Detection device, detection method, and detection program

Abstract

To more accurately detect unauthorized messages in an on-vehicle network.SOLUTION: A detection device detects unauthorized messages in an on-vehicle network mounted on a vehicle. The detection device includes: a message acquisition unit that acquires a transmission message in the on-vehicle network; and a determination unit that makes a determination regarding the transmission message acquired by the message acquisition unit, and thereby makes a determination regarding an unauthorized message in the on-vehicle network. The determination unit can output a second determination result related to the transmission message in addition to a first determination result as to whether the transmission message acquired by the message acquisition unit is the unauthorized message.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to a detection device, a detection method, and a detection program. [Background technology]

[0002] Conventionally, in-vehicle network systems have been developed to improve security in in-vehicle networks.

[0003] For example, Patent Document 1 (JP 2019-29961 A) discloses the following fraud detection method: That is, in a fraud detection method used in a monitoring electronic control unit connected to a network in an in-vehicle network system, fraud detection rule information indicating a first condition that is a condition regarding the relationship in content between frames having a first identifier and frames having a second identifier is used to determine whether a set of frames received from the network satisfies the first condition, fraud detection rule information indicating a second condition that is a condition regarding the relationship in content between frames having the first identifier and frames having a third identifier is used to determine whether the set of frames received from the network satisfies the second condition, calculates an anomaly level for the transmission of the first type frames according to the number of conditions that are determined not to be satisfied, and transmits a predetermined frame according to the calculated anomaly level. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2019-29961 Summary of the Invention [Problem to be solved by the invention]

[0005] When determining whether a message sent from an in-vehicle device in an in-vehicle network is an unauthorized message, it may be difficult to make a clear determination depending on the value of the data included in the message.

[0006] The present invention has been made to solve the above-mentioned problems, and its purpose is to provide a detection device, a detection method, and a detection program that can more accurately detect fraudulent messages in an in-vehicle network. [Means for solving the problem]

[0007] The detection device disclosed herein is a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, and includes a message acquisition unit that acquires transmitted messages in the in-vehicle network, and a judgment unit that makes a judgment regarding fraudulent messages in the in-vehicle network by making a judgment on the transmitted messages acquired by the message acquisition unit, and the judgment unit is capable of outputting a second judgment result regarding the transmitted messages in addition to a first judgment result regarding whether the transmitted messages acquired by the message acquisition unit are fraudulent messages.

[0008] The detection method disclosed herein is a detection method in a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, and includes a step of acquiring a transmission message in the in-vehicle network, and a step of making a judgment regarding a fraudulent message in the in-vehicle network by making a judgment on the acquired transmission message, and in the judgment regarding the fraudulent message, in addition to a first judgment result as to whether the acquired transmission message is the fraudulent message, a second judgment result regarding the transmission message can be output.

[0009] The detection program disclosed herein is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, and is a program that causes a computer to function as a message acquisition unit that acquires transmitted messages in the in-vehicle network and a judgment unit that makes a judgment regarding fraudulent messages in the in-vehicle network by making a judgment on the transmitted messages acquired by the message acquisition unit, and the judgment unit is capable of outputting a second judgment result regarding the transmitted messages in addition to a first judgment result as to whether the transmitted messages acquired by the message acquisition unit are fraudulent messages.

[0010] One aspect of the present disclosure can be realized not only as a detection device equipped with such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the detection device, or as an in-vehicle communication system that includes the detection device. [Effects of the Invention]

[0011] According to the present disclosure, it is possible to more accurately detect fraudulent messages in an in-vehicle network. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating a configuration of a bus connection device group according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining the problem that arises when detecting fraudulent messages in an in-vehicle network. [Figure 5] FIG. 5 is a flowchart outlining an operation procedure for determining fraudulent messages by the determination unit in the detection device according to the embodiment of the present disclosure. [Figure 6] FIG. 6 is a flowchart defining an operation procedure including details of an unclear determination process for determining whether a message is fraudulent by a determination unit in a detection device according to an embodiment of the present disclosure. [Figure 7] FIG. 7 is a flowchart defining an operation procedure including details of an unclear determination process according to the second modification for determining whether a fraudulent message is detected by a determination unit in a detection device according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0013] First, the contents of the embodiments of the present disclosure will be listed and described.

[0014] (1) A detection device according to an embodiment of the present disclosure is a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, and includes a message acquisition unit that acquires outgoing messages in the in-vehicle network, and a judgment unit that makes a judgment regarding fraudulent messages in the in-vehicle network by making a judgment regarding the outgoing messages acquired by the message acquisition unit, and the judgment unit is capable of outputting a second judgment result regarding the outgoing messages in addition to a first judgment result regarding whether the outgoing messages acquired by the message acquisition unit are fraudulent messages.

[0015] With this configuration, for example, the second determination result can be output when determining whether a transmitted message is a fraudulent message or not, thereby preventing erroneous determination of whether the transmitted message is a fraudulent message or not, thereby enabling more accurate detection of fraudulent messages in the in-vehicle network.

[0016] (2) The determination unit may perform different processes on the transmission message when outputting the first determination result and when outputting the second determination result.

[0017] With this configuration, more appropriate processing can be performed according to the judgment result, for example, by creating log data for transmitted messages for which it is possible to clearly determine whether they are fraudulent or not, and by postponing the creation of log data for transmitted messages for which it is difficult to clearly determine whether they are fraudulent or not.

[0018] (3) The determination unit may calculate a statistical value of the second determination result, and determine whether or not the fraudulent message exists based on the calculated statistical value.

[0019] With this configuration, it is possible to obtain a more accurate determination result that statistically considers the number of times the second determination result is output within a certain period of time, or other second determination results that have been output multiple times.

[0020] (4) The second determination result may include a plurality of types of determination results, and the determination unit may perform weighting according to the types in calculating the statistical value.

[0021] With this configuration, for example, a type of judgment result corresponding to the possibility that the transmitted message being judged is an unauthorized message can be output as the second judgment result, thereby making it possible to obtain a more accurate judgment result.

[0022] (5) When the determination unit outputs the second determination result, the determination unit may create log data indicating that the second determination result has been output.

[0023] With this configuration, for example, it is possible to separately analyze a transmitted message that is difficult to clearly determine whether it is an unauthorized message or not.

[0024] (6) When the judgment unit outputs the second judgment result as the first judgment, the judgment unit may perform a second judgment with different content on another transmitted message that is different from the transmitted message that was the subject of judgment, and may determine whether or not the fraudulent message exists based on the judgment result of the second judgment.

[0025] In this way, by performing both the first determination and the second determination, which are different from each other, it is possible to further improve the performance of detecting fraudulent messages.

[0026] (7) The transmission message that is the target of the first determination and the other transmission message that is the target of the second determination may indicate different types of measurement results related to the vehicle.

[0027] This configuration makes it possible to prevent erroneous determinations due to an abnormality in one instrument, etc., and obtain more accurate determinations as to whether or not an unauthorized message exists.

[0028] (8) The transmitted message that is the subject of the first judgment may indicate a measurement result of the vehicle speed of the vehicle, and the judgment unit may change the judgment criteria for the second judgment depending on whether the measurement result of the vehicle speed satisfies a predetermined condition.

[0029] Here, the measurement results of the engine speed, steering angle, accelerator opening, or vehicle acceleration of a vehicle when the vehicle is traveling at a low speed often tend to differ from the measurement results when the vehicle is traveling at a high speed.

[0030] Therefore, with the above-mentioned configuration, in the second judgment, more appropriate judgment criteria can be used that take into account the tendency of the measurement results for the vehicle to change depending on the vehicle's speed, thereby obtaining a more accurate judgment result as to whether or not a fraudulent message is present.

[0031] (9) The transmitted message acquired by the message acquisition unit indicates a measurement result of the vehicle speed of the vehicle, and the detection device further includes a memory unit that stores a normal vehicle speed, which is the measurement result of the vehicle speed under normal conditions when the fraudulent message is not present, as well as a first threshold value and a second threshold value having a magnitude relationship determined based on the normal vehicle speed, and the judgment unit may compare the difference between the measurement result of the vehicle speed indicated by the transmitted message and the normal vehicle speed with the first threshold value and the second threshold value, and output the first judgment result or the second judgment result depending on the comparison result.

[0032] With this configuration, it is possible to easily grasp the difference from the normal state of the vehicle and easily determine whether the message is fraudulent.

[0033] (10) The memory unit may further store a third threshold value that is greater than the first threshold value and less than the second threshold value, and the judgment unit may output the second judgment result if the difference is greater than the first threshold value and less than or equal to the second threshold value. After outputting the second judgment result, the judgment unit may use the third threshold value stored in the memory unit to make a judgment regarding the fraudulent message for the transmitted message.

[0034] In this way, when the second determination result is output, a more accurate determination result can be obtained by performing a more detailed determination using the third threshold value.

[0035] (11) The detection device may further include a counter, and the judgment unit may change the count-up value of the counter depending on the magnitude relationship between the difference and the first threshold, the second threshold, and the third threshold, and may use the count value of the counter to make a judgment regarding the fraudulent message.

[0036] With this configuration, for example, the difference between the measured vehicle speed indicated by the transmitted message and the normal vehicle speed, i.e., the possibility that the transmitted message is a fraudulent message, can be reflected in the count value, thereby obtaining even more accurate judgment results.

[0037] (12) The determination unit may determine that the fraudulent message is present when the count value of the counter is equal to or greater than a predetermined value, the predetermined value being greater than the maximum value of the multiple count-up values ​​of the counter.

[0038] With this configuration, outputting the second determination result multiple times is one of the conditions for obtaining a determination result that an unauthorized message exists, so that a more accurate determination result can be obtained.

[0039] (13) The transmitted message that is the subject of the first judgment indicates the measurement result of the vehicle speed of the vehicle, and the transmitted message that is the subject of the second judgment indicates the measurement result of the engine speed of the vehicle, and the detection device further includes a memory unit that stores a normal engine speed, which is the measurement result of the engine speed under normal conditions when the fraudulent message is not present, and a fourth threshold value determined based on the normal engine speed, and in the second judgment, the judgment unit may compare the difference between the measurement result of the engine speed indicated by the transmitted message and the normal engine speed with the fourth threshold value.

[0040] This configuration prevents erroneous determinations due to abnormalities in the sensor that measures vehicle speed, etc., and allows for more accurate determination of whether or not a fraudulent message is present. Furthermore, differences from the normal vehicle state can be easily grasped, making it easy to determine whether or not a fraudulent message is present.

[0041] (14) A detection method according to an embodiment of the present disclosure is a detection method in a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, and includes the steps of acquiring a transmission message in the in-vehicle network and making a judgment regarding the fraudulent message in the in-vehicle network by making a judgment on the acquired transmission message, and in the judgment regarding the fraudulent message, in addition to a first judgment result as to whether the acquired transmission message is the fraudulent message, a second judgment result regarding the transmission message can be output.

[0042] This method can output a second determination result when determining whether a transmitted message is a fraudulent message, for example, and can prevent erroneous determination of whether the transmitted message is a fraudulent message, thereby enabling more accurate detection of fraudulent messages in an in-vehicle network.

[0043] (15) A detection program according to an embodiment of the present disclosure is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, and is a program for causing a computer to function as a message acquisition unit that acquires transmitted messages in the in-vehicle network and a judgment unit that makes a judgment regarding fraudulent messages in the in-vehicle network by making a judgment regarding the transmitted messages acquired by the message acquisition unit, and the judgment unit is capable of outputting a second judgment result regarding the transmitted messages in addition to a first judgment result regarding whether the transmitted messages acquired by the message acquisition unit are fraudulent messages.

[0044] With this configuration, for example, the second determination result can be output when determining whether a transmitted message is a fraudulent message or not, thereby preventing erroneous determination of whether the transmitted message is a fraudulent message or not, thereby enabling more accurate detection of fraudulent messages in the in-vehicle network.

[0045] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0046] <Configuration and basic operation> [Overall configuration] 1 is a diagram illustrating a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 1, the in-vehicle communication system 301 includes a gateway device (detection device) 101, a plurality of in-vehicle communication devices 111, and a plurality of bus connection device groups 121.

[0047] 2 is a diagram illustrating a configuration of a bus connection device group according to an embodiment of the present disclosure. Referring to FIG. 2, bus connection device group 121 includes a plurality of control devices 122. Note that bus connection device group 121 is not limited to a configuration including a plurality of control devices 122, and may also be a configuration including a single control device 122.

[0048] 1 again, the in-vehicle communication system 301 is mounted on a vehicle 1 (hereinafter also referred to as a target vehicle) traveling on a road. The in-vehicle network 12 includes a plurality of in-vehicle devices that are devices inside the target vehicle 1. Specifically, the in-vehicle network 12 includes a plurality of in-vehicle communication devices 111, which are an example of the in-vehicle devices, and a plurality of control devices 122 shown in FIG.

[0049] In addition, as long as the in-vehicle network 12 is configured to include multiple in-vehicle devices, it may be configured to include multiple in-vehicle communication devices 111 but not include a control device 122, or it may be configured to include no in-vehicle communication device 111 but include multiple control devices 122, or it may be configured to include one in-vehicle communication device 111 and one control device 122.

[0050] In the in-vehicle network 12, the in-vehicle communication device 111 communicates with, for example, a device outside the target vehicle 1. Specifically, the in-vehicle communication device 111 is, for example, a TCU (Telematics Communication Unit), a short-range wireless terminal device, and an ITS (Intelligent Transport Systems) wireless device.

[0051] The gateway device 101 is capable of transmitting and receiving data such as firmware updates and data stored by the gateway device 101 to and from an external device outside the target vehicle 1 via the port 112.

[0052] The gateway device 101 is, for example, a central gateway (CGW), and is connected to the in-vehicle devices via buses 13 and 14. Specifically, the buses 13 and 14 are buses that comply with standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0053] For example, the in-vehicle communication device 111 is connected to the gateway device 101 via a bus 14 that conforms to the Ethernet standard. Also, for example, each control device 122 in the bus connection device group 121 is connected to the gateway device 101 via a bus 13 that conforms to the CAN standard. The control device 122 can control functional units such as meters, engine, and brakes in the target vehicle 1.

[0054] The bus 13 is not limited to a configuration in which the control device 122 is connected, and devices other than the control device 122, such as sensors, may also be connected.

[0055] The gateway device 101 performs relay processing, for example, to relay information exchanged between control devices 122 connected to different buses 13 in the target vehicle 1, information exchanged between each in-vehicle communication device 111, and information exchanged between the control device 122 and the in-vehicle communication device 111.

[0056] More specifically, in the target vehicle 1, for example, a message is periodically transmitted from one on-board device to another on-board device in accordance with a predetermined agreement. The message may be transmitted by broadcast or unicast. Hereinafter, a periodically transmitted message is also referred to as a periodic message.

[0057] In addition to periodic messages, the target vehicle 1 also has messages that are irregularly transmitted from one control device 122 to another control device 122. The messages include an ID for identifying the content of the message and the sender, etc. Whether a message is a periodic message or not can be identified by the ID.

[0058] The following describes messages sent from one control device 122 to another control device 122, but the same applies to messages sent between the control device 122 and the in-vehicle communication device 111, and messages sent between each in-vehicle communication device 111.

[0059] [Gateway device configuration] 3 is a diagram illustrating a configuration of a gateway device in an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 3, the gateway device 101 functions as a detection device in an IDS (Intrusion Detection System) and detects unauthorized messages in an in-vehicle network 12 mounted in a target vehicle 1.

[0060] More specifically, the gateway device 101 includes a communication processing unit 51, a storage unit 52, a counter 53, a determination unit 54, and a message acquisition unit 55. The communication processing unit 51, the determination unit 54, and the message acquisition unit 55 are realized by processors such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor). The storage unit 52 is, for example, a non-volatile memory.

[0061] When the communication processing unit 51 receives a message from a certain control device 122 via the corresponding bus 13 , it performs relay processing to transmit the received message to another control device 122 via the corresponding bus 13 .

[0062] More specifically, when communication processing unit 51 receives a message from control device 122, it holds the message and waits until it receives an instruction to permit relay processing of the message from message acquisition unit 55 or determination unit 54, as will be described later. Then, when communication processing unit 51 receives an instruction to permit relay processing of the message from message acquisition unit 55 or determination unit 54, it performs relay processing of the message.

[0063] The message acquisition unit 55 acquires a message to be transmitted in the in-vehicle network 12 , that is, a message to be relayed by the communication processing unit 51 , and stores the acquired message in the storage unit 52 .

[0064] More specifically, the storage unit 52 stores detection condition information indicating the types of data used to detect fraudulent messages in the in-vehicle network 12. The types of data include, for example, measurement results such as engine speed, vehicle speed, yaw rate, steering angle, accelerator opening, and vehicle acceleration. Details of the detection condition information will be described later.

[0065] The message acquisition unit 55 recognizes the type of data that it should monitor by referring to the detection condition information registered in the storage unit 52. Then, the message acquisition unit 55 monitors the data included in messages relayed by the communication processing unit 51, and each time it detects a message including data of the type to be monitored, it acquires the detected message from the communication processing unit 51. Then, the message acquisition unit 55 attaches a timestamp indicating the time at which the message was received to the acquired message, and stores the timestamped message in the storage unit 52.

[0066] Furthermore, if the message held by the communication processing unit 51 does not include data of the type to be monitored, the message acquisition unit 55 instructs the communication processing unit 51 to permit relay processing of the message, for example.

[0067] The detection condition information registered in the memory unit 52 indicates not only the type of data used to detect fraudulent messages, but also, for each type of data, the criteria for determining whether a message containing that data is a fraudulent message.

[0068] Specifically, the detection condition information indicates, for example, a type of data used to detect fraudulent messages, such as vehicle speed, and indicates a threshold value that serves as a criterion for determining whether a message including data indicating vehicle speed is a fraudulent message. The threshold value that serves as the criterion is predetermined, for example, based on a measurement result of vehicle speed under normal circumstances when no fraudulent messages exist in the in-vehicle network 12.

[0069] The determination unit 54 determines whether a message in the in-vehicle network 12 is fraudulent by making a determination on the message acquired by the message acquisition unit 55. More specifically, the determination unit 54 acquires data included in the message stored in the storage unit 52 by the message acquisition unit 55. Then, the determination unit 54 determines, for example, based on the acquired data, whether or not the message including the data is fraudulent.

[0070] Further, when the determination unit 54 determines that the message is not an illegal message, for example, it gives an instruction to the communication processing unit 51 to permit the relay processing of the message.

[0071] [Description of the problem] FIG. 4 is a diagram for explaining problems in detecting an illegal message in an in-vehicle network. Here, it is assumed that a message indicating the vehicle speed (hereinafter also referred to as "vehicle speed message") is the determination target. The horizontal axis of the graph shown in FIG. 4 indicates the difference D from the vehicle speed in the normal state, and the vertical axis indicates an example of the calculation result of the ratio of normal messages to illegal messages included in a plurality of messages indicating the vehicle speed. The vehicle speed in the normal state is, for example, the average value of the vehicle speeds when the target vehicle 1 is traveling in the normal state.

[0072] Referring to FIG. 4, in a plurality of vehicle speed messages in which the difference D is included in the range of 0 < D < D1, 100% are normal messages. Also, in a plurality of vehicle speed messages in which the difference D is D = D2 (> D1), 80% are normal messages and 20% are illegal messages.

[0073] Further, in a plurality of vehicle speed messages in which the difference D is D = D3 (> D2), 50% are normal messages and 50% are illegal messages. Also, in a plurality of vehicle speed messages in which the difference D is D = D4 (> D3), 20% are normal messages and 80% are illegal messages. Also, in a plurality of vehicle speed messages in which the difference D is included in the range of D > D5 (> D4), 100% are illegal messages.

[0074] Thus, when the difference D between the vehicle speed indicated by the message to be judged and the normal vehicle speed is within the range of D1 to D5, the message may be both a normal message and a fraudulent message, making it difficult to clearly determine whether the message is fraudulent or not, and an erroneous determination may occur. In particular, the closer the difference D is to D3, the more difficult it becomes to determine whether the message is fraudulent, and the greater the possibility of an erroneous determination. Therefore, the detection device according to the embodiment of the present disclosure solves this problem with the following configuration and operation.

[0075] <Flow of operations for determining whether a message is malicious or not by the determination unit> [Overview of operation flow] Each device in the in-vehicle communication system 301 is equipped with a computer including a memory, and a processing unit such as a CPU in the computer reads out from the memory and executes a program including some or all of the steps in the following flowchart. The programs for these multiple devices can each be installed externally. The programs for these multiple devices are distributed in a state where they are stored on a recording medium.

[0076] FIG. 5 is a flowchart outlining an operation procedure for determining fraudulent messages by the determination unit in the detection device according to the embodiment of the present disclosure.

[0077] Here, it is assumed that a message indicating the vehicle speed is the object of judgment. It is also assumed that the storage unit 52 has registered therein detection condition information indicating the vehicle speed in normal times and a threshold value of the difference D between the vehicle speed in normal times and the vehicle speed in normal times. For example, it is assumed that two threshold values ​​Ta (first threshold value) and Tb (second threshold value) having a magnitude relationship are stored as threshold values. The magnitude relationship between these two threshold values ​​Ta and Tb is Ta <Tbである。

[0078] Referring to FIG. 5, first, when a message to be determined, which is acquired by the message acquisition unit 55, is newly stored in the storage unit 52, the determination unit 54 acquires the data included in the newly stored message. Then, the determination unit 54 calculates the difference D between the vehicle speed indicated by the acquired data and the vehicle speed in the normal state stored in the storage unit 52 (step S11).

[0079] Next, the determination unit 54 performs determination X1 to compare the calculated difference D with two threshold values Ta and Tb stored in the storage unit 52 and output a determination result of a type corresponding to the comparison result (step S12).

[0080] In determination X1, in addition to the first determination result as to whether the message including the acquired data is an illegal message, the determination unit 54 can output a second determination result regarding the message.

[0081] Specifically, when the calculated difference D is less than or equal to the threshold value Ta (D ≤ Ta) (in step S12, "A"), the determination unit 54 outputs, as the first determination result, a determination result A indicating that the message is a normal message. Also, when the calculated difference D is greater than the threshold value Tb (Tb < D) (in step S12, "B"), the determination unit 54 outputs, as the first determination result, a determination result B indicating that the message is an illegal message.

[0082] Further, when the calculated difference D is greater than the threshold value Ta and less than or equal to the threshold value Tb (Ta < D ≤ Tb) (in step S12, "C"), the determination unit 54 outputs, as the second determination result, a determination result C indicating that the message is a message that cannot clearly determine whether it is a normal message or an illegal message (hereinafter, also referred to as an "indeterminate message").

[0083] Next, determination unit 54 performs different processes on the message when it outputs determination results A and B, and when it outputs determination result C. For example, when determination unit 54 outputs determination result A in determination X1 ("A" in step S12), it stores the message ID, data included in the message, etc. in storage unit 52, and also performs normality determination processing, such as issuing an instruction to communication processing unit 51 to permit relay processing of the message (step S13).

[0084] On the other hand, if the judgment unit 54 outputs judgment result C in judgment X1 ("C" in step S12), it calculates a statistical value of judgment result C, as described below, and performs an unknown judgment process to determine whether or not a fraudulent message exists in the in-vehicle network 12 based on the calculated statistical value (step S14).

[0085] Furthermore, when the determination unit 54 outputs a determination result B in the determination X1 ("B" in step S12), it performs fraud determination processing such as IPS (Intrusion Prevention System) processing.

[0086] Specifically, as the fraud determination process, the determination unit 54, for example, identifies the sender of the fraudulent message, resets the identified in-vehicle communication device 111 or control device 122, discards the data included in the fraudulent message and replaces it with data indicating an alternative value, and instructs the communication processing unit 51 to relay the replaced message. Also, as the fraud determination process, the determination unit 54 notifies a higher-level device inside or outside the target vehicle 1 via the communication processing unit 51 that a fraudulent message has been transmitted (step S15).

[0087] When a new message to be judged is stored in the storage unit 52, the judgment unit 54 performs the operations from step S11 onwards again.

[0088] Note that the determination unit 54 is not limited to a configuration that uses, in determination X1, a measurement result indicated by data included in the message to be determined, such as the vehicle speed of the target vehicle 1. For example, when the message to be determined is a periodic message, the determination unit 54 may be configured to compare, in determination X1, the transmission interval of the periodic message with the transmission interval of the periodic message under normal conditions.

[0089] Furthermore, the detection device that detects fraudulent messages is not limited to a gateway device, but may be a device that does not relay messages. In this case, the determination unit in the device, which corresponds to determination unit 54, may be configured not to perform the normality determination process (step S13) when it outputs determination result A.

[0090] [Details of the unknown determination process] 6 is a flowchart defining an operational procedure including details of the unknown determination process for determining whether a message is malicious by a determination unit in a detection device according to an embodiment of the present disclosure. In FIG. 6, details of the unknown determination process (step S14) shown in FIG. 5 are shown, and several steps are added to FIG. 5.

[0091] Here, it is assumed that a threshold value Tc (third threshold value) is stored in addition to the threshold values ​​Ta and Tb in the storage unit 52. The magnitude relationship between the threshold values ​​Ta, Tb, and Tc is as follows: Ta <Tc<Tbである。

[0092] Referring to Figure 6, when the judgment unit 54 outputs judgment result C in judgment X1 ('C' in step S12), it performs judgment X2 regarding fraudulent messages using threshold Tc, and in judgment X2, outputs a judgment result of a type corresponding to the possibility that the message being judged is a fraudulent message.

[0093] More specifically, the judgment unit 54 compares the difference D calculated in step S11 with three thresholds Ta, Tb, and Tc stored in the memory unit 52, and performs judgment X2 to output a judgment result of a type corresponding to the comparison result (step S21).

[0094] Specifically, when the calculated difference D is greater than the threshold Ta and less than or equal to the threshold Tc (Ta < D ≤ Tc), the determination unit 54 outputs a determination result C1 indicating that the message to be determined is an unknown message with a high probability of being normal ( "C1" in step S21).

[0095] Also, when the calculated difference D is greater than the threshold Tc and less than or equal to the threshold Tb (Tc < D ≤ Tb), the determination unit 54 outputs a determination result C2 indicating that the message to be determined is an unknown message with a high probability of being an illegal message ( "C2" in step S21).

[0096] Next, the determination unit 54 calculates statistical values for multiple times of determination X2 as the statistical value of the determination result C. For example, the determination unit 54 counts the output times of the determination result C, that is, the output times of the determination result C1 or the determination result C2 in the determination X2, as the statistical value of the determination result C.

[0097] At this time, the determination unit 54 changes the count-up value according to the magnitude relationship between the difference D and the thresholds Ta, Tb, and Tc. In other words, the determination unit 54 performs weighting according to the type of the determination result C in calculating the count value. That is, the determination unit 54 performs weighting of the count-up value according to the type of the determination result C.

[0098] For example, when the determination unit 54 outputs the determination result C1 in the determination X2 ( "C1" in step S21), it increases the count value of the counter 53 by one (step S22).

[0099] On the other hand, when the determination unit 54 outputs the determination result C2 in the determination X2 ( "C2" in step S21), it increases the count value of the counter 53 by n. n is an integer greater than or equal to 2 (step S23).

[0100] Next, the determination unit 54 checks whether the count value is greater than or equal to m. m is greater than the maximum value of the multiple count-up values of the counter 53. Here, m is an integer greater than the maximum value n. (step S24).

[0101] Next, if the count value is less than m ("NO" in step S24), the determination unit 54 issues an instruction to the communication processing unit 51 to permit relay processing of the message being determined (step S25).

[0102] Next, the determination unit 54 waits until a new message to be determined is stored in the storage unit 52. Then, when a new message to be determined is stored in the storage unit 52, the determination unit 54 performs the operations from step S11 onwards again.

[0103] Next, when the judgment unit 54 outputs judgment result A in judgment X1 for the newly stored message ("A" in step S12), it resets the count value (step S26) and performs normal judgment processing (step S13).

[0104] On the other hand, if the judgment unit 54 outputs judgment result B in judgment X1 for the newly stored message ("B" in step S12), it resets the count value (step S27) and performs fraud judgment processing (step S15).

[0105] Furthermore, when the decision unit 54 outputs a decision result C in decision X1 for the newly stored message ("C" in step S12), it performs the operations from step S21 onwards again.

[0106] Furthermore, if the count value is equal to or greater than m in step S24 ("YES" in step S24), the determination unit 54 determines that a fraudulent message exists in the in-vehicle network 12. Then, the determination unit 54 resets the count value (step S27) and performs fraud determination processing on, for example, the most recent message to be determined (step S15).

[0107] In this way, by configuring the system to determine that an unauthorized message exists when the determination result C is output multiple times in succession, it is possible to prevent erroneous determinations regarding unauthorized messages and perform more accurate determinations.

[0108] Furthermore, by configuring the count value to increase by a larger amount when outputting judgment result C2 compared to when outputting judgment result C1, it is easier to obtain a judgment result that a fraudulent message is present when outputting judgment result C2 than when outputting judgment result C1, and a more accurate judgment can be made.

[0109] Note that the storage unit 52 is not limited to a configuration in which three thresholds Ta, Tb, and Tc are stored, and may store two thresholds or four or more thresholds. Furthermore, when four or more thresholds are stored in the storage unit 52, the determination unit 54 can output three or more types of determination results C1, C2, C3, ... using the four or more thresholds in determination X2 of step S21.

[0110] Furthermore, the determination unit 54 is not limited to a configuration in which it calculates a count value based on the number of times the determination results C1 and C2 are output as the statistical value of the determination result C. The determination unit 54 may also calculate, for example, the ratio of the number of times the determination result C2 is output to the number of times the determination X2 is made as the statistical value of the determination result C.

[0111] Specifically, the judgment unit 54 performs judgment X2, for example, each time it outputs judgment result C in judgment X1, and if the number of times that judgment result C2 has been output among the judgment results of the most recent 10 judgments X2 is equal to or greater than a predetermined number, it determines that a fraudulent message exists in the in-vehicle network 12.

[0112] [Modification 1 of the Unknown Determination Process] Referring again to Figure 5, when the judgment unit 54 outputs judgment result C in judgment X1, the configuration is not limited to performing the unknown judgment processing shown in Figure 6, and may be configured to create log data indicating that judgment result C has been output as the unknown judgment processing (step S14), for example.

[0113] In this case, the judgment unit 54 stores, for example, in the memory unit 52, as log data, information indicating that the message being judged is an unknown message, the ID of the unknown message, and the data contained in the message, and also instructs the communication processing unit 51 to allow relay processing of the message.

[0114] [Variation 2 of the Unknown Determination Process] 7 is a flowchart defining an operation procedure including details of an unknown determination process according to Modification 2 for determining whether a fraudulent message is received by a determination unit in a detection device according to an embodiment of the present disclosure. FIG. 7 shows details of the unknown determination process (step S14) shown in FIG.

[0115] Referring to Figure 7, when the judgment unit 54 outputs judgment result C in judgment X1 ('C' in step S12), it performs judgment X3 with content different from judgment X1 on another message other than the message that was the target of judgment, and determines whether or not there is a fraudulent message in the in-vehicle network 12 based on the judgment result of judgment X3.

[0116] More specifically, when the judgment unit 54 outputs judgment result C in judgment X1 ("C" in step S12), it performs judgment X3 on another message that includes data indicating measurement results regarding the target vehicle 1, which is of a different type from the data included in the message that is the subject of judgment X1.

[0117] Here, the determination unit 54 determines a message indicating vehicle speed as the determination target for determination X1, and a message indicating engine speed as the determination target for determination X3. Also, the storage unit 52 is assumed to have registered therein detection condition information indicating the engine speed under normal conditions and a threshold value Ts (fourth threshold value) of the difference Ds from the engine speed under normal conditions. The engine speed under normal conditions is, for example, the average value of the engine speed when the target vehicle 1 is traveling under normal conditions.

[0118] In this case, for example, the determination unit 54 acquires data included in the message indicating the engine speed among the plurality of messages stored in the storage unit 52 by the message acquisition unit 55. Then, the determination unit 54 calculates the difference Ds between the engine speed indicated by the acquired data and the engine speed during normal operation stored in the storage unit 52 (step S31).

[0119] Next, the determination unit 54 performs a determination X3 of comparing the calculated difference Ds with the threshold Ts stored in the storage unit 52 (step S32).

[0120] Then, when the calculated difference Ds is less than or equal to the threshold Ts (Ds ≤ Ts) ( "YES" in step S32), the determination unit 54 determines that there is no illegal message in the in-vehicle network 12 and performs normal determination processing (step S13).

[0121] On the other hand, when the calculated difference Ds is greater than the threshold Ts (Ts < Ds) ( "NO" in step S32), the determination unit 54 determines that there is an illegal message in the in-vehicle network 12 and performs illegal determination processing (step S15).

[0122] Note that the determination unit 54 may be configured to change the determination criterion of determination X3 (step S32) according to whether the measurement result of the vehicle speed satisfies a predetermined condition in determination X1 (step S12).

[0123] Here, when the target vehicle 1 is traveling at a high speed, it is more difficult for the engine speed to increase compared to when it is traveling at a low speed. For this reason, for example, when the target vehicle 1 is traveling at a high speed, the determination unit 54 sets a lower criterion for determining that there is an illegal message in determination X3 compared to when the target vehicle 1 is traveling at a low speed.

[0124] More specifically, it is assumed that the vehicle speed P serving as a criterion for determining whether or not the target vehicle 1 is traveling at a low speed is stored in the memory unit 52. In this case, when the determination unit 54 outputs the determination result C in determination X1 (i.e., "C" in step S12), the determination unit 54 compares the vehicle speed indicated by the message to be determined with the vehicle speed P stored in the memory unit 52.

[0125] Then, when the vehicle speed indicated by the message is less than or equal to the vehicle speed P, the determination unit 54 determines that the target vehicle 1 is traveling at a low speed. On the other hand, when the vehicle speed indicated by the message is greater than the vehicle speed P, the determination unit 54 determines that the target vehicle 1 is traveling at a high speed.

[0126] When the determination unit 54 determines that the target vehicle 1 is traveling at a high speed, in determination X3, the determination unit 54 uses the threshold value Ts1 as a criterion for determining whether an illegal message exists. On the other hand, when the determination unit 54 determines that the target vehicle 1 is traveling at a low speed, in determination X3, the determination unit 54 uses a threshold value Ts2 greater than the threshold value Ts1 as a criterion for determining whether an illegal message exists.

[0127] Specifically, when the determination unit 54 determines that the target vehicle 1 is traveling at a high speed and the difference Ds between the engine speed indicated by the message to be determined in determination X3 and the engine speed during normal operation is less than or equal to the threshold value Ts1 (Ds ≦ Ts1), the determination unit 54 determines that no illegal message exists in the in-vehicle network 12.

[0128] On the other hand, when the determination unit 54 determines that the target vehicle 1 is traveling at a high speed and the difference Ds is greater than the threshold value Ts1 (Ts1 < Ds), the determination unit 54 determines that an illegal message exists in the in-vehicle network 12.

[0129] Also, when the determination unit 54 determines that the target vehicle 1 is traveling at a low speed and the difference Ds is less than or equal to the threshold value Ts2 (Ds ≦ Ts2), the determination unit 54 determines that no illegal message exists in the in-vehicle network 12.

[0130] On the other hand, when the determination unit 54 determines that the target vehicle 1 is traveling at high speed and the difference Ds is greater than the threshold value Ts2 (Ts2 < Ds), it is determined that there is an illegal message in the in-vehicle network 12.

[0131] Also, even if the types of data used for determination X1 and the types of data used for determination X3 are the same. For example, the determination unit 54 may use, as the determination target for determination X1, a message indicating the vehicle speed newly stored in the storage unit 52, and use, as the determination target for determination X3, a message indicating the past vehicle speed stored in the storage unit 52.

[0132] It should be considered that the above embodiments are illustrative in all respects and not restrictive. The scope of the present disclosure is indicated by the claims rather than the above description, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.

[0133] The above description includes the features appended below.

[0134] [Appendix 1] A detection device for detecting an illegal message in an in-vehicle network mounted on a vehicle, a message acquisition unit that acquires a transmission message in the in-vehicle network, a determination unit that determines whether there is an illegal message in the in-vehicle network by making a determination on the transmission message acquired by the message acquisition unit, in addition to the first determination result as to whether the transmission message acquired by the message acquisition unit is the illegal message, the determination unit can output a second determination result regarding the transmission message, when the determination unit outputs the second determination result, it makes another determination regarding the illegal message, and in the other determination, outputs a determination result of a type corresponding to the possibility that the transmission message that is the determination target is the illegal message, The determination unit determines whether or not the fraudulent message exists based on statistical values ​​of a plurality of the other determinations. [Explanation of symbols]

[0135] 1. Target vehicle 12 In-vehicle network 13,14 Bus 51 Communication processing unit 52 Storage section 53 Counter 54 Judgment section 55 Message acquisition unit 101 Gateway device (detection device) 111 In-vehicle communication device Port 112 121 Bus connection devices 122 Control device 301 In-Vehicle Communication System

Claims

1. A detection device for detecting fraudulent messages in an in-vehicle network mounted on a vehicle, comprising: a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is an unauthorized message in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit, the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; the determination unit performs different processes on the transmission message when the first determination result is output and when the second determination result is output; When the determination unit outputs the second determination result, the determination unit creates log data indicating that the second determination result has been output.

2. The detection device according to claim 1 , wherein the determination unit calculates a statistical value of the second determination result, and determines whether or not the fraudulent message is present based on the calculated statistical value.

3. the second determination result includes a plurality of types of determination results, The detection device according to claim 2 , wherein the determination unit performs weighting according to the type in calculating the statistical value.

4. A detection device for detecting fraudulent messages in an in-vehicle network installed in a vehicle, comprising: a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is an unauthorized message in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit, the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; the determination unit performs different processes on the transmission message when the first determination result is output and when the second determination result is output; When the judgment unit outputs the second judgment result as the first judgment, it performs a second judgment with different content on other sent messages that are different from the sent message that was the target of judgment, and determines whether or not the fraudulent message exists based on the judgment result of the second judgment.

5. The detection device according to claim 4 , wherein the transmission message that is the subject of the first determination and the other transmission message that is the subject of the second determination indicate different types of measurement results related to the vehicle.

6. the transmission message to be determined in the first determination indicates a measurement result of a vehicle speed of the vehicle; The detection device according to claim 4 or 5, wherein the determination unit changes a determination criterion for the second determination depending on whether the measurement result of the vehicle speed satisfies a predetermined condition.

7. A detection device for detecting fraudulent messages in an in-vehicle network installed in a vehicle, comprising: a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is an unauthorized message in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit, the transmission message acquired by the message acquisition unit indicates a measurement result of the vehicle speed of the vehicle, the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; The detection device further comprises: a storage unit that stores a normal vehicle speed, which is a measurement result of the vehicle speed during normal times when the fraudulent message is not present, and a first threshold value and a second threshold value having a magnitude relationship determined based on the normal vehicle speed; the determination unit compares a difference between the measurement result of the vehicle speed indicated in the transmission message and the normal vehicle speed with the first threshold value and the second threshold value, and outputs the first determination result or the second determination result according to a comparison result; the storage unit further stores a third threshold value that is greater than the first threshold value and less than the second threshold value; the determination unit outputs the second determination result when the difference is greater than the first threshold value and equal to or less than the second threshold value; When the determination unit outputs the second determination result, the detection device performs a determination regarding the fraudulent message on the transmitted message using the third threshold value stored in the memory unit.

8. The detection device further comprises: Equipped with a counter, The detection device according to claim 7, wherein the determination unit changes a count-up value of the counter depending on a magnitude relationship between the difference and the first threshold, the second threshold, and the third threshold, and uses the count value of the counter to make a determination regarding the fraudulent message.

9. The determination unit determines that the fraudulent message exists when the count value of the counter is equal to or greater than a predetermined value, The detection device according to claim 8 , wherein the predetermined value is greater than the maximum value of the plurality of count-up values ​​of the counter.

10. the transmission message to be determined in the first determination indicates a measurement result of a vehicle speed of the vehicle; the transmission message to be determined in the second determination indicates a measurement result of an engine rotation speed of the vehicle, The detection device further comprises: a storage unit configured to store a normal engine speed, which is a measurement result of the engine speed during normal operation when the fraudulent message is not present, and a fourth threshold value determined based on the normal engine speed; 6. The detection device according to claim 4, wherein in the second determination, the determination unit compares a difference between the measurement result of the engine speed indicated by the transmission message and the normal engine speed with the fourth threshold value.

11. A detection method for a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, comprising: obtaining a message transmitted in the in-vehicle network; and performing a determination on the acquired transmitted message to determine whether the message is an unauthorized message in the in-vehicle network; In the determination regarding the fraudulent message, in addition to a first determination result as to whether or not the acquired transmitted message is the fraudulent message, a second determination result regarding the transmitted message can be output; the detection device performs different processes on the transmitted message depending on whether the detection device outputs the first determination result or the second determination result in the determination regarding the fraudulent message; The detection method further comprises: The detection method includes a step of creating log data indicating that the second determination result has been output when the second determination result is output in the determination regarding the fraudulent message.

12. A detection method for a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, comprising: obtaining a message transmitted in the in-vehicle network; and performing a determination on the acquired transmitted message to determine whether the message is an unauthorized message in the in-vehicle network; In the determination regarding the fraudulent message, in addition to a first determination result as to whether or not the acquired transmitted message is the fraudulent message, a second determination result regarding the transmitted message can be output; the detection device performs different processes on the transmitted message depending on whether the detection device outputs the first determination result or the second determination result in the determination regarding the fraudulent message; In the step of making a judgment regarding the fraudulent message, if the second judgment result is output as the first judgment, a second judgment with different content is made on another sent message that is different from the sent message that was the subject of the judgment, and based on the judgment result of the second judgment, it is determined whether or not the fraudulent message exists.

13. A detection method for a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, comprising: obtaining a message transmitted in the in-vehicle network; and performing a determination on the acquired transmitted message to determine whether the message is an unauthorized message in the in-vehicle network; In the determination regarding the fraudulent message, in addition to a first determination result as to whether or not the acquired transmitted message is the fraudulent message, a second determination result regarding the transmitted message can be output; The acquired transmission message indicates a measurement result of the vehicle speed of the vehicle, The detection device is a storage unit that stores a normal vehicle speed, which is a measurement result of the vehicle speed during normal times when the fraudulent message is not present, and a first threshold value and a second threshold value having a magnitude relationship determined based on the normal vehicle speed; In the step of making a determination regarding the fraudulent message, a difference between the measurement result of the vehicle speed indicated in the transmitted message and the normal vehicle speed is compared with the first threshold value and the second threshold value, and the first determination result or the second determination result is output according to the comparison result; the storage unit further stores a third threshold value that is greater than the first threshold value and less than the second threshold value; In the step of determining whether the message is fraudulent, if the difference is greater than the first threshold and equal to or less than the second threshold, the second determination result is output; A detection method in which, in the step of making a judgment regarding the fraudulent message, if the second judgment result is output, a judgment regarding the fraudulent message is made for the transmitted message using the third threshold value stored in the memory unit.

14. A detection program used in a detection device that detects fraudulent messages in an in-vehicle network mounted on a vehicle, comprising: Computer, a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is fraudulent in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit; It is a program to function as the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; the determination unit performs different processes on the transmission message when the first determination result is output and when the second determination result is output; the determination unit, when outputting the second determination result, creates log data indicating that the second determination result has been output.

15. A detection program used in a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, comprising: Computer, a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is fraudulent in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit; It is a program to function as the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; the determination unit performs different processes on the transmission message when the first determination result is output and when the second determination result is output; A detection program in which, when the judgment unit outputs the second judgment result as the first judgment, it performs a second judgment with different content on other sent messages that are different from the sent message that was the target of judgment, and determines whether or not the fraudulent message exists based on the judgment result of the second judgment.

16. A detection program used in a detection device that detects fraudulent messages in an in-vehicle network installed in a vehicle, comprising: Computer, a message acquisition unit that acquires a transmission message in the in-vehicle network; a determination unit that determines whether a message is fraudulent in the in-vehicle network by performing a determination on the transmitted message acquired by the message acquisition unit; It is a program to function as the determination unit is capable of outputting a second determination result regarding the outgoing message acquired by the message acquisition unit in addition to a first determination result regarding whether the outgoing message is the fraudulent message; the transmission message acquired by the message acquisition unit indicates a measurement result of the vehicle speed of the vehicle, The detection device is a storage unit that stores a normal vehicle speed, which is a measurement result of the vehicle speed during normal times when the fraudulent message is not present, and a first threshold value and a second threshold value having a magnitude relationship determined based on the normal vehicle speed; the determination unit compares a difference between the measurement result of the vehicle speed indicated in the transmission message and the normal vehicle speed with the first threshold value and the second threshold value, and outputs the first determination result or the second determination result according to a comparison result; the storage unit further stores a third threshold value that is greater than the first threshold value and less than the second threshold value; the determination unit outputs the second determination result when the difference is greater than the first threshold value and equal to or less than the second threshold value; When the determination unit outputs the second determination result, the determination unit determines whether the transmitted message is a fraudulent message using the third threshold value stored in the memory unit.

Images