same processing as in step ST104 is executed for the determination rules not included in the determination range.

[0050] Next, record the log of the determination result (step ST1094). This is the same as the processing in step ST105.

[0051] Note that in the abnormality detection process, the processing after step ST102 may be executed each time the communication data D is received, or a certain amount of communication data D may be accumulated as a queue and executed collectively at a certain timing.

[0052] According to Embodiment 1, it is possible to realize anomaly detection by monitoring communication data while preventing resource shortage even in an environment with limited resources. More specifically, an anomaly detection unit that determines the presence or absence of anomalies in communication data, and a rule update unit that updates a detection rule based on usage status data indicating the usage status of resources and generates an updated detection rule in which the range of determination processing to be executed is within the remaining capacity of the resources. When there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the storage, an unexecuted process management unit that executes a temporary storage process of storing the determination rule of the unexecuted determination process and the communication data in the storage is provided. The anomaly detection unit determines the presence or absence of anomalies in the communication data based on the updated detection rule. When the temporary storage process is being executed, the anomaly detection unit executes the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured. As a result, even in an environment with limited resources, the range of determination processing to be executed is changed according to the remaining capacity of the resources capable of performing the determination processing, so that a resource shortage does not occur. Therefore, the processing does not stop even during high load, and the anomaly detection of communication data can be continued.

[0053] Also, when there is an unexecuted determination process in the updated detection rule, the determination process is executed at a timing when there is remaining capacity of the resources. Therefore, it is possible to prevent omission of execution of the detection rule without excessively increasing the processing load, and to perform a monitoring process through anomaly detection of communication data.

[0054] Embodiment 2. Next, Embodiment 2 will be described with reference to FIGS. 9 to 13. Note that the same reference numerals are given to the same or corresponding configurations as those shown in FIGS. 1 to 8, and the description thereof will be omitted. Embodiment 2 causes an anomaly detection unit of another device on the system to execute anomaly detection processing when all determination processes are not included in the determination range. FIG. 9 is a block diagram showing the configuration of the abnormality detection system according to Embodiment 2. The abnormality detection system 2000 is different from the first embodiment in that, separately from the abnormality detection device 200, an abnormality detection unit 211, which is another abnormality detection unit, is provided in the ECU 210. The abnormality detection device 200 includes a communication control unit 201, a detection rule storage unit 202, a rule update unit 203, a resource management unit 104, and an abnormality detection unit 205. The abnormality detection device 200 also includes an unexecuted process management unit 206 and a log recording unit 207. The abnormality detection unit 205 and the abnormality detection unit 211 correspond to the "first abnormality detection unit" and the "second abnormality detection unit", respectively.

[0055] FIG 9 As shown in FIG, in Embodiment 2, not only the abnormality detection device 200 but also the ECU 210 includes an abnormality detection unit. That is, the ECU 210 also has a function as an abnormality detection device. Note that the abnormality detection device 200 may also have the function of the ECU, which is the same as in the first embodiment. The abnormality detection unit 205 of the abnormality detection device 200 and the abnormality detection unit 211 of the ECU 210 can be configured without particular limitation as long as the resources are physically or logically separated and the abnormality detection processes can be executed independently. That is, it is sufficient that the resources used by the abnormality detection unit 211 are physically or logically separated from the resources used by the abnormality detection unit 205. For example, the abnormality detection unit 211 does not necessarily have to be provided in the ECU 210 and may be provided in another device connected to the in-vehicle network 120 as long as the above conditions are satisfied. Also, for the ECU 210, any mode in which the abnormality detection process by the abnormality detection unit 211 can be executed is acceptable. For example, a switch, a system-on-a-chip (SOC), a virtual machine (VM), or a processor having a plurality of cores can be considered.

[0056] Communication control unit 201This is basically the same as the communication control unit 101 in Embodiment 1, but it is different from Embodiment 1 in that the communication data D to be determined and the unexecuted detection rule R21* are transmitted to the abnormality detection unit 211 of the ECU 210, and the detection log L2 from the abnormality detection unit 211 is received. The unexecuted detection rule R21* and the detection log L2 will be described later.

[0057] The detection rule storage unit 202 is the same as the detection rule storage unit 102 in Embodiment 1, but the detection rule R1* to be stored is different from that in Embodiment 1. The detection rule R1* will be described later.

[0058] The rule update unit 203 is the same as that in Embodiment of 1 The rule update unit 103 However, since the detection rule R1* before update is different from that in Embodiment 1, the detection rule R2* after update is also different from that in Embodiment 1.

[0059] The detection rules of Embodiment 2 will be described. FIG. 10A is a diagram showing an example of the detection rules according to Embodiment 2 and is a diagram showing the detection rules before update. FIG. 10B is a diagram showing an example of the detection rules according to Embodiment 2 and is a diagram showing the detection rules after update. In FIGS. 10A and 10B, some of the same items as FIGS. 2A and 2B showing the detection rules of Embodiment 1, specifically, the descriptions of "source", "destination", "data size", and "data" are omitted. As shown in FIGS. 10A and 10B, the detection rule R1* and the detection rule R2* after update also include a list of determination rules composed of, for example, five determination rules Ra* to Re*. Each determination rule includes "rule number", "data ID", "source", "destination", "data size", "data", "determination priority", "determination range", and "resource utilization rate" in the same manner as in Embodiment 1.

[0060] The determination rules Ra* to Re* further include items of "risk value at the time of omission" and "number of times included in the determination range". The "risk value at the time of omission" indicates the importance of the determination rule from the perspective of risk assessment and is determined in advance. The "number of times included in the determination range" is the number of times that the determination rule is included in the determination range within a certain period, and is the count of the number of times included in the determination range when the determination range is determined in the rule update process. In Embodiment 1, the determination priority was included in the determination range in descending order, but in Embodiment 2, the determination priority to be seen as Calculate a combination of determination rules such that the sum of the values weighted by the number of times included in the determination range for the product of the risk values at the time of omission is maximized, and include the determination rules constituting the calculated combination in the determination range. In the example shown in FIG. 10B, the updated detection rule R2* only includes the determination rules Ra* and Rd* in the determination range, and the determination rules Rb*, Rc*, and Re* are outside the determination range. Also, thereby, the total utilization rate of the resources of the determination rules included in the determination range is 30%.

[0061] Also, the determination priority to be seen as may be updated based on the value weighted by the number of times included in the determination range for the product of the risk values at the time of omission. For example, the determination priority of the determination rule with a small number of times included in the determination range may be increased so that the determination rule with a small number of times included in the determination range is preferentially included in the determination range. In the examples shown in FIGS. 10A and 10B, it can be seen that the determination priorities of the determination rules Ra*, Rb*, and Rd* are updated so that the determination rules Ra* and Rd are included in the determination range. Also, only the determination rules Ra* and Rd* that are still included in the determination range after the update have an increase of 1 in the number of times included in the determination range. Note that the above is an example, and other methods than the above are also conceivable as long as the determination rules to be included in the determination range are determined based on at least one of the "risk value at the time of omission", "determination priority", and "number of times included in the determination range".

[0062] The detection rule R1* and the updated detection rule R2* in the second embodiment are as described above. However, in the second embodiment, the detection rule R1 and the updated detection rule R2 of the first embodiment may also be used. Also, it is conceivable to use the detection rule R1* and the updated detection rule R2* of the second embodiment in the first embodiment.

[0063] The resource management unit 104 is the same as in the first embodiment. It manages the usage status of the resources provided by the anomaly detection device 200, and transmits the data on the usage status of the resources as usage status data P to the rule update unit 203 and the unexecuted process management unit 206.

[0064] The anomaly detection unit 205 detects an anomaly in the communication data D by determining whether the communication data D is normal or not by executing a determination process on the communication data D in the same manner as the anomaly detection unit 105 in the first embodiment to determine the presence or absence of an anomaly. The anomaly detection unit 205 determines whether the communication data D is normal or not based on the updated detection rule R2* to detect an anomaly. Also, the anomaly detection unit 205 transmits the determination result to the log recording unit as a detection log L1. The detection log L1 will be described later.

[0065] The unexecuted process management unit 206 basically changes the execution method of the determination process when there is a determination rule not included in the determination range in the updated detection rule R2* and there is a determination process not executed in the abnormality detection unit 205, similar to the unexecuted process management unit 106 in the first embodiment. However, while the unexecuted process management unit 106 in the first embodiment performs processing according to the availability of the remaining capacity of the storage 83, the unexecuted process management unit 206 performs processing according to the availability of the remaining capacity of the communication device 84. The unexecuted process management unit 206 receives the updated detection rule R2* from the rule update unit 203 and receives the usage status data P from the resource management unit 104. The unexecuted process management unit 206 acquires information regarding the remaining capacity of the communication device 84 from the usage status data P, and according to the remaining capacity of the communication device 84, causes the communication control unit 201 to execute a "transfer process" of transmitting the unexecuted detection rule R21* and the communication data D to be determined to the abnormality detection unit 211 of the ECU 210. The unexecuted detection rule R21* is composed of the determination rules Rb*, Rc*, and Re* in the case of the updated detection rule R2* shown in FIG. 10B. Note that since the communication control unit 201 is realized by the communication device 84, causing the communication control unit 201 to transmit is equivalent to causing the communication device 84 to transmit.

[0066] When the transfer process is executed by the unexecuted process management unit 206, the abnormality detection unit 211 receives the unexecuted detection rule R21* and the communication data D, and determines the presence or absence of an abnormality in the communication data D based on the unexecuted detection rule R21*. That is, the abnormality detection unit 211 executes the determination processes of the determination rules Rb*, Rc*, and Re*. The abnormality detection unit 211 transmits the result of the determination process as the detection log L2 to the log recording unit 207 via the in-vehicle network 120 and the communication control unit 201.

[0067] The log recording unit 207 acquires the detection log L1 from the abnormality detection unit 205 and the detection log L2 from the abnormality detection unit 211, integrates the detection log L1 and the detection log L2, and records them as the integrated detection log L. FIG. 11 is a diagram showing an example of a detection log according to Embodiment 2, and shows an example of a detection log generated by different abnormality detection units and a detection log after integrating each detection log. The detection log L1, the detection log L2, and the integrated detection log L include "transmission / reception time", "log recording time", "data ID", "transmission source", "transmission destination", "data size", "data", "rule number", and "abnormal item". Note that the items to be recorded are arbitrary, and other items may be used as long as they can be used in log analysis when identifying the cause of an abnormality or the like.

[0068] The "transmission / reception time" is the time when the communication data D to be determined is received in the abnormality detection unit (abnormality detection unit 205 or abnormality detection unit 211). The "log recording time" is the time when each log is recorded in the log recording unit 207 (or each device). The "data ID" is the data ID of the communication data to be determined. "Transmission source" and "transmission destination" indicate the device serving as the transmission source and the device serving as the transmission destination when the communication data D is transmitted and received on the in-vehicle network 120. The "data size" is the data size of the communication data D, and "data" indicates the value or range of specific data. The "rule number" is the rule number of the determination rule of the executed determination process. The "abnormal item" is an item in which the communication data D does not conform to the determination rule in the determination process, and is an item determined to be abnormal in relation to the determination process in the determination rule. However, the detection log shown in FIG. 11 is an example, and the items recorded in the detection logs L1 and L2 are arbitrary. Other items may be used as long as they can be used in log analysis when identifying the cause of an abnormality or the like.

[0069] The log recording unit 207 sequentially receives the detection logs L1 and L2 sequentially sent from the abnormality detection unit 205 and the abnormality detection unit 211. When newly recording a detection log, it integrates and records the newly received detection log with the already recorded detection log. In the example shown in FIG. 11, the detection logs L1 and L2 are integrated so that each log (one line of log) of the integrated detection log L, which is the log after integration, is arranged in the order of the transmission / reception time, and the order of each log and the order of transmission / reception are made to match. Note that when recording the detection logs L1 and L2 without considering consistency, they will be recorded in the order of the log recording time. Here, the abnormality detection unit 205 and the abnormality detection unit 211 each independently execute a determination process, and the detection logs L1 and L2 are also sent to the log recording unit 207 respectively, so the time-series order of the transmission / reception time of the communication data D and the time-series order of the log recording time do not always match. In particular, in the second embodiment, the resources used by the abnormality detection unit 205 and the abnormality detection unit 211 are physically or logically separated. By making the order of each log and the order of transmission / reception match as described above, even if the abnormality detection unit 205 and the abnormality detection unit 211 each independently execute a determination process, the finally obtained integrated detection log L is arranged in the transmission / reception order of the communication data D, and the ease of analysis is high.

[0070] Generally, in log analysis, it is rare to perform analysis from the logs in a single device, and it is also conceivable to perform analysis from the logs in the entire system. There are also cases where the time-series information of the transmission / reception time of communication data becomes important information for analysis. Regarding the method of taking log consistency, a method of grouping related detection logs L1 and L2 is also conceivable. As long as it is a method that can improve the ease of log analysis in log analysis when identifying the cause of an abnormality or the like, there is no particular limitation.

[0071] Next, the operation will be described. Also in the second embodiment, rule update processing and anomaly detection processing are executed in the same manner as in the first embodiment. Regarding the rule update processing, although the specific method of update is different from that in the first embodiment, such as performing an update considering the "risk value at the time of omission", the flow is the same. Also, the rule update processing and the anomaly detection processing are independent of each other and are executed at arbitrary timings, which is the same as in the first embodiment. For this reason, only the anomaly detection processing will be described for the operation of the second embodiment. FIG. 12 is a flowchart showing the anomaly detection processing according to the second embodiment. First, the communication control unit 201 receives communication data D (step ST201).

[0072] Next, the anomaly detection unit 205 refers to the determination range of the detection rule (updated detection rule R2*) (step ST202).

[0073] In the updated detection rule R2*, if all the determination rules are included in the determination range, the process proceeds to step ST204, and if there is a determination rule not included in the determination range, the process proceeds to step ST206 (step ST203).

[0074] When all the determination rules are included in the determination range (step ST203: Y), the anomaly detection unit 205 determines the target communication data D based on the detection rule (updated detection rule R2*) (step ST204), outputs the determination result as the detection log L1, and records it in the log recording unit 207 as the integrated detection log L (step ST 205 ). When there is already a recorded integrated log, the log recording unit 207 integrates and records the detection log L1 into the integrated detection log L. As described above, when integrating the detection logs, the integration is performed so that the order of each log matches the order of transmission and reception.

[0075] If there is a determination rule not included in the determination range (step ST203: N), first, the usage status of resources is acquired (step ST206). The unexecuted process management unit 206 receives the usage status data P from the resource management unit 104, and acquires the usage status of the resources provided in the abnormality detection device 200 from the usage status data P. Further, the unexecuted process management unit 206 determines whether there is spare capacity in the communication device 84 from the acquired usage status of the resources. If there is spare capacity in the communication device 84, the process proceeds to step ST208, and if there is no spare capacity, the process ends.

[0076] If there is spare capacity in the communication device 84 (step ST207: Y), the unexecuted process management unit 206 causes the communication control unit 201 to transmit the communication data D to be determined and the unexecuted detection rule R21* composed of the determination rules not included in the determination range in the updated detection rule R2* to the abnormality detection unit 211 of the ECU 210 (step ST208: transfer process). The ECU 210 sends the received communication data D and the unexecuted detection rule R21* to the ECU 210.

[0077] When the abnormality detection unit 211 receives the communication data D and the unexecuted detection rule R21* from the communication control unit 201 of the abnormality detection device 200, the abnormality detection unit 211 executes the unexecuted determination process that has not been executed by the abnormality detection unit 205 and determines the communication data D (step ST209). As described above, since the abnormality detection process by the abnormality detection unit 205 and the abnormality detection process by the abnormality detection unit 211 are executed independently, the processes in steps ST204 and 205 and the process in step ST209 are also executed in parallel.

[0078] The details of the process in step ST209 will be described. FIG. 13 is a flowchart showing the operation when executing the unexecuted determination process in the second embodiment. First, the communication data D to be determined is acquired (step ST2091). The abnormality detection unit 211 acquires the communication data D received by the ECU 210 from the communication control unit 201.

[0079] Next, obtain the determination rules not included in the determination range (step ST2092). The abnormality detection unit 205 obtains the unexecuted detection rule R21* received by the ECU 210 from the communication control unit 201, thereby obtaining the determination rules not included in the determination range in the updated detection rule R2*.

[0080] Next, determine the communication data based on the detection rules (step ST2093). The abnormality detection unit 211 executes the same process as the process of step ST204 by the abnormality detection unit 205 for the determination rules not included in the determination range.

[0081] Next, record the log of the determination result (step ST2094). The abnormality detection unit 211 transmits the detection log L2 to the communication control unit 201 of the abnormality detection device 200. The communication control unit 201 transmits the received detection log L2 to the log recording unit 207. The log recording unit 207 integrates and records the detection log L2 into the integrated detection log L in the same manner as in step ST205 when there is already a recorded integrated log. When integrating the detection logs, the integration is performed so that the order of each log and the order of transmission and reception are consistent. The rest is the same as in the first embodiment.

[0082] According to Embodiment 2, the same effects as those of Embodiment 1 can be obtained. More specifically, an updated detection rule is generated in the same manner as in Embodiment 1, and the abnormality detection unit determines the presence or absence of communication data abnormality within the range of the remaining capacity of the resource based on the updated detection rule. Further, another abnormality detection unit whose used resources are physically or logically separated from the abnormality detection unit is provided. When there is an unexecuted determination process that is not executed in the updated detection rule and the communication device has remaining capacity, the unexecuted process management unit executes a transfer process of transmitting the determination rule of the unexecuted determination process and the communication data to another abnormality detection unit. When the transfer process is executed, since another abnormality detection unit executes the unexecuted determination process, omission of execution of the detection rule is prevented. In addition, another abnormality detection unit is provided in a device (ECU) different from the abnormality detection device, and the used resources are separated from the abnormality detection unit, so that the process is not stopped even during high load, and abnormality detection of communication data can be continued, and monitoring processing through abnormality detection of communication data can be performed.

[0083] Also, in the update of the detection rule, according to the remaining capacity of the resources capable of executing the determination process, the determination priority, and glance the risk value at the time of omission, the range and determination priority of the determination process to be executed are changed, so that the monitoring process can be continued while maximizing the effect of the monitoring process even during high load.

[0084] Also, when recording the inspection known as results of the abnormality detection, the detection logs of the abnormality detection unit and the detection logs of other abnormality detection units are integrated and recorded. At the time of integration, each detection log is arranged in the order of the transmission / reception time of the communication data and then integrated. Thereby, the order of each log and the order of transmission / reception are matched, the ease of log analysis is enhanced, and log analysis for specifying the cause of an abnormality or the like is facilitated.

[0085] Embodiment 3. Next, Embodiment 3 will be described with reference to FIGS. 14 and 15. Components that are the same as or corresponding to those shown in FIGS. 1 to 13 are denoted by the same reference numerals, and their description will be omitted. Embodiment 3 is a combination of Embodiment 1 and Embodiment 2. FIG. 14 is a block diagram showing the configuration of the abnormality detection system in Embodiment 3. FIG. 14 shows the abnormality detection system of Embodiment 3 in a form in which a configuration peculiar to Embodiment 1 is added based on Embodiment 2. However, the same applies when a configuration peculiar to Embodiment 2 is added based on Embodiment 1. Also, in order to avoid making the drawings complicated, the description of the data flow is partially omitted. For components denoted by the same reference numerals as those in Embodiments 1 and 2, they are the same as in Embodiments 1 and 2, respectively. The abnormality detection device 300 of the abnormality detection system 3000 is different from that in Embodiment 2 in that the undetermined information storage unit 107 is provided.

[0086] When there is a determination rule that is not included in the determination range in the updated detection rule R2* and there is a determination process that has not been executed in the abnormality detection unit 205, the unexecuted process management unit 306 changes the execution method of the determination process based on the resource utilization status. The unexecuted process management unit 306 receives the updated detection rule R2* from the rule update unit 203 and receives the utilization status data P from the resource management unit 104. The unexecuted process management unit 306 acquires information regarding the remaining capacity of the storage 83 and the communication device 84 from the utilization status data P, and manages the processes that have not been executed in the abnormality detection unit 205 according to the remaining capacity of the storage 83 and the communication device 84.

[0087] When there is room in the storage 83, the unexecuted process management unit 306 causes the unexecuted detection rule R21* and the communication data D to be judged to be stored in the undetermined information storage unit 107. Thereafter, in the same manner as the unexecuted process management unit 106 of the first embodiment, when it is determined that the remaining capacity of the resources (the usage rate or processing speed of the processor 81, or the remaining capacity of the usage amount of the memory 82) necessary for executing the unexecuted determination process can be secured, the unexecuted detection rule R21* and the communication data D to be judged stored in the undetermined information storage unit 107 are transmitted to the abnormality detection unit 205, and the abnormality detection unit 205 is made to execute the unexecuted determination process.

[0088] When there is room in the communication device 84, the unexecuted process management unit 306 transmits the unexecuted detection rule R21* and the communication data D to be judged to the abnormality detection unit 211 of the ECU 210 via the communication control unit 201 and the in-vehicle network 120. The abnormality detection unit 211 executes the unexecuted determination process (the determination process of the determination rule constituting the unexecuted detection rule R21*) in the same manner as in the second embodiment, and transmits the result of the determination process as the detection log L2 to the log recording unit 207 via the in-vehicle network 120 and the communication control unit 201. The log recording unit 207 integrates the received detection log with the already recorded log and records it as the integrated detection log L in the same manner as in the second embodiment.

[0089] Next, the operation will be described. Since the abnormality detection process of the third embodiment is only different from that of the second embodiment, only the flow of the abnormality detection process will be described here. FIG. 15 is a flowchart showing the abnormality detection process according to the third embodiment. Steps ST201 to ST206 are the same as those in the second embodiment.

[0090] After obtaining the resource utilization status in step ST206, the unexecuted process management unit 306 determines whether the resource with available capacity is the storage 83 or the communication device 84 based on the utilization status data P. If the resource with available capacity is the storage 83, the process proceeds to step ST308; if the resource with available capacity is the communication device 84, the process proceeds to step ST309 (step ST307). If there is available capacity in both, it may proceed to either one. For example, it is conceivable to proceed to the one with greater available capacity. Although not shown in the figure, if there is no available capacity in either, the process ends.

[0091] If there is available capacity in the storage 83, the processes of steps ST108 and 109 of Embodiment 1 are executed (step ST308). If there is available capacity in the communication device 84, the processes of steps ST208 and 209 of Embodiment 2 are executed (step ST309). For the rest, it is the same as in Embodiment 2.

[0092] According to Embodiment 3, when there is available capacity in the storage, the same effects as in Embodiment 1 can be obtained, and when there is available capacity in the communication device, the same effects as in Embodiment 2 can be obtained.

[0093] In the above embodiments, the case where the abnormality detection system and the abnormality detection device of each embodiment are applied to the ECU has been described. However, the present invention is not limited to this, and it may be applied to control devices or control systems for mobility such as construction machines, agricultural machines, ships, railways, and aircraft. Further, it may be applied to industrial control systems such as factories, buildings, and infrastructure facilities.

[0094] Although various exemplary embodiments and examples are described in the present application, the various features, aspects, and functions described in one or more of the embodiments are not limited to the application of a specific embodiment, but can be applied to the embodiments alone or in various combinations. Accordingly, numerous modifications not illustrated are envisioned within the scope of the technology disclosed in the present application. For example, it shall include cases where at least one component is modified, added, or omitted, and further cases where at least one component is extracted and combined with components of other embodiments.

Description of Reference Numerals

[0095] 81 Processor, 82 Memory, 83 Storage, 84 Communication Device, 100, 200, 300 Abnormality Detection Device, 101, 201 Communication Control Unit, 102, 202 Detection Rule Storage Unit, 103, 203 Rule Update Unit, 104 Resource Management Unit, 105, 205, 211 Abnormality Detection Unit, 106, 206, 306 Unprocessed Process Management Unit, 107 Unjudged Information Storage Unit, 110, 210 ECU, 120 In-vehicle Network, 207 Log Recording Unit, 1000, 2000, 3000 Abnormality Detection System, D Communication Data, L Integrated Detection Log, L1, L2 Detection Log, P Usage Status Data, R1, R1* Detection Rule, R2, R2* Updated Detection Rule, R21, R21* Unprocessed Detection Rule, Ra~Re, Ra*~Re* Judgment Rule

Claims

1. A communication control unit connected to a network and receiving communication data flowing through the network; A detection rule storage unit storing a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data and storing a detection rule used for detecting an abnormality in the communication data; An abnormality detection unit for determining the presence or absence of an abnormality in the communication data; A resource status management unit that manages the usage status of resources used by the abnormality detection unit and outputs usage status data indicating the usage status of the resources; A rule update unit that updates the detection rule based on the usage status data and generates an updated detection rule in which the range of the determination process to be executed is within the remaining capacity range of the resources; An unexecuted process management unit that, when there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the storage, executes a temporary storage process of storing the determination rule and the communication data of the unexecuted determination process in the storage; The abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule; When the temporary storage process is being executed, the abnormality detection unit executes the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured. An abnormality detection device characterized by this.

2. The determination rule includes a determination priority, and the rule update unit includes the determination process of the determination rule having a higher determination priority in the range of the determination process to be preferentially executed. The abnormality detection device according to claim 1.

3. The determination rule includes data indicating the amount of resources required for the execution of the determination process, and the rule update unit updates the determination priority to minimize the difference between the remaining capacity of the resources and the total amount of resources required for the determination process to be executed. The combination of the determination rules is generated, and the determination process of the combination of the determination rules is included in the range of the determination process to be executed. The abnormality detection device according to claim 2.

4. The determination rule includes a risk value when an abnormality detection is missed and data on the number of times included in the range of the determination process to be executed. The rule update unit generates a combination of the determination processes based on at least one of the risk value, the determination priority, and the number of times, and the determination process of the combination of the determination rules is included in the range of the determination process to be executed. The abnormality detection device according to claim 2.

5. The abnormality detection device according to claim 1, wherein the usage status data includes at least one of the usage rate and processing speed of the processor, the amount of memory used, the amount of storage used, the communication bandwidth and communication speed of the communication device.

6. A communication control unit connected to a network and receiving communication data flowing through the network, A detection rule storage unit that stores a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data and stores a detection rule used for detecting an abnormality in the communication data, A first abnormality detection unit that determines the presence or absence of an abnormality in the communication data, A second abnormality detection unit in which the resources used by the first abnormality detection unit are physically or logically separated, A resource status management unit that manages the usage status of the resources used by the first abnormality detection unit and outputs usage status data indicating the usage status of the resources, A rule update unit that updates the detection rule based on the usage status data and generates an updated detection rule in which the range of the determination process to be executed is within the remaining capacity range of the resources, When there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the communication device, the transfer process of transmitting the determination rule of the unexecuted determination process and the communication data to the second abnormality detection unit is executed by the communication device, and an unexecuted process management unit is provided, The first abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule, The second abnormality detection unit executes the unexecuted determination process when the transfer process is being executed. An abnormality detection system characterized by this.

7. When there is an unexecuted determination process that is not executed in the updated detection rule, When there is remaining capacity in the storage and no remaining capacity in the communication device, the unexecuted process management unit executes a temporary storage process of storing the determination rule of the unexecuted determination process and the communication data in the storage, When there is remaining capacity in both the storage and the communication device, the unexecuted process management unit selects and executes either the temporary storage process or the transfer process, When the temporary storage process is executed by the unexecuted process management unit, The first abnormality detection unit determines the presence or absence of an abnormality in the communication data by executing the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured. When the transfer process is executed by the unexecuted process management unit, The second abnormality detection unit determines the presence or absence of an abnormality in the communication data by executing the unexecuted determination process. The abnormality detection system according to claim 6.

8. Further comprising a log recording unit that records a detection log which is a result of determining the presence or absence of an abnormality in the communication data, When the transfer process is executed, the log recording unit integrates and records the detection logs respectively obtained from the first abnormality detection unit and the second abnormality detection unit. The abnormality detection system according to claim 6 or 7.

9. The determination rule includes a determination priority, and the rule update unit includes, in the scope of the determination process, preferentially executing the determination process of the determination rule having a higher determination priority. The abnormality detection system according to claim 6 or 7.

10. The determination rule includes data indicating the amount of resources required for the execution of the determination process. The rule update unit updates the determination priority and generates a combination of determination rules that minimizes the difference between the remaining resources and the total amount of resources required for the executed determination process, and includes the determination process of the determination rules of the combination in the scope of the determination process to be executed. The abnormality detection system according to claim 9.

11. The determination rule includes a risk value when an abnormality detection is missed and data on the number of times included in the scope of the determination process to be executed. The rule update unit generates a combination of the determination processes based on at least one of the risk value, the determination priority, and the number of times, and includes the determination process of the determination rules of the combination in the scope of the determination process to be executed. The abnormality detection system according to claim 9.

12. The usage status data includes at least one data among the usage rate and processing speed of the processor, the usage amount of the memory, the usage amount of the storage, the communication bandwidth and communication speed of the communication device. The abnormality detection system according to claim 6.

13. An abnormality detection method for detecting an abnormality in communication data flowing through a network, Managing the usage status of resources used for determining the presence or absence of an abnormality in the communication data, and outputting usage status data indicating the usage status of the resources. Including a determination rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data, updating a detection rule used for detecting an abnormality in the communication data based on the usage status data, and generating an updated detection rule with the range of the determination process to be executed within the range of the remaining capacity of the resource. A step of determining the presence or absence of an abnormality in the communication data based on the updated detection rule by a first abnormality detection unit. When there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the communication device, a transfer process is executed by the communication device to transmit the determination rule of the unexecuted determination process and the communication data to a second abnormality detection unit in which the resources used with the first abnormality detection unit are physically or logically separated. An abnormality detection method characterized by comprising a step of executing the unexecuted determination process by the second abnormality detection unit when the transfer process is being executed.

Images