Intrusion detection device and intrusion detection method

Abstract

Provided are an intrusion detection device and method that enable more accurate detection of unauthorized communications. This intrusion detection device comprises: a communication unit that transmits and receives a frame to and from an in-vehicle electronic device; an attribute acquisition unit that acquires attributes of the frame; a status acquisition unit that acquires communication control status information indicating the status of communication control of the frame by the in-vehicle electronic device; and an abnormality detection unit that detects an abnormality in the in-vehicle electronic device on the basis of the attribute and the communication control status. Even when the number of frames transmitted per unit time is within a predetermined value, it is possible to detect an abnormality in the in-vehicle electronic device in accordance with the communication control status of the ECU 20 that is the source of the frame and the attributes of the frame.

Description

[Technical Field]

[0001] The present disclosure relates to an intrusion detection device and an intrusion detection method. [Background technology]

[0002] Conventionally, automobiles are equipped with multiple ECUs (Electronic Control Units) that consist of microcomputers, etc. The multiple ECUs are connected to an in-vehicle network such as a CAN (Controller Area Network) to communicate with each other and with external devices.

[0003] In recent years, there has been a threat that ECUs are attacked by crackers or the like through unauthorized external communications, resulting in vehicle control being taken over. To counter such threats, an IDS (Intrusion Detection System) is known, which is a technology that monitors network communications to detect the occurrence of such attack activity and notify an administrator or the like. For example, Patent Document 1 discloses a technology that counts the number of messages periodically transmitted from a communication device per unit time, and determines that an attack activity is occurring if the count number exceeds a threshold.

[0004] However, the technology disclosed in the above-mentioned Patent Document 1 may not be able to detect attacking activities that should be considered abnormal. For example, if an attacking device (such as an ECU or external device whose software has been spoofed or tampered with) transmits unauthorized frames at a specified interval, the number of frames transmitted per unit time will be below a threshold, and the transmission of these unauthorized frames will not be detected as unauthorized communication. Therefore, the technology disclosed in Patent Document 1 may not be able to accurately detect unauthorized communication. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 6891671 Summary of the Invention [Problem to be solved by the invention]

[0006] In view of the above problems, the present disclosure provides an intrusion detection device and a detection method that enable detection of unauthorized communications to be performed more accurately. [Means for solving the problem]

[0007] An intrusion detection device according to a first aspect of the present disclosure includes a communication unit that transmits and receives frames to and from an in-vehicle electronic device, an attribute acquisition unit that acquires attributes of the frames, a status acquisition unit that acquires communication control status information indicating the communication control status of the frames by the in-vehicle electronic device, and an abnormality detection unit that detects an abnormality in the in-vehicle electronic device based on the attributes and the communication control status.

[0008] In addition, an intrusion detection device according to a second aspect of the present disclosure includes a communication unit that transmits and receives frames to and from an on-board electronic device, an attribute acquisition unit that acquires attributes of the frames, a status acquisition unit that acquires communication control status information indicating the communication control status of the frames by the on-board electronic device, an abnormality determination unit that detects an abnormality in the on-board electronic device, and a transmission unit that, when the abnormality determination unit detects an abnormality in the on-board electronic device, adds the attributes and the communication control status information to abnormality information indicating the abnormality and transmits the abnormality information. [Effects of the Invention]

[0009] According to the intrusion detection device of the present disclosure, it is possible to more accurately detect unauthorized communications. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram showing an example of the configuration of an intrusion detection device 100 according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating the detailed configuration of the intrusion detection device 100. [Figure 3]1 shows an example of a communication control state table provided in the state acquisition unit 103. [Figure 4] 10 is an example of a determination table used by a frame transmission determination unit 104 to determine whether an ECU 20 is normal or abnormal. [Figure 5] 10 shows an example of a communication control group table provided in the state determination unit 105. [Figure 6] 4 is a flowchart showing the operation of the first embodiment. [Figure 7] 4 is a flowchart showing the operation of the first embodiment. [Figure 8] FIG. 10 is a block diagram showing an example of the configuration of an intrusion detection device 100′ according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be designated by the same numerals. Note that the accompanying drawings show embodiments and implementation examples according to the principles of the present disclosure, but these are for understanding the present disclosure and are not to be used to interpret the present disclosure in a limiting manner. The descriptions in this specification are merely typical examples and are not intended to limit the scope or application of the present disclosure in any way.

[0012] Although the present embodiment has been described in sufficient detail to enable those skilled in the art to implement the present disclosure, it should be understood that other implementations and forms are possible, and that changes in configuration and structure and substitutions of various elements are possible without departing from the scope and spirit of the technical ideas of the present disclosure. Therefore, the following description should not be interpreted as being limited thereto. The control lines and information lines shown in the various drawings are those considered necessary for explaining the invention, and do not represent all control lines and information lines in the actual product.

[0013] [First embodiment] First, an intrusion detection device 100 according to a first embodiment will be described with reference to the block diagram of Fig. 1. Fig. 1 is a block diagram showing an example of the configuration of the intrusion detection device 100 according to the first embodiment. An in-vehicle network 1 is configured by connecting the intrusion detection device 100 and a plurality of ECUs 20a to 20e (in-vehicle electronic devices) to a network 10. For ease of explanation, five ECUs 20a to 20e are shown in Fig. 1, but it goes without saying that the number is not limited to this.

[0014] The network 10 is a network that connects the intrusion detection device 100 and the multiple ECUs 20, and is used for data communication. The communication standard may be CAN, Ethernet, SPI, or the like, and is not limited to a specific one. Note that, hereinafter, the multiple ECUs 20a to 20e may be collectively referred to as "ECU 20."

[0015] The ECU 20 is an arithmetic and control device that executes calculations to execute various controls related to the vehicle. Multiple ECUs 20 exchange messages (hereinafter also referred to as "frames" or "data") with one another using the network 10. In a frame, the sender and destination are specified in advance by identification information such as an ID, and the ECU 20 can receive the frame based on this identification information. The ECU 20 may be any information processing device connected to the network 10, and may also be an external device such as a diagnostic machine connected via an interface such as an OBD (On-Board Diagnostics) interface.

[0016] The intrusion detection device 100 is an information processing device that monitors the network 10 and detects unauthorized communications from the outside (intrusions into the ECU 20, attack activities). The intrusion detection device 100 may also be an information processing device that simultaneously realizes the functions of the ECU 20.

[0017] 2 is a block diagram showing an example of the configuration of an intrusion detection device 100 according to the first embodiment. The intrusion detection device 100 includes, for example, a communication unit 101, an attribute acquisition unit 102, a status acquisition unit 103, a frame transmission determination unit 104, a status determination unit 105, and an anomaly detection unit 106.

[0018] The communication unit 101 transmits and receives frames to and from the network 10. The frames received by the communication unit 101 are output to the attribute acquisition unit 102. Furthermore, if the frame transmitted or received by the communication unit 101 is a frame related to a communication control state, which will be described later, the frame is output to the state acquisition unit 103.

[0019] The attribute acquisition unit 102 acquires attribute information relating to the attributes of a frame from the frame acquired by the communication unit 101. The acquired attribute information of the frame is defined in advance in the in-vehicle network 1, and includes, for example, an ID included in the frame, the timing at which the frame is transmitted, the payload (actual data portion) of the frame, etc. The attribute acquisition unit 102 outputs the acquired attribute and information on the ECU 20 that is the sender of the frame to the frame transmission determination unit 104.

[0020] The status acquisition unit 103 acquires communication control status information relating to the status of communication control by the ECU 20 for the frame received by the communication unit 101. The communication control status information is defined in advance in the in-vehicle network 1 so as to indicate one of a plurality of statuses. The status of communication control by the ECU 20 changes depending on factors internal and external to the ECU 20. The communication control status information is information indicating the current status of the ECU 20.

[0021] An example of a protocol that defines communication control states is AUTOSAR CAN Network Management (CanNm). CanNm is a protocol for communication control defined by AUTOSAR, and is a protocol for continuously communicating the startup status of a group of ECUs (PN clusters) that need to communicate simultaneously, regardless of the state of the vehicle's ignition power. CanNm defines five communication control states, and the ECU's communication control state transitions depending on factors known as internal requests and external requests.

[0022] An internal request means that an ECU requests the continuation of its own operation when it determines that it needs to continue its startup due to its own internal factors. In contrast, an external request is indicated by an NM frame transmitted in one of three communication control states called network modes. Specifically, an NM frame has an area allocated to each PN cluster, and when an NM frame is received, this area is checked to determine whether a communication request is coming from the same PN cluster. In an in-vehicle network 1 using CanNm, the types and attributes of frames that can be transmitted and received in each of multiple communication control states may be specified. The intrusion detection device 100 of this embodiment utilizes the fact that the attributes of frames that can be transmitted and received are specified depending on the communication control state, determines the combination of the communication control state and the attributes of the frame being transmitted, and detects unauthorized communication based on the determination result.

[0023] One method for the status acquisition unit 103 to acquire communication control status information indicating the communication control status of the ECU 20 is to receive the communication control status information directly from the ECU 20. The status acquisition unit 103 can also determine the communication control status from the communication status of frames transmitted and received between the target ECU and acquire information including the determination result as the communication control status information.

[0024] In the above-described example of CanNm, the communication control state of each ECU 20 can be inferred from the contents of the NM frame flowing on the network 10 and the information of the PN cluster of each ECU 20. That is, the NM frame and the PN cluster can function together as communication control state information. The communication control state information acquired by the state acquisition unit 103 is managed by the state acquisition unit 103 for each of the ECUs 20a to 20e in a communication control state table exemplarily shown in FIG. 3, and is output to the frame transmission determination unit 104 and the state determination unit 105. In FIG. 3, state 1, state 2, and state 3 are defined as the communication control states of the ECUs 20a to 20e, and the communication control state information indicates which state the communication control state of each of the ECUs 20a to 20e is in.

[0025] The frame transmission determination unit 104 determines whether the ECU 20 that is the sender of the frame received by the communication unit 101 is permitted to transmit the frame and whether the ECU 20 is normal or abnormal, based on a combination of the attribute information acquired from the attribute acquisition unit 102 and the communication control state information acquired from the state acquisition unit 103. Fig. 4 shows an example of a determination table that the frame transmission determination unit 104 uses to determine whether the ECU 20 is normal or abnormal.

[0026] This determination table is a table for determining whether the ECU 20 is normal or abnormal for each of nine combinations of states 1 to 3 indicated by the communication control state information and attributes 1 to 3 indicated by the attribute signal. If the ECU 20 is determined to be normal, it is determined that the ECU 20 can transmit frames (transmission enabled), and if the ECU 20 is determined to be abnormal, it is determined that the ECU 20 cannot transmit frames (transmission disabled). For example, assume that the communication control states of the ECUs 20a to 20e are as shown in FIG. 3 (ECUs 20a and 20b are in state 1, ECUs 20d and 20e are in state 2, and ECU 20c is in state 3). In this case, if the attribute of a frame received from ECU 20c is attribute 2, it is determined that ECU 20c is abnormal and transmission is disabled according to the determination table in FIG. 4. The determination result by the frame transmission determination unit 104 is output to the abnormality detection unit 106.

[0027] The state determination unit 105 determines whether the ECU 20 is normal or abnormal based on the communication control state information acquired from the state acquisition unit 103 and a communication control group table such as that shown in Fig. 5. A communication control group is a group made up of ECUs 20 whose communication control state at any timing is always the same (same). In the above-mentioned example of CanNm, the communication control group corresponds to a PN cluster.

[0028] 5, it is assumed that ECUs 20a and 20b are classified into group 1 as a communication control group, and ECUs 20c to 20e are classified into group 2 as a communication group. In this case, for example, if the communication control state information of ECUs 20d and 20e indicates state 1, while the communication control state of ECU 20c, which also belongs to group 2, indicates state 2, the state determination unit 105 can determine that ECU 20c is abnormal. The determination result by the state determination unit 105 is output to the abnormality detection unit 106.

[0029] The abnormality detection unit 106 has a function of ultimately determining whether or not the ECU 20 is abnormal (detecting an abnormality) by using either or both of the determination result of the frame transmission determination unit 104 and the determination result of the state determination unit 105. When both determination results are used to determine whether the ECU 20 is normal or abnormal, it is possible to determine whether the ECU 20 is normal or abnormal with higher accuracy than when only one of the determination results is used.

[0030] Even when determining whether the ECU 20 is normal or abnormal based solely on the determination result of the frame transmission determination unit 104, it is possible to determine whether the ECU 20 is normal or abnormal with sufficient accuracy. For example, even when fraudulent messages are transmitted so that the number of messages transmitted from the ECU 20 per unit time is equal to or less than a threshold, the frame transmission determination unit 104 can determine whether the frame is normal or abnormal based on a combination of communication control state information indicating the state of the frame and attribute information indicating the attribute of the frame. In other words, the abnormality detection unit 106 can determine whether the ECU 20 is normal or abnormal using only the determination result of the frame transmission determination unit 104, and even in this case, it is possible to detect fraudulent communications more accurately than when the determination is based on the number of messages transmitted from the ECU 20 per unit time.

[0031] However, even if the communication control status information acquired by the status acquisition unit 103 actually relates to unauthorized communication, the unauthorized communication may not be reflected in the communication control status information. Specifically, an attacking device masquerading as the ECU 20 may manipulate data so that its own unauthorized message frame is determined to be legitimate in order to disguise the transmission of an unauthorized message as legitimate. To address such a situation, the anomaly detection unit 106 can determine whether the ECU 20 is normal or abnormal by using both the determination results of the frame transmission determination unit 104 and the determination results of the status determination unit 105. The status determination unit 105 can determine whether the ECU 20 is normal or abnormal by focusing on communication control groups whose communication control status at any given time is always the same. In other words, even if the attacking device falsifies a frame relating to its own communication control status, the anomaly detection unit 106 can accurately determine whether the ECU 20 is normal or abnormal by checking the communication control status of the ECU 20 that belongs to the same communication control group as the attacking device.

[0032] The timing of anomaly detection unit 106's anomaly determination is not limited to a specific timing, and the determination may be performed appropriately when anomaly detection unit 106 receives a determination result from frame transmission determination unit 104 or state determination unit 105, or the anomaly determination may be performed at a fixed cycle regardless of the reception timing. Furthermore, the anomaly determination by anomaly detection unit 106 may take into consideration hysteresis in the determination results of frame transmission determination unit 104 or state determination unit 105.

[0033] An example of the operation for determining whether the ECU 20 is normal or abnormal in the intrusion detection device 100 of the first embodiment will be described with reference to the flowchart of FIG. 6. FIG. 6 shows the operation when the abnormality detection unit 106 determines whether the ECU 20 is normal or abnormal using only the determination result of the frame transmission determination unit 104. First, the communication unit 101 acquires (receives) a frame (received frame) transmitted from the ECU 20 (step S101). Next, if the received frame indicates a communication control state, the state acquisition unit 103 acquires communication control state information from the frame (step S102). The acquired communication control state information is updated and stored as information on the latest communication control state of the ECU 20, as shown in FIG. 3. Next, the attribute acquisition unit 102 acquires attribute information indicating the attribute of the received frame (step S103).

[0034] The frame transmission determination unit 104 acquires the attribute information of the frame acquired from the attribute acquisition unit 102 and the communication control state information held as internal information in the state acquisition unit 103, and determines whether or not to transmit the frame by referring to the determination table (FIG. 4) for the combination (step S104). If the determination table indicates that a frame related to the combination of the attribute information and the communication control state information is transmittable (YES in step S105), the frame transmission determination unit 104 transmits the information to the abnormality detection unit 106. The abnormality detection unit 106 determines, in accordance with this information, that the ECU 20 that transmitted the frame is normal (step S106). On the other hand, if the determination table indicates that a frame related to the combination of the attribute information and the communication control state information is not transmittable (NO in step S105), the frame transmission determination unit 104 transmits the information to the abnormality detection unit 106. The abnormality detection unit 106 determines, in accordance with this information, that the ECU 20 that transmitted the frame is abnormal (step S107).

[0035] Another example of the operation for determining whether the ECU 20 is normal or abnormal in the intrusion detection device 100 of the first embodiment will be described with reference to the flowchart of Fig. 7. Fig. 7 shows the operation when the abnormality detection unit 106 determines whether the ECU 20 is normal or abnormal using only the determination result of the state determination unit 105.

[0036] First, the communication unit 101 acquires a frame from each of the ECUs 20a to 20e (step S201), and acquires communication control state information related to the ECUs 20a to 20e that transmit the frame (step S202). Then, the state determination unit 105 checks the communication control state of the ECUs 20 that belong to the same communication control group (step S203). For example, if the ECUs 20a to 20e are grouped as shown in FIG. 5, the communication control state information of frames transmitted by the ECUs 20a and 20b that belong to group 1 is checked collectively. Similarly, the communication control state information of frames transmitted by the ECUs 20c to 20e that belong to group 2 may be checked collectively.

[0037] In step S204, it is determined whether the ECUs 20 in the same communication control group are in the same communication control state, based on the result of the check in step S203. If the result of the check is affirmative, the process proceeds to step S205, where it is determined that the ECUs 20 in the same communication control group are normal. On the other hand, if the result of the check is negative, the process proceeds to step S206, where it is determined that the ECUs 20 in the same communication control group are in an abnormal state. In this manner, the above operation is repeated until the check is completed for all communication control groups (step S207).

[0038] In the above flowchart, the case where the communication control states of ECUs 20 belonging to the same communication control group are the same is described as an example, but this is just one example, and it is also possible to determine whether an ECU 20 is normal or abnormal by defining in advance the abnormal state of the ECU 20 according to the distribution of the communication control states of ECUs 20 belonging to the same communication control group and specifying the distribution of the obtained communication control state information. In other words, if the communication control states of ECUs 20 in the same communication control group have a certain relationship, it can be determined that communication is normal.

[0039] The signal relating to the obtained distribution may be added to the output signal output by the abnormality detection unit 106 and output from the abnormality detection unit 106. For example, if only one ECU 20 in the same communication control group has a different communication control state, it is possible to output to the abnormality detection unit 106 a first abnormal state indicating that the ECU 20 is abnormal. Furthermore, if the ECUs 20 in the same communication control group are in different communication control states, it is possible to output to the abnormality detection unit 106 a second abnormal state indicating that all ECUs 20 in the same communication control group are abnormal. Furthermore, the abnormality detection unit 106 may be configured to make a final abnormality determination depending on the abnormal state output from the state determination unit 105.

[0040] As described above, the flowchart in Fig. 6 shows the operation when the abnormality detection unit 106 determines whether the ECU 20 is normal or abnormal using only the determination result of the frame transmission determination unit 104, and the flowchart in Fig. 7 shows the operation when the abnormality detection unit 106 determines whether the ECU 20 is normal or abnormal using only the determination result of the state determination unit 105. When the abnormality detection unit 106 determines whether the ECU 20 is normal or abnormal based on both the determination result of the frame transmission determination unit 104 and the determination result of the state determination unit 105, the procedures in Fig. 6 and the procedures in Fig. 7 may be executed in parallel.

[0041] As described above, the first embodiment enables more accurate detection of unauthorized communications. Specifically, it is possible to determine whether the ECU 20 that is the source of a transmitted frame is normal or abnormal based on attribute information and communication control state information of the transmitted frame. Furthermore, the state determination unit 105 determines whether the ECU 20 that is the source of a transmitted frame is normal or abnormal based on the communication control group definition and the communication control state information. The abnormality detection unit 106 can determine whether the ECU 20 that is the source of a frame is normal or abnormal based on either or both of the determination results of the frame transmission determination unit 104 and the determination results of the state determination unit 105. Therefore, according to the first embodiment, even if the number of frames transmitted per unit time is within a predetermined value, it is possible to determine whether the ECU 20 that is the source of a frame is abnormal based on the combination of the communication control state of the ECU 20 that is the source of the frame and the frame attributes, or the identity of the communication control group.

[0042] [Second embodiment] Next, an intrusion detection device 100' according to a second embodiment will be described with reference to Fig. 8. The intrusion detection device 100' according to the second embodiment is connected to the ECU 20 via a network, similar to the intrusion detection device 100 according to the first embodiment. However, as shown in Fig. 8, the intrusion detection device 100' has a configuration that is partially different from that of the intrusion detection device 100.

[0043] As shown in Fig. 8, intrusion detection device 100' according to the second embodiment additionally includes a transmitter 107 and a transmission information generator 108 in addition to the configuration of intrusion detection device 100 according to the first embodiment. The other configuration is the same as that of intrusion detection device 100 according to the first embodiment, and the same components are denoted by the same reference numerals in Fig. 8.

[0044] When the abnormality detection unit 106 detects an abnormality in the ECU 20 in the same manner as in the first embodiment, the transmission unit 107 transmits the abnormality information to the outside. Specifically, the abnormality information is information indicating that the ECU 20 is abnormal, as determined by the frame transmission determination unit 104 or the state determination unit 105. The destination of the abnormality information may be, for example, an external device or server, but is not limited to a specific device. Another example is a security operation center (SOC). By transmitting the abnormality information from the transmission unit 107, it is possible to grasp the occurrence of an external threat or attack and take action.

[0045] The transmission information generation unit 108 has a function of generating transmission information to be attached to the abnormality information transmitted from the transmission unit 107. The transmission information includes, for example, the frame attributes acquired by the attribute acquisition unit 102 and the communication control status information of the ECU 20 acquired by the status acquisition unit 103. Communication control status information for multiple ECUs 20a to 20e may be attached to one abnormality information. For example, communication control status information for other ECUs 20 belonging to the same communication control group as the ECU 20 that transmitted the abnormal frame may also be attached. Adding communication control status information for multiple ECUs 20 to one abnormality information increases the amount of data transmitted by the transmission unit 107, but makes it easier to understand the situation when an abnormality occurs. For example, when the information is transmitted to a SOC, it can be used for triage of the abnormality or secondary analysis by an analyst.

[0046] The present invention is not limited to the above-described embodiments and includes various modifications. The above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0047] Furthermore, the above-described configurations, functions, processing units, and processing means may be implemented in hardware by designing some or all of them as integrated circuits. Furthermore, the above-described configurations and functions may be implemented in software by a processor interpreting and executing a program that implements each function. Information such as programs, tables, and files that implement each function may be stored in a memory, hard disk, or SSD storage device, or on a storage medium such as an IC card, SD card, or DVD. [Explanation of symbols]

[0048] 1...In-vehicle network, 10...Network, 20a-20e...ECU, 100...Intrusion detection device, 101...Communication unit, 102...Attribute acquisition unit, 103...Status acquisition unit, 104...Frame transmission determination unit, 105...Status determination unit, 106...Abnormality detection unit, 107...Transmission unit, 108...Transmission information generation unit.

Claims

1. a communication unit for transmitting and receiving frames to and from the in-vehicle electronic device; an attribute acquisition unit that acquires attributes of the frame; a status acquisition unit that acquires communication control status information indicating a communication control status of the frame by the in-vehicle electronic device; an abnormality detection unit that detects an abnormality in the in-vehicle electronic device based on the attribute and the communication control state; a state determination unit that determines whether the in-vehicle electronic devices belonging to the same group are in the same communication control state; Equipped with the abnormality detection unit detects an abnormality based on the determination result of the state determination unit. Intrusion detection devices.

2. a communication unit for transmitting and receiving frames to and from the in-vehicle electronic device; an attribute acquisition unit that acquires attributes of the frame; a status acquisition unit that acquires communication control status information indicating a communication control status of the frame by the in-vehicle electronic device; an abnormality detection unit that detects an abnormality in the in-vehicle electronic device based on the attribute and the communication control state; a frame transmission determination unit that determines whether or not transmission of the frame is permitted based on the attribute and the communication control state; a state determination unit that determines whether or not the communication control states of the vehicle-mounted electronic devices that belong to the same group have a certain relationship; Equipped with the abnormality detection unit detects an abnormality in the vehicle-mounted electronic device based on the determination result of the frame transmission determination unit or the determination result of the state determination unit. Intrusion detection devices.

3. The intrusion detection device further includes a transmission unit that, when the abnormality detection unit detects an abnormality in the on-vehicle electronic device, transmits abnormality information indicating the abnormality together with the attribute and the communication control status information.

3. The intrusion detection device according to claim 1.

4. transmitting and receiving frames to and from an on-board electronic device; obtaining attributes of the frame; acquiring communication control status information indicating a communication control status of the frame by the in-vehicle electronic device; detecting an abnormality in the in-vehicle electronic device based on the attribute and the communication control state; determining whether the communication control states of the vehicle-mounted electronic devices belonging to the same group have a certain relationship; Equipped with the step of detecting an abnormality detects an abnormality based on a determination result of the step of determining whether or not the certain relationship exists. Intrusion detection methods.

5. transmitting and receiving frames to and from an on-board electronic device; obtaining attributes of the frame; acquiring communication control status information indicating a communication control status of the frame by the in-vehicle electronic device; detecting an abnormality in the in-vehicle electronic device based on the attribute and the communication control state; a first step of determining whether transmission of the frame is permitted based on the attribute and the communication control state; a second step of determining whether the communication control states of the vehicle-mounted electronic devices belonging to the same group have a certain relationship; Equipped with the step of detecting an abnormality detects the abnormality based on either a determination result of the first step or a determination result of the second step; Intrusion detection methods.

6. The intrusion detection method further includes a step of, when an abnormality in the on-vehicle electronic device is detected in the step of detecting the abnormality, adding the attribute and the communication control status information to abnormality information indicating the abnormality and transmitting the information.

6. The intrusion detection method according to claim 4 or 5.

Images