Anomaly detection device, mobile device, anomaly detection method, and program

Abstract

To provide an abnormality determination device, a mobile body including the same, an abnormality determination method, and a program for more appropriately detecting an illegal signal input to a communication network.SOLUTION: An abnormality determination device included in an ECU of a vehicle includes a determination unit that determines whether a plurality of signals is a normal signal or an abnormal signal on the basis of detection timing of the plurality of signals in a communication network, a judgment unit for judging, when a signal judged to be an abnormal signal is detected, the type of abnormality that has occurred in the communication network on the basis of the distribution of detection timings of each of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals detected after the timing at which the signal determined to be an abnormal signal is detected in the communication network.SELECTED DRAWING: Figure 9

Description

Technical Field

[0001] The present invention relates to an abnormality determination device, a moving body, an abnormality determination method, and a program.

Background Art

[0002] Patent Document 1 discloses a technique for determining whether an attack on a communication network has occurred. [Prior Art Document] [Patent Document] Patent Document 1: Japanese Unexamined Patent Application Publication No. 2020-92325

Summary of the Invention

Problems to be Solved by the Invention

[0003] By the way, it is an issue to more appropriately detect an illegal signal input to a communication network. The present application aims to improve safety in order to solve the above issue. And, by extension, it contributes to the development of a sustainable transportation system by further improving traffic safety.

Means for Solving the Problems

[0004] In a first aspect of the present invention, an abnormality determination device is provided. The abnormality determination device is an abnormality determination device in a communication network where signals are expected to be input periodically. The abnormality determination device includes a determination unit that determines whether the plurality of signals in the communication network are normal signals or abnormal signals based on the detection timings of the plurality of signals in the communication network. The abnormality determination device includes a determination unit that determines the type of abnormality that has occurred in the communication network based on the distribution of the detection timings of each of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals that are detected after the timing when the signal determined to be the abnormal signal is detected.

[0005] In the abnormality detection device described above, the determination unit may determine the type of attack carried out by inputting an unauthorized signal into the communication network based on the sequence of detection timings of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals.

[0006] In any of the above-described abnormality detection devices, the determination unit may determine that an attack has occurred on the communication network if there is a regularity in the detection timing of the multiple signals determined to be abnormal, based on the sequence of detection timings of the multiple signals determined to be normal and the multiple signals determined to be abnormal.

[0007] In any of the above-described abnormality detection devices, the determination unit may determine that a spoofing attack has occurred on the communication network if it determines, based on the sequence of detection timings, that the plurality of signals determined to be abnormal signals are detected within a predetermined time range from the plurality of signals determined to be normal signals.

[0008] In any of the above-described abnormality detection devices, the determination unit may determine that a spoofing attack has occurred on the communication network if it determines, based on the sequence of detection timings, that the plurality of signals determined to be abnormal signals are detected within a predetermined time range prior to the detection timing of the plurality of signals determined to be normal signals.

[0009] In any of the above-described abnormality detection devices, the determination unit may determine that a spoofing attack has occurred on the communication network if it determines, based on the sequence of detection timings, that the multiple signals determined to be abnormal signals are detected within a predetermined time range later than the detection timings of the multiple signals determined to be normal signals.

[0010] In any of the above-described abnormality detection devices, the determination unit may determine that a spoofing attack has occurred on the communication network if it determines, based on the sequence of detection timings, that the multiple signals determined to be abnormal signals are detected within a predetermined time range before and after the detection timings of the multiple signals determined to be normal signals.

[0011] In any of the above-described abnormality detection devices, the determination unit may determine that a DoS attack has occurred in the communication network if the number of signals determined to be abnormal exceeds a predetermined number during the detection timing of consecutive signals determined to be normal.

[0012] In any of the above-described abnormality detection devices, the determination unit may determine that an abnormality has occurred in the equipment connected to the communication network if the regularity in the detection timings of the multiple signals determined to be abnormal signals is lower than a predetermined value, based on the sequence of detection timings.

[0013] Any of the above abnormality detection devices may include a identification unit that identifies a reference signal to be used as a reference for identifying an abnormal signal from among a plurality of signals detected in the communication network. Any of the above abnormality detection devices may include a timing estimation unit that estimates the timing at which the plurality of signals are detected in the communication network after the reference signal, based on the detection timing of the reference signal and the time interval at which the plurality of signals are input to the communication network. The determination unit may determine whether each of the plurality of signals detected in the communication network after the reference signal is a normal signal, based on the timing estimated by the timing estimation unit and the detection timing of the plurality of signals detected in the communication network after the reference signal.

[0014] In any of the above-mentioned abnormality detection devices, the communication network may be a communication network compliant with the Control Area Network (CAN) standard.

[0015] In a second embodiment of the present invention, a mobile body is provided. The mobile body is equipped with any of the abnormality detection devices described above.

[0016] The above-mentioned moving object may be a vehicle.

[0017] A third aspect of the present invention provides an anomaly determination method. The anomaly determination method includes the step of determining whether a plurality of signals in a communication network are normal signals or abnormal signals based on the detection timing of the plurality of signals. When a signal determined to be an abnormal signal is detected, the anomaly determination method includes the step of determining the type of anomaly that occurred in the communication network based on the distribution of the detection timings of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals, which were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network.

[0018] In a fourth aspect of the present invention, a program is provided. The program causes a computer to function as one of the anomaly detection devices described above.

[0019] The above summary of the invention does not enumerate all of its features. Furthermore, subcombinations of these features may also constitute an invention. [Brief explanation of the drawing]

[0020] [Figure 1] A conceptual diagram of the system configuration of the mobile body 10 in one embodiment is shown. [Figure 2] This is a block diagram that schematically shows the functional configuration of the ECU110. [Figure 3] This is to explain how to calculate the period of a signal. [Figure 4] This diagram illustrates the process of setting a reference signal used to detect malicious signals. [Figure 5] This diagram schematically illustrates a state in which signal 330 is delayed from its 10ms periodic input timing due to competition with other signals. [Figure 6] Schematically shows the state where signal 430 is delayed from the periodic input timing without interference from other signals. [Figure 7] It is a diagram for explaining the process of determining whether the determination unit 240 is a normal signal or an abnormal signal. [Figure 8] Shows the determination process when the input of the signal to the communication network 180 competes with other signals. [Figure 9] Shows an example case when it is determined that a spoofing attack has been carried out. [Figure 10] Shows another example case when it is determined that a spoofing attack has been carried out. [Figure 11] Shows another example case when it is determined that a spoofing attack has been carried out. [Figure 12] Shows an example case when it is determined that a DoS (Denial-of-Service) attack has been carried out. [Figure 13] Shows another example case when it is determined that an abnormality has occurred in the ECU connected to the communication network 180. [Figure 14] It is a flowchart showing the process related to the abnormality determination method executed by the ECU 110. [Figure 15] Shows an example of the computer 2000.

Embodiments for Carrying Out the Invention

[0021] Hereinafter, the present invention will be described through embodiments of the invention. However, the following embodiments do not limit the invention according to the claims. Also, not all combinations of features described in the embodiments are essential for the solution means of the invention.

[0022] Figure 1 conceptually shows the system configuration of a mobile body 10 in one embodiment. In this embodiment, the mobile body 10 is a vehicle. The mobile body 10 comprises a system 20. The system 20 comprises a plurality of ECUs (electronic control units), including ECU100, ECU110, ECU111, ECU120, and ECU121. The ECUs in the mobile body 10 include ECUs for controlling equipment that directly affects the driving of the mobile body 10, such as the engine, transmission, and steering system. The ECUs in the mobile body 10 also include ECUs for controlling equipment that does not directly affect the driving of the mobile body 10, such as the air conditioner and navigation system. ECU100, ECU110, ECU111, ECU120, and ECU121 are examples of in-vehicle equipment.

[0023] The ECUs in the mobile unit 10 communicate with each other via Controller Area Network (CAN) communication. Each of the ECUs in the mobile unit 10 is connected to each other via multiple communication networks 180. ECU 100 functions as a gateway that relays communication between the multiple communication networks 180.

[0024] The communication network 180 is a communication network in which signals are expected to be input at predetermined time intervals. In this embodiment, the communication network 180 is a communication network compliant with the CAN standard. The communication network 180 is an example of a communication network.

[0025] Figure 2 is a block diagram schematically showing the functional configuration of the ECU 110. The ECU 110 comprises an abnormality detection device 200 and a storage unit 280. The ECU 110 has a function to determine whether a signal input to the communication network 180 is a normal signal or an abnormal signal. The ECU 110 also has a function to determine the type of abnormality that occurred in the communication network 180.

[0026] In this embodiment, the abnormal signal may be an unauthorized signal input when a third party attacks the communication network 180. Examples of attacks against the communication network 180 include impersonation attacks and DoS attacks. The abnormal signal may be an abnormal signal that an ECU other than ECU 110 inputs to the communication network 180 irregularly.

[0027] The anomaly detection device 200 may be implemented by a processor such as a CPU that performs calculations. The storage unit 280 may include a non-volatile storage medium such as flash memory, or a volatile storage medium such as random access memory. The ECU 110 may be configured to include a computer. The ECU 110 performs various controls by operating the anomaly detection device 200 according to a program stored in the non-volatile storage medium.

[0028] The abnormality detection device 200 includes a identification unit 210, a time interval estimation unit 220, a timing estimation unit 230, a determination unit 240, and a determination unit 250.

[0029] The determination unit 240 determines whether a plurality of signals in the communication network 180 are normal signals or abnormal signals based on the detection timing of the plurality of signals. When a signal determined to be an abnormal signal is detected, the determination unit 250 determines the type of abnormality that occurred in the communication network 180 based on the distribution of detection timings of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals that were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network 180. The distribution of detection timings may be expressed using indicators such as the number, density, time interval, arrangement, order, regularity, variability, pattern, etc.

[0030] The determination unit 250 may determine the type of attack carried out by inputting malicious signals into the communication network 180 based on the sequence of detection timings of multiple signals determined to be normal signals and multiple signals determined to be abnormal signals.

[0031] The determination unit 250 may determine that an attack has occurred on the communication network 180 if there is a regularity in the detection timing of the multiple signals determined to be abnormal, based on the sequence of detection timings of the multiple signals determined to be abnormal.

[0032] The determination unit 250 may determine that a spoofing attack has been carried out on the communication network 180 if it determines, based on the sequence of detection timings, that multiple signals determined to be abnormal signals are detected within a predetermined time range from the multiple signals determined to be normal signals. For example, the determination unit 250 may determine that a spoofing attack has been carried out on the communication network 180 if it determines, based on the sequence of detection timings, that multiple signals determined to be abnormal signals are detected within a predetermined time range before the detection timing of multiple signals determined to be normal signals. The determination unit 250 may determine that a spoofing attack has been carried out on the communication network 180 if it determines, based on the sequence of detection timings, that multiple signals determined to be abnormal signals are detected within a predetermined time range after the detection timing of multiple signals determined to be normal signals. The determination unit 250 may determine that a spoofing attack has been carried out on the communication network 180 if it determines, based on the sequence of detection timings, that multiple signals determined to be abnormal signals are detected within a predetermined time range before and after the detection timing of multiple signals determined to be normal signals.

[0033] The determination unit 250 may determine that a DoS attack has occurred in the communication network 180 if the number of signals determined to be abnormal during the detection timing of consecutive signals determined to be normal exceeds a predetermined number.

[0034] The determination unit 250 may determine that an abnormality has occurred in equipment connected to the communication network 180 if the regularity in the detection timings of multiple signals determined to be abnormal signals is lower than a predetermined value, based on the sequence of detection timings.

[0035] The identification unit 210 identifies a reference signal that will serve as a reference for identifying abnormal signals from among multiple signals detected in the communication network 180. The timing estimation unit 230 estimates the timing at which multiple signals will be detected in the communication network 180 after the reference signal, based on the detection timing of the reference signal and the time interval at which multiple signals are input to the communication network 180.

[0036] Specifically, the time interval estimation unit 220 estimates the time intervals between signals that are continuously input to the communication network 180 based on the detection timings of multiple signals detected in the communication network 180. For example, the time interval estimation unit 220 estimates the period of signals that are input to the communication network 180. Then, the timing estimation unit 230 estimates the timing at which multiple signals are detected in the communication network 180 after the reference signal, based on the detection timing and time intervals of the reference signal.

[0037] The determination unit 240 determines whether each of the multiple signals detected in the communication network 180 after the reference signal is a normal signal, based on the timing estimated by the timing estimation unit 230 and the detection timing of the multiple signals detected in the communication network 180 after the reference signal. Specifically, the determination unit 240 determines whether each of the multiple signals detected in the communication network 180 after the reference signal is a normal signal, based on the timing estimated by the timing estimation unit 230 and the detection timing of the multiple signals detected in the communication network 180 after the reference signal.

[0038] The timing estimation unit 230 may calculate the timing obtained by adding a value obtained by multiplying the time interval by a positive number to the detection timing of the reference signal, and use this timing as the timing at which multiple signals are detected in the communication network 180 after the reference signal.

[0039] The determination unit 240 may determine that a signal detected in the communication network 180 after the reference signal is a normal signal if the difference between the detection timing of the signal detected in the communication network 180 after the reference signal and the timing estimated by the timing estimation unit 230 is less than or equal to a predetermined value.

[0040] The time interval estimation unit 220 may estimate the time interval based on the average value of the difference in detection timings of signals continuously detected in the communication network 180 within a predetermined period.

[0041] The timing estimation unit 230 may calculate the timing obtained by adding a value obtained by multiplying the time interval by a positive number to the detection timing of the reference signal as the timing at which multiple signals are detected in the communication network 180 after the reference signal. The time interval estimation unit 220 may set a predetermined period length according to the positive number multiplied by the time interval. The time interval estimation unit 220 may set a predetermined period length such that the timing error predicted by the timing estimation unit 230 from the positive number is less than or equal to a predetermined value. The time interval estimation unit 220 may update the time interval before the predetermined time has elapsed. The identification unit 210 may update the reference signal by identifying a signal detected after the currently set reference signal as a new reference signal before the predetermined time has elapsed.

[0042] If the timing estimation unit 230 detects a second signal that is not the signal to be determined as a normal signal at the timing when the estimated first signal is detected, it may newly estimate a timing for the detection of the first signal by adding a predetermined signal length to the detection timing of the second signal.

[0043] The identification unit 210 may identify the first signal as a new reference signal if the difference between the detection timing of the first signal detected in the communication network 180 after the currently set reference signal and the timing elapsed by a positive multiple of the time interval from the detection timing of the reference signal is less than or equal to a predetermined value.

[0044] The identification unit 210 may not identify the second signal as a reference signal if the time interval between the first signal and the second signal detected consecutively in the communication network 180 is less than or equal to a predetermined interval, but may identify the second signal as a reference signal if, at a minimum, the time interval between the first signal and the second signal detected consecutively in the communication network 180 exceeds a predetermined interval.

[0045] In this embodiment, signals with a predetermined specific CAN ID are the ones that are determined to be normal signals and abnormal signals. Therefore, unless otherwise specified, this embodiment will focus on signals that have been assigned a specific CAN ID. The drawings of this embodiment are intended to clearly illustrate the signals transmitted through the communication network 180 and are not scaled down to a fixed time scale.

[0046] Figure 3 illustrates the method for calculating the signal period. As shown in Figure 3, in the communication network 180, the anomaly detection device 200 detects M signals within a period T0. In this case, the time interval estimation unit 220 calculates the signal period T using the average value T0 / (M-1). In this embodiment, for the purpose of easy explanation, the signal period is assumed to be calculated as 10 ms.

[0047] The time interval estimation unit 220 further calculates the estimation error of the signal period T. For example, the time interval estimation unit 220 may calculate the standard error as the estimation error of the signal period T.

[0048] Figure 4 is a diagram illustrating the process of setting a reference signal used to detect malicious signals. In Figure 4, the actual signal time indicates the time when the anomaly detection device 200 actually detected the signal in the communication network 180. In this embodiment, the time of signal detection is described as the time when signal reception is completed. For example, the time of signal detection may be the time when the anomaly detection device 200 has finished receiving the entire signal. In other embodiments, the time of signal detection may be the time when signal reception began.

[0049] In Figure 4, the actual signal period is the time interval between signals continuously detected in the communication network 180. In this embodiment, the signals to be processed are those expected to be input to the communication network 180 with a period of 10 ms. The identification unit 210 identifies signals as reference signals if the difference (delay time) between the detection time and the time elapsed by a positive multiple of the period of 10 ms from the detection time of a given signal is less than or equal to the first threshold. The identification unit 210 calculates the cumulative delay time value by adding the delay time each time a signal is received. The identification unit 210 identifies signals as reference signals if the cumulative delay time value is less than or equal to the first threshold. In this embodiment, in order to clearly illustrate the process of setting the reference signal, the first threshold is assumed to be 0.5 ms.

[0050] In Figure 4, time t1 is assumed to be the time when a signal is detected in the communication network 180. The anomaly detection device 200 detects the next signal at time t2, 11 ms after time t1. The identification unit 210 calculates the difference between time t2 and the timing after a period of 10 ms has elapsed from time t1 as the delay time. Therefore, the delay time at time t2 is 1 ms. For this reason, the identification unit 210 calculates 1 ms as the cumulative delay time at time t2. Since the cumulative delay time exceeds the first threshold, the identification unit 210 does not identify the signal received at time t2 as the reference signal.

[0051] Next, the anomaly detection device 200 detects the next signal at time t3, which is 11 ms after time t2. The identification unit 210 calculates the difference between time t3 and the timing when a period of 10 ms has elapsed since time t2 as the delay time. The delay time at time t2 is 1 ms. Therefore, the identification unit 210 calculates 2 ms as the cumulative delay time at time t3. Since the cumulative delay time exceeds the first threshold, the identification unit 210 does not identify the signal received at time t3 as the reference signal.

[0052] Next, the anomaly detection device 200 detects the next signal at time t4, which is 8 ms after time t3. The identification unit 210 calculates the difference between time t4 and the timing when a period of 10 ms has elapsed since time t3 as the delay time. The delay time at time t4 is -2 ms. Therefore, the identification unit 210 calculates 0 ms as the cumulative delay time at time t4. Since the cumulative delay time is less than or equal to the first threshold, the identification unit 210 identifies the signal received at time t4 as the reference signal and sets time t4 as the reference time.

[0053] Next, the anomaly detection device 200 detects the next signal at time t5, which is 11.02 ms after time t4. The identification unit 210 calculates the delay time as the difference between time t5 and the timing after a period of 10 ms has elapsed since time t4. The delay time at time t5 is 1.02 ms. Therefore, the identification unit 210 calculates 1.02 ms as the cumulative delay time at time t4. Since the cumulative delay time exceeds the first threshold, the identification unit 210 does not identify the signal received at time t5 as the reference signal.

[0054] Next, the anomaly detection device 200 detects the next signal at time t6, which is 8.5 ms after time t5. The identification unit 210 calculates the delay time as the difference between time t6 and the timing when a period of 10 ms has elapsed since time t5. The delay time at time t6 is -1.5 ms. Therefore, the identification unit 210 calculates -0.48 ms as the cumulative delay time at time t6. Since the absolute value of the cumulative delay time is less than or equal to the first threshold, the identification unit 210 sets the signal received at time t6 as the reference signal and sets time t6 as the reference time. At this time, the identification unit 210 resets the cumulative delay time to 0.

[0055] Next, the anomaly detection device 200 detects the next signal at time t7, which is 10.4 ms after time t6. The identification unit 210 calculates the difference between time t7 and the timing after a period of 10 ms has elapsed since time t6 as the delay time. Since the cumulative delay time value is reset to 0 at time t6, the delay time at time t7 is 0.4 ms. Therefore, the identification unit 210 calculates 0.4 ms as the cumulative delay time value at time t7. Since the cumulative delay time value is less than or equal to the first threshold, the identification unit 210 identifies the signal received at time t7 as the reference signal and sets time t7 as the reference time.

[0056] Thus, when the identification unit 210 detects a new signal, if the difference between the timing at which the new signal was detected and the reference timing, which is an integer multiple of the signal period after the reference time, is less than or equal to a first threshold, the identification unit 210 identifies the new signal as a reference signal. The identification unit 210 then sets the time at which the new signal was detected as the reference time used to detect the malicious signal.

[0057] Next, with reference to Figures 5 and 6, we will explain a situation in which a transmission delay occurs due to a conflict between the input of a signal to the communication network 180 and the input of other signals.

[0058] Figure 5 schematically illustrates a state in which signal 330 is delayed from its 10ms periodic input timing due to competition with other signals. In Figure 5, signals 310, 320, and 330 are signals that are input to the communication network 180 in succession.

[0059] Signal 310 is a signal whose input to the communication network 180 began at time t1 and ended at time t2. Signal 320 is a signal whose input to the communication network 180 began at time t3 and ended at time t5. Signal 320 is a signal whose input to the communication network 180 began at time t6 and ended at time t7.

[0060] In Figure 5, signals 310 and 330 belong to a group of signals that are input to the communication network 180 with a period of 10 ms. Signals 310 and 330 are assigned the same CAN ID. In Figure 5, signal 330 represents a state where it is delayed from the periodic input timing to the communication network 180 due to conflict with signal 320. Here, it is assumed that signal 320 is assigned a different CAN ID than the CAN IDs assigned to signals 310 and 330. However, the same processing can be applied even if the CAN ID of signal 320 is the same as the CAN IDs of signals 310 and 330.

[0061] For example, if signal 330 is input to the communication network 180 at the same time as signal 320, a communication conflict will result in signal 330 starting to be input to the communication network 180 after time t5, when signal 320 has finished being input to the communication network 180. In another example, signal 330 is a signal that should start being input to the communication network 180 during the period when signal 320 is being input to the communication network 180. In this example, signal 330 will start to be input to the communication network 180 after time t5, after waiting for signal 320 to finish being input to the communication network 180 and the bus to become idle.

[0062] When signal 330 is input to the communication network 180, after the input of the data frame of signal 320 to the communication network 180 is complete, the bus enters an idle state after the completion of 3 bits of ITM (Intermission). Therefore, signal 330, which is in conflict with signal 320, can begin to be input to the communication network 180 from time t6, after the time for the ITM to end has elapsed from time t5. The time interval corresponding to ITM is a predetermined minimum time interval that should be left between consecutive signals.

[0063] If the time interval between signal 320 and signal 330, that is, the time interval between time t5 and time t7, matches the sum of the signal length and ITM of signal 330, the determination unit 240 can determine that signal 330 was delayed due to a conflict with signal 320. Therefore, the determination unit 240 determines that signal 330 is a normal signal that was delayed due to a conflict. On the other hand, since signal 330 is a signal that was delayed due to a conflict, the identification unit 210 does not identify signal 330 as a reference signal.

[0064] Thus, the determination unit 240 may determine that signal 330 is a normal signal delayed due to competition with other signals if the time interval between signals continuously detected in the communication network 180 matches the sum of the signal length and ITM. The determination unit 240 may also determine that signal 330 is a normal signal delayed due to competition with other signals if the time interval between signals continuously detected in the communication network 180 is shorter than a threshold determined by setting a predetermined margin in the sum of the signal length and ITM.

[0065] Figure 6 schematically shows a state in which signal 430 is delayed from the periodic input timing without conflict with other signals. Assume that signals 310 and 430 contain the same CAN ID. Unlike the situation shown in Figure 5, signal 430 is a signal delayed from the periodic input timing without conflict with signal 320.

[0066] As shown in Figure 6, signal 430 begins to be input to the communication network 180 at time t9, which is after time t6. The time interval between signal 320 and signal 430, i.e., the time interval between time t10 and time t5, is sufficiently longer than the sum of the signal length and ITM of signal 430. Therefore, the determination unit 240 can determine that signal 430 is delayed from the periodic input timing without conflict with signal 320. For this reason, the determination unit 240 determines that signal 430 is an abnormal signal.

[0067] Figure 7 is a diagram illustrating the process by which the determination unit 240 determines whether a signal is normal or abnormal. Referring to Figure 7, we will explain the case in which it is determined whether a signal detected after time t11 has been set as the reference time is a normal or abnormal signal.

[0068] In this embodiment, to clearly illustrate the determination process of the determination unit 240, the second threshold for determining whether a signal is normal or abnormal is set to 1 ms. That is, the determination unit 240 determines that a detected signal is normal if the difference between the time the signal is detected and the estimated detection time estimated from the reference time and period T is 1 ms or less. The second threshold may be set considering the estimation error of the estimated detection time calculated based on the estimation error of period T. In this embodiment, for the purpose of ease of illustration, the first threshold (0.5 ms) is described as being half of the second threshold (1 ms), but the first threshold may be 1 / 5 or less of the second threshold. The first threshold may be 1 / 10 of the second threshold.

[0069] Referring to Figure 7, the anomaly detection device 200 detects a new signal at time t12, 11 ms after time t11. The timing estimation unit 230 estimates a time 10 ms after the reference time as the estimated detection time when the next signal after the signal at time t11 should be detected. The difference between time t12 and the estimated detection time is 1 ms. In other words, the difference between time t12 and the estimated detection time is 1 ms or less. Therefore, the determination unit 240 determines that the signal detected at time t12 is a normal signal.

[0070] Next, the anomaly detection device 200 detects a new signal at time t13, 10.5 ms after time t12. The timing estimation unit 230 estimates a time 10 × 2 ms after the reference time as the estimated detection time when the next signal after the signal at time t12 should be detected. The difference between time t13 and the estimated detection time is 1.5 ms. In other words, the difference between time t13 and the estimated detection time is greater than 1 ms. Therefore, the determination unit 240 determines that the signal detected at time t13 is an anomaly signal.

[0071] As explained in relation to Figure 4, etc., if the input of a signal to the communication network 180 conflicts with other signals, the detection time of the signal may be delayed from the estimated detection time. Therefore, the determination unit 240 may determine whether the signal detected at time t13 was delayed due to conflict with other signals when it was input to the communication network 180. If the determination unit 240 can determine that the signal detected at time t13 was delayed due to conflict with other signals when it was transmitted, it may determine that the signal detected at time t13 is a normal signal. If the determination unit 240 determines that the signal detected at time t13 was not delayed due to conflict with other signals when it was transmitted, it may determine that the signal detected at time t13 is an abnormal signal. This process will be explained in detail in relation to Figure 8.

[0072] Next, the anomaly detection device 200 detects a new signal at time t14, 9.5 ms after time t13. The timing estimation unit 230 sets a time 10 × 3 ms after the reference time as the estimated detection time when the next signal after the signal at time t13 should be detected. The difference between time t14 and the estimated detection time is 1 ms. In other words, the difference between time t14 and the estimated detection time is 1 ms or less. Therefore, the determination unit 240 determines that the signal detected at time t14 is a normal signal.

[0073] Next, the anomaly detection device 200 detects a new signal at time t15, 9.8 ms after time t14. The timing estimation unit 230 sets a time 10 × 4 ms after the reference time as the estimated detection time when the next signal after the signal at time t14 should be detected. The difference between time t15 and the reference timing is 0.8 ms. In other words, time t15 is within a range of ±1 ms centered on the reference timing. Therefore, the determination unit 240 determines that the signal detected at time t15 is a normal signal.

[0074] Thus, the timing estimation unit 230 estimates a time that is a positive multiple of a period of 10 ms after the reference time as the estimated detection time at which multiple signals input to the communication network 180 after the reference time should be detected. The determination unit 240 determines that a new signal is a normal signal if the difference between the detection time of the new signal and the corresponding estimated detection time is less than or equal to a predetermined value. On the other hand, the determination unit 240 may determine that a new signal is an abnormal signal if the difference between the detection time of the new signal and the corresponding estimated detection time exceeds a predetermined value.

[0075] As described above, the estimated detection time is estimated by adding a period to a specific reference time. Since the estimation error of the period T accumulates in the estimated detection time, the longer the elapsed time from the reference time, the lower the estimation accuracy of the estimated detection time becomes. For this reason, it is desirable for the identification unit 210 to update the reference time before the cumulative error caused by the estimation error of the period and the number of period additions (positive numbers multiplied by the period) reaches a predetermined value. For example, it is desirable for the identification unit 210 to update the reference time before the number of period additions used to calculate the estimated detection time reaches a predetermined maximum value. Furthermore, it is desirable for the time interval estimation unit 220 to set the period T0, as explained in relation to Figure 3, according to the number of period additions used to calculate the estimated detection time. For example, the time interval estimation unit 220 may set the period T0 according to the maximum value of the number of period additions used to calculate the estimated detection time. As an example, it is desirable for the time interval estimation unit 220 to set a longer period T0 the more period additions used to calculate the estimated detection time there are. In addition, it is desirable that the time interval estimation unit 220 updates the period T each time a predetermined amount of time has elapsed.

[0076] Figure 8 shows the determination process when a signal input to the communication network 180 conflicts with other signals. In Figure 8, signals 800, 810, and 820 are signals input to the communication network 180 from a specific ECU and are subject to determination by ECU 110 as to whether or not they are normal signals. Signals 811, 821, and 822 are signals input to the communication network 180 from other ECUs. Signals 811, 821, and 822 are assigned different CAN IDs than those assigned to signals 800, 810, and 820.

[0077] The anomaly detection device 200 detects signal 800 at time t0. Here, time t0 is assumed to be the reference time. The timing estimation unit 230 estimates time t01, which is 10 ms after the reference time t0, as the estimated detection time at which signal 810 should be detected in the communication network 180. Furthermore, the timing estimation unit 230 estimates time t02, which is 2 x 10 ms after the reference time t0, as the estimated detection time at which signal 820 should be detected in the communication network 180.

[0078] As shown in Figure 8, signal 810 is delayed due to conflict with signal 811, and is detected at time t2, delayed from the estimated detection time t01. The determination unit 240 determines whether a signal with a CAN ID other than the CAN ID to be determined has been detected within the period from a predetermined period prior to the estimated detection time t01 to the estimated detection time t01. As an example, the determination unit 240 may determine whether a signal with a CAN ID other than the CAN ID to be determined is being input to the communication network 180 within the period from a time equal to the signal length L prior to the estimated detection time t01 to the estimated detection time t01.

[0079] As shown in Figure 8, signal 811 is input during the period from a time a signal length L prior to the estimated detection time t01 to the estimated detection time t01. In this case, the determination unit 240 determines that the signal following signal 800 was delayed due to conflict with signal 811. In this case, the determination unit 240 corrects the estimated detection time t01 by setting the new estimated detection time t01' to a time a signal length L later than the detection time t1 of signal 811. The determination unit 240 determines whether the signal 810 detected at time t2 is a normal signal by comparing the time t2 in which signal 810 was detected with the estimated detection time t01'. In the example in Figure 8, since the difference between the time t2 in which signal 810 was detected and the estimated detection time t01' is 1 ms or less, the determination unit 240 determines that the signal 810 detected at time t2 is a normal signal.

[0080] Next, the processing of signal 820 will be explained. As shown in Figure 8, signal 820 is delayed due to a conflict with signal 821, and then further delayed due to a conflict with signal 822, and is detected at time t5, delayed from the estimated detection time t02. The determination unit 240 determines whether a signal with a CAN ID other than the CAN ID to be determined has been detected within the period from a predetermined period prior to the estimated detection time t02 to the estimated detection time t02. As an example, the determination unit 240 may determine whether a signal with a CAN ID other than the CAN ID to be determined is being input to the communication network 180 within the period from a time equal to the signal length L prior to the estimated detection time t02 to the estimated detection time t02.

[0081] As shown in Figure 8, signal 821 is input during the period from a time point a signal length L prior to the estimated detection time t02 to the estimated detection time t02. In this case, the determination unit 240 determines that the signal following signal 810 was delayed due to conflict with signal 821. In this case, the determination unit 240 corrects the estimated detection time t02 by setting the new estimated detection time t02' to a time point a signal length L later than the detection time t3 of signal 821.

[0082] As shown in Figure 8, signal 822 is input during the period from a time a signal length L prior to the corrected estimated detection time t02' to the estimated detection time t02. In this case, the determination unit 240 determines that the signal following signal 810 was delayed due to conflict with signal 822. In this case, the determination unit 240 further corrects the estimated detection time t02' by setting the new estimated detection time t02'' to a time a signal length L later than the detection time t4 of signal 822. The determination unit 240 determines whether the signal 820 detected at time t5 is a normal signal by comparing the time t5 when signal 820 was detected with the estimated detection time t02''. In the example in Figure 8, since the difference between the time t5 when signal 820 was detected and the estimated detection time t02'' is 1 ms or less, the determination unit 240 determines that the signal 820 detected at time t5 is a normal signal.

[0083] Figure 9 shows an example of a case where a spoofing attack is determined to have occurred. In Figure 9, normal signals are shown in black, and abnormal signals are shown in white. Figure 9 shows a case where an abnormal signal is detected within a predetermined time range after the detection time of a normal signal.

[0084] The determination unit 250 determines that a spoofing attack has occurred against the communication network 180 if, for each of the multiple normal signals, an abnormal signal is detected after the normal signal, the difference Δt between the detection time of the normal signal and the detection time of the abnormal signal detected immediately after the normal signal is less than or equal to a predetermined time, and the number of abnormal signals detected between consecutive normal signals is less than or equal to a predetermined number.

[0085] Figure 10 shows another example of when a spoofing attack is determined to have occurred. In Figure 10, normal signals are shown in black, and abnormal signals are shown in white. Figure 10 shows a case where an abnormal signal is detected within a predetermined time range prior to the detection of a normal signal.

[0086] The determination unit 250 determines that a spoofing attack has occurred against the communication network 180 if, for each of the multiple normal signals, an abnormal signal is detected before the normal signal, the difference Δt between the detection time of the normal signal and the detection time of the abnormal signal detected immediately before the normal signal is less than or equal to a predetermined time, and the number of abnormal signals detected between consecutive normal signals is less than or equal to a predetermined number.

[0087] Figure 11 shows another example of when a spoofing attack is determined to have occurred. In Figure 11, normal signals are shown in black, and abnormal signals are shown in white. Figure 11 shows the case where an abnormal signal is detected within a predetermined time range before and after the detection time of a normal signal.

[0088] The determination unit 250 determines that a spoofing attack has occurred against the communication network 180 if, for each of the multiple normal signals, an abnormal signal is detected before and after the normal signal, the difference Δt1 between the detection time of the normal signal and the detection time of the abnormal signal detected immediately before the normal signal is less than or equal to a predetermined time, the difference Δt2 between the detection time of the normal signal and the detection time of the abnormal signal detected immediately after the normal signal is less than or equal to a predetermined time, and the number of abnormal signals detected between consecutive normal signals is less than or equal to a predetermined number.

[0089] Figure 12 shows an example of a case where a Denial-of-Service (DoS) attack is determined to have occurred. In Figure 12, normal signals are shown in black, and abnormal signals are shown in white. Figure 12 shows a case where more than a predetermined number of abnormal signals are detected between consecutively detected normal signals.

[0090] The determination unit 250 determines, for each set of continuously detected normal signals, a predetermined number N between the normal signals. DIf an abnormal signal exceeding a certain value is detected, it is determined that a DoS attack has occurred against the communication network 180. Alternatively, the determination unit 250 may determine that a DoS attack has occurred against the communication network 180 if, for each set of continuously detected normal signals, the density of abnormal signals detected between normal signals exceeds a predetermined value. Alternatively, the determination unit 250 may determine that a DoS attack has occurred against the communication network 180 if, for each set of continuously detected normal signals, the maximum value of the interval between abnormal signals detected between normal signals is less than or equal to a predetermined value.

[0091] Figure 13 shows another example of when an abnormality is determined to have occurred in an ECU connected to the communication network 180. In Figure 13, normal signals are shown in black, and abnormal signals are shown in white. Figure 13 shows a case where the regularity of abnormal signals detected between consecutively detected normal signals is lower than a predetermined value.

[0092] The determination unit 250 determines that an abnormality has occurred in the ECU connected to the communication network 180 if, for each set of continuously detected normal signals, the regularity of the detection times of abnormal signals detected between normal signals is lower than a predetermined value. The regularity of the detection times of abnormal signals may be a value expressed using indicators such as the variation in the time intervals between continuously detected normal signals and abnormal signals, or the variation in the time intervals between continuously detected abnormal signals. The variation in time intervals may be a value expressed, for example, as the standard deviation of time intervals.

[0093] Figure 14 is a flowchart showing the process performed by the ECU110 regarding the abnormality detection method. This flowchart is executed for multiple signals detected within a predetermined period after an abnormality signal is detected.

[0094] In S1402, the determination unit 240 determines whether each of the detected multiple signals is a normal signal or an abnormal signal. The method described in relation to Figure 7, etc., can be applied to the processing in S1402.

[0095] In S1404, the determination unit 250 determines that the number of abnormal signals detected between consecutive normal signals is a predetermined number N. D It is determined whether or not it exceeds a certain value. The number of abnormal signals detected between consecutive normal signals is a predetermined number N. D If the value exceeds this, in S1406, the determination unit 250 determines that a DoS attack has been carried out against the communication network 180.

[0096] In S1404, the determination unit 250 determines that the number of abnormal signals detected between consecutive normal signals is a predetermined number N. D If the following conditions are met, in S1408, it is determined whether the regularity of the detection time of the abnormal signal is lower than a predetermined value. If the regularity of the detection time of the abnormal signal is lower than a predetermined value, in S1410, the determination unit 250 determines that an abnormality has occurred in the ECU connected to the communication network 180.

[0097] In S1408, the determination unit 250 determines that the regularity of the detection time of the abnormal signal is an abnormal value predetermined, and in S1412, it determines that a spoofing attack has been carried out against the communication network 180. In S1412, as explained in relation to Figures 9, 10, and 11, the determination unit 250 may further determine whether or not a spoofing attack has been carried out against the communication network 180 based on the difference between the detection time of the normal signal and the detection time of the abnormal signal.

[0098] If the anomaly detection device 200 determines in S1406 that a DoS attack has occurred, it may notify an external server that collects the status of the mobile unit 10 that a DoS attack has occurred. If the anomaly detection device 200 determines that a DoS attack has occurred, it may notify the occupant of the mobile unit 10 that an attack has occurred.

[0099] If the anomaly detection device 200 determines in S1412 that a spoofing attack has occurred, it may notify an external server that collects the status of the mobile unit 10 that a spoofing attack has occurred. If it determines that a spoofing attack has occurred, the anomaly detection device 200 may notify the occupant of the mobile unit 10 that an attack has occurred.

[0100] If the abnormality detection device 200 determines in S1410 that an abnormality has occurred in the ECU connected to the communication network 180, it may notify the external server that collects the status of the mobile body 10 that an abnormality has occurred in the ECU. If it determines that an abnormality has occurred in the ECU, the abnormality detection device 200 may notify the occupant of the mobile body 10 that an abnormality has occurred in the mobile body 10.

[0101] According to the abnormality detection device 200 of this embodiment, it is possible to properly determine whether each signal detected in the communication network 180 is a normal signal or an abnormal signal. Since signals are expected to be input to the communication network 180 periodically, it is possible to appropriately determine whether a spoofing attack has occurred, whether a DoS attack has occurred, and whether an abnormality has occurred in the ECU, based on the distribution of detection times of the detected normal and abnormal signals, without using timestamps for each signal. As a result, the occupants of the mobile unit 10 can take appropriate action.

[0102] Figure 15 shows an example of a computer 2000 in which multiple embodiments of the present invention may be embodied in whole or in part. A program installed on the computer 2000 can cause the computer 2000 to function as a system or part of a system, such as system 20 according to the embodiment, or as a device or part of such device, such as ECU 110, to perform operations associated with such system or part of a system or as a device or part of such device, and / or to perform a process or stage of such process according to the embodiment. Such a program may be executed by the CPU 2012 to cause the computer 2000 to perform specific operations associated with some or all of the processing procedures and blocks of the block diagram described herein.

[0103] The computer 2000 according to this embodiment includes a CPU 2012 and RAM 2014, which are interconnected by a host controller 2010. The computer 2000 also includes a ROM 2026, flash memory 2024, communication interface 2022, and input / output chip 2040. The ROM 2026, flash memory 2024, communication interface 2022, and input / output chip 2040 are connected to the host controller 2010 via an input / output controller 2020.

[0104] CPU2012 operates according to the programs stored in ROM2026 and RAM2014, thereby controlling each unit.

[0105] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 stores programs and data used by the CPU 2012 in the computer 2000. The ROM 2026 stores boot programs and / or hardware-dependent programs of the computer 2000, such as those executed by the computer 2000 upon activation. The input / output chip 2040 may also connect various input / output units, such as keyboards, mice, and monitors, to the input / output controller 2020 via input / output ports such as serial ports, parallel ports, keyboard ports, mouse ports, monitor ports, USB ports, and HDMI® ports.

[0106] The program is provided via a computer-readable storage medium such as a CD-ROM, DVD-ROM, or memory card, or via a network. RAM2014, ROM2026, or flash memory 2024 are examples of computer-readable storage media. The program is installed in flash memory 2024, RAM2014, or ROM2026 and executed by CPU2012. The information processing described within these programs is read by computer 2000, resulting in coordination between the program and the various types of hardware resources described above. The apparatus or method may be configured to realize the operation or processing of information in accordance with the use of computer 2000.

[0107] For example, when communication is performed between computer 2000 and an external device, CPU 2012 may execute a communication program loaded into RAM 2014 and, based on the processing described in the communication program, instruct the communication interface 2022 to perform communication processing. Under the control of CPU 2012, the communication interface 2022 reads the transmission data stored in the transmit buffer processing area provided in the recording medium such as RAM 2014 and flash memory 2024, sends the read transmission data to the network, and writes the received data received from the network to the receive buffer processing area provided on the recording medium.

[0108] Furthermore, CPU2012 may read all or necessary parts of a file or database stored on a recording medium such as flash memory 2024 into RAM2014, and perform various types of processing on the data in RAM2014. CPU2012 then writes the processed data back to the recording medium.

[0109] Various types of information, such as various types of programs, data, tables, and databases, may be stored on the recording medium and subjected to information processing. The CPU2012 may perform various types of processing on the data read from RAM2014, including various types of operations, information processing, conditional judgments, conditional branching, unconditional branching, information retrieval / replacement, etc., as described herein and specified by the program's instruction sequence, and write the results back to RAM2014. The CPU2012 may also retrieve information in files, databases, etc., within the recording medium. For example, if multiple entries are stored in the recording medium, each having an attribute value of a first attribute associated with an attribute value of a second attribute, the CPU2012 may search among the multiple entries for an entry that matches the condition where the attribute value of the first attribute is specified, read the attribute value of the second attribute stored in that entry, and thereby obtain the attribute value of the second attribute associated with the first attribute that satisfies the predetermined condition.

[0110] The programs or software modules described above may be stored on or near computer-readable storage media on computer 2000. Recording media such as hard disks or RAM provided within a server system connected to a dedicated communication network or the Internet can be used as computer-readable storage media. Programs stored on computer-readable storage media may be provided to computer 2000 via the network.

[0111] A program installed on computer 2000, which causes computer 2000 to function as ECU110, may interact with CPU 2012 and other components to cause computer 2000 to function as various parts of ECU110. The information processing described in these programs is read by computer 2000 and functions as various parts of ECU110, which are concrete means of collaboration between software and the various hardware resources described above. Through these concrete means, information calculations or processing according to the intended use of computer 2000 in this embodiment are realized, thereby constructing a unique ECU110 suited to the intended use.

[0112] Various embodiments have been described with reference to block diagrams, etc. In a block diagram, each block may represent (1) a stage in a process in which an operation is performed, or (2) a part of a device that has the role of performing an operation. A particular stage and part may be implemented by a dedicated circuit, a programmable circuit supplied with computer-readable instructions stored on a computer-readable storage medium, and / or a processor supplied with computer-readable instructions stored on a computer-readable storage medium. The dedicated circuit may include digital and / or analog hardware circuits, and may include integrated circuits (ICs) and / or discrete circuits. The programmable circuit may include reconfigurable hardware circuits, including logic AND, logic OR, logic XOR, logic NAND, logic NOR, and other logic operations, flip-flops, registers, memory elements such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), etc.

[0113] A computer-readable storage medium may include any tangible device capable of storing instructions that are executed by a suitable device, and as a result, a computer-readable storage medium having instructions stored therein constitutes at least part of a product containing instructions that can be executed to provide a means for performing an operation specified in a processing procedure or block diagram. Examples of computer-readable storage media may include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, etc. More specific examples of computer-readable storage media may include floppy disks, diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), electrically erasable programmable read-only memory (EEPROM), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital multipurpose disc (DVD), Blu-ray® disc, memory stick, integrated circuit card, etc.

[0114] Computer-readable instructions may include assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, Java®, C++, and traditional procedural programming languages ​​such as the C programming language or similar programming languages.

[0115] Computer-readable instructions may be provided locally or via a wide area network (WAN), such as a local area network (LAN) or the internet, to a processor or programmable circuit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, and may be executed to provide a means for performing the described processing procedure or the operation specified in the block diagram. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, and the like.

[0116] Although the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications or improvements can be made to the above embodiments. It will be clear from the claims that such modified or improved forms may also be included in the technical scope of the present invention.

[0117] It should be noted that the execution order of operations, procedures, steps, and stages in the devices, systems, programs, and methods shown in the claims, specifications, and drawings is not explicitly stated as "before," "prior to," etc., and can be implemented in any order unless the output of a previous process is used in a later process. Even if the operation flow in the claims, specifications, and drawings is described using phrases such as "first," "next," etc. for convenience, it does not mean that it is essential to perform the operations in that order. [Explanation of Symbols]

[0118] 10 Mobile Units 20 Systems 100 ECU 110 ECU 111 ECU 120 ECU 121 ECU 180 Communications Network 200 Abnormality judgment device 210 Specific section 220-hour interval estimation unit 230 Timing Estimation Unit 240 Judgment section 250 Judgment Department 280 Storage section 310, 320, 330, 430, 800, 810, 811, 820, 821, 822 signal 2000 Computer 2010 Host Controller 2012 CPU 2014 RAM 2020 Input / Output Controller 2022 Communication Interface 2024 Flash Memory 2026 ROM 2040 Input / Output Chip

Claims

1. An anomaly detection device in a communication network where periodic signals are expected to be input, A determination unit that determines whether the multiple signals are normal signals or abnormal signals based on the detection timing of multiple signals in the communication network, When a signal determined to be an abnormal signal is detected, a determination unit determines the type of abnormality that occurred in the communication network based on the distribution of detection timings of the multiple signals determined to be normal and the multiple signals determined to be abnormal, which were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network. Equipped with, The determination unit determines that an attack has occurred on the communication network if, based on the sequence of detection timings of the multiple signals determined to be normal signals and the multiple signals determined to be abnormal signals, there is a regularity in the detection timing of the multiple signals determined to be abnormal signals that are detected between consecutively detected signals determined to be normal signals. Abnormality judgment device.

2. Based on the sequence of detection timings of the plurality of signals determined to be normal signals and the plurality of signals determined to be abnormal signals, the determination unit determines: (i) If the regularity of the detection timing of the multiple signals determined to be abnormal signals is greater than or equal to a predetermined value, it is determined that an attack has occurred on the communication network. (ii) If the regularity of the detection timing of the multiple signals determined to be abnormal signals is lower than the predetermined value, it is determined that an abnormality has occurred in the equipment connected to the communication network. An abnormality detection device according to claim 1.

3. The determination unit determines the second signal to be a normal signal if the time interval between the first signal and the second signal detected consecutively in the communication network is the minimum predetermined time interval that should be left between consecutive signals, or if the time interval between the first signal and the second signal detected consecutively in the communication network is shorter than a threshold determined by setting a predetermined margin in the minimum time interval. An abnormality detection device according to claim 1 or 2.

4. The determination unit determines the type of attack carried out by inputting malicious signals into the communication network, based on the sequence of detection timings for the multiple signals determined to be normal signals and the multiple signals determined to be abnormal signals. An abnormality detection device according to claim 1 or 2.

5. The determination unit determines, based on the sequence of detection timings, that a spoofing attack has occurred on the communication network if it determines that the multiple signals determined to be abnormal signals are detected within a predetermined time range from the multiple signals determined to be normal signals. An abnormality detection device according to claim 1 or 2.

6. The determination unit determines, based on the sequence of detection timings, that a spoofing attack has occurred on the communication network if it determines that the multiple signals determined to be abnormal signals were detected within a predetermined time range prior to the detection timing of the multiple signals determined to be normal signals. An anomaly detection device according to claim 5.

7. The determination unit determines, based on the sequence of detection timings, that a spoofing attack has occurred on the communication network if it determines that the multiple signals determined to be abnormal signals are detected within a predetermined time range later than the detection timings of the multiple signals determined to be normal signals. An anomaly detection device according to claim 5.

8. The determination unit determines, based on the sequence of detection timings, that a spoofing attack has occurred on the communication network if it determines that the multiple signals determined to be abnormal signals are detected within a predetermined time range before and after the detection timings of the multiple signals determined to be normal signals. An anomaly detection device according to claim 5.

9. The determination unit determines that a DoS attack has occurred in the communication network if, during the detection timing of consecutive signals determined to be normal signals, the number of signals determined to be abnormal exceeds a predetermined number. An abnormality detection device according to claim 1 or 2.

10. Based on the sequence of detection timings, the determination unit determines that an abnormality has occurred in the equipment connected to the communication network if the regularity in the detection timings of the multiple signals determined to be abnormal signals is lower than a predetermined value. An abnormality detection device according to claim 1.

11. An anomaly detection device in a communication network where periodic signals are expected to be input, A unit for identifying a reference signal that serves as a reference for identifying abnormal signals from among multiple signals detected in the aforementioned communication network, A timing estimation unit estimates the timing at which the multiple signals are detected in the communication network after the reference signal, based on the detection timing of the reference signal and the time interval at which the multiple signals are input to the communication network. A determination unit that determines whether the multiple signals are normal signals or abnormal signals based on the detection timing of multiple signals in the communication network, When a signal determined to be an abnormal signal is detected, a determination unit determines the type of abnormality that occurred in the communication network based on the distribution of detection timings of the multiple signals determined to be normal and the multiple signals determined to be abnormal, which were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network. Equipped with, The determination unit determines whether each of the multiple signals detected in the communication network after the reference signal is a normal signal, based on the timing estimated by the timing estimation unit and the detection timing of the multiple signals detected in the communication network after the reference signal. Abnormality judgment device.

12. The aforementioned communication network is a communication network that conforms to the Control Area Network (CAN) standard. An abnormality detection device according to any one of claims 1, 2, and 11.

13. A mobile body equipped with an abnormality detection device according to any one of claims 1, 2, and 11.

14. The aforementioned moving object is a vehicle. The mobile body according to claim 13.

15. A step in which a computer determines whether a plurality of signals are normal signals or abnormal signals based on the detection timing of multiple signals in a communication network, When the computer detects a signal determined to be an abnormal signal, it determines the type of abnormality that occurred in the communication network based on the distribution of the detection timings of the multiple signals determined to be normal and the multiple signals determined to be abnormal, which were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network. Equipped with, The step in which the computer determines the type of anomaly that occurred in the communication network includes determining that an attack has occurred in the communication network if, based on the sequence of detection timings of the multiple signals determined to be normal signals and the multiple signals determined to be abnormal signals, there is a regularity in the detection timing of the multiple signals determined to be abnormal signals that are detected between consecutively detected signals determined to be normal signals. Abnormality judgment method.

16. The computer identifies a reference signal to serve as a standard for identifying abnormal signals from among multiple signals detected in the communication network, The computer performs a timing estimation step in which it estimates the timing at which the multiple signals are detected in the communication network after the reference signal, based on the detection timing of the reference signal and the time interval at which the multiple signals are input to the communication network. The computer determines whether the multiple signals are normal signals or abnormal signals based on the detection timing of the multiple signals in the communication network. When the computer detects a signal determined to be an abnormal signal, it determines the type of abnormality that occurred in the communication network based on the distribution of the detection timings of the multiple signals determined to be normal and the multiple signals determined to be abnormal, which were detected after the timing at which the signal determined to be an abnormal signal was detected in the communication network. Equipped with, The step in which the computer determines whether the plurality of signals are normal signals or abnormal signals includes a step in which it determines whether each of the plurality of signals detected in the communication network after the reference signal is a normal signal, based on the timing estimated in the timing estimation step and the detection timing of the plurality of signals detected in the communication network after the reference signal. Abnormality judgment method.

17. A program for causing a computer to function as an abnormality detection device according to any one of claims 1, 2, and 11.

Images