Anomaly detection method, anomaly detection device, and program

Abstract

This abnormality detection method is for detecting a network abnormality in an onboard network system comprising a plurality of electronic control units that send / receive messages via a network inside a vehicle, wherein: a conversion to image data is performed on a sensor value transition or a reception interval for a plurality of messages included in a message thread in a fixed period, from among message threads received from the onboard network (S11); a trained CNN is used to classify, from the image data, whether an attack message has been inserted during the fixed period (S12); and if an attack message has been inserted during the fixed period (Yes in S13), a detection result is output conveying that there is an additional attack with an attack message inserted during the fixed period (S14).

Description

[Technical Field]

[0001] The present disclosure relates to an anomaly detection method, an anomaly detection device, and a program for detecting an anomaly in a message transmitted in an in-vehicle network. [Background technology]

[0002] In recent years, systems inside automobiles have been equipped with numerous devices called Electronic Control Units (ECUs). The network that connects these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. One of the most mainstream in-vehicle networks is the Controller Area Network (CAN), also known as the CAN bus.

[0003] The CAN bus is designed to avoid the need for a large amount of physical wiring between ECUs in a car. The payload of a CAN packet, or message, contains data from one or more ECUs called sensors that detect vehicle behavior, such as speed sensors, acceleration sensors, and yaw rate sensors.

[0004] On the CAN bus, each ECU broadcasts messages using a pre-assigned ID. However, current CAN buses lack sufficient security features, making them vulnerable to injection attacks, which could lead to the insertion of malicious messages that could lead to cyberattacks. Injection attacks are a common type of cyberattack.

[0005] For this reason, many techniques have been proposed to detect and respond to injection attacks on CAN buses (e.g., Non-Patent Document 1). Non-Patent Document 1 discloses a technology that uses a deep neural network (DNN) to accurately detect attacks on a CAN bus from CAN packets. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Min-Joo Kang and Je-Won Kang. Intrusion detection system using deep neural network for in-vehicle network security. PloS one,11(6):e0155781, 2016. Summary of the Invention [Problem to be solved by the invention]

[0007] However, as cyber-attack methods become smarter, the technology disclosed in Non-Patent Document 1 may become unable to detect attacks on the CAN bus.

[0008] The present disclosure has been made in consideration of the above-mentioned circumstances, and aims to provide an anomaly detection method, an anomaly detection device, and a program that can accurately detect attacks on an in-vehicle network. [Means for solving the problem]

[0009] In order to solve the above problem, an anomaly detection method according to one embodiment of the present disclosure is an anomaly detection method for detecting an anomaly in a network in an in-vehicle network system including a plurality of electronic control units that exchange messages via the network, the anomaly detection method comprising: detecting an anomaly in a network in a vehicle; No Se The change in sensor value is converted into image data, and a trained CNN (Convolution Neural Network) is used to classify the image data to determine whether or not an attack message has been inserted during the specified period. If an attack message has been inserted during the specified period, a detection result is output indicating that an additional attack in which an attack message has been inserted during the specified period has occurred.

[0010] These general or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of a system, a method, an integrated circuit, a computer program, and a recording medium. [Effects of the Invention]

[0011] According to the anomaly detection method and the like of the present disclosure, attacks on an in-vehicle network can be detected with high accuracy. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an overview of an anomaly detection device according to the first embodiment. [Figure 2A] FIG. 2A is a diagram illustrating a structure of a CAN bus data frame according to the first embodiment. [Figure 2B] FIG. 2B is an explanatory diagram of an attack method of an injection attack according to the first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of a hardware configuration of a computer that realizes the functions of the anomaly detection device according to the embodiment by software. [Figure 4] FIG. 4 is a block diagram illustrating an example of the configuration of the anomaly detection device according to the first embodiment. [Figure 5] FIG. 5 is a block diagram illustrating an example of a detailed configuration of the input processing unit illustrated in FIG. [Figure 6A] FIG. 6A is an explanatory diagram of a window generation method performed by the window generation processing unit according to the first embodiment. [Figure 6B] FIG. 6B is a diagram showing an example of the size of a sub-window generated by the window generation processing unit according to the first embodiment. [Figure 7] FIG. 7 is a diagram showing an example of a case where an attack message is included in the current sub-window generated by the window generation processing unit according to the first embodiment. [Figure 8A]FIG. 8A is a diagram conceptually showing the reception intervals of a normal message sequence when no additional attack is performed. [Figure 8B] FIG. 8B is a diagram conceptually showing the reception intervals of an abnormal message sequence when an additional attack is being carried out. [Figure 9A] FIG. 9A is a diagram conceptually showing sensor values ​​of a normal message sequence when no additional attack is performed. [Figure 9B] FIG. 9B is a diagram conceptually illustrating sensor values ​​of an abnormal message sequence when an additional attack is being carried out. [Figure 10A] FIG. 10A is a diagram showing an example of an image of reception intervals of a message sequence when no additional attack is performed according to the first embodiment. [Figure 10B] FIG. 10B is a diagram showing an example of an image of reception intervals of a message sequence when an additional attack according to the first embodiment is being carried out. [Figure 11A] FIG. 11A is a diagram showing an example of an image of sensor values ​​of a message sequence when no additional attack is performed according to the first embodiment. [Figure 11B] FIG. 11B is a diagram showing an example of an image of sensor values ​​of a message sequence when an additional attack according to the first embodiment is being carried out. [Figure 12] FIG. 12 is a conceptual diagram of the processing of the trained CNN according to the first embodiment. [Figure 13] FIG. 13 is a diagram for conceptually explaining the processing flow of the trained CNN shown in FIG. [Figure 14] FIG. 14 is a diagram illustrating an example of the structure of a trained CNN according to the first embodiment. [Figure 15] FIG. 15 is a flowchart illustrating an outline of the operation of the anomaly detection device according to the first embodiment. [Figure 16] FIG. 16 is a block diagram illustrating an example of the configuration of an anomaly detection device according to the second embodiment. [Figure 17] FIG. 17 is a block diagram illustrating an example of a detailed configuration of a message classification processing unit according to the second embodiment. [Figure 18] FIG. 18 is a diagram for conceptually explaining the granularity of anomaly detection according to the second embodiment. [Figure 19] FIG. 19 is a diagram for conceptually explaining the flow of processing by the CNN Message Classifier according to the second embodiment. [Figure 20A] FIG. 20A is a diagram illustrating a specific example of a plurality of messages and feature amounts input to the message classifier according to the second embodiment. [Figure 20B] FIG. 20B is a diagram showing a specific example of a determination result by the message classifier according to the second embodiment. [Figure 21] FIG. 21 is a diagram for conceptually explaining the feature extraction process performed by the message classifier according to the second embodiment. [Figure 22] FIG. 22 is a diagram conceptually illustrating the processing flow of the LSTM Message Classifier according to the second embodiment. [Figure 23A] FIG. 23A is a diagram illustrating a specific example of a plurality of messages and feature amounts input to the message classifier according to the second embodiment. [Figure 23B] FIG. 23B is a diagram showing a specific example of a determination result by the message classifier according to the second embodiment. [Figure 24] FIG. 24 is a diagram for explaining the problems with message-level classification against equivalence attacks and their countermeasures. [Figure 25] FIG. 25 is a diagram for conceptually explaining that it is possible to determine whether or not an equal-value attack has occurred by calculating the difference in sensor values ​​between messages in a message sequence. [Figure 26] FIG. 26 is a flowchart illustrating an outline of the operation of the anomaly detection device according to the second embodiment. [Figure 27] FIG. 27 is a flowchart showing an example of detailed processing of step S243 shown in FIG. [Figure 28] FIG. 28 is a flowchart showing another example of the detailed processing of step S243 shown in FIG. [Figure 29]FIG. 29 is a diagram showing an example of an abnormal message sequence in the case where all messages included in a certain period of time can be classified based on the reception intervals according to the variation of the second embodiment. [Figure 30] FIG. 30 is a diagram showing an example of a classification result of an abnormal message sequence in a case where all messages included in a certain period can be classified based on the reception intervals according to the variation of the second embodiment. [Figure 31] FIG. 31 is a diagram showing an example of a classification result of an abnormal message sequence in a case where all messages included in a certain period of time cannot be classified based on the reception intervals according to the variation of the second embodiment. [Figure 32] FIG. 32 is a flowchart showing an example of detailed processing of step S2434A shown in FIG. [Figure 33A] FIG. 33A is a diagram conceptually showing an example of the case where the answer is Yes in step S24345 shown in FIG. [Figure 33B] FIG. 33B is a diagram conceptually showing an example of the case where the answer is Yes in step S24347 shown in FIG. [Figure 33C] FIG. 33C is a diagram conceptually showing an example of the case where the answer is No in step S24347 shown in FIG. [Figure 34] FIG. 34 is a flowchart showing an example of detailed processing of step S2435A shown in FIG. [Figure 35] FIG. 35 is a diagram showing the determination rules used in the detailed processing of step S2435A shown in FIG. [Figure 36A] FIG. 36A is a diagram for conceptually explaining whether a message that cannot be classified is the end of an attack. [Figure 36B] FIG. 36B is a diagram for conceptually explaining the reception interval rule within the same group shown in FIG. [Figure 36C] FIG. 36C is a diagram conceptually showing an example of the case where the answer is Yes in step S24354 shown in FIG. [Figure 36D] FIG. 36D is a diagram conceptually showing an example of the case where the answer is Yes in step S24354 shown in FIG. [Figure 36E] FIG. 36E is a diagram showing an example of the determination result in step S24359 shown in FIG. DETAILED DESCRIPTION OF THE INVENTION

[0013] An anomaly detection method according to one embodiment of the present disclosure is an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that exchange messages via the network within the vehicle, the method converting the reception intervals or changes in sensor values ​​of a plurality of messages included in a message series over a certain period of time among a message series received from the network into image data, using a trained CNN (Convolution Neural Networks) to classify from the image data whether or not an attack message has been inserted during the certain period, and if an attack message has been inserted during the certain period, outputting a detection result indicating that there is an additional attack in which an attack message has been inserted during the certain period.

[0014] This allows for accurate detection of an additional attack on a message sequence over a certain period of time by using an image of the reception intervals of multiple messages or the transition of sensor values, thereby enabling accurate detection of attacks on an in-vehicle network.

[0015] Here, for example, a message sequence received from the network is divided using a sliding window to obtain multiple messages contained in the certain period, and image data representing the reception intervals of the multiple messages or an image representing the changes in sensor values ​​of the multiple messages is generated from the obtained multiple messages, thereby converting the reception intervals of the multiple messages or the changes in sensor values ​​into image data.

[0016] In this way, by using a sliding window, it is possible to speed up the reception processing of a message sequence over a certain period of time, so that the detection of an additional attack on a message sequence over a certain period of time can be performed with reduced time delay.

[0017] Furthermore, for example, if an attack message is inserted during the certain period, it may be further determined whether the plurality of messages are attack messages based on predetermined rules from the sensor values ​​contained in each of the plurality of messages included in the message series during the certain period.

[0018] This allows a rule-based determination of whether each of a plurality of messages contained in a message sequence over a certain period of time is normal or abnormal.

[0019] Furthermore, for example, if an attack message has been inserted during the certain period, the method further calculates the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other among the multiple messages included in the message sequence during the certain period, groups the calculated difference values, and determines whether all the difference values ​​included in each group are 0. If all the difference values ​​are not 0, it outputs a detection result indicating that there is an additional attack in which an attack message has been inserted during the certain period. If all the difference values ​​are 0, it outputs a detection result indicating that there is an additional attack in which an attack message has been inserted during the certain period. be In this case, the difference value is 0 during the certain period. be The detection result may be output as a result that the messages of the group are not attack messages.

[0020] This allows us to treat equivalence attacks that do not affect the behavior of the vehicle in which the in-vehicle network is installed as normal, thereby reducing the number of erroneous judgments of normal messages as attack messages, and thus enabling us to accurately detect attacks on the in-vehicle network.

[0021] Furthermore, for example, if an attack message is inserted during the certain period, a trained CNN different from the trained CNN may be used to detect the attack message and the attacked sensor from the plurality of messages included in the message sequence during the certain period.

[0022] This makes it possible to detect whether each of a plurality of messages contained in a message sequence over a certain period of time is a normal message or an abnormal message.

[0023] Furthermore, for example, if attack messages are inserted during the certain period, a trained LSTM (Long short-term memory) may be used to detect whether the multiple messages contained in the message sequence during the certain period are attack messages.

[0024] This makes it possible to determine whether each of a plurality of messages contained in a message sequence over a certain period of time is a normal message or an abnormal message.

[0025] Furthermore, for example, if an attack message has been inserted during the certain period, the method may further include: obtaining a determination result obtained by determining whether or not a plurality of messages included in the message sequence during the certain period are attack messages based on predetermined rules from sensor values ​​included in each of the plurality of messages; obtaining a first detection result that detects attack messages and an attacked sensor from the plurality of messages included in the message sequence during the certain period using a trained CNN different from the trained CNN; obtaining a second detection result that detects whether or not a plurality of messages included in the message sequence during the certain period are attack messages from the plurality of messages included in the message sequence during the certain period using a trained LSTM; and outputting the obtained determination result, the first detection result, and the second detection result by ensemble processing; and selecting one of the determination result, the first detection result, and the second detection result in the ensemble processing, or integrating the obtained determination result, the first detection result, and the second detection result by taking a weighted average.

[0026] This makes it possible to select or combine the best of individual methods such as rule-based, CNN, and LSTM while minimizing the variability of their individual results, thereby enabling accurate detection of whether each of multiple messages contained in a message sequence over a certain period of time is normal or abnormal.

[0027] In addition, an anomaly detection device according to one embodiment of the present disclosure is an anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that exchange messages via the network within the vehicle, the anomaly detection device comprising a processor and a memory, which converts the reception intervals or changes in sensor values ​​of a plurality of messages included in a message sequence over a certain period of time among a message sequence received from the network into image data, uses a trained CNN to classify from the image data whether or not an attack message has been inserted during the certain period, and if an attack message has been inserted during the certain period, outputs a detection result indicating that there has been an additional attack in which an attack message has been inserted during the certain period.

[0028] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of a system, a method, an integrated circuit, a computer program, and a recording medium.

[0029] The embodiments described below each illustrate a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims are described as optional components. Furthermore, in all embodiments, the respective contents can be combined.

[0030] (Embodiment 1) Hereinafter, an information processing method and the like of the abnormality detection device 10 according to the first embodiment will be described with reference to the drawings.

[0031] [1. Overview of the Anomaly Detection Device 10] FIG. 1 is a diagram illustrating an overview of an abnormality detection device 10 according to the first embodiment.

[0032] The anomaly detection device 10 is a device for detecting an anomaly in an in-vehicle network in an in-vehicle network system that includes multiple electronic control units (ECUs) that exchange messages via the in-vehicle network, which is a network within a vehicle. As shown in Fig. 1, the anomaly detection device 10 receives a CAN data stream flowing through the in-vehicle network and outputs a detection result that detects an anomaly in the in-vehicle network at the event level. Here, the CAN data stream is a message sequence received from the in-vehicle network and includes multiple messages.

[0033] FIG. 2A is a diagram illustrating a structure of a CAN bus data frame according to the first embodiment.

[0034] The CAN bus data frame shown in FIG. 2A is also called a CAN packet or a message of the CAN bus, but will hereinafter be referred to as a message.

[0035] As shown in Figure 2A, the message structure consists of the following fields: SOF (Start Of Frame), ID field, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit "r", DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence, CRC delimiter "DEL", ACK (Acknowledgement) slot, ACK delimiter "DEL", and EOF (End Of Frame).

[0036] A message has a simple structure that includes three important parts: an ID field, DLC, and a data field containing the main content. The ID is used to identify the message. The ID field may be, for example, 11 bits long and contains a value indicating the type of data. The ID value is also used to determine the priority of the message; for example, a message with a smaller ID value is given priority over a message with a larger ID value. The DLC is a 4-bit value that indicates the length of the data field. The data field may be up to 64 bits long and contains a value indicating the content of the message.

[0037] FIG. 2B is an explanatory diagram of an attack method of an injection attack according to the first embodiment.

[0038] As described above, an injection attack is a cyber-attack that inserts an attack message, which is an illegal or abnormal message, into a message sequence. An injection attack is one of the common cyber-attacks, but is the cyber-attack assumed in this embodiment. Injection attack techniques can be divided into an addition attack and a substitution attack, as shown in FIG. 2B.

[0039] An append attack is an attack method in which an attack message is inserted into a normal message sequence. That is, an append attack is an injection attack in which an attack message, indicated by a hatched solid circle, is inserted between normal messages, indicated by a hatched dotted circle, as shown in Figure 2B, to insert an attack message into a message sequence.

[0040] A substitution attack is an attack method that overwrites a normal message with an attack message. In other words, a substitution attack is an injection attack in which an attack message, indicated by a hatched solid circle, replaces a normal message, indicated by a hatched dotted circle, to insert an attack message into a message sequence, as shown in Figure 2B.

[0041] [1.1 Hardware configuration of anomaly detection device 10] FIG. 3 is a diagram illustrating an example of a hardware configuration of a computer 1000 that realizes the functions of the anomaly detection device 10 according to the embodiment by software.

[0042] 3, the computer 1000 is a computer including an input device 1001, an output device 1002, a CPU 1003, an internal storage 1004, a RAM 1005, a reading device 1007, a transmitting / receiving device 1008, and a bus 1009. The input device 1001, the output device 1002, the CPU 1003, the internal storage 1004, the RAM 1005, the reading device 1007, and the transmitting / receiving device 1008 are connected by the bus 1009.

[0043] The input device 1001 is a user interface device such as an input button, a touchpad, a touch panel display, etc., and accepts user operations. Note that the input device 1001 may be configured to accept voice operations, remote operations using a remote control, etc., in addition to accepting user touch operations.

[0044] The output device 1002 is also used as the input device 1001, and is configured by a touch pad or a touch panel display, etc., and notifies the user of information that should be made known to the user.

[0045] The internal storage 1004 is a flash memory, etc. Furthermore, the internal storage 1004 may store in advance programs for realizing the functions of the anomaly detection device 10, etc.

[0046] The RAM 1005 is a random access memory, and is used to store data and the like when a program or application is executed.

[0047] The reading device 1007 reads information from a recording medium such as a USB (Universal Serial Bus) memory. The reading device 1007 reads the above-mentioned programs and applications from a recording medium on which the programs and applications are recorded, and stores the programs and applications in the built-in storage 1004.

[0048] The transmitting / receiving device 1008 is a communication circuit for performing wireless or wired communication. The transmitting / receiving device 1008 may communicate with, for example, a server device or a cloud connected to a network, download the above-mentioned programs and applications from the server device or the cloud, and store them in the built-in storage 1004.

[0049] The CPU 1003 is a central processing unit that copies programs and applications stored in the internal storage 1004 to the RAM 1005 and sequentially reads and executes instructions contained in the programs and applications from the RAM 1005. Alternatively, the instructions may be executed directly from the internal storage 1004.

[0050] [1.2 Configuration of the anomaly detection device 10] FIG. 4 is a block diagram showing an example of the configuration of the abnormality detection device 10 according to the first embodiment.

[0051] 1, an anomaly detection device 10 according to this embodiment is configured with an input processing unit 11, an event classification processing unit 12, and an output processing unit 13. Note that the output processing unit 13 is not an essential component as long as it can acquire the classification results of the event classification processing unit 12.

[0052] [1.2.1 Input processing unit 11] When a CAN data stream flowing through the in-vehicle network is input, the input processing unit 11 acquires multiple messages. The input processing unit 11 also converts the reception intervals of the acquired multiple messages or the transition of sensor values ​​into image data. In this embodiment, the input processing unit 11 converts the reception intervals of multiple messages included in a message sequence over a certain period of time from the message sequence received from the in-vehicle network into image data.

[0053] FIG. 5 is a block diagram showing an example of a detailed configuration of the input processing unit 11 shown in FIG.

[0054] As shown in FIG. 5, input processing unit 11 according to this embodiment includes message receiving unit 111, window generation processing unit 112, and imaging processing unit 113.

[0055] [1.2.1.1 Message Receiving Unit 111] The message receiving unit 111 receives a message sequence from the in-vehicle network by inputting a CAN data stream flowing through the in-vehicle network.

[0056] [1.2.1.2 Window generation processing unit 112] The window generation processing unit 112 divides the message sequence received by the message receiving unit 111 from the in-vehicle network using a sliding window, thereby acquiring a plurality of messages included in a certain period of time.

[0057] Fig. 6A is an explanatory diagram of a window generation method of window generation processing unit 112 according to Embodiment 1. Fig. 6B is a diagram showing an example of the size of a sub-window generated by window generation processing unit 112 according to Embodiment 1. Note that a window refers to a buffer area for storing received messages.

[0058] 6A(a) shows an example of a message sequence received by the message receiving unit 111. Each of the multiple messages included in the message sequence is represented by a circle. 6A(b) shows an example of a sliding window generated by the window generation processing unit 112.

[0059] More specifically, window generation processing unit 112 generates a sliding window divided into three sub-windows: past, present, and future. In this embodiment, as shown in FIG. 6B, the size of the past sub-window is set to 200 ms, the size of the current sub-window is set to 100 ms, and the size of the future sub-window is set to 100 ms.

[0060] FIG. 7 is a diagram showing an example of a case where an attack message is included in the current sub-window generated by window generation processing unit 112 according to the first embodiment.

[0061] As shown in Fig. 7, past, present, and future subwindows are generated to detect whether the current subwindow contains an attack event, i.e., whether an attack message has been inserted. Note that generating a future subwindow introduces a latency period into the detection process, but it allows for more reliable detection of an attack message being inserted into the current subwindow.

[0062] [1.2.1.3 Imaging Processing Unit 113] The imaging processing unit 113 generates image data representing the reception intervals of the plurality of messages or an image representing the transition of the sensor values ​​of the plurality of messages from the plurality of messages acquired by the window generation processing unit 112. In this way, the imaging processing unit 113 converts the reception intervals of the plurality of messages or the transition of the sensor values ​​from the plurality of messages acquired by the window generation processing unit 112 into image data.

[0063] Here, the difference between when an additional attack is made and when it is not made will be described with reference to FIGS. 8A to 9B.

[0064] Fig. 8A is a diagram conceptually showing the intervals between receiving normal message sequences when no additional attack is being carried out, and Fig. 8B is a diagram conceptually showing the intervals between receiving abnormal message sequences when an additional attack is being carried out.

[0065] On a CAN bus, messages are transmitted periodically, so in a normal message sequence, the intervals between messages are not disrupted, as shown in Figure 8A. On the other hand, in an abnormal message sequence, the intervals between messages are disrupted, as shown in Figure 8B. In other words, as can be seen by comparing Figures 8A and 8B, an additional attack disrupts the intervals between messages.

[0066] Fig. 9A is a diagram conceptually showing sensor values ​​of a normal message sequence when no additional attack is being carried out, and Fig. 9B is a diagram conceptually showing sensor values ​​of an abnormal message sequence when an additional attack is being carried out.

[0067] As shown in Figure 9A, in a normal message sequence, the sensor values ​​included in the messages are not disturbed. On the other hand, as shown in Figure 9B, in an abnormal message sequence, the sensor values ​​included in the messages are disturbed. In other words, as can be seen by comparing Figures 9A and 9B, when an additional attack is carried out, the sensor values ​​of the messages are disturbed.

[0068] From the above, it can be seen that whether or not an additional attack is being carried out can be detected by using the reception intervals between multiple messages or the transition of the sensor values ​​of multiple messages.

[0069] For this reason, the imaging processing unit 113 converts the reception intervals of the plurality of messages acquired by the window generation processing unit 112 or the transition of the sensor values ​​into image data.

[0070] Fig. 10A is a diagram showing an example of an image of a reception interval of a message sequence when an additional attack is not performed according to embodiment 1. Fig. 10B is a diagram showing an example of an image of a reception interval of a message sequence when an additional attack is performed according to embodiment 1.

[0071] Fig. 11A is a diagram showing an example of an image of sensor values ​​of a message sequence when an additional attack is not performed according to embodiment 1. Fig. 11B is a diagram showing an example of an image of sensor values ​​of a message sequence when an additional attack is performed according to embodiment 1. A plurality of images are shown as examples in Figs. 11A and 11B. Each of the images shown in Figs. 10A to 11B is generated as an image of, for example, 96 pixels x 96 pixels.

[0072] The imaging processing unit 113 can obtain, for example, an image as shown in Fig. 10A or 10B by converting the reception intervals of the plurality of messages acquired by the window generation processing unit 112 into image data. Similarly, the imaging processing unit 113 can obtain, for example, images as shown in Fig. 11A or 11B by converting the sensor values ​​of the plurality of messages acquired by the window generation processing unit 112 into image data. Comparing Fig. 10A and Fig. 10B with Fig. 11A and Fig. 11B, it can be seen that Fig. 11A and Fig. 11B, which are images in the case where an additional attack is being carried out, contain characteristic changes in the sensor values ​​and message reception frequency.

[0073] [1.2.2 Event Classification Processor 12] The event classification processor 12 detects whether an additional attack has occurred within a certain period of time in a message sequence received from the in-vehicle network. More specifically, the event classification processor 12 classifies, from image data, whether an attack message has been inserted into multiple messages included within the certain period of time using a trained CNN (Convolution Neural Network) 121. The multiple messages included within the certain period of time are the multiple messages included in the current subwindow described above.

[0074] The trained CNN 121 is an example of an event classifier that can classify, from image data, whether or not an attack message has been inserted into a plurality of messages contained within a certain period of time. This event classifier is trained using, for example, images such as those shown in Figures 10A to 11B, i.e., images showing sensor values ​​or reception intervals of normal messages and attack messages, as training data.

[0075] The event classifier is not limited to the CNN 121, but may be a long short-term memory (LSTM) or a bi-directional long short-term memory (BLSTM).

[0076] Furthermore, the event classification processing unit 12 may determine whether an attack message has been inserted within a certain period of time based on a predetermined rule. In this case, the event classification processing unit 12 may determine whether an attack message has been inserted within a certain period of time based on the statistical values ​​of the reception frequencies or reception intervals of multiple messages acquired by the window generation processing unit 112. Examples of the statistical values ​​of the reception intervals here include the difference in the reception times of multiple messages or the average reception intervals of multiple messages.

[0077] Fig. 12 is a conceptual diagram of the processing of the trained CNN 121 according to Embodiment 1. Fig. 13 is a diagram for conceptually explaining the flow of processing of the trained CNN 121 shown in Fig. 12.

[0078] As shown in Figure 12, when an image showing the interval between receiving multiple messages over a certain period of time or an image showing the transition of sensor values ​​is input, the trained CNN 121 classifies whether or not the multiple messages over a certain period of time contained in the input image are subject to an incremental attack.

[0079] More specifically, as shown in (a) of FIG. 13, a message sequence received from an in-vehicle network is first divided using a sliding window to obtain multiple messages included in the current subwindow. Next, in (b) of FIG. 13, the reception intervals or sensor value transitions of the multiple messages included in the current subwindow are converted into image data and input to an event classifier. Next, in (c) of FIG. 13, the trained CNN 121 as an event classifier classifies the multiple messages included in the input image data over a certain period of time as being subject to an additive attack. Then, in (d) of FIG. 13, the trained CNN 121 outputs, as a detection result, whether the multiple messages included in the current subwindow are subject to an additive attack or not.

[0080] FIG. 14 is a diagram illustrating an example of the structure of the trained CNN 121 according to the first embodiment.

[0081] That is, the CNN 121 includes, for example, multiple convolutional layers, multiple pooling layers, a fully connected layer, and a custom layer, and receives image data and outputs a classification result. The custom layer is used as a layer for performing image segmentation.

[0082] [1.2.3 Output Processing Section 13] When an attack message is inserted within a certain period of time in a message sequence received from the in-vehicle network, the output processing unit 13 outputs a detection result indicating that there is an additional attack in which an attack message is inserted within the certain period of time. In other words, when the event classification processing unit 12 detects that there is an additional attack within a certain period of time in a message sequence received from the in-vehicle network, the output processing unit 13 outputs a detection result indicating that fact.

[0083] On the other hand, if the event classification processing unit 12 detects that there are no additional attacks during the certain period, the output processing unit 13 outputs a detection result indicating that the multiple messages included in the certain period are normal.

[0084] If the event classification processing unit 12 detects that no additional attacks have occurred during the certain period, the output processing unit 13 may further determine whether a replacement attack has been performed on multiple messages included in the certain period. In this case, the output processing unit 13 can determine whether a replacement attack has been performed on multiple messages included in the certain period by using a neural network model such as CNN. If an abnormal message is included in the multiple messages included in the certain period, the output processing unit 13 may determine that a replacement attack has been performed and output a detection result indicating this. On the other hand, if no abnormal message is included in the multiple messages included in the certain period, the output processing unit 13 may output a detection result indicating that the multiple messages included in the certain period are normal.

[0085] [1.3 Operation of the anomaly detection device 10] Next, the operation of the anomaly detection device 10 configured as above will be described.

[0086] FIG. 15 is a flowchart showing an outline of the operation of the abnormality detection device 10 according to the first embodiment.

[0087] First, the anomaly detection device 10 visualizes the transition of the sensor values ​​or the reception intervals of messages included in a subwindow (a fixed period) (S11). More specifically, the anomaly detection device 10 visualizes the transition of the sensor values ​​or the reception intervals of multiple messages included in a message sequence over a fixed period of time among the message sequences received from the in-vehicle network as image data. This allows the anomaly detection device 10 to obtain an image showing the transition of the sensor values ​​or the reception intervals of multiple messages.

[0088] Next, the anomaly detection device 10 classifies the input image using a CNN (S12). More specifically, the anomaly detection device 10 uses the trained CNN to classify whether or not an attack message has been inserted during the certain period of time, based on the image showing the reception intervals of the multiple messages or the transition of the sensor values ​​obtained in step S11.

[0089] Next, the anomaly detection device 10 determines whether the classification result in step S12 indicates the presence of an additional attack (S13).

[0090] In step S13, if the classification result indicates the presence of an additional attack (Yes in S13), the anomaly detection device 10 outputs a detection result indicating the presence of an additional attack in the window (S14). In other words, if an attack message is inserted during the certain period, the anomaly detection device 10 outputs a detection result indicating the presence of an additional attack in which an attack message is inserted during the certain period.

[0091] On the other hand, in step S13, if the classification result does not indicate the presence of an additional attack (No in S13), the anomaly detection device 10 outputs a detection result other than the above, including the absence of an additional attack within the window (S15).

[0092] [1.4 Effects, etc.] As described above, according to the anomaly detection device 10 and anomaly detection method of this embodiment, an additional attack disrupts the message reception intervals or sensor values. Therefore, by using an image of the transition of the message reception intervals or sensor values ​​of multiple messages, it is possible to accurately detect the presence of an additional attack in a message sequence over a certain period of time. Furthermore, the disruption of the message reception intervals or sensor values ​​that occurs during an additional attack is a phenomenon that cannot be disguised even if cyber-attack methods become smarter. Therefore, even if cyber-attack methods become smarter, it is unlikely that attacks on the CAN bus will become undetectable.

[0093] Therefore, the anomaly detection device 10 and the anomaly detection method according to this embodiment can accurately detect attacks on an in-vehicle network.

[0094] In addition, by using a sliding window, it is possible to speed up the reception processing of a message sequence over a certain period of time, so that it is possible to detect the presence of an additional attack on a message sequence over a certain period of time with reduced time delay.

[0095] (Embodiment 2) In the first embodiment, an attack event is detected on a window-by-window basis, that is, it is described that whether or not an additional attack has been made on a message sequence over a certain period of time among the message sequences received from the in-vehicle network is detected, but this is not limited to this. When an attack event is detected on a window-by-window basis, it is also possible to further detect whether each message is normal or abnormal on a message-by-message basis. In other words, when it is detected that an additional attack has been made on a message sequence over a certain period of time, it is also possible to further determine or detect whether each of the multiple messages included in the message sequence is a normal message or an attack message. This case will be described below as a second embodiment.

[0096] 2.1 Configuration of the anomaly detection device 10A FIG. 16 is a block diagram showing an example of the configuration of an abnormality detection device 10A according to the second embodiment.

[0097] An anomaly detection device 10A according to this embodiment is configured with an input processing unit 11A, an event classification processing unit 12, an output processing unit 13A, and a message classification processing unit 14A, as shown in Fig. 16. Elements that are the same as those in Fig. 4 are given the same reference numerals, and detailed description thereof will be omitted.

[0098] [2.1.1 Input processing unit 11A] When a CAN data stream flowing through the in-vehicle network is input, the input processing unit 11A acquires multiple messages. The input processing unit 11 converts the reception intervals of the multiple acquired messages or the transition of sensor values ​​into image data and outputs the image data to the event classification processing unit 12. The input processing unit 11 also outputs the multiple acquired messages to the message classification processing unit 14A.

[0099] More specifically, the input processing unit 11A receives a message sequence from the in-vehicle network by inputting a CAN data stream flowing through the in-vehicle network. The input processing unit 11A divides the message sequence received from the in-vehicle network using a sliding window to acquire multiple messages included in a certain period of time.

[0100] The input processing unit 11A generates image data representing the reception intervals of the multiple messages obtained over a certain period of time or an image representing the transition of the sensor values ​​of the multiple messages, and outputs the image data to the event classification processing unit 12.

[0101] Furthermore, the input processing unit 11A outputs a plurality of messages included in the acquired certain period to the message classification processing unit 14A. Note that, when an attack event is detected in the event classification processing unit 12, the input processing unit 11A may output a plurality of messages included in the acquired certain period to the message classification processing unit 14A.

[0102] [2.1.2 Output processing unit 13A] When an attack event is detected by the event classification processing unit 12, the output processing unit 13 sends an instruction to the message classification processing unit 14A to detect whether each message is normal or abnormal on a message-by-message basis, and obtains the detection result from the message classification processing unit 14A. In this case, the output processing unit 13 simply outputs the detection result indicating that there is an additional attack in which an attack message is inserted during the certain period of time, and that each message is normal or abnormal.

[0103] The function of the output processing unit 13 when no attack event is detected by the event classification processing unit 12, i.e., when the event classification processing unit 12 detects that there are no additional attacks for the certain period of time, is the same as described in the embodiment, so the description will be omitted.

[0104] [2.1.3 Message Classification Processing Unit 14A] When an attack event is detected on a window-by-window basis by the event classification processing unit 12, the message classification processing unit 14A detects whether each message is normal or abnormal on a message-by-message basis. More specifically, when an attack event is detected on a window-by-window basis by the event classification processing unit 12, the message classification processing unit 14A receives a message sequence for a certain period of time input by the input processing unit 11A. The message classification processing unit 14A detects whether each of the multiple messages included in the input message sequence for the certain period of time is a normal message or an attack message.

[0105] FIG. 17 is a block diagram showing an example of a detailed configuration of the message classification processing unit 14A according to the second embodiment.

[0106] As shown in FIG. 17, the message classification processing unit 14A according to this embodiment includes a CNN Message Classifier 141, an LSTM Message Classifier 142, a Human Message Classifier 143, and an ensemble processing unit 144.

[0107] [2.1.3.1 CNN Message Classifier141] When an attack event is detected in units of a window in the event classification processing unit 12, the CNN Message Classifier 141 receives as input a message sequence for a certain period of time input by the input processing unit 11A.

[0108] The CNN Message Classifier 141 uses a trained CNN to detect attack messages and attacked sensors from among a plurality of messages included in an input message sequence over a certain period of time.

[0109] This trained CNN is a CNN model different from the CNN 121 according to the first embodiment, and is an example of a message classifier for classifying, from a message sequence, whether each of multiple messages included in the message sequence is an attack message or a normal message. The message classifier includes, for example, multiple convolutional layers, multiple pooling layers, and a fully connected layer, and is trained using, for example, a message sequence such as that shown in FIG. 7 as training data.

[0110] Here, the granularity of anomaly detection according to the second embodiment will be described with reference to FIG.

[0111] FIG. 18 is a diagram for conceptually explaining the granularity of anomaly detection according to the second embodiment.

[0112] The top row of FIG. 18 shows an example of a message sequence received from the in-vehicle network, with boxes representing each message.

[0113] The anomaly detection device 10 according to the second embodiment first detects whether an attack event has occurred at the window-based granularity shown in 1), i.e., within a certain section (a certain period) of a message sequence. Next, the anomaly detection device 10 detects whether each message included in a certain section (a window-based) of a message sequence at the message-based granularity shown in 2), i.e., whether it is an attack message or a normal message. Furthermore, the anomaly detection device 10 detects whether each message is an attack message or a normal message at the sensor-based granularity shown in 3), i.e., using the sensor values ​​included in each message. More specifically, when a message includes multiple sensor values, the anomaly detection device 10 determines whether each sensor value indicates an attack or a normal message. On the other hand, when a message includes a single sensor value, the anomaly detection device 10 can determine whether the message is an attack message or a normal message based on whether the sensor value indicates an attack or a normal message.

[0114] In this embodiment, the CNN Message Classifier 141 detects whether each message is normal (normal message) or abnormal (attack message) at the granularity of each message shown in 2) of FIG.

[0115] The process of the CNN Message Classifier 141 will be conceptually explained below with reference to FIGS. 19, 20A, and 20B.

[0116] Fig. 19 is a diagram for conceptually explaining the processing flow of the CNN Message Classifier 141 according to the embodiment 2. (a) of Fig. 19 is shown in the same notation as the message sequence shown in Fig. 7, and the message sequence shown in (a) of Fig. 19 corresponds to the message sequence received from the in-vehicle network shown in (a) of Fig. 13.

[0117] First, as shown in Figure 19(a), a message sequence received from an in-vehicle network is divided using a sliding window to obtain multiple messages contained in the current subwindow, which are then input to a trained CNN as a message classifier.

[0118] FIG. 20A is a diagram illustrating a specific example of a plurality of messages and feature amounts input to the message classifier according to the second embodiment.

[0119] In this embodiment, for example, 72 messages included in the current sub-window (one window) are input to the message classifier. Here, each message includes multiple feature amounts. The feature amounts include one or more sensor values, each of which is a sensor value and a value indicating the message reception interval. For example, as shown in FIG. 20A, the sensor values ​​include a sensor value indicating the vehicle speed obtained by a vehicle speed sensor, a sensor value indicating the steering angle obtained by a steering angle sensor, and a sensor value indicating the acceleration obtained by an acceleration sensor. The sensor values ​​and the value indicating the message reception interval may be collectively referred to as the feature amount of the message.

[0120] 19(b), the trained CNN as a message classifier classifies each of the multiple messages included in the input message sequence as either a normal message or an abnormal message. Note that an abnormal message is called an attack message in this embodiment because it contains a sensor value obtained by a sensor under attack and indicates an abnormal value.

[0121] Then, in (c) of FIG. 19, the trained CNN serving as a message classifier outputs, as a detection result, whether each of the multiple messages included in the current subwindow is a normal message or an attack message.

[0122] 20B is a diagram showing a specific example of a determination result by the message classifier according to embodiment 2. In the example shown in FIG. 20A, it is determined that the speed value of 80 km / h in message No. 3 indicates an abnormality due to an attack, and the other sensor values ​​are normal. In this case, the trained CNN serving as the message classifier classifies message No. 3 as abnormal as shown in FIG. 20B, and outputs the determination result together with the sensor ID (index), such as 2, indicating the speed sensor that output the speed value of message No. 3.

[0123] If a single message contains sensor values ​​obtained from multiple sensors, the trained CNN acting as a message classifier cannot determine whether each sensor is normal or abnormal. Whether a single message contains sensor values ​​obtained from multiple sensors differs depending on the vehicle model.

[0124] Fig. 21 is a diagram conceptually illustrating the feature extraction process performed by the message classifier according to embodiment 2. Fig. 21(a) shows a specific example of multiple messages and feature quantities input to the message classifier, similar to Fig. 20A. Fig. 21(b) shows the determination result obtained as a result of convolution of multiple messages included in the current subwindow using a predetermined small filter.

[0125] 21(a), the trained CNN as a message classifier performs convolution on, for example, message No. 1 among messages No. 1 to 3, on message No. 2 among messages No. 2 to 4, and on message No. 3 among messages No. 3 to 5. As a result of performing this feature extraction process, the trained CNN as a message classifier outputs a determination result (classification result) indicating that messages No. 3 and No. 5 are abnormal and further indicating that, for example, the speed sensor indicated by sensor ID 2 is under attack.

[0126] [2.1.3.2 LSTM Message Classifier142] When an attack event is detected in units of a window in the event classification processing unit 12, the LSTM Message Classifier 142 receives as input a message sequence for a certain period of time input by the input processing unit 11A.

[0127] The LSTM Message Classifier 142 uses a trained LSTM to detect whether multiple messages included in an input message sequence over a certain period of time are attack messages.

[0128] This trained LSTM may be a BLSTM. This trained LSTM is an example of a message classifier that classifies each of multiple messages in a message sequence as either an attack message or a normal message. This message classifier is trained using, for example, a message sequence such as that shown in Figure 7 as training data.

[0129] The process of the LSTM Message Classifier 142 will be conceptually explained below with reference to FIGS. 22, 23A, and 23B.

[0130] Fig. 22 is a diagram conceptually illustrating the processing flow of the LSTM Message Classifier 142 according to the second embodiment. (a) of Fig. 22 is the same as (a) of Fig. 19, and the message sequence shown in (a) of Fig. 19 corresponds to the message sequence received from the in-vehicle network shown in (a) of Fig. 13. (b) of Fig. 22 shows an example in which the LSTM used as the message classifier is a BLSTM. The trained BLSTM used as the message classifier is configured by stacking two BLSTM layers and two Dense layers.

[0131] First, as shown in Fig. 22(a), the message sequence received from the in-vehicle network is divided using a sliding window to obtain multiple messages contained in the current subwindow, which are then input to BLSTM as a message classifier.

[0132] Fig. 23A is a diagram showing a specific example of a plurality of messages and feature amounts input to a message classifier according to embodiment 2. Note that Fig. 23A is the same as Fig. 20A, and therefore a description thereof will be omitted. Although not shown in Fig. 23A, the feature amount may further include the missing state of each sensor value. In this case, if there is a missing sensor value, it is represented as 1, and if there is no missing sensor value, it is represented as 0.

[0133] Next, in FIG. 22(b), the trained BLSTM as a message classifier classifies each of the multiple messages included in the input message sequence as either a normal message or an abnormal message.

[0134] Then, in (c) of FIG. 22, the trained BLSTM as a message classifier outputs, as a detection result, whether each of the multiple messages included in the current subwindow is a normal message or an attack message.

[0135] 23B is a diagram showing a specific example of a determination result by the message classifier according to embodiment 2. In the example shown in FIG. 23A, the speed value of 80 km / h in message No. 3 indicates an abnormality due to an attack, while the other sensor values ​​are normal. In this case, the trained BLSTM serving as the message classifier outputs a determination result including the number of sensors and messages that were the detection targets, as shown in FIG. 23B, with the attacked sensors classified as a value of 1 and the normal sensors classified as a value of 0.

[0136] [2.1.3.3 Human Message Classifier143] When an attack event is detected in units of a window by the event classification processing unit 12, the Human Message Classifier 143 receives as input a message sequence for a certain period of time input by the input processing unit 11A.

[0137] The Human Message Classifier 143 determines whether or not a plurality of messages included in an input message sequence over a certain period are attack messages based on the sensor values ​​included in each of the plurality of messages and on predetermined rules.

[0138] Here, the predetermined rules are rules based on human intuition that are effective for message-level classification. For example, as described above, in an incremental attack, an attack message is inserted between normal message sequences, disrupting the intervals at which abnormal message sequences containing the attack message are received. Furthermore, as in an attack on speed, such as vehicle speed, the sensor values ​​contained in the attack message deviate from the sensor values ​​contained in normal message sequences. In other words, when attack messages and normal messages contained in normal message sequences are clustered, they form disjoint groups. By defining such human intuition as rules in advance, the Human Message Classifier 143 determines whether multiple messages are attack messages based on the sensor values ​​contained in each of the multiple messages contained in a message sequence over a certain period of time.

[0139] Note that there are cases where the sensor value included in the attack message is the same as that of a normal message. An attack using an attack message with the same sensor value as a normal message is called an equivalence attack. An attack using an attack message with a sensor value different from that of the normal message is called a shift attack. Below, we will explain human intuition, which is effective for message-level classification against equivalence attacks.

[0140] 24A and 24B are diagrams for explaining the problems with message-level classification against equivalence attacks and their countermeasures. In (a) and (b) of Fig. 24A, the vertical direction indicates the sensor value, and the horizontal direction indicates the reception time.

[0141] As shown in Figure 24(a), even in the case of an equivalence attack, the intervals between receiving anomalous message sequences are disrupted, so it is detected as an additional attack. However, it is not clear whether the anomalous message sequence is arranged like the upper or lower row in Figure 24(b). In other words, in the case of an equivalence attack, although it is detected as an additional attack, it is not possible to distinguish between normal messages and attack messages, and there is a high possibility that normal messages will be mistakenly detected as attack messages.

[0142] On the other hand, if an equivalence attack is performed, the reception interval of the message sequence will be disrupted, but the side effects on the vehicle will be small.

[0143] Considering these points, we intuitively conclude that attack messages determined to be equivalence attacks should not be subject to anomaly detection. Therefore, when an additional attack is detected, we further determine whether it is an equivalence attack or not by calculating the difference in the sensor value of the immediately preceding message.

[0144] FIG. 25 is a diagram for conceptually explaining that it is possible to determine whether or not an equal-value attack has occurred by calculating the difference in sensor values ​​between messages in a message sequence.

[0145] 25(a) shows a message sequence subjected to an equivalence attack. The attack messages are indicated by circles B, D, and F, and the normal messages are indicated by circles A, C, and E.

[0146] In this case, as shown in (b) of Figure 25, the difference values ​​between A and B, C and D, and E and F are zero (0), and since the difference values ​​continue to be 0, it can be determined that an equivalence attack is being carried out. Therefore, it is sufficient to determine that each of the message sequences indicated by A to F is a normal message.

[0147] In other words, even if an additional attack is detected, the difference in the sensor value of the immediately preceding message is calculated, and if the difference remains 0 and it is determined to be an equivalence attack, the attack message determined to be an equivalence attack can be determined to be a normal message. On the other hand, if the difference is not 0, it is not an equivalence attack, so it is subject to anomaly detection, and the results of other Message Classifiers can be used in the ensemble processing unit 144, which will be described later.

[0148] More specifically, first, Human Message Classifier 143 calculates the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other, out of multiple messages included in the input message sequence for a certain period of time. Next, Human Message Classifier 143 groups the calculated difference values ​​and determines whether all the difference values ​​included in each group are 0.

[0149] If all the difference values ​​are not 0, the Human Message Classifier 143 outputs a detection result indicating that there is an additional attack in which an attack message has been inserted during the input period. be In this case, the Human Message Classifier 143 detects that the difference value is 0 within the input period. be The detection result is output as the group's messages are not attack messages.

[0150] [2.1.3.4 Ensemble Processing Unit 144] Ensemble processing is a technique used in machine learning that can output prediction results that combine the strengths of individual models while reducing the variance in the prediction results of each model.

[0151] In this embodiment, the ensemble processing unit 144 stacks and outputs the detection result of the CNN Message Classifier 141, the detection result of the LSTM Message Classifier 142, and the determination result of the Human Message Classifier 143. Note that the ensemble processing unit 144 may select and output any one of the detection result of the CNN Message Classifier 141, the detection result of the LSTM Message Classifier 142, and the determination result of the Human Message Classifier 143.

[0152] More specifically, first, the ensemble processing unit 144 acquires the detection result of the CNN Message Classifier 141. In other words, the ensemble processing unit 144 acquires a first detection result, using a trained CNN different from the trained CNN, in which, from among multiple messages included in a message sequence over a certain period of time, messages that are attack messages and sensors that have been attacked are detected. The ensemble processing unit 144 also acquires the detection result of the LSTM Message Classifier 142. In other words, the ensemble processing unit 144 acquires a second detection result, using the trained LSTM, in which, from among multiple messages included in a message sequence over a certain period of time, it is detected whether multiple messages are attack messages.

[0153] Furthermore, the ensemble processing unit 144 acquires the determination result of the Human Message Classifier 143. In other words, the ensemble processing unit 144 acquires the determination result obtained by determining whether or not the multiple messages are attack messages based on predetermined rules from the sensor values ​​included in each of the multiple messages included in a message sequence over a certain period of time.

[0154] Next, the ensemble processing unit 144 performs ensemble processing on the acquired determination result, first detection result, and second detection result and outputs the ensemble processing result. In the ensemble processing, the ensemble processing unit 144 selects one of the determination result, first detection result, and second detection result, or integrates the acquired determination result, first detection result, and second detection result by taking a weighted average.

[0155] 2.2 Operation of the abnormality detection device 10A Next, the operation of the abnormality detection device 10A configured as above will be described.

[0156] FIG. 26 is a flowchart showing an outline of the operation of the abnormality detection device 10A according to the second embodiment.

[0157] First, the anomaly detection device 10A performs input processing on a window-by-window basis (S21). More specifically, the anomaly detection device 10A divides a message sequence received from an in-vehicle network using a sliding window to acquire multiple messages included in the current subwindow (a fixed period). From the acquired multiple messages included in the fixed period, the anomaly detection device 10A generates image data representing the reception intervals of the multiple messages or an image representing the transition of the sensor values ​​of the multiple messages.

[0158] Next, anomaly detection device 10A performs an event classification process (S22). More specifically, anomaly detection device 10A uses trained CNN 121 to classify whether or not an attack event in which an attack message was inserted occurred during the certain period, based on the image showing the reception intervals of multiple messages or the transition of sensor values ​​generated in the input process of step S21.

[0159] Next, the anomaly detection device 10 determines whether the classification result of the event classification process performed in step S22 indicates the presence of an additional attack (S23).

[0160] In step S23, if the classification result indicates the presence of an additional attack (Yes in S23), anomaly detection device 10A further performs message classification processing (S24). More specifically, anomaly detection device 10A performs processing to detect whether each of a plurality of messages included in an input message sequence for a certain period of time is a normal message or an attack message.

[0161] Here, the detailed processing of step S24 will be described.

[0162] In step S24, first, the anomaly detection device 10A performs CNN Message Classifier processing (S241), LSTM Message Classifier processing (S242), and Human Message Classifier processing (S243). Note that the CNN Message Classifier processing is performed by the above-mentioned CNN Message Classifier 141, and the LSTM Message Classifier processing is performed by the above-mentioned LSTM Message Classifier 142, and therefore detailed explanations will be omitted. Similarly, the Human Message Classifier processing is performed by the above-mentioned Human Message Classifier 143. This processing will be described in detail later.

[0163] Next, anomaly detection device 10A performs ensemble processing on the first detection result obtained in step S241, the second detection result obtained in step S242, and the determination result obtained in step S243, and outputs the result.

[0164] Returning to FIG. 26, the explanation will be continued below.

[0165] On the other hand, in step S23, if the classification result does not indicate the presence of an additional attack (No in S23), the anomaly detection device 10A outputs a detection result indicating that there is no additional attack in the message sequence input over a certain period of time, i.e., a detection result indicating normality (S25).

[0166] FIG. 27 is a flowchart showing an example of detailed processing of step S243 shown in FIG.

[0167] 27, first, the anomaly detection device 10A calculates the difference values ​​of the sensor values ​​of the received messages (S2431). More specifically, the anomaly detection device 10A calculates the difference values ​​of the sensor values ​​of all combinations of two messages that are received one after the other, out of the multiple messages included in the current subwindow (a fixed period) acquired in the input process of step S21.

[0168] Next, anomaly detection device 10A performs grouping (classification) on the sensor value differences calculated in step S2431 (S2432). More specifically, anomaly detection device 10A performs grouping on the sensor value differences of all combinations of two messages that are received one after the other in time, calculated in step S2431, to generate groups.

[0169] Next, the abnormality detection device 10A acquires the difference value included in each group generated in step S2432 (S2433).

[0170] Next, abnormality detection device 10A determines whether the difference value included in each group acquired in step S2433 is 0 (S2434).

[0171] In step S2434, if the difference value included in the group is 0 (Yes in S2434), anomaly detection device 10A determines that it is an equivalence attack with a difference value of 0, and determines that the received messages included in the group are normal (S2435). More specifically, if the difference value included in a group is 0, anomaly detection device 10A determines that all of the multiple messages included in the group are normal messages.

[0172] On the other hand, if the difference value included in the group is not 0 in step S2434 (No in S2434), anomaly detection device 10A determines that the received messages included in the group are to be detected (S2436). More specifically, if the difference value included in the group is not 0, anomaly detection device 10A determines that the multiple messages included in the group may include attack messages and determines that the multiple messages included in the group are to be detected.

[0173] In this way, if an equivalence attack is carried out, it will be detected as an additional attack, but since the side effects on the vehicle are small, it will be treated as a normal message, thereby preventing normal messages from being mistakenly detected as attack messages.

[0174] [2.3 Effects, etc.] As described above, the anomaly detection device 10 and anomaly detection method according to this embodiment detect attacks on an in-vehicle network in two stages: first, detecting whether or not there is an attack event in a message sequence over a certain period of time, and then, if there is an attack event, detecting the attack message. This enables attacks on an in-vehicle network to be detected with high accuracy.

[0175] More specifically, when detecting attack messages, detection using a trained CNN, detection using a trained LSTM, and detection based on predetermined rules are performed in parallel, and the results are ensemble processed, allowing for a combination of detection using a neural network model and rule-based detection.

[0176] This allows the false positive rate of attack messages to approach zero, making it possible to accurately detect attacks on in-vehicle networks.

[0177] (Variation) In this modification, the Human Message Classifier 143 determines whether each of multiple messages included in a message sequence over a certain period of time is an attack message based on a rule that uses clustering and regression, as another example of the predetermined rule described above. In other words, the anomaly detection device 10A is not limited to performing the detailed processing shown in Fig. 27 as the detailed processing of step S243 shown in Fig. 26, but may also perform the detailed processing shown in Fig. 28 described below.

[0178] FIG. 28 is a flowchart showing another example of the detailed processing of step S243 shown in FIG.

[0179] 28, first, anomaly detection device 10A calculates the difference between the reception interval and the sensor value (S2431A). More specifically, anomaly detection device 10A calculates the reception interval of multiple messages included in the current subwindow (fixed period) acquired in the input process of step S21, and the difference value of the sensor value for all combinations of two messages that are received one after the other.

[0180] Next, anomaly detection device 10A classifies the messages based on the reception interval calculated in step S2431A (S2432A). More specifically, anomaly detection device 10A classifies each of the multiple messages included in a certain period into normal messages and abnormal messages based on the reception interval calculated in step S2431A.

[0181] Next, in step S2432A, anomaly detection device 10A determines whether all messages included in a certain period have been classified (S2433A).

[0182] In step S2433A, if all messages have been classified (Yes in S2433A), anomaly detection device 10A judges each sensor based on the message classification result in step S2432A (S2434A).

[0183] Here, a case where all messages contained in a certain period can be classified into normal messages and abnormal messages (attack messages) based on the message reception intervals will be conceptually explained using FIGS. 29 and 30. FIG.

[0184] 29 is a diagram showing an example of an abnormal message sequence when all messages included in a certain period of time according to a variation of Embodiment 2 can be classified based on their reception intervals. (a) of FIG. 29 shows a case where an attack message is inserted immediately after a normal message. (b) of FIG. 29 shows a case where an attack message is inserted immediately before a normal message.

[0185] FIG. 30 is a diagram showing an example of a classification result of an abnormal message sequence in a case where all messages included in a certain period can be classified based on the reception intervals according to the variation of the second embodiment.

[0186] In the cases shown in (a) and (b) of Figure 29, the reception interval between the attack message and the normal message is abnormal. Also, the reception interval between the normal messages is known. Based on this, all messages can be classified into attack messages and normal messages, as shown in Figure 30, for example.

[0187] On the other hand, if all messages cannot be classified in step S2433A (No in S2433A), anomaly detection device 10A judges the messages and sensors included in the certain period using a plurality of rules (S2435A).

[0188] Here, a case where all messages contained in a certain period cannot be classified into normal messages and attack messages based on the message reception intervals will be conceptually explained using FIG.

[0189] FIG. 31 is a diagram showing an example of a classification result of an abnormal message sequence in a case where all messages included in a certain period of time cannot be classified based on the reception intervals according to the variation of the second embodiment.

[0190] For example, if an attack message is inserted in the middle of the reception interval of a normal message, rather than just before or after the normal message, it will not be possible to correctly classify normal messages and attack messages based on the reception interval, as shown in Figure 31. In other words, if an attack message is inserted in the middle of the reception interval of a normal message, there may be cases where it is not possible to distinguish between attack messages and normal messages based solely on the reception interval of an abnormal message sequence.

[0191] Of steps S2434A and S2435A, the detailed processing of step S2434A, that is, the judgment processing of each sensor when all messages have been classified, will be described below.

[0192] Fig. 32 is a flowchart showing an example of detailed processing of step S2434A shown in Fig. 28. Fig. 33A is a diagram conceptually showing an example of the case where the answer is Yes at step S24345 shown in Fig. 32. Fig. 33B is a diagram conceptually showing an example of the case where the answer is Yes at step S24347 shown in Fig. 32. Fig. 33C is a diagram conceptually showing an example of the case where the answer is No at step S24347 shown in Fig. 32.

[0193] In step S2434A, first, anomaly detection device 10A determines whether or not information from multiple sensors is included in the message (S24341). More specifically, anomaly detection device 10A determines whether or not sensor values ​​obtained from multiple sensors are included in each of all messages included in a certain period of time.

[0194] In step S24341, information of multiple sensors is included in the message. do not have In the case of (S24341 No 28 (S24342), anomaly detection device 10A adopts the classification results of all messages performed in step S2432A shown in Fig. 28. More specifically, if none of the messages included in a certain period contain sensor values ​​obtained from multiple sensors, anomaly detection device 10A outputs the classification results of all messages performed in step S2432A as the result of detailed processing in step S24342.

[0195] On the other hand, in step S24341, information of multiple sensors is included in the message. be In case (S24341 Yes ), the abnormality detection device 10A performs the processes of steps S24343 to S24348 for each sensor. More specifically, in step S24341, information on a plurality of sensors is included in the message. be In case (S24341 Yes ), the abnormality detection device 10A performs processing to divide the messages into two groups based on the message reception intervals (S24343).

[0196] Next, abnormality detection device 10A uses the difference value calculated in step S2431A shown in FIG. 28 to determine whether the difference value of the sensor values ​​is constant in at least one of the two groups divided in step S24343 (S24344).

[0197] In step S24344, if the difference value between the sensor values ​​is not constant in at least one of the groups (No in S24344), abnormality detection device 10A proceeds to step S24342.

[0198] On the other hand, in step S24344, if the difference value between the sensor values ​​is constant in at least one of the groups (Yes in S24344), anomaly detection device 10A determines whether the sensor values ​​are the same across the two groups (S24345).

[0199] In step S24345, if the sensor values ​​are the same across the two groups (Yes in S24345), the anomaly detection device 10A proceeds to step S24348. More specifically, if the sensor values ​​are the same across the two groups, the sensor values ​​of the attack messages and normal messages are flat, as shown in Figure 33A, for example, and it is impossible to distinguish between the attack messages and normal messages. Therefore, the anomaly detection device 10A proceeds to step S24348 and determines that all messages are normal messages.

[0200] On the other hand, in step S24345, if the sensor values ​​across the two groups are not the same (No in S24345), anomaly detection device 10A divides the sensor values ​​into two groups using a clustering algorithm such as the K-means method (S24346).

[0201] Next, abnormality detection device 10A determines whether or not there are any groups having the same sensor value as a result of the process in step S24346 (S24347).

[0202] In step S24347, if there are no groups with the same sensor value (Yes in S24347), the process proceeds to step S24348. More specifically, if there are no groups with the same sensor value as a result of the processing in step S24346, it is considered that copies of normal sensor values ​​are lined up and the normal sensor value (fixed value) is fluctuating, as shown in Figure 33B, for example. Therefore, anomaly detection device 10A proceeds to step S24348 and determines that all messages are normal messages.

[0203] On the other hand, if there are groups with the same sensor value in step S24347 (No in S24347), the process proceeds to step S24342. More specifically, if there are groups with the same sensor value as a result of the processing in step S24346, it is considered that the groups have been divided into two groups: one group with normal and constant sensor values, and one group with fixed values, as shown in Figure 33C, for example. Therefore, anomaly detection device 10A proceeds to step S24342 and adopts the results of classifying all messages performed in step S2432A.

[0204] In this way, the anomaly detection device 10A can determine whether the messages classified in step S2433A shown in FIG. 28 are the result of an equivalence attack (whether they are the result of an equivalence attack or a shift attack) by clustering the reception intervals and sensor values ​​and grouping them as normal or abnormal.

[0205] Next, the detailed process of step S2435A shown in FIG. 28, that is, the determination process of each sensor when all messages cannot be classified, will be described.

[0206] Fig. 34 is a flowchart showing an example of detailed processing of step S2435A shown in Fig. 28. Fig. 35 is a diagram showing judgment rules used in detailed processing of step S2435A shown in Fig. 28. Fig. 36A is a diagram for conceptually explaining whether a message that could not be classified is the end of an attack. Fig. 36B is a diagram for conceptually explaining the reception interval rule within the same group shown in Fig. 35. Figs. 36C and 36D are diagrams conceptually showing an example of a case where the answer is Yes in step S24354 shown in Fig. 34. Fig. 36E is a diagram showing an example of the judgment result of step S24359 shown in Fig. 34.

[0207] In step S2435A, first, anomaly detection device 10A determines whether the message that could not be classified in step 2433A is a normal message following the attack message that is the terminal.

[0208] 36A illustrates a message sequence that cannot be classified in the current subwindow, indicated as A, and that is the final attack message, indicated as B. That is, as shown in FIG. 36A, when the message indicated as B is the final attack message, the reception interval of only the first message in the current subwindow, indicated as A, is short, but the reception intervals of the subsequent messages are normal.

[0209] Since the above assumption can be made that this is the end of the attack, in this modified example, the anomaly detection device 10A checks whether the attack is at its end based on whether the following three conditions are met: The three conditions are met if only the first message in the current subwindow cannot be classified, the other messages show normal reception intervals, and there was an additional attack in a previous subwindow.

[0210] In step S24351, if it is confirmed that this is the end of the attack (Yes in S24351), the anomaly detection device 10A proceeds to step S24352 and determines that all sensors are normal (S24352).

[0211] On the other hand, if it is determined in step S24351 that the attack is not at its end (No in S24351), anomaly detection device 10A performs the processes of steps S24353 to S24359 for each sensor. More specifically, if it is determined in step S24351 that the attack is not at its end (No in S24351), anomaly detection device 10A performs clustering based on the message reception intervals using a clustering algorithm such as the K-means method (S24353).

[0212] Next, the anomaly detection device 10A performs clustering and determines whether a plurality of messages included in the generated group have clearly abnormal reception intervals and are not copy patterns (identical values) (S24354).

[0213] In step S24354, if the reception interval is clearly abnormal and the pattern is not a copy pattern (same value) (Yes in S24354), a determination is made based on the reception interval rule within the same group (S24355).

[0214] Here, a clearly abnormal reception interval corresponds to a case where the reception interval of a message can be clearly classified into a normal or attack group, for example, due to irregular reception intervals between attack messages and normal messages.

[0215] Furthermore, the reception interval rule within the same group predefines that messages with the same reception interval will be judged to have the same result. More specifically, the reception interval rule within the same group is predefined as shown in the top row of Fig. 35, for example.

[0216] The reception interval rule within the same group shown in Figure 35 stipulates that if a message is classified into the normal group, the reception interval is determined to be normal, and if it is classified into the attack group, the reception interval is determined to be abnormal (due to an attack). For example, as shown in Figure 36B, messages with the same reception interval are classified into the same group. More specifically, if a message is included in, for example, frame A, it will be classified into the normal group, and its reception interval can be determined to be normal. Similarly, if a message is included in, for example, frame B, it will be classified into the attack group, and its reception interval can be determined to be abnormal and due to an attack.

[0217] On the other hand, if it is determined in step S24354 that the reception interval is not obviously abnormal or that the pattern is a copy pattern (equivalent) (No in S24354), the process proceeds to step S24356, where an equivalence attack determination rule is used for determination (S24356).

[0218] Here, the absence of an abnormal reception interval corresponds to, for example, the case where an attack message is inserted in the middle of the normal message period, making the reception intervals of the attack message and normal messages almost equal, as shown in Figure 36C. The absence of an abnormal reception interval also corresponds to the case where an attack message is inserted in the middle of a window. The case of a copy pattern (same value) corresponds to, for example, the case where an attack message is inserted with a sensor value that is the same as the sensor value (normal value) of a normal message, as shown in Figure 36D.

[0219] Furthermore, the equivalence attack determination rule is, for example, predefined as the rule shown in the middle of Fig. 35. That is, the equivalence attack determination rule shown in Fig. 35 stipulates that the sensor value and difference value of the immediately preceding message are calculated and grouped, and a group with successive difference values ​​of 0 is determined to be normal, and a group with successive difference values ​​that are not 0 is determined to be abnormal.

[0220] Next, the anomaly detection device 10A determines whether there are any unclassified messages (S24357).

[0221] In step S24357, if there are no unclassified messages (No in S24357), all messages have been classified, and therefore anomaly detection device 10A ends the process.

[0222] On the other hand, if there are unclassified messages in step S24357 (Yes in S24357), it is determined whether the past subwindow is normal (S24358). Here, the anomaly detection device 10A can determine whether the past subwindow is normal by determining whether all of the sensor values ​​of the multiple messages included in the past subwindow are normal.

[0223] In step S24358, if the previous subwindow is not normal (No in S24358), the process proceeds to step S24355.

[0224] On the other hand, if the previous subwindow is normal in step S24358 (Yes in S24358), the anomaly detection device 10A makes a determination using the regression determination rule (S24359).

[0225] Here, the regression determination rule is, for example, a rule shown in the bottom row of FIG. 35 that is determined in advance.

[0226] The regression judgment rule shown in Figure 35 stipulates that, since the sensor values ​​of normal messages change continuously, if the regression error is small, they are judged to be normal, and if the regression error is large, they are judged to be abnormal. For example, as shown in Figure 36E, if the past subwindow enclosed by a frame is normal, it is assumed that there is a range of normal messages in the current subwindow in which the sensor values ​​change continuously with the same trend following the last normal message in the past subwindow. For this reason, the regression line of the past subwindow enclosed by a frame is calculated, and the error between the sensor value indicated by the message in the current subwindow and the regression line is calculated. As a result, if the regression error with the sensor value indicated by the message in the current subwindow is small, it can be judged to be normal, and if the regression error is large, it can be judged to be abnormal (attacked).

[0227] In this way, the anomaly detection device 10A classifies messages that could not be classified based on the reception interval in step S2433A shown in FIG. 28, and by further making a judgment for each sensor, it is possible to determine whether the messages that could not be classified based on the reception interval are normal or abnormal.

[0228] (Possibilities for other embodiments) Although the anomaly detection method and anomaly detection device of the present disclosure have been described above in the embodiments, there are no particular limitations on the entity or device that performs each process. The processes may be performed by a processor embedded in a specific device that is locally located. Alternatively, the processes may be performed by a cloud server that is located in a different location from the local device.

[0229] It should be noted that the present disclosure is not limited to the above-described embodiments. For example, the present disclosure may be embodied in another embodiment realized by any combination of the components described in this specification or by excluding some of the components. Furthermore, the present disclosure also includes modifications obtained by applying various modifications to the above-described embodiments that would occur to a person skilled in the art without departing from the spirit of the present disclosure, i.e., the meaning of the wording of the claims.

[0230] The present disclosure also includes the following cases:

[0231] (1) The above-mentioned device is specifically a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. Each device achieves its function when the microprocessor operates in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands to the computer to achieve a predetermined function.

[0232] (2) Some or all of the components constituting the above-described device may be configured as a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0233] (3) Some or all of the components constituting the above-mentioned device may be configured as an IC card or a standalone module that can be attached to or detached from each device. The IC card or module may be a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. The IC card or module may be tamper-resistant.

[0234] (4) The present disclosure may also be embodied as the methods described above, as a computer program for implementing these methods on a computer, or as a digital signal comprising the computer program.

[0235] (5) Furthermore, the present disclosure may be the computer program or the digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (registered trademark) Disc), semiconductor memory, etc. Alternatively, the present disclosure may be the digital signal recorded on such a recording medium.

[0236] Furthermore, the present disclosure may also be applied to transmitting the computer program or the digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0237] The present disclosure may also provide a computer system including a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program.

[0238] The program or the digital signal may also be implemented by another independent computer system by recording it on the recording medium and transferring it, or by transferring it via the network or the like. [Industrial Applicability]

[0239] The present disclosure can be used for an abnormality detection method, an abnormality detection device, and a program that detects abnormalities in messages transmitted over an in-vehicle network, and in particular for an abnormality detection method, an abnormality detection device, and a program that are installed in a vehicle together with an in-vehicle network and detect abnormalities in messages transmitted over the in-vehicle network. [Explanation of symbols]

[0240] 10, 10A abnormality detection device 11, 11A Input processing section 12 Event classification processing section 13, 13A Output processing section 14A Message Classification Processing Unit 111 Message receiving unit 112 Window generation processing unit 113 Imaging Processing Unit 121 CNN 141 CNN Message Classifier 142 LSTM Message Classifier 143 Human Message Classifier 144 Ensemble Processing Unit 1000 computers 1001 Input Device 1002 Output device 1004 Internal Storage 1007 Reading device 1008 Transmitting and receiving device 1009 Bus

Claims

1. 1. An anomaly detection method for detecting an anomaly in an in-vehicle network system including a plurality of electronic control units that exchange messages via a network within a vehicle, comprising: converting the transition of the sensor values ​​of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period. Anomaly detection methods.

2. An anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that exchange messages via the network within a vehicle, comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Anomaly detection methods.

3. An anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, calculating the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other among the plurality of messages included in the message sequence over the fixed period of time; Grouping the calculated difference values; determining whether all the difference values ​​included in each group are 0; If all the difference values ​​are not 0, output a detection result indicating that an additional attack in which an attack message has been inserted during the certain period of time has occurred; If all the difference values ​​are 0, the messages in the group whose difference values ​​are 0 during the certain period are determined to be not attack messages and the detection result is output. Anomaly detection methods.

4. An anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, Using a trained CNN different from the trained CNN, detect attack messages and attacked sensors from a plurality of messages included in the message sequence over the certain period of time. Anomaly detection methods.

5. An anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, Using a trained Long Short-Term Memory (LSTM), it is detected whether or not the plurality of messages included in the message sequence over the certain period are attack messages. Anomaly detection methods.

6. An anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using a trained CNN (Convolution Neural Network), classify the image data to determine whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, acquiring a determination result obtained by determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Using a trained CNN different from the trained CNN, obtain a first detection result that detects a message that is an attack message and an attacked sensor from a plurality of messages included in the message sequence for the certain period of time; using the trained LSTM to obtain a second detection result that detects whether the plurality of messages included in the message sequence over the certain period are attack messages; ensemble-processing the acquired determination result, the first detection result, and the second detection result, and outputting the result; In the ensemble processing, selecting one of the determination result, the first detection result, and the second detection result, or integrating the acquired determination result, the first detection result, and the second detection result by taking a weighted average; Anomaly detection methods.

7. Dividing a message sequence received from the network using a sliding window to obtain a plurality of messages included in the certain period; generating an image representing a transition of the sensor values ​​of the plurality of messages from the acquired plurality of messages, thereby converting the transition of the sensor values ​​of the plurality of messages into image data; The anomaly detection method according to claim 1 .

8. If an attack message is inserted during the specified period, moreover, determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; The anomaly detection method according to claim 1 or 7.

9. If an attack message is inserted during the specified period, moreover, calculating the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other among the plurality of messages included in the message sequence over the fixed period of time; Grouping the calculated difference values; determining whether all the difference values ​​included in each group are 0; If all the difference values ​​are not 0, output a detection result indicating that an additional attack in which an attack message has been inserted during the certain period of time has occurred; If all the difference values ​​are 0, the messages in the group whose difference values ​​are 0 during the certain period are determined to be not attack messages and the detection result is output. The anomaly detection method according to any one of claims 1, 7 and 8.

10. If an attack message is inserted during the specified period, moreover, Using a trained CNN different from the trained CNN, detect attack messages and attacked sensors from a plurality of messages included in the message sequence over the certain period of time. The anomaly detection method according to claim 1 or 7.

11. If an attack message is inserted during the specified period, moreover, Using a trained Long Short-Term Memory (LSTM), it is detected whether or not the plurality of messages included in the message sequence over the certain period are attack messages. The anomaly detection method according to claim 1 or 7.

12. If an attack message is inserted during the specified period, moreover, acquiring a determination result obtained by determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Using a trained CNN different from the trained CNN, obtain a first detection result that detects a message that is an attack message and an attacked sensor from a plurality of messages included in the message sequence for the certain period of time; using the trained LSTM to obtain a second detection result that detects whether the plurality of messages included in the message sequence over the certain period are attack messages; ensemble-processing the acquired determination result, the first detection result, and the second detection result, and outputting the result; In the ensemble processing, selecting one of the determination result, the first detection result, and the second detection result, or integrating the acquired determination result, the first detection result, and the second detection result by taking a weighted average; The anomaly detection method according to claim 1 or 7.

13. An anomaly detection device for detecting an anomaly in an in-vehicle network system including a plurality of electronic control units that exchange messages via a network within a vehicle, comprising: A processor and a memory, converting the transition of the sensor values ​​of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period. Anomaly detection device.

14. An anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: A processor and a memory, converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Anomaly detection device.

15. An anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: A processor and a memory, converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, calculating the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other among the plurality of messages included in the message sequence over the fixed period of time; Grouping the calculated difference values; determining whether all the difference values ​​included in each group are 0; If all the difference values ​​are not 0, output a detection result indicating that an additional attack in which an attack message has been inserted during the certain period of time has occurred; If all the difference values ​​are 0, the messages in the group whose difference values ​​are 0 during the certain period are determined to be not attack messages and the detection result is output. Anomaly detection device.

16. An anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: A processor and a memory, converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, Using a trained CNN different from the trained CNN, detect attack messages and attacked sensors from a plurality of messages included in the message sequence over the certain period of time. Anomaly detection device.

17. An anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: A processor and a memory, converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, Using a trained Long Short-Term Memory (LSTM), it is detected whether or not the plurality of messages included in the message sequence over the certain period are attack messages. Anomaly detection device.

18. An anomaly detection device for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via a network within a vehicle, comprising: A processor and a memory, converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, acquiring a determination result obtained by determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Using a trained CNN different from the trained CNN, obtain a first detection result that detects a message that is an attack message and an attacked sensor from a plurality of messages included in the message sequence for the certain period of time; using the trained LSTM to obtain a second detection result that detects whether the plurality of messages included in the message sequence over the certain period are attack messages; ensemble-processing the acquired determination result, the first detection result, and the second detection result, and outputting the result; In the ensemble processing, selecting one of the determination result, the first detection result, and the second detection result, or integrating the acquired determination result, the first detection result, and the second detection result by taking a weighted average; Anomaly detection device.

19. 1. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system including a plurality of electronic control units that exchange messages via a network within a vehicle, the program comprising: converting the transition of the sensor values ​​of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period. A program that a computer runs.

20. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via the network within a vehicle, the program comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from a sensor value included in each of the plurality of messages; A program that a computer runs.

21. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via the network within a vehicle, the program comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, calculating the difference values ​​of the sensor values ​​for all combinations of two messages that are received one after the other among the plurality of messages included in the message sequence over the fixed period of time; Grouping the calculated difference values; determining whether all the difference values ​​included in each group are 0; If all the difference values ​​are not 0, output a detection result indicating that an additional attack in which an attack message has been inserted during the certain period of time has occurred; If all the difference values ​​are 0, the messages in the group whose difference values ​​are 0 during the certain period are determined to be not attack messages and the detection result is output. A program that a computer runs.

22. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via the network within a vehicle, the program comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, Detecting attack messages and attacked sensors from a plurality of messages included in the message sequence for the certain period using a trained CNN different from the trained CNN; A program that a computer runs.

23. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via the network within a vehicle, the program comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, using a trained Long Short-Term Memory (LSTM) to detect whether or not a plurality of messages included in the message sequence over the certain period are attack messages; A program that a computer runs.

24. A program for causing a computer to execute an anomaly detection method for detecting an anomaly in an in-vehicle network system having a plurality of electronic control units that transmit and receive messages via the network within a vehicle, the program comprising: converting the reception intervals of a plurality of messages included in a message sequence over a certain period of time from the message sequence received from the network or the transition of the sensor values ​​into image data; Using the trained CNN, classify the image data as to whether or not an attack message has been inserted during the certain period of time; If an attack message is inserted during the certain period, output a detection result indicating that there is an additional attack in which an attack message is inserted during the certain period; If an attack message is inserted during the specified period, moreover, acquiring a determination result obtained by determining whether or not the plurality of messages included in the message sequence over the certain period are attack messages based on a predetermined rule from the sensor values ​​included in each of the plurality of messages; Using a trained CNN different from the trained CNN, obtain a first detection result that detects a message that is an attack message and an attacked sensor from a plurality of messages included in the message sequence for the certain period of time; using the trained LSTM to obtain a second detection result that detects whether the plurality of messages included in the message sequence over the certain period are attack messages; ensemble-processing the acquired determination result, the first detection result, and the second detection result, and outputting the result; In the ensemble processing, selecting one of the determination result, the first detection result, and the second detection result, or integrating the acquired determination result, the first detection result, and the second detection result by weighted averaging; A program that a computer runs.

Images