Anomaly detection method, anomaly detection device, and program

Abstract

To provide an anomaly determination method that can perform effective anomaly detection processing.SOLUTION: An anomaly determination method includes receiving, as a received message, each of a plurality of messages which include a plurality of messages that are periodic and each of which includes a first field having a fixed value, calculating the time available for determining an anomaly in the received messages, obtaining a level determined by the calculated time, and selecting one of the following, according to the level, among n anomaly determinations: selecting all n anomaly determinations, selecting k anomaly determinations, or selecting none of the anomaly determinations. The n anomaly determinations include an anomaly determination that uses the reception timing based on the periodicity, or the number of received messages, and an anomaly determination that uses the first field.SELECTED DRAWING: Figure 12

Description

Technical Field

[0001] The present disclosure relates to a method for determining a detection function according to a processing load when detecting an abnormal message in a vehicle network, etc.

Background Art

[0002] In recent years, a large number of devices called electronic control units (ECUs) have been arranged in the systems of automobiles. The communication network connecting these ECUs is called an in-vehicle network. There are a number of communication standards in the in-vehicle network. Among them, one of the most mainstream in-vehicle network standards is Controller Area Network (hereinafter referred to as CAN).

[0003] In a network based on the CAN standard (hereinafter also referred to as a CAN network), the communication path (bus) is composed of two cables, and the ECU connected to the bus is also called a node. Each node connected to the bus transmits and receives data in units called frames or messages. Also in CAN, an identifier indicating the transmission destination or transmission source of data is not used.

[0004] The node that transmits a frame (hereinafter also referred to as a transmission node) attaches an ID called a message ID indicating the type of message to each message and transmits the message, that is, sends a signal to the bus. The node that receives a message (hereinafter also referred to as a reception node) receives only the message including a predetermined message ID, that is, reads a signal from the bus. Messages with the same ID are transmitted at a certain cycle.

[0005] As described above, a large number of ECUs arranged in the systems of automobiles are each connected to the CAN network and operate while exchanging various messages with each other.

[0006] In this scenario, an ECU with communication capabilities with the outside of the CAN network may be illegally controlled by someone due to unauthorized external access, and may send abnormal messages (also called attack messages) to the CAN network. Such an illegally controlled ECU (also called an unauthorized ECU) can, for example, impersonate another ECU and send abnormal messages, thereby illegally controlling the vehicle. A method for detecting such so-called impersonation attacks is disclosed, for example, in Patent Document 1. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] International Publication No. 2015 / 151418 [Overview of the project] [Problems that the invention aims to solve]

[0008] However, the method disclosed in Patent Document 1 has the problem that if the time available for executing the anomaly detection process to detect abnormal messages sent to the in-vehicle network is short, the anomaly detection process will not be executed.

[0009] Therefore, this disclosure provides an anomaly determination method and an anomaly determination device that can perform effective anomaly detection processing. [Means for solving the problem]

[0010] To solve the above problems, an abnormality determination method according to one aspect of the present disclosure is an abnormality determination method for determining an abnormality in a received message, which includes a plurality of messages having periodicity, each of which includes a first field having a fixed value, and each of these plurality of messages is received as the received message; the time available for determining an abnormality in the received message is calculated; a level determined by the calculated time is obtained; and according to the level, one of the following is selected: (i) all n abnormality determinations are selected from n abnormality determinations (where n is a positive integer); (ii) k abnormality determinations are selected from the n abnormality determinations (where k is a positive integer and k ≤ n); or (iii) none of the n abnormality determinations are selected, wherein the n abnormality determinations include abnormality determinations that use the reception timing based on the periodicity or the number of received messages, and abnormality determinations that use the first field.

[0011] These comprehensive or specific embodiments may be implemented as systems, devices, methods, integrated circuits, computer programs, or non-temporary recording media such as computer-readable CD-ROMs, or as any combination of systems, devices, methods, integrated circuits, computer programs, and recording media. [Effects of the Invention]

[0012] According to one aspect of the present disclosure, an anomaly detection method, etc., can perform appropriate anomaly detection processing according to the detection processing time. [Brief explanation of the drawing]

[0013] [Figure 1] Figure 1 is a block diagram showing the overall configuration of the in-vehicle network system in Embodiment 1. [Figure 2] Figure 2 shows the format of a CAN protocol message (data frame) in Embodiment 1. [Figure 3]FIG. 3 is a block diagram showing an example of a gateway included in the in-vehicle network system according to Embodiment 1. [Figure 4] FIG. 4 is a diagram showing an example of the received ID list according to Embodiment 1. [Figure 5] FIG. 5 is a diagram showing an example of the transfer rule according to Embodiment 1. [Figure 6] FIG. 6 is a block diagram showing an example of the abnormal detection processing function group according to Embodiment 1. [Figure 7] FIG. 7 is a diagram showing an example of the relationship between the determination function and the processing time and detection performance according to Embodiment 1. [Figure 8] FIG. 8 is a diagram showing an example of the relationship between the determination function and the processing time and detection performance according to Embodiment 1. [Figure 9] FIG. 9 is a diagram showing an example of the relationship between the determination function and the processing time and detection performance according to Embodiment 1. [Figure 10] FIG. 10 is a block diagram showing an example of an ECU included in the in-vehicle network system according to Embodiment 1. [Figure 11] FIG. 11 is a flowchart showing an example of the transfer process according to Embodiment 1. [Figure 12] FIG. 12 is a flowchart showing another example of the abnormal detection process according to Embodiment ¹. [Figure 13] FIG. 13 is a flowchart showing yet another example of the abnormal detection process according to Embodiment 1. [Figure 14] FIG. 14 is a flowchart showing another example of the abnormal detection process according to Embodiment 1. [Figure 15] FIG. 15 is a flowchart showing still another example of the abnormal detection process according to Embodiment 1. [Figure 16] FIG. 16 is a flowchart showing another example of the abnormal detection process according to Embodiment 1. [Figure 17] [[ID=?]]FIG. 17 is a flowchart showing an example of the abnormal detection process including the reset process according to Embodiment 1. It should be noted that there seems to be a mistake in the original text where the ID for the description of FIG. 17 is marked as "ID=42" in the original but "ID=?" in the translation. It should be "ID=42" throughout for consistency. [Figure 18] FIG. 18 is a flowchart showing another example of the abnormality detection process including the reset process in Embodiment 1. [Figure 19] FIG. 19 is a flowchart showing yet another example of the abnormality detection process including the reset process in Embodiment 1. [Figure 20] FIG. 20 is a diagram showing an example of the reset process in the modification. [Figure 21] FIG. 21 is a block diagram showing an example of the abnormality detection function group in Embodiment 2. [Figure 22] FIG. 22 is a flowchart showing an example of the abnormality detection process in Embodiment 2. [Figure 23] FIG. 23 is a flowchart showing another example of the abnormality detection process in Embodiment 2. [Figure 24] FIG. 24 is a flowchart showing yet another example of the abnormality detection process in Embodiment 2. [Figure 25] FIG. 25 is a flowchart showing another example of the abnormality detection process in Embodiment 2. [Figure 26] FIG. 26 is a flowchart showing yet another example of the abnormality detection process in Embodiment 2. [Figure 27] FIG. 27 is a block diagram showing an example of the abnormality detection function group in Embodiment 3. [Figure 28] FIG. 28 is a block diagram showing another example of the abnormality detection function group in Embodiment 3. [Figure 29] FIG. 29 is a diagram showing an example of the non-selected information in Embodiment 3. [Figure 30] FIG. 30 is a flowchart showing an example of the abnormality detection process in Embodiment 3. [Figure 31] FIG. 31 is a flowchart showing another example of the abnormality detection process in Embodiment 3. [Figure 32] FIG. 32 is a flowchart showing an example of the non-selected information follow-up process in Embodiment 3. [Figure 33] Figure 33 is a table showing the judgment function and the selection criteria for the judgment function in the modified example. [Figure 34] Figure 34 is a flowchart showing an example of anomaly detection processing in a modified example. [Figure 35] Figure 35 is a flowchart showing another example of anomaly detection processing in a modified example. [Figure 36] Figure 36 is a block diagram showing an example of an ECU in a modified example. [Figure 37] Figure 37 is a block diagram showing another example of an ECU in a modified example. [Figure 38] Figure 38 is a block diagram showing the overall configuration of the in-vehicle network system in a modified example. [Figure 39] Figure 39 is a block diagram showing an example of a communication ECU included in an in-vehicle network system in a modified example. [Figure 40] Figure 40 is a block diagram showing an example of a server in a modified example. [Figure 41] Figure 41 is a table showing the judgment function and the selection criteria for the judgment function in the modified example. [Modes for carrying out the invention]

[0014] (Knowledge that forms the basis of this disclosure) When a function that detects the transmission of an abnormal message over a CAN network generates and outputs the detection result and related information as a log, a large amount of data is required for a detailed post-incident review of the circumstances leading to the detection of the abnormality. However, if the storage capacity of the log output destination or the amount of communication required to send the detection result to the log output destination is large, it will incur significant time and resource costs.

[0015] Therefore, an abnormality determination method according to one aspect of the present disclosure is an abnormality determination method for determining an abnormality in a received message, which includes a plurality of messages having periodicity, each of which includes a first field having a fixed value and a second field having a changing value, and each of these messages is received as the received message, and the method selects, according to one or more criteria among the time, load, data volume, or number of messages in which the abnormality determination method can be executed, which of a plurality of combinations each consisting of an abnormality determination using the reception timing based on the periodicity, or the number of received messages, an abnormality determination using the first field, and an abnormality determination using the second field, to perform the determination.

[0016] As a result, the anomaly detection method according to one aspect of this disclosure can perform appropriate anomaly detection processing according to the limited detection processing time.

[0017] Furthermore, an anomaly detection device according to one aspect of the present disclosure is an anomaly detection device in an in-vehicle network system including a network and one or more electronic control units connected to the network, and includes one or more processors and a storage unit accessible from the one or more processors, wherein the one or more processors receive from the network each of a plurality of messages, each of which has periodicity, and each of which has a first field having a fixed value and a second field having a changing value, as the received message, and selects whether the determination is made using one or more of a plurality of anomaly determinations, each of which includes receiving timing based on periodicity, anomaly determination using the number of received messages, anomaly determination using the first field, and anomaly determination using the second field, according to one or more criteria among the time, load, data amount, or number of messages in which the anomaly detection method can be executed.

[0018] As a result, the anomaly detection device according to one aspect of this disclosure can perform appropriate anomaly detection processing according to the limited detection processing time.

[0019] Furthermore, a program according to one aspect of this disclosure is a program that causes one or more processors in the above-mentioned abnormality detection device to perform the above-mentioned abnormality detection method.

[0020] This allows for appropriate anomaly detection processing to be performed according to the detection processing time.

[0021] The embodiments will be described in detail below with reference to the drawings.

[0022] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection configurations of components, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit this disclosure. Among the components in the following embodiments, components not described in the independent claim representing the highest-level concept are described as optional components.

[0023] (Embodiment 1) [1. Overview] In this embodiment, the execution of the function for determining an anomaly is appropriately controlled according to the time available for anomaly detection processing in the in-vehicle network system, and the case in which an anomaly is determined will be described in detail with reference to the drawings.

[0024] [1.1 Overall Configuration of the In-Vehicle Network System] Figure 1 is a block diagram showing the overall configuration of the in-vehicle network system in this embodiment.

[0025] In Figure 1, the in-vehicle network system 10 is composed of a CAN network and includes ECU100a, ECU100b, ECU100c, and ECU100d, buses 200a and 200b, and a gateway 300. Note that ECU100a, ECU100b, ECU100c, and ECU100d are examples of electronic control units.

[0026] In the following, ECU100a, ECU100b, ECU100c, and ECU100d may be collectively referred to as ECU100, or a subset of them without specifying which one they are.

[0027] Furthermore, in the following, bus 200a and bus 200b may be described collectively, or either one without specifying, as bus 200.

[0028] ECU100a is connected to the engine 101, ECU100b is connected to the brake 102, ECU100c is connected to the door open / close sensor 103, and ECU100d is connected to the window open / close sensor 104.

[0029] The ECU 100 acquires messages representing the status of connected devices and periodically sends messages representing the acquired status to the bus 200. For example, the ECU 100a acquires information about the rotational speed, which is one of the statuses of the engine 101, and sends a message containing a data value representing this rotational speed to the bus 200 with a predetermined ID.

[0030] Furthermore, each ECU 100 reads messages sent by other ECUs 100 from the bus 200 and selectively receives them according to the ID attached to the message. This selective reception will be described later.

[0031] Gateway 300 connects bus 200a, to which ECUs 100a and 100b are connected, and bus 200b, to which ECUs 100c and 100d are connected. Gateway 300 has the function of forwarding messages received from one bus 200 to the other bus 200. Gateway 300 is also a node on the CAN network.

[0032] The in-vehicle network system is merely an example used to explain the application of the abnormality detection method and other related processes, and is not limited to in-vehicle network systems.

[0033] [1.2 Message Data Format] Figure 2 shows the format of a CAN protocol message (data frame). Here, we see a message in the standard ID format of the CAN protocol.

[0034] A message consists of a Start Of Frame (SOF), an ID field, a Remote Transmission Request (RTR), an IDE (IDentifier Extension), a reserved bit (r), a Data Length Code (DLC), a data field, a CRC (Cycric Redundancy Check) sequence, a CRC delimiter (DEL on the left in the diagram), an ACK (Acknowledgement) slot, an ACK delimiter (DEL on the right in the diagram), and an EOF (End Of Frame).

[0035] SOF is a 1-bit dominant. Dominant means superior. In a CAN network where a digital method is used for data transmission, a dominant is the state in which voltage is applied to the two cables that make up the bus to transmit the value "0", or the value of "0" that is transmitted. In contrast, the state in which voltage is applied to the two cables that make up the bus to transmit the value of "1", or the value of "1" that is transmitted, is called recessive. Recessive means inferior. If the value of "0" and the value of "1" are transmitted to the bus simultaneously from two nodes, the value of "0" takes precedence. The bus is in a recessive state when idle. Each ECU 100 starts transmitting a message by changing the state of the bus 200 from recessive to dominant, and the other ECUs 100 read this change and synchronize. In Figure 2, the parts where the lines indicating the dominant or recessive that make up the message are solid lines indicate that they can take on either dominant or recessive values. Since SOF is fixed in a dominant state, the dominant line is a solid line, and the recessive line is a dashed line.

[0036] The ID is an 11-bit value that indicates the type of data a message contains. In CAN, when multiple nodes simultaneously initiate communication arbitration between messages, messages with smaller ID values ​​are given higher priority. The term ID is synonymous with Message ID and CAN ID.

[0037] RTR is a 1-bit dominant that indicates a frame is a message.

[0038] IDE stands for Dominant, 1-bit each. A message is also called a data frame.

[0039] DLC is a 4-bit value that indicates the length of the following data field.

[0040] The data field is a value that indicates the content of the data being transmitted, and can be up to 64 bits long, with its length adjustable in 8-bit increments. The specifications regarding the allocation of this portion of the transmitted data depend on the vehicle model or manufacturer.

[0041] The CRC sequence is a 15-bit value calculated from the transmitted values ​​of the SOF, ID field, control field, and data field.

[0042] The CRC delimiter is a 1-bit recessive fixed separator that indicates the end of the CRC sequence. The receiving node determines whether there is an anomaly by comparing the result calculated from the values ​​of the SOF, ID field, control field, and data field of the received message with the value of the CRC sequence.

[0043] The ACK slot is 1 bit long, and the transmitting node sends a recessive signal in this portion. If the receiving node has successfully received up to the CRC sequence, it sends a dominant signal as an acknowledgment. Since the dominant signal takes precedence, if the communication of one message proceeds successfully up to the CRC sequence, bus 200 is dominant while the ACK slot is being transmitted.

[0044] The ACK delimiter is fixed at 1 bit recessive and is a separator that indicates the end of an ACK slot.

[0045] The EOF (End of Message) is fixed as a 7-bit recessive message, indicating the end of the message.

[0046] [1.3 Gateway Configuration] Figure 3 is a block diagram showing an example of a gateway 300 included in the in-vehicle network system 10 in Embodiment 1. In Figure 3, the gateway 300 includes a frame transmission / reception unit 310, a frame interpretation unit 320, a reception ID determination unit 330, a reception ID list holding unit 340, a frame processing unit 350, a transfer rule holding unit 360, an anomaly detection processing function group 370, and a frame generation unit 380.

[0047] These configurations represent functional configurations, and the gateway 300 is provided as an information processing device that includes, for example, a processing unit implemented by a processor, a storage unit implemented by semiconductor memory, an input / output unit implemented by input / output ports, and so on.

[0048] The configuration exhibiting the above functions is achieved by having the processing unit read a program held in the memory unit, execute it, and record predetermined data in the memory unit. Alternatively, these configurations may be achieved by transmitting and receiving data via the input / output unit instead of recording predetermined data in the memory unit. Or, the configuration exhibiting the above functions may be achieved by a combination of these.

[0049] The frame transmission / reception unit 310 transmits and receives messages in accordance with the CAN protocol to buses 200a and 200b, respectively.

[0050] More specifically, the frame transmission / reception unit 310 reads the message sent to the bus 200 one bit at a time and forwards the read message to the frame interpretation unit 320.

[0051] Furthermore, the frame transmission / reception unit 310 sends messages to buses 200a and 200b one bit at a time, according to the bus information transmitted from the frame generation unit 380.

[0052] The frame transmission / reception unit 310 performs message transfer between buses 200 by transmitting messages received from bus 200a to bus 200b and messages received from bus 200b to bus 200a.

[0053] The frame interpretation unit 320 receives message values ​​from the frame transmission / reception unit 310, maps them to each field in the CAN protocol, and interprets the received message. The frame interpretation unit 320 then transfers the ID field value and the interpreted set of values ​​to the received ID determination unit 330.

[0054] The frame interpretation unit 320 further decides, based on the determination result sent from the received ID determination unit 330, whether to transfer the value of the message's ID field and the data fields appearing after the ID field to the frame processing unit 350, or to cancel the reception of the message.

[0055] Furthermore, if the frame interpretation unit 320 determines that the received message does not conform to the CAN protocol, it requests the frame generation unit 380 to send an error frame.

[0056] An error frame is a frame in a specific format defined by the CAN protocol, distinct from the messages described above, that is sent from a node when an error occurs on the CAN network. When an error frame is sent to the bus, message transmission on that network is interrupted.

[0057] Furthermore, if the frame interpretation unit 320 interprets that it has received an error frame sent by another node, it discards the message it is currently reading.

[0058] The reception ID determination unit 330 receives the value of the ID field from the frame interpretation unit 320 and determines whether or not to receive the read message according to the list of message IDs held by the reception ID list holding unit 340. The reception ID determination unit 330 sends the result of this determination to the frame interpretation unit 320.

[0059] The received ID list holding unit 340 holds a list of message IDs (also called the received ID list) received by the gateway 300. Figure 4 shows an example of the received ID list in Embodiment 1. Details of the received ID list in Figure 4 will be described later.

[0060] The frame processing unit 350 determines the destination bus 200 according to the ID of the received message, in accordance with the data transfer rules held by the transfer rule holding unit 360, and sends information indicating the destination bus 200, the message ID sent from the frame interpretation unit 320, and the data to be transferred to the frame generation unit 380.

[0061] The frame processing unit 350 also sends the message received from the frame interpretation unit 320 to the anomaly detection processing function group 370 and requests the anomaly detection processing function group 370 to determine whether or not the message is an abnormal message. The frame processing unit 350 does not forward the message that the anomaly detection processing function group 370 has determined to be an abnormal message.

[0062] The transfer rule holding unit 360 holds rules (hereinafter also referred to as transfer rules) for data transfer for each bus 200. Figure 5 is a diagram showing an example of a transfer rule in Embodiment 1. Details of the transfer rule in Figure 5 will be described later.

[0063] The anomaly detection processing function group 370 is a group of functions that determine whether the incoming message is an abnormal message or not. Details of the functional configuration included in the anomaly detection processing function group 370 will be described later. The anomaly detection processing function group 370 sends the determination result to the frame processing unit 350.

[0064] The frame generation unit 380 generates an error frame in response to a request from the frame interpretation unit 320 to transmit an error frame, and causes the frame transmission / reception unit 310 to send the error frame.

[0065] The frame generation unit 380 also generates a message frame using the message ID and data received from the frame processing unit 350, and sends the message frame to the frame transmission / reception unit 310 along with the bus information.

[0066] [1.4 Receiving ID List] As shown in Figure 4, the received ID list is a list of message IDs of messages that the gateway 300 receives and processes, and is held in the received ID list holding unit 340.

[0067] In Figure 4, the received ID list stores the message ID in each row. In the received ID list in Figure 4, the message IDs are "1", "2", "3", and "4", and gateway 300 receives messages with these message IDs. Gateway 300 stops receiving messages with message IDs that are not included in the received ID list.

[0068] Note that the ID values ​​and the number of IDs included in the receiving ID list are examples for illustrative purposes only and do not necessarily limit the configuration of the receiving ID list used in Gateway 300.

[0069] [1.5 Transfer Rules] The forwarding rules are stored in the forwarding rule holder 360. In Figure 5, each line of the forwarding rule stores a combination of the source bus 200 and destination bus 200 of the message, and the message ID to be forwarded.

[0070] Specifically, the first line of the forwarding rule is source "bus 200a", destination "bus 200b", and ID "*", meaning that gateway 300 will forward any message received from bus 200a to bus 200b, regardless of its ID. The second line of the forwarding rule is source "bus 200b", destination "bus 200a", and ID "3", meaning that gateway 300 will forward any message received from bus 200b to bus 200a if its ID is "3".

[0071] [1.6 Configuration of Anomaly Detection Processing Function Group] Figure 6 is a block diagram showing an example of an anomaly detection processing function group in Embodiment 1. In Figure 6, the anomaly detection processing function group 370 includes a determination function selection unit 371, a control unit 372, an anomaly detection unit 373, and a detection rule holding unit 381.

[0072] These configurations are functional configurations, and these configurations are realized in the gateway 300 by the processing unit reading and executing a program held in the memory unit, the processing unit storing predetermined data in the memory unit, or the processing unit sending and receiving data via the input / output unit, or by a combination of these.

[0073] The Judgment Function Selection Unit 371 selects which judgment function to execute from among the judgment functions provided by the Anomaly Detection Unit 373 and sends the selection to the Control Unit. The Judgment Function Selection Unit 371 calculates the time available for the Anomaly Detection Unit 373's Anomaly Detection Processing (detection processing time) and selects a judgment function that fits within that detection processing time. Figure 7 shows an example of the relationship between judgment function, processing time, and detection performance in Embodiment 1. For example, the Judgment Function Selection Unit 371 maintains the processing time and detection performance (e.g., false detection rate and detection rate) for each judgment function as shown in Figure 7, and finds a combination of judgment functions that fits within the detection processing time calculated by the Judgment Function Selection Unit 371 and selects the judgment function. At this time, if there are multiple combinations of judgment functions that fit within the detection processing time calculated by the Judgment Function Selection Unit 371, it selects the combination with the best detection performance (e.g., a combination with a low false detection rate and a high detection rate).

[0074] The control unit 372 controls the abnormality detection unit 373 to execute the function selected by the judgment function selection unit 371 from among the judgment functions provided by the abnormality detection unit 373.

[0075] The anomaly detection unit 373 includes at least seven types of determination functions. Specifically, these determination functions include a function to determine whether a DoS attack is occurring based on the amount of messages sent per unit time (the amount of messages is also called the amount of data), a function to check the ID field of a message, a function to check the data length of a message, a function to check the period (the period may be a time interval) of message transmission for each CAN ID, a function to check the frequency of message transmission for each CAN ID, and a function to check the value of the data field of a message (the value of the data field is called the data value).

[0076] The functions described above are, in order, called the DoS attack detection function, ID detection function, data length detection function, transmission cycle detection function, transmission frequency detection function, and data value detection function. Anomaly detection that uses periodic reception timing or the number of received messages is the DoS attack detection function, transmission cycle detection function, transmission frequency detection function, etc. Anomaly detection that uses fields with fixed values ​​is the ID detection function, etc. Fields with fixed values ​​such as the ID field are concrete examples of the first type of field. In addition, anomaly detection that uses fields with changing values ​​is the data length detection function and data value detection function, etc. Fields with changing values ​​such as the data field are concrete examples of the second type of field.

[0077] Furthermore, the system includes a function to recognize the vehicle's status and check it based on the judgment results of these judgment functions, the transmission cycle, frequency, data value, or the amount of change in the data value. This function is called the vehicle status judgment function. In addition, the abnormality detection unit 373 includes a comprehensive judgment function that comprehensively determines whether the message received from the frame processing unit 350 is an abnormal message based on the judgment results of these judgment functions. The result determined by the comprehensive judgment function becomes the result of the detection processing by the abnormality detection unit 373.

[0078] The detection rule holding unit 381 holds the judgment criteria necessary to execute each judgment function. The detection rule holding unit 381 holds individual judgment criteria for each CAN ID. In addition, the abnormality detection unit 373 may not execute a judgment function if no detection rule is set. The control unit 372 controls the execution of the judgment function according to the judgment criteria stored in the detection rule holding unit 381.

[0079] Furthermore, as described above, the judgment criteria held by the detection rule holding unit 381 exist for each CAN ID, and these judgment criteria differ for each judgment function. Also, the judgment function for which the judgment criteria exist differs for each CAN ID. Moreover, there may be multiple judgment criteria for a single judgment function for each CAN ID. As a result, the judgment function that the judgment function selection unit 371 prioritizes will differ for each CAN ID of the received message.

[0080] The judgment function selection unit 371 is not limited to selecting the combination of judgment functions that provides the best detection performance if there are multiple combinations of judgment functions that fit within the calculated detection processing time. For example, it is not limited to selecting a combination with a low false detection rate and a high detection rate. The judgment function selection unit 371 may select a combination of judgment functions using only one of the false detection rate or detection rate as a measure of detection performance, or it may use evaluation indicators that represent detection performance such as detection precision, F-measure, infomedness, or markedness, or a combination thereof, instead of the false detection rate or detection rate. Therefore, the judgment function selection unit 371 can select an effective combination of judgment functions according to the target system by adopting an appropriate indicator for each system.

[0081] The judgment function selection unit 371 finds a combination of judgment functions that fits within the calculated detection processing time and selects an appropriate combination from among those combinations of judgment functions, but is not limited to this. Figure 8 is a diagram showing an example of the relationship between judgment functions and processing time / detection performance in Embodiment 1. As shown in Figure 8, for example, when processing in the order of DoS attack judgment function, ID judgment function, data length judgment function, transmission cycle judgment function, data value (range) judgment function, and vehicle state judgment function, it is possible to select the range of judgment functions to be executed and the range of judgment functions not to be executed. Here, the order of processing of judgment functions is just an example and is not limited to this. The order in which the judgment functions are executed may be different, and other judgment functions may be added to the judgment functions described.

[0082] Figure 9 is a diagram illustrating an example of the relationship between the judgment function and processing time / detection performance in Embodiment 1. The judgment function selection unit 371 may pre-store the processing time and detection performance for each combination of judgment functions as shown in Figure 9, and select one of the stored combinations. This allows the anomaly detection unit 373 to process the judgment functions in an appropriate order for each system and appropriately select the judgment function to be executed. Furthermore, by pre-determining the judgment function to be selected by the judgment function selection unit 371 during the design phase, the time required for selection can be reduced.

[0083] It should be noted that the judgment function selection unit 371 finds a combination of judgment functions that fits within the calculated detection processing time and selects those judgment functions, but this is not limited to this. For example, when the anomaly detection unit 373 detects some kind of anomaly, the anomaly detection unit 373 will always select the judgment function in which the anomaly was detected, and does not need to select some or all of the judgment functions that have not detected an anomaly. If the anomaly detection unit 373 has not detected an anomaly, the anomaly detection unit 373 may select the minimum necessary judgment functions within the range that fits within the detection processing time. In this way, the anomaly detection unit 373 continues to select the judgment function in which an anomaly has been detected, so that anomalies can continue to be detected. Also, if the anomaly detection unit 373 has not detected an anomaly, the anomaly detection processing time can be shortened.

[0084] Furthermore, if the frame transmission / reception unit 310 receives messages from multiple networks connected to the gateway 300, the anomaly detection unit 373 may select a judgment function such that the anomaly detection processing time for messages transmitted on networks where anomalies would affect vehicle operation is longer than for messages transmitted on networks where anomalies would not affect vehicle operation. The anomaly detection unit 373 may also decide which judgment function to select for each message. This increases the likelihood that the anomaly detection unit 373 can secure sufficient detection processing time for important messages, making the in-vehicle network system 10 more secure.

[0085] Furthermore, the judgment function selection unit 371 may calculate the detection processing time by subtracting the transfer processing time required for transfer processing, such as determining the destination bus 200 or the process by which the frame transmission / reception unit 310 actually sends messages to each bus 200, from the permitted time (permission time) from when the gateway 300 receives a message until the transfer is completed, as the detection processing time. Alternatively, the judgment function selection unit 371 may calculate the detection processing time by subtracting the transfer time from the permission time and further subtracting any other necessary processing. This makes it possible for the in-vehicle network system 10 to execute the anomaly detection process with priority over other processing, and conversely, it is also possible to execute other processing with priority over the anomaly detection process.

[0086] Although the judgment function selection unit 371 is described as calculating the detection processing time, it is not limited to this. Alternatively, the anomaly detection processing function group 370 may have a processing time calculation unit that calculates the detection processing time, and the judgment function selection unit 371 may obtain the processing time from the processing time calculation unit and select a judgment function. Or, the anomaly detection processing function group 370 may receive the detection processing time from the frame processing unit 350 and select a judgment function based on that. This makes the calculation of processing time more efficient when functions other than the anomaly detection processing function group 370 also calculate processing time.

[0087] [1.7 ECU Configuration] Figure 10 is a block diagram showing an example of an ECU included in the in-vehicle network system in Embodiment 1. In Figure 10, the ECU 100 includes a frame transmission / reception unit 110, a frame interpretation unit 120, a reception ID determination unit 130, a reception ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180.

[0088] These configurations are functional configurations, and these configurations are realized in the gateway 300 by the processing unit reading and executing a program held in the memory unit, the processing unit storing predetermined data in the memory unit, or the processing unit sending and receiving data via the input / output unit, or by a combination of these.

[0089] The frame transmission / reception unit 110 sends and receives messages to the bus 200 in accordance with the CAN protocol.

[0090] More specifically, the frame transmission / reception unit 110 reads the message sent to the bus 200 one bit at a time and transfers the read message to the frame interpretation unit 120.

[0091] Furthermore, the frame transmission / reception unit 110 sends the message sent from the frame generation unit 180 to the bus 200.

[0092] The frame interpretation unit 120 receives a value representing the message from the frame transmission / reception unit 110, maps it to each field in the CAN protocol, and interprets the message. The frame interpretation unit 120 then transfers the interpreted series of values, which are the ID field, to the received ID determination unit 130.

[0093] The frame interpretation unit 120 further decides, based on the determination result sent from the received ID determination unit 130, whether to transfer the value of the ID field included in the message and the values ​​of the data fields appearing after the ID field to the frame processing unit 150, or to cancel the reception of the message.

[0094] Furthermore, if the frame interpretation unit 120 determines that the target message does not conform to the CAN protocol, it requests the frame generation unit 180 to send an error frame.

[0095] Furthermore, if the frame interpretation unit 120 interprets that it has received an error frame sent by another node, it discards the message it is currently reading.

[0096] The reception ID determination unit 130 receives the value of the ID field from the frame interpretation unit 120 and determines whether or not to receive the read message according to the list of message IDs held by the reception ID list holding unit 140. The reception ID determination unit 130 sends the result of this determination to the frame interpretation unit 120.

[0097] The received ID list holding unit 140 holds the received ID list received by the ECU 100. The received ID list is in the same format as shown in Figure 4, so its explanation is omitted here.

[0098] The frame processing unit 150 performs processing according to the data of the received message. The content of the processing differs for each ECU 100.

[0099] For example, ECU100a, when it receives a message indicating that a door is open while the vehicle's speed exceeds 30 km / h, executes the process to sound an alarm. ECU100c, when it receives a message indicating that the brakes are not applied and the door is opened, executes the process to sound an alarm.

[0100] These processes are just examples for illustrative purposes, and the ECU 100 may perform processes other than those described above. The frame processing unit 150 causes the frame generation unit 180 to generate a frame to be sent out in order to perform such processes.

[0101] The data acquisition unit 170 acquires output data indicating the status of equipment connected to the ECU 100 or measured values ​​from sensors, and transfers the acquired output data to the frame generation unit 180.

[0102] The frame generation unit 180, in response to the frame interpretation unit 120's request for error frame transmission, constructs an error frame and sends it to the frame transmission / reception unit 110.

[0103] The frame generation unit 180 also generates a message frame by assigning a predetermined message ID to the data value received from the data acquisition unit 170, and sends the generated message frame to the frame transmission / reception unit 110.

[0104] [1.8 Transfer Process] Figure 11 is a flowchart illustrating an example of the transfer process in Embodiment 1. Since the transfer process performed by Gateway 300 is common regardless of the transfer direction, here we will explain an example where Gateway 300 transfers a message received from bus 200a to bus 200b.

[0105] First, the frame transmission / reception unit 310 reads a message from the bus 200a (step S1001). The frame transmission / reception unit 310 then sends the data of each field of the read message to the frame interpretation unit 320.

[0106] Next, the frame interpretation unit 120 works in conjunction with the received ID determination unit 130 to determine whether or not the message to be processed is the message in question based on the value of the ID field (message ID) of the read message (step S1002).

[0107] If the frame interpretation unit 120 determines that the read message is not a message to be processed (No in step S1002), the message will not be forwarded.

[0108] If the frame interpretation unit 120 determines that the read message is a message to be processed (Yes in step S1002), the frame interpretation unit 120 transfers the values ​​of each field in the message to the frame processing unit 350. Then, the frame processing unit 350 determines the destination bus according to the transfer rules stored in the transfer rule holding unit 360 (step S1003).

[0109] The frame processing unit 350 sends the values ​​of each field in the message received from the frame interpretation unit 320 to the anomaly detection processing function group 370 and requests a determination as to whether or not it is an abnormal message. The anomaly detection processing function group 370 determines whether or not the sent message is an abnormal message based on the values ​​of each field in the sent message and sends the result of that determination to the frame processing unit 350 (step S1004).

[0110] If the anomaly detection processing function group 370 determines that the message is an abnormal message (Yes in step S1005), the message will not be forwarded.

[0111] If the anomaly detection processing function group 370 determines that the message is a normal message and not an abnormal message (No in step S1005), the frame processing unit 350 requests the frame generation unit 380 to forward the message to the destination bus determined in step S1003.

[0112] The frame generation unit 380 receives a request from the frame processing unit 350, generates a message to be received by the specified transfer destination, and sends the message to the frame transmission / reception unit 310 (step S1006).

[0113] In the example above, the determination of whether the received message is abnormal (step S1004) is made after determining the destination of the received message (step S1003), but this is not limited to this. The determination of whether the received message is abnormal may be made after determining whether the received message is abnormal. Furthermore, the determination of the destination of the received message and the determination of whether the message is abnormal may be performed in parallel.

[0114] [1.9 Anomaly Detection Processing] Figure 12 is a flowchart showing another example of the anomaly detection process in Embodiment 1.

[0115] First, the anomaly detection processing function group 370 receives a request for anomaly detection processing from the frame processing unit 350 and calculates the time available for anomaly detection processing (step S1101). Here, the time available for anomaly detection processing is called the detection processing time. The detection processing time is calculated according to the amount of messages sent to the network, the amount of data contained in the messages, or the number of destinations for message forwarding, etc.

[0116] Next, the determination function selection unit 371 determines whether the calculated detection processing time is shorter than the time required for the detection processing (step S1102).

[0117] If the determination function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 selects a determination function to execute the processing (step S1103).

[0118] Next, the judgment function selection unit 371 sends information regarding the selected judgment function to the control unit 372.

[0119] Next, the control unit 372 controls each judgment function so that only the function selected by the judgment function selection unit 371 in step S1103 is executed, and the abnormality detection unit 373 executes the abnormality detection process (step S1104).

[0120] If the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the control unit 372 controls each determination function of the abnormality detection unit 373 to execute all the detection processing that should be performed.

[0121] Furthermore, if the judgment function selection unit 371 individually selects the judgment function to be executed, the processing performed in the step of executing the abnormality detection process in Figure 12 (step S1104) becomes the processing performed in steps S1110 to S1119 in Figure 13. Figure 13 is a flowchart showing yet another example of the abnormality detection process in Embodiment 1. Also, the processing performed in step S1103, in which the judgment function to be executed by the judgment function selection unit 371 in Figure 12 is selected, becomes the processing performed in step S1105 in Figure 13.

[0122] If the judgment function selection unit 371 determines that the calculated detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the judgment function selection unit 371 selects a judgment function that can be executed within the detection processing time (step S1105). The judgment function selection unit 371 then sends information regarding the selected judgment function to the control unit 372.

[0123] If the determination function selection unit 371 determines that the calculated detection processing time is longer than the time required for the detection processing (No in step S1102), step S1110, which is described below, is performed.

[0124] The control unit 372 determines whether the determination function selection unit 371 has selected the DoS attack determination function (step S1110).

[0125] If the control unit 372 determines that the DoS attack determination function has been selected by the determination function selection unit 371 (if the answer is Yes in step S1110), the control unit 372 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0126] If the control unit 372 determines that the DoS attack detection function is not selected (i.e., No in step S1110), the control unit 372 does not execute the DoS attack detection function of the anomaly detection unit 373.

[0127] Next, the control unit 372 determines whether the determination function selection unit 371 has selected the ID determination function (step S1112).

[0128] If the control unit 372 determines that the ID determination function has been selected by the determination function selection unit 371 (if the answer is Yes in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0129] If the control unit 372 determines that the ID determination function has not been selected by the determination function selection unit 371 (i.e., No in step S1112), the control unit 372 will not execute the ID determination function of the abnormality detection unit 373.

[0130] Next, the control unit 372 determines whether the determination function selection unit 371 has selected the data length determination function (step S1114).

[0131] If the control unit 372 determines that the data length determination function has been selected by the determination function selection unit 371 (if the answer is Yes in step S1114), the control unit 372 executes the data length determination function of the anomaly detection unit 373 (step S1115).

[0132] If the control unit 372 determines that the data length determination function has not been selected by the determination function selection unit 371 (i.e., No in step S1114), the control unit 372 does not execute the data length determination function of the abnormality detection unit 373.

[0133] The control unit 372 determines whether the determination function selection unit 371 has selected the transmission cycle determination function (step S1116).

[0134] If the control unit 372 determines that the transmission cycle determination function has been selected by the determination function selection unit 371 (if the answer is Yes in step S1116), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0135] If the control unit 372 determines that the transmission cycle determination function has not been selected by the determination function selection unit 371 (i.e., No in step S1116), the control unit 372 does not execute the transmission cycle determination function of the abnormality detection unit 373.

[0136] The control unit 372 determines whether the determination function selection unit 371 has selected the data value determination function (step S1118).

[0137] If the control unit 372 determines that the data value determination function has been selected by the determination function selection unit 371 (if the answer is Yes in step S1118), the control unit 372 executes the data value determination function of the anomaly detection unit 373 (step S1119).

[0138] If the control unit 372 determines that the data value determination function has not been selected by the determination function selection unit 371 (i.e., No in step S1118), the control unit 372 does not execute the data value determination function of the abnormality detection unit 373.

[0139] Here, anomaly detection processing related to five determination functions—DoS attack determination, ID determination, data length determination, transmission cycle determination, and data value determination—has been described. However, the anomaly detection processing may also include anomaly detection processing related to transmission frequency determination and vehicle status determination. Furthermore, the anomaly detection processing may include several combinations of the above determination functions, or other determination processes not described. For example, the control unit 372 may determine whether the determination function selection unit 371 has selected each determination function, and the control unit 372 may control the execution of the determination function according to the determination result. This allows for flexible control of the determination function to be executed.

[0140] Furthermore, when selecting the range of judgment functions to be executed and the range of judgment functions not to be executed by the judgment function selection unit 371, the processing performed in step (S1104) of executing the abnormality detection process in Figure 12 becomes the processing shown in Figure 14. Also, the processing performed in step S1103 of selecting a function by the judgment function selection unit 371 in Figure 12 becomes the processing performed in step S1106 in Figure 14.

[0141] Figure 14 is a flowchart showing another example of the anomaly detection process in Embodiment 1. If the determination function selection unit 371 determines that the detection processing time is shorter than the time required for the detection processing (Yes in step S1102), the determination function selection unit 371 determines the determination functions that can be executed within the detection processing time and selects the determination function at the time when the anomaly detection process is terminated (step S1106).

[0142] The judgment function selection unit 371 then sends a message to the control unit 372.

[0143] If the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), step S1120, which is described below, is performed.

[0144] The control unit 372 determines whether the determination function selection unit 371 has chosen to terminate processing before the DoS attack determination function is executed (step S1120).

[0145] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate processing before the DoS attack determination function (if the result is No in step S1120), the control unit 372 executes the DoS attack determination function of the anomaly detection unit 373 (S1111).

[0146] If the control unit 372 determines that the determination function selection unit 371 has selected to terminate processing before the DoS attack determination function (i.e., if the answer is Yes in step S1120), the control unit 372 terminates the anomaly detection process.

[0147] Next, the control unit 372 determines whether the determination function selection unit 371 has chosen to terminate processing before the ID determination function (step S1112).

[0148] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate processing before the ID determination function (No in step S1112), the control unit 372 executes the ID determination function of the abnormality detection unit 373 (step S1113).

[0149] If the control unit 372 determines that the determination function selection unit 371 has selected to terminate the process before the ID determination function (Yes in step S1112), the control unit 372 terminates the abnormality detection process.

[0150] Next, the control unit 372 determines whether the determination function selection unit 371 has selected to terminate processing before the data length determination function (step S1122).

[0151] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate processing before the data length determination function (No in step S1122), the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0152] If the control unit 372 determines that the option to terminate processing before the data length determination function is selected (Yes in step S1122), the control unit 372 terminates the abnormality detection process.

[0153] Then, the control unit 372 determines whether the determination function selection unit 371 has selected to terminate processing before the transmission cycle determination function (step S1123).

[0154] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate processing before the transmission cycle determination function (No in step S1123), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0155] If the control unit 372 determines that the determination function selection unit 371 has selected to terminate the process before the transmission cycle determination function (Yes in step S1123), the control unit 372 terminates the abnormality detection process.

[0156] Next, the control unit 372 determines whether the determination function selection unit 371 has selected to terminate processing before the data value determination function (step S1124).

[0157] If the control unit 372 determines that the determination function selection unit 371 has selected not to terminate processing before the data value determination function (No in step S1124), the control unit 372 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0158] If the control unit 372 determines that the determination function selection unit 371 has selected to terminate the process before the data value determination function (Yes in step S1124), the control unit 372 terminates the abnormality detection process.

[0159] Here, anomaly detection processing related to five judgment functions—DoS attack detection, ID detection, data length detection, transmission cycle detection, and data value detection—has been described. However, the processing described in Figure 14 may also include anomaly detection processing related to transmission frequency detection and vehicle status detection. Furthermore, the processing described in Figure 14 may be a combination of some of the judgment functions described above, or it may include other judgment functions. The processing described in Figure 14 may include processing in which the control unit 372 determines whether the judgment function selection unit 371 has selected a range of judgment functions to be executed and a range of judgment functions not to be executed, and the control unit 372 controls the execution of the judgment functions according to the determination result. This eliminates the need to check whether each judgment function is selected or not, and processing time can be reduced.

[0160] If the judgment function selection unit 371 only selects whether or not to execute the transmission cycle judgment function and the data value judgment function, the step of executing the abnormality detection process shown in Figure 12 (step S1104) becomes the process shown in Figure 15.

[0161] Figure 15 is a flowchart showing yet another example of the anomaly detection process in Embodiment 1. Furthermore, the process performed in step S1103, in which the judgment function selection unit 371 shown in Figure 12 selects a judgment function, becomes the process performed in step S1107 shown in Figure 15.

[0162] The determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for abnormality detection processing by the transmission cycle determination function and the data value determination function (step S1102).

[0163] If the determination function selection unit 371 determines that the detection processing time is shorter than the required time (Yes in step S1102), the determination function selection unit 371 does not select the transmission cycle determination function or the data value determination function (step S1107).

[0164] If the determination function selection unit 371 determines that the detection processing time is longer than the required time (No in step S1102), then step S1111, which will be described next, is performed.

[0165] The control unit 372 executes the processing of the DoS attack detection function (step S1111).

[0166] Then, the control unit 372 executes the processing of the ID determination function (step S1113).

[0167] Next, the control unit 372 performs the data length determination function (step S1115).

[0168] Subsequently, the control unit 372 determines whether the determination function selection unit 371 has selected the transmission cycle determination function or the data value determination function (step S1130).

[0169] If the control unit 372 determines that the transmission cycle determination function and the data value determination function have been selected by the determination function selection unit 371 (Yes in step S1130), the control unit 372 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0170] Next, the control unit 372 performs a data value determination function (step S1119).

[0171] If the control unit 372 determines that the transmission cycle determination function and the data value determination function have not been selected by the determination function selection unit 371 (No in step S1130), the control unit 372 will not execute the transmission cycle determination function and the data value determination function of the abnormality detection unit 373.

[0172] Here, anomaly detection processing related to five judgment functions—DoS attack detection, ID detection, data length detection, transmission cycle detection, and data value detection—has been described. However, the processing described in Figure 15 may also include anomaly detection processing related to transmission frequency detection and vehicle status detection. The processing described in Figure 15 may be a combination of some of the judgment processing described above, or it may include other judgment functions. The processing described in Figure 15 does not only select whether or not to execute the transmission cycle detection function and the data value detection function, but the control unit 372 may also determine whether or not the judgment function selection unit 371 has selected a combination of some functions of each judgment function, and the control unit 372 may control the execution of the judgment function according to the result of that determination. This makes it possible to determine in advance the combination of processing to be executed during the design phase, and to check all at once whether or not a judgment function has been selected, thus shortening the processing time.

[0173] Figure 16 is a flowchart showing another example of the anomaly detection process in Embodiment 1.

[0174] Furthermore, if the determination function selection unit 371 not only selects whether or not to execute the transmission cycle determination function and the data value determination function, but also selects not to execute any determination functions, then the processes performed in steps S1108 and S1109, as shown in Figure 16, are added between the processes performed in step S1107 and step S1131, as shown in Figure 15.

[0175] Next, the determination function selection unit 371 determines whether the detection processing time calculated in step S1101 is longer than the time required for anomaly detection processing by the DoS attack determination function, the ID determination function, and the data length determination function (step S1108).

[0176] If the judgment function selection unit 371 determines that the detection processing time is shorter than the required time described above, the judgment function selection unit 371 does not select any judgment functions (step S1109).

[0177] Next, the control unit 372 determines whether the determination function selection unit 371 has selected all determination functions (step S1131). In other words, the control unit 372 determines whether the determination function selection unit 371 has not selected the DoS attack determination function, the ID determination function, or the data length determination function.

[0178] If the control unit 372 determines that the determination function selection unit 371 has selected the DoS attack determination function, the ID determination function, and the data length determination function (Yes in step S1131), the control unit 372 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0179] Subsequently, the control unit 372 executes the ID determination function of the anomaly detection unit 373 (step S1113).

[0180] Then, the control unit 372 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0181] The subsequent processing related to the transmission period determination function and the data value determination function is the same as the processing described in Figure 15, so the explanation will be omitted.

[0182] If the control unit 372 determines that the DoS attack determination function, ID determination function, and data length determination function have not been selected by the determination function selection unit 371 (No in step S1131), the control unit 372 will not execute any of the determination functions of the anomaly detection unit 373.

[0183] Here, the anomaly detection processing related to the five determination functions—DoS attack determination, ID determination, data length determination, transmission cycle determination, and data value determination—is described as the process explained in Figure 16. However, the process explained in Figure 16 may also include anomaly detection processing related to transmission frequency determination and vehicle status determination. Furthermore, the process explained in Figure 16 may be a combination of several of the above determination processes, or may include other determination functions. The process explained in Figure 16 is described by dividing it into a process to determine whether the DoS attack determination function, ID determination function, and data length determination function have been selected, and a process to select whether or not to execute only the transmission cycle determination function and data value determination function, but it is not limited to this. The process explained in Figure 16 is a process in which the control unit 372 determines that the determination function selection unit 371 has selected all determination functions, and the control unit 372 controls the execution of the determination functions according to the determination result. As a result, the anomaly detection method in this embodiment can perform anomaly detection even when there is no time to perform anomaly detection processing.

[0184] The abnormality detection processing between the judgment function selection unit 371 and the control unit 372 is not limited to the above, and may be performed in any combination described above.

[0185] Furthermore, while the determination function selection unit 371 selects a determination function to perform processing if it determines that the detection processing time is shorter than the time required for the detection process (step S1102), it is not limited to this. If the determination function selection unit 371 selects a determination function to perform processing without performing the determination process in step S1102, and the detection processing time is longer than the time required for the detection process, it may select all determination functions. This simplifies the processing performed by the determination function selection unit 371.

[0186] When the control unit 372 executes each judgment function, it refers to the detection rules set for each CAN ID. The control unit 372 then controls the system to execute the judgment function that has been selected by the judgment function selection unit 371 and is described in the detection rules. In other words, even if a judgment function is selected by the judgment function selection unit 371, it will not be executed if it is not described in the detection rules. Furthermore, if the detection processing time calculated in step S1102 is determined to be longer than the time required for the detection processing, the control unit 372 assumes that all judgment functions have been selected by the judgment function selection unit 371 and executes the functions described in the detection rules.

[0187] [1.10 Reset Process] In the anomaly detection process, depending on the type of judgment function that was not selected when the judgment function selection unit 371 selected a function to be executed, the next time one of the judgment functions is executed, the judgment result may be different from the normal result. For example, the transmission cycle judgment function assumes that the in-vehicle network system 10 periodically receives messages, and records the reception time (referred to as the previous reception time) when the message was received last time, and determines whether the message received this time is an abnormal message based on the difference between the previous reception time and the current reception time.

[0188] If, at this time, the transmission cycle determination function is not selected by the determination function selection unit 371 even though the message was received normally, the reception time of the previous message cannot be recorded. As a result, the reception time of the message two messages prior will be compared with the current reception time, which may prevent a correct determination. In particular, if the transmission cycle determination function is not selected consecutively, the interval during which the reception time cannot be recorded becomes longer, increasing the likelihood of an incorrect determination. Similar concerns apply to the data value determination function when determining whether a message is normal or abnormal based on the change in the previous data value and the current data value.

[0189] Therefore, if a certain judgment function is not selected by the judgment function selection unit 371 and the process is skipped, it is necessary to perform a reset process on that judgment function before executing it again to prevent unexpected judgment results. In particular, for functions that make judgments by comparing the previous value with the current value, such as the transmission cycle judgment function or the data value judgment function that determines the amount of change in data, or functions that perform cumulative calculations, such as the transmission frequency judgment function, if they are not selected by the judgment function selection unit 371 and the process is skipped, it is necessary to perform a reset process in advance to clear the previous value or the cumulative value.

[0190] Figure 17 is a flowchart showing an example of an anomaly detection process including a reset process in Embodiment 1. Figure 18 is a flowchart showing another example of an anomaly detection process including a reset process in Embodiment 1, and Figure 19 is a flowchart showing yet another example of an anomaly detection process including a reset process in Embodiment 1. The flowcharts are in which a reset process is added to the anomaly detection process shown in Figure 15, where the determination function selection unit 371 only selects whether or not to execute the transmission cycle determination function and the data value determination function. Therefore, the explanation of processes other than the reset process that are the same as in Figure 15 is omitted.

[0191] First, the determination function selection unit 371 checks a flag indicating that the transmission cycle determination function and the data value determination function processing were skipped, thereby determining whether the previous processing was skipped (step S1140).

[0192] If the determination function selection unit 371 determines that the previous process was skipped (Yes in step S1140), the determination function selection unit 371 requests the control unit 372 to perform a reset process for the transmission period determination function and the data value determination function.

[0193] Then, the control unit 372, upon receiving a request from the determination function selection unit 371, executes a reset process for the transmission cycle determination function (step S1141).

[0194] Next, the control unit 372 performs a reset process for the data value determination function (step S1142).

[0195] Furthermore, after steps S1101 and S1102, the determination function selection unit 371, in step S1107, performs the process of not selecting the transmission period determination function and the data value determination function, and then sets a flag indicating that the processing of the transmission period determination function and the data value determination function was skipped (step S1143). Here, the flag indicating that the processing of the transmission period determination function and the data value determination function was skipped is set for each CAN ID.

[0196] For the reset process, for example, the previously stored value may be cleared, and then the value at which the judgment function is first executed may be stored as the previous value. Alternatively, after clearing the previously stored value, the message that the judgment function, which does not have a previous value, first determines to be a normal message may be stored as the previous value. Here, if the previous value is stored for each CAN ID, the previous value will be stored when the judgment function is first executed upon receiving a message with the same CAN ID as when the previous value was cleared, or when the judgment function, which does not have a previous value for a message with the same CAN ID as when the previous value was cleared, first determines that the received message is a normal message. Furthermore, instead of using a message with the same CAN ID, a message with a different CAN ID may be used as a basis for deciding whether to store the previous value.

[0197] For example, you could determine whether to store the previous value based on a message with the correct Message Authentication Code (MAC), or you could determine whether to store the previous value based on another message with a different CAN ID that has a similar or identical transmission cycle.

[0198] Figure 20 shows an example of a reset process in a modified example. Figure 20 shows an example of messages with different CAN IDs but the same transmission period. For example, in the abnormality detection method according to this disclosure, if the load ratio falls below a threshold immediately before time T2, and messages ID1, ID2, and ID3 are received at approximately the same time, the reception times of messages ID1, ID2, and ID3 are stored as the previous values. In addition, in the abnormality detection method according to this disclosure, the stored cumulative values ​​may be initialized, or the held vehicle state may be initialized. This makes it possible to perform a more accurate determination by the determination function after the reset process.

[0199] In the abnormality detection method described herein, reset processing is performed on the transmission cycle detection function and the data value detection function. However, this is not limited to these, and reset processing may also be performed on other detection functions that have the previous value, or on transmission frequency detection functions or vehicle status detection functions that store cumulative values ​​or vehicle status. Furthermore, the reset processing does not have to be performed at the timing shown in Figure 17, but may be performed at the timing shown in Figures 18 and 19, for example.

[0200] Furthermore, the processes shown in Figures 17 to 19 have a reset process added to the flowchart shown in Figure 15, but are not limited to this. A reset process may also be added to the flowcharts of other anomaly detection processes (for example, the flowcharts shown in Figures 12 to 14, Figure 16, and Figure 21 onwards). In addition, the timing at which the reset process is executed may be changed for each CAN ID. This makes it possible for the anomaly determination method in the embodiments of this disclosure to execute the reset process at an appropriate timing according to the stored information.

[0201] It should be noted that the determination function selection unit 371 sets a flag indicating that processing has been skipped when it does not select either the transmission cycle determination function or the data value determination function, but this is not the only limitation. For example, the determination function selection unit 371 also refers to the detection rules set for each CAN ID, and if a determination function not selected by the determination function selection unit 371 is not executed as a detection rule, it does not need to set a flag indicating that processing has been skipped, or even if a flag indicating that processing has been skipped is set, it does not need to execute the reset process during the reset process. This reduces unnecessary reset processes, shortens processing time, or prevents a decrease in detection performance due to reset processes.

[0202] [1.11 Effects] In this embodiment, the anomaly detection processing function group 370 selects a judgment function to be executed according to the available time for anomaly detection processing (detection processing time), thereby selecting a combination of judgment functions that can achieve a large anomaly detection effect in proportion to the detection processing time, even when the detection processing time is short. Furthermore, by performing a reset process on some or all of the judgment functions, the negative effects caused by not executing the judgment function can be mitigated, thereby further improving the anomaly detection performance.

[0203] (Embodiment 2) [2. Overview] In Embodiment 1, in the anomaly detection processing function group 370, the judgment function selection unit 371 selected the judgment function to be processed, and the control unit 372 controlled the execution of each judgment function according to the selection result of the judgment function selection unit 371. In this embodiment, the case in which the control unit 372 determines which judgment function to execute according to the detection processing time in an in-vehicle network system will be described with reference to the drawings.

[0204] [2.1 Configuration of Anomaly Detection Processing Function Group] Figure 21 is a block diagram showing an example of an anomaly detection processing function group in Embodiment 2. In Figure 21, the anomaly detection processing function group 370 includes a control unit 374 and an anomaly detection unit 373. Note that the same components as in Embodiment 1 will not be described.

[0205] These configurations are functional and are realized by the processing unit reading and executing a program held in the memory unit of the gateway 300, storing predetermined data in the memory unit, or sending and receiving data via the input / output unit, or a combination of these processes.

[0206] The control unit 374 determines which of the judgment functions provided by the anomaly detection unit 373 can be executed within the detection processing time, and controls the execution of the judgment function. The control unit 374 calculates the time available for the anomaly detection processing of the anomaly detection unit 373 (detection processing time), and controls the execution of the judgment function so that it fits within that detection processing time.

[0207] For example, the control unit 374, similar to the judgment function selection unit 371 in Embodiment 1, stores data on the processing time for each judgment function and the detection performance (e.g., false detection rate and detection rate) as shown in Figure 7. It then determines the combination of judgment functions that fits within the calculated detection processing time and controls the system to execute only that judgment function. If there are multiple combinations of judgment functions that fit within the calculated detection processing time, the control unit 374 executes the combination of judgment functions with the best detection performance (e.g., a combination with a low false detection rate and a high detection rate).

[0208] It should be noted that while the control unit 374 is said to calculate the detection processing time, it is not limited to this. The anomaly detection processing function group 370 has a processing time calculation unit that calculates the detection processing time, and the control unit 374 may obtain the processing time from the processing time calculation unit and select a judgment function, or the anomaly detection processing function group 370 may obtain information regarding the detection processing time from the frame processing unit 350 and select a judgment function to execute based on that. As a result, the control unit 374 only needs to manage the processing time related to the anomaly detection processing, so the anomaly detection processing can be loosely coupled with other functions and the influence of other functions on the anomaly detection processing can be suppressed.

[0209] [2.2 Anomaly Detection Processing] Figure 22 is a flowchart showing an example of anomaly detection processing in Embodiment 2.

[0210] First, the anomaly detection processing function group 370 receives a request for anomaly detection processing from the frame processing unit 350 and calculates the time available for anomaly detection processing (detection processing time) (step S1101).

[0211] Next, the control unit 374 determines whether the detection processing time calculated in step S1101 is longer than the time required for the detection processing to be performed (step S1200).

[0212] If the control unit 374 determines in step S1200 that the detection processing time is longer than the time required for the detection processing to be performed (Yes in step S1200), the control unit 374 executes the abnormality detection processing (step S1104).

[0213] Furthermore, when the determination function executed by the control unit 374 is individually controlled, the step of executing the abnormality detection process shown in Figure 22 (step S1104) becomes the process shown in Figure 23. Figure 23 is a flowchart showing another example of the abnormality detection process in Embodiment 2, and Figure 24 is a flowchart showing yet another example of the abnormality detection process in Embodiment 2.

[0214] After calculating the detection processing time in step S1101, the control unit 374 determines whether there is time to execute the DoS attack determination function (step S1210).

[0215] If the control unit 374 determines that there is time to execute the DoS attack detection function (Yes in step S1210), the control unit 374 executes the DoS attack detection function of the anomaly detection unit 373 (S1111).

[0216] If the control unit 374 determines that there is not enough time to execute the DoS attack detection function (No in step S1210), the control unit 374 will not execute the DoS attack detection function of the anomaly detection unit 373.

[0217] Next, the control unit 374 determines whether there is enough time to perform the ID determination function in the remaining detection processing time after the DoS attack determination function has been executed (step S1211).

[0218] If the control unit 374 determines that there is time to perform the ID determination function (Yes in step S1211), the control unit 374 performs the ID determination function of the anomaly detection unit 373 (S1113).

[0219] If the control unit 374 determines that there is not enough time to perform the ID determination function (No in step S1211), the control unit 374 will not perform the ID determination function of the anomaly detection unit 373.

[0220] Next, the control unit 374 determines whether there is enough time to perform the data length determination function based on the remaining detection processing time after the ID determination function has been executed (step S1212).

[0221] If the control unit 374 determines that there is time to perform the data length determination function (Yes in step S1212), the control unit 374 performs the data length determination function of the anomaly detection unit 373 (S1115).

[0222] If the control unit 374 determines that there is not enough time to perform the data length determination function (No in step S1212), the control unit 374 does not perform the data length determination function of the anomaly detection unit 373.

[0223] Then, the control unit 374 determines whether there is time to perform the transmission cycle determination function based on the remaining detection processing time after the data length determination function has been executed (step S1213).

[0224] If the control unit 374 determines that there is time to perform the transmission cycle determination function (Yes in step S1213), the control unit 374 performs the transmission cycle determination function of the abnormality detection unit 373 (S1117).

[0225] If the control unit 374 determines that there is not enough time to perform the transmission cycle determination function (No in step S1213), the control unit 374 will not perform the transmission cycle determination function of the abnormality detection unit 373.

[0226] Next, the control unit 374 determines whether there is time to perform the data value determination function based on the remaining detection processing time after the transmission period determination function has been executed (step S1214).

[0227] If the control unit 374 determines that there is time to perform the data value determination function (Yes in step S1214), the control unit 374 performs the data value determination function of the anomaly detection unit 373 (S1119).

[0228] If the control unit 374 determines that there is not enough time to execute the data value determination function (No in step S1214), the control unit 374 does not execute the data value determination function of the anomaly detection unit 373. As a result, the anomaly determination method according to this disclosure can flexibly control the selection of the determination function to be executed.

[0229] Furthermore, when determining the range of the judgment function to be executed by the control unit 374, the processing of the flowchart shown in Figure 14 in Embodiment 1 becomes the processing of the flowchart shown in Figure 24. This eliminates the need to check whether each judgment function is selected or not, thereby reducing the processing time for confirmation.

[0230] Furthermore, if the control unit 374 only determines whether or not to execute the transmission period determination function and the data value determination function, the processing in the flowchart shown in Figure 15 in Embodiment 1 becomes the processing in the flowchart shown in Figure 25. Figure 25 is a flowchart showing another example of the anomaly detection processing in Embodiment 2.

[0231] First, the anomaly detection processing function group 370 receives a request for anomaly detection processing from the frame processing unit 350 and calculates the time available for anomaly detection processing (step S1101).

[0232] Next, the control unit 374 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0233] Next, the control unit 374 executes the ID determination function of the anomaly detection unit 373 (step S1113).

[0234] Then, the control unit 374 executes the data length determination function of the abnormality detection unit 373 (step S1115).

[0235] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be performed (step S1230).

[0236] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be performed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0237] Then, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be performed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0238] If the control unit 374 determines that the detection processing time is shorter than the time required for the processing to be performed (No in step S1230), the control unit 374 terminates its operation.

[0239] This allows for a reduction in processing time by enabling a combination of processes to be determined in advance during the design phase, etc., allowing for a simultaneous confirmation of whether or not the judgment function is selected. Furthermore, if the control unit 374 determines not only whether or not to execute the transmission cycle judgment function and the data value judgment function, but also whether or not to execute any judgment functions, the processing in the flowchart shown in Figure 16 in Embodiment 1 becomes the processing in the flowchart shown in Figure 26. Figure 26 is a flowchart showing yet another example of the anomaly detection processing in Embodiment 2. This allows the anomaly determination method according to this disclosure to also address situations where there is no time to perform the anomaly detection processing.

[0240] First, the anomaly detection processing function group 370 receives a request for anomaly detection processing from the frame processing unit 350 and calculates the time available for anomaly detection processing (step S1101).

[0241] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the minimum processing that the control unit 374 performs (step S1231).

[0242] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing that the control unit 374 must perform (Yes in step S1231), the control unit 374 executes the DoS attack determination function of the anomaly detection unit 373 (step S1111).

[0243] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing that the control unit 374 must perform (Yes in step S1231), the control unit 374 executes the ID determination function of the anomaly detection unit 373 (step S1113).

[0244] Then, if the control unit 374 determines that the detection processing time is longer than the time required for the minimum processing that the control unit 374 must perform (Yes in step S1231), the control unit 374 executes the data length determination function of the anomaly detection unit 373 (step S1115).

[0245] Next, the control unit 374 determines whether the detection processing time is longer than the time required for the processing to be performed (step S1230).

[0246] Next, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be performed (Yes in step S1230), the control unit 374 executes the transmission cycle determination function of the abnormality detection unit 373 (step S1117).

[0247] Then, if the control unit 374 determines that the detection processing time is longer than the time required for the processing to be performed (Yes in step S1230), the control unit 374 executes the data value determination function of the abnormality detection unit 373 (step S1119).

[0248] If the control unit 374 determines that the detection processing time is shorter than the time required for the minimum processing that the control unit 374 must perform (No in step S1231), the control unit 374 terminates its operation.

[0249] Furthermore, if the control unit 374 determines that the detection processing time is shorter than the time required for the processing to be performed (No in step S1230), the control unit 374 terminates its operation.

[0250] In addition, while the anomaly detection processing related to the five determination functions of DoS attack detection, ID detection, data length detection, transmission cycle detection, and data value detection has been described, the anomaly detection method relating to this disclosure may further include anomaly detection processing related to transmission frequency detection and vehicle status detection. Furthermore, the anomaly detection method relating to this disclosure may include several combinations of the above processes, or may include other determination functions.

[0251] The abnormality detection processing performed by the control unit 374 is not limited to the above, and may be a combination of the above.

[0252] Furthermore, the processing related to the DoS attack detection function, ID detection function, data length detection function, transmission cycle detection function, and data value detection function shown in Figures 13 to 19 and Figures 23 to 26 may be performed in a different order for each message ID.

[0253] [2.3 Reset Process] In the anomaly detection process, when the control unit 374 determines whether or not to execute each judgment function, if a judgment function was not executed, the next time that judgment function is executed, an unusual judgment result may be obtained. Therefore, as in Embodiment 1, a reset process needs to be performed for judgment functions that the control unit 374 has determined not to execute.

[0254] In Embodiment 1, when the determination function selection unit 371 performs the process of selecting a determination function, a flag indicating that the process was skipped is set. In Embodiment 2, when the control unit 374 determines that each determination function should not be executed, a flag indicating that the process was skipped needs to be set. The determination by the control unit 374 to determine whether or not to perform a reset process in response to the flag indicating that the process was skipped is the same as the process shown in Figures 17 to 19 of Embodiment 1, so no explanation is provided.

[0255] [2.4 Effects] In this embodiment, the abnormality detection processing function group 370 can accurately reflect the execution time of each determination function in determining whether to execute the determination function by determining whether to execute the determination function immediately before the execution of each determination function, and can execute a combination of determination functions that can exert a great abnormality detection effect.

[0256] (Embodiment 3) [3. Overview] In Embodiment 1, in the abnormality detection processing function group 370, the determination function selection unit 371 selects the determination function to perform the processing, and the control unit 372 controls the execution of each determination function according to the selection result of the determination function selection unit 371. In this embodiment, in the in-vehicle network system, when the determination function is not executed, the message at that time is saved, and when there is a margin in the detection processing time, the abnormality detection processing for the message is described while referring to the drawings for the case of executing it later.

[0257] [3.1 Configuration of Abnormality Detection Processing Function Group] FIG. 27 is a block diagram showing an example of the abnormality detection processing function group in Embodiment 3. In FIG. 27, the abnormality detection processing function group 370 includes a determination function selection unit 371, an abnormality detection unit 373, a non-selection information holding unit 375, and a control unit 376. Alternatively, as shown in FIG. 28, it may have a configuration that does not include the determination function selection unit 371 as in Embodiment 2 and includes an abnormality detection unit 373, a non-selection information holding unit 375, and a control unit 377. FIG. 28 is a block diagram showing another example of the abnormality detection processing function group in Embodiment 3. Note that the description of the same components as in Embodiment  1 is omitted.

[0258] Note that these configurations are configurations showing functions, and are realized by the processing unit reading and executing a program stored in the storage unit in the gateway 300, holding predetermined data in the storage unit, or executing data transmission and reception via the input / output unit, or executing a combination of these.

[0259] When some of the determination functions of the abnormality detection unit 373 are not executed, the non-selection information holding unit 375 transmits and holds the information of the received message. Further, the non-selection information holding unit 375 transmits the held message to the control unit 376 in response to a request from the control unit 376.

[0260] In addition to the functions of the control unit 372 in the first embodiment, when there is a determination function that was not selected in past processing, and a message is held in the non-selection information holding unit 375, and it can be determined that there is time to execute the abnormality detection process for the message, the control unit 376 acquires the message from the non-selection information holding unit 375 and executes the abnormality detection process for the message.

[0261] Note that the control unit 377 has the same functions as the control unit 376, except that it has the functions of the control unit 374 in the second embodiment instead of the functions of the control unit 372 in the first embodiment.

[0262] Note that when some of the determination functions of the abnormality detection unit 373 are not executed, the non-selection information holding unit 375 not only holds the received message, but also holds information regarding the determination function that was not executed, for example, as shown in FIG. 28. When the control unit 376 or the control unit 377 executes the abnormality detection process, the abnormality detection process may be executed only for the determination function that was not executed. FIG. 29 is a diagram showing an example of non-selection information in the third embodiment. Thereby, in the abnormality determination method according to the present disclosure, it is possible to execute only the necessary determination functions, so that the processing time can be shortened.

[0263] [3.2 Abnormality Detection Process] Figure 30 is a flowchart showing an example of the anomaly detection process in Embodiment 3, and Figure 31 is a flowchart showing another example of the anomaly detection process in Embodiment 3. In the anomaly detection process in Embodiment 1 shown in Figure 12, if a certain judgment function is not executed, the message received at that time is saved (step S1300). Then, if there is sufficient time for detection processing, the anomaly detection process for that message is executed later (step S1302). Here, the explanation of the same process as shown in Figure 12 is omitted.

[0264] The judgment function selection unit 371, after selecting a judgment function to be performed because the detection processing time is shorter than the time required for the judgment processing that should be performed (after step S1103), requests the non-selected information storage unit 375 to save information related to the message. The non-selected information storage unit 375 saves the information related to the message in response to the request from the judgment function selection unit 371 (step S1300).

[0265] Subsequently, the control unit 376 performs an anomaly detection process, queries the non-selected information holding unit 375 to determine whether or not there is non-selected information, and determines whether or not there is non-selected information (step S1301).

[0266] If the control unit 376 determines that there is non-selection information (Yes in step S1301), the control unit 376 performs non-selection information follow-up processing (step S1302). The non-selection information follow-up processing will be described later.

[0267] If the control unit 376 determines that there is no non-selected information (No in step S1301), the control unit 376 terminates the abnormality detection process.

[0268] Furthermore, if a message with the same CAN ID as the message (received message) for which anomaly detection processing is requested by the frame processing unit 350 is stored in the non-selected information storage unit 375, and some judgment functions use the previous value, the anomaly detection processing may not be performed correctly. For this reason, if a message with the same CAN ID as the received message is stored in the non-selected information storage unit 375, the judgment function selection unit 371 may not select a judgment function that uses the previous value, and may perform anomaly detection processing by all judgment functions after the non-selected information follow-up processing for the message with the same CAN ID as the received message has been completed.

[0269] The above process is shown in Figure 31.

[0270] If the determination function selection unit 371 determines that the detection processing time is longer than the time required for the detection processing (No in step S1102), the determination function selection unit 371 determines whether or not a message with the same CAN ID as the received message is held in the non-selected information holding unit 375 (step S1310).

[0271] If the determination function selection unit 371 determines that a message with the same CAN ID as the received message is stored in the non-selected information storage unit 375 (Yes in step S1310), the determination function selection unit 371 selects only the determination functions for which the previous value is not required (step S1311).

[0272] Then, the judgment function selection unit 371 will skip some judgment functions and save the non-selected information (step S1300).

[0273] If the determination function selection unit 371 determines that no message with the same CAN ID as the received message is stored in the non-selected information storage unit 375 (No in step S1310), the control unit 376 executes an anomaly detection process (step S1104). As a result, when the non-selected information follow-up process is completed, the state of each determination function becomes the same as if the determination function selection process had not been performed, eliminating the need for a reset process.

[0274] [3.3 Post-processing of non-selected information] Figure 32 is a flowchart showing an example of the non-selection information follow-up processing in Embodiment 3. The non-selection information follow-up processing described above is explained in Figure 32.

[0275] First, the control unit 376 calculates the time available for anomaly detection processing for messages included in the non-selected information (detection processing time) (step S1320).

[0276] Next, the control unit 376 acquires one non-selected information from the non-selected information holding unit 375 (step S1321).

[0277] Next, the control unit 376 calculates the time required for abnormal detection processing of the message included in the acquired non-selected information and determines whether it is shorter than the detection processing time (step S1322).

[0278] If the control unit 376 determines that the time required for anomaly detection processing of the messages included in the acquired non-selected information is shorter than the detection processing time and that there is sufficient time (Yes in step S1322), the control unit 376 executes anomaly detection processing for the messages included in the non-selected information (step S1323).

[0279] Then, return to step S1320.

[0280] When the control unit 376 determines that the time required for the abnormality detection process of the message included in the acquired non-selected information is longer than the detection process time and there is no time margin (No in step S1322), the control unit 376 returns the non-selected information to the non-selected information holding unit 375 (step S1324).

[0281] Here, the control unit 376 ends the non-selected information follow-up process.

[0282] When performing the abnormality detection process on the message included in the non-selected information in step S1323, the control unit 376 may execute only the determination functions not selected in the previously performed abnormality detection process. At this time, in the determination of whether there is a time margin in step S1322, it is determined whether there is a margin with respect to the time required to perform the processing of the determination functions not selected in the previously performed abnormality detection process. Thereby, in the abnormality determination method according to the present disclosure, since only the necessary determination functions can be executed, the processing time can be shortened.

[0283] [3.4 Effects] In the present embodiment, when the determination function is not executed, the abnormality detection processing function group 370 stores the message received at that time, and when there is a margin in the detection processing time, the abnormality detection process for the message is executed later. Thereby, the abnormality detection processing function group 370 can not only make a determination that can exhibit the maximum abnormality detection effect while satisfying the time constraint at the time of message reception, but also execute the abnormality detection process by the determination function as originally planned although the timing is delayed. Thereby, in the abnormality determination method and the like according to the present disclosure, the abnormality detection performance does not deteriorate and the processing time constraint is satisfied.

[0284] [4. Other Variants] This disclosure is not limited to the embodiments described above. Furthermore, modifications to the embodiments that a person skilled in the art could conceive of, as long as they do not depart from the spirit of this disclosure, and forms that combine components from different embodiments are also included within the scope of this disclosure. For example, the following modifications are also included within this disclosure.

[0285] (1) In the above embodiment, the anomaly detection processing function group 370 calculates the time available for anomaly detection processing (detection processing time) and determines whether or not to select a judgment function to be executed in the anomaly detection processing, or which judgment function to select, depending on whether or not the detection processing time is longer than the time required for the detection processing that should be executed. However, the disclosure is not limited thereto. For example, the decision of whether or not to select a judgment function to be executed in the anomaly detection processing, or which judgment function to select, may be determined from the load rate, data volume, or message volume of the in-vehicle network system 10. Here, the load rate is the ratio of the amount of data or messages transmitted per unit time to the maximum amount of data or messages that can be transmitted to the in-vehicle network.

[0286] Figure 33 is a table showing the judgment function and selection conditions for the judgment function in a modified example. Figure 34 is a flowchart showing an example of anomaly detection processing in a modified example. For example, Figure 34 shows an example of a judgment function selected according to the load rate. The judgment function selection unit 371 may determine the judgment function to select based on the information described in Figure 33, instead of the information of Embodiment 1 described in Figure 7.

[0287] For example, if a load rate of 60% or higher is defined as a high load, then in the anomaly detection process shown in Figure 34, the determination function selection unit 371 determines that the load rate calculated in step S1400 is 60% or higher, and this is considered a "high load" (step S1401).

[0288] Next, the determination function selection unit 371 selects a determination function to perform based on the information shown in Figure 33 (step S1402).

[0289] Next, the control unit 374 performs abnormality detection processing (step S1104).

[0290] Furthermore, if the judgment function selection unit 371 does not determine that the load is "high" (No in step S1401), the control unit 374 executes an abnormality detection process (step S1104).

[0291] Figure 35 is a flowchart showing another example of anomaly detection processing in a modified example. The processing performed is the same, except that the load rate shown in Figure 34 is used as the message volume. Also, although not shown, the same applies when the judgment function selection unit 371 determines which judgment function to select according to the amount of data.

[0292] Furthermore, instead of selecting a judgment function only when the load is high, the state determined by the load percentage may be defined in three stages: "high load," "medium load," and "low load," and the judgment function selected by the judgment function selection unit 371 may be determined based on which stage is being used. Alternatively, the judgment function selected by the judgment function selection unit 371 may be determined based on a combination of these stages, such as "high load," "high load" + "medium load," or "full load." In addition, the state determined by the load percentage may be defined in two or four or more stages, rather than three.

[0293] Furthermore, metrics other than load factor, data volume, or message volume may be used, and when calculating load factor, data volume, or message volume, they may be calculated from the entire in-vehicle network. Also, for example, in the case of gateway 300, values ​​related to metrics such as load factor, data volume, or message volume may be calculated for messages forwarded by gateway 300, or values ​​related to metrics such as load factor, data volume, or message volume may be calculated for messages input to gateway 300.

[0294] The anomaly detection processing function group 370 may receive the load rate, data volume, or message volume from the frame processing unit 350 and select a judgment function and control the execution of the judgment function based on this information. Alternatively, the load rate, data volume, and message volume may be received not with each message reception, but only when there is a change in the stage. In this case, if the anomaly detection processing function group 370 does not receive the load rate, data volume, or message volume from the frame processing unit 350, it will determine that these values ​​were the same as the previous time.

[0295] Furthermore, the determination function selection unit 371 may select a determination function based on the vehicle's status, such as whether the vehicle is stopped, moving, traveling at high speed, traveling at a constant speed, in autonomous driving mode, whether autonomous driving has started, whether autonomous driving has ended, whether the driver assistance function is operating, whether the driver assistance function has started, or whether the driver assistance function has ended, and the control unit 377 may control the execution of the determination function.

[0296] The judgment function selection unit 371 may select a judgment function based on the judgment function used in the detection rule set for each CAN ID, the detection processing time, load rate, data volume, and message volume, and the control unit 377 may control the execution of the judgment function. In other words, the judgment function selection unit 371 or the control units 374 and 377 select a judgment function from the combination of functions used in the detection rule.

[0297] The judgment function selection unit 371 determined the judgment function to select based on the information shown in Figure 33, but is not limited to this. For example, the judgment function selection unit 371 may determine the judgment function to select based on a combination of judgment functions and selection conditions, as shown in Figure 41.

[0298] Figure 35 is a flowchart showing another example of anomaly detection processing in a modified example.

[0299] First, the control unit 374 calculates the message volume (step S1410).

[0300] Next, the control unit 374 determines whether the message volume is large or not (step S1411).

[0301] If the control unit 374 determines that the message volume is greater than a predetermined value (Yes in step S1411), the control unit 374 selects a determination function to perform (step S1412).

[0302] Then, the control unit 374 performs abnormality detection processing (step S1104).

[0303] Furthermore, if the control unit 374 determines that the message volume is less than a predetermined value (No in step S1411), the control unit 374 executes an anomaly detection process (step S1104).

[0304] As a result, the anomaly detection method described herein allows for the selection of a detection function using other indicators such as load rate, data volume, and message volume, even when it is difficult to calculate the detection processing time or when the detection processing time cannot be uniquely determined.

[0305] (2) In the above embodiment, the ECU 100 was described as comprising a frame transmission / reception unit 110, a frame interpretation unit 120, a received ID determination unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180. However, the configuration of the ECU in the in-vehicle network system in this disclosure is not limited to this.

[0306] Figure 36 is a block diagram showing an example of an ECU in a modified example. In Figure 36, the ECU 100f consists of a frame transmission / reception unit 110, a frame interpretation unit 120, a frame generation unit 180, and an anomaly detection processing function group 370. The frame interpretation unit 120 may, for example, receive all messages regardless of ID and request the anomaly detection processing function group 370 to determine whether all messages are abnormal.

[0307] Furthermore, in addition to the configuration shown in Figure 36, the ECU 100f may also include a reception ID determination unit 130 and a reception ID list holding unit 140. The ECU 100f may receive only messages whose message IDs are listed in the reception ID list held by the reception ID list holding unit, and request the abnormality detection processing function group 370 to determine whether or not a message is abnormal.

[0308] Furthermore, the ECU100g may also be equipped with an external communication unit 390.

[0309] This allows not only the gateway but also the ECU to analyze whether a message being sent to the in-vehicle network is an abnormal message. As a result, for example, the functionality for detecting anomalies in the in-vehicle network system is improved, and a higher level of security is ensured.

[0310] Figure 37 is a block diagram showing another example of an ECU in a modified example. The ECU 100g shown in Figure 37 may include a transmission data acquisition unit 171 that acquires data to be transmitted to the bus 200 from other connected devices or external sources, and an anomaly detection processing function group 370g. The anomaly detection processing function group 370g of the ECU 100g may also determine whether the data received from the transmission data acquisition unit 171 is an abnormal message, and only if it determines that the received data is not an abnormal message, it may request the frame generation unit 180 to transmit the message.

[0311] Furthermore, the ECU100g may also be equipped with an external communication unit 390.

[0312] As a result, the anomaly detection method, etc., described herein can, for example, suppress the spread of an abnormal message to the in-vehicle network including the ECU 100g when an abnormal message is transmitted from a car navigation system that has been illegally manipulated from the outside. Furthermore, the anomaly detection method, etc., described herein can suppress the intrusion of abnormal messages attempted to be transmitted from outside the vehicle into the in-vehicle network system.

[0313] (3) In the above embodiment, the determination function selection unit 371 uses one criterion to determine which determination function to select or which determination function to execute, but it is not limited to this. For example, the determination function selection unit 371 may use different criteria for each CAN ID. Also, if multiple buses are connected to the gateway 300 or ECU, the determination function selection unit 371 may use different criteria for each of the multiple buses. Furthermore, the determination function selection unit 371 may use different criteria for each state of the vehicle, such as whether the vehicle is stopped, moving, driving at high speed, driving at a constant speed, driving autonomously, whether autonomous driving has started, whether autonomous driving has ended, whether the driver assistance function is operating, whether the driver assistance function has started, or whether the driver assistance function has ended.

[0314] Furthermore, if there are criteria for each CAN ID, the judgment function selection unit 371 may choose not to select a judgment function for important CAN IDs and select a judgment function for unimportant CAN IDs. The judgment function selection unit 371 may also change the selected judgment function according to its importance level.

[0315] As a result, the anomaly detection method and other related methods described herein can be controlled more flexibly, enabling optimal execution in various systems and situations.

[0316] (4) In the above embodiment, the anomaly detection processing function group 370 returns a determination result to the frame processing unit 350, but it is not limited to this, and information about the selected determination function or information about the executed determination function may be returned together with the determination result.

[0317] This allows the frame processing unit 350, etc., which called the anomaly detection processing function group 370, to confirm the accuracy of the judgment result of the anomaly detection processing function group 370.

[0318] (5) In the embodiments described above, an in-vehicle network was shown as an example of a network communication system that communicates in accordance with the CAN protocol. The technology relating to this disclosure is not limited to use in in-vehicle networks, but may also be used in networks of robots, industrial equipment, and other network communication systems that communicate in accordance with the CAN protocol other than in-vehicle networks.

[0319] Furthermore, while the CAN protocol was used as the in-vehicle network, it is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc., may be used. Alternatively, these networks may be combined as subnetworks.

[0320] For example, in the case of Ethernet, the determination function selection unit 371 selects a determination function from functions such as a DoS attack determination function, a source address determination function, a destination address determination function, a protocol determination function, a source port number determination function, a destination port number determination function, or a data value determination function. Alternatively, the determination function selection unit 371 may select one or more determination functions from the above multiple determination functions as the determination function to be executed by the control unit 377. In network standards other than Ethernet, the same processing as in the case of CAN or Ethernet is performed for functions that determine header information or payload values.

[0321] (6) The gateway 300 in the above embodiment includes a first processing unit and a second processing unit, and the first processing unit may process the functions of the determination function selection unit 371 of the anomaly detection processing function group 370, while the second processing unit may process the functions of the control unit 372 and the anomaly detection unit 373. At this time, the result selected by the determination function selection unit 371 is sent from the first processing unit to the second processing unit. Then, in the second processing unit, the control unit 372 may control the determination function of the anomaly detection unit 373 according to the selection result sent from the determination function selection unit 371.

[0322] The gateway 300 may also include a third processing unit, a fourth processing unit, and a fifth processing unit. The third processing unit includes a processing time calculation unit that calculates the detection processing time performed by the judgment function selection unit 371, and the detection processing time calculated by the processing time calculation unit is sent to the fourth processing unit. In the fourth processing unit, the judgment function selection unit 371 selects a judgment function according to the detection processing time, and the selected result is sent to the fifth processing unit. In the fifth processing unit, the control unit 372 may control the judgment function of the abnormality detection unit 373 according to the sent selection result.

[0323] Furthermore, the first processing unit may include a judgment function selection unit 371, a control unit 372, and an anomaly detection unit 373, and the second processing unit may also include a control unit 372 and an anomaly detection unit 373. In the first processing unit, when the judgment function selection unit 371 performs an anomaly detection process using the anomaly detection unit 373 of the first processing unit, it may select a judgment function that was not selected by the judgment function selection unit 371 and send it to the second processing unit, and the control unit 372 and anomaly detection unit 373 of the second processing unit perform the anomaly detection process, thereby performing the anomaly detection process that was originally desired.

[0324] Furthermore, within the gateway 300, not only are the processing units divided and present, but the gateway 300 may also have a second processing unit and a fifth processing unit, while other ECUs may have a first processing unit, a third processing unit, and a fourth processing unit. Also, Figure 38 is a block diagram showing the overall configuration of the in-vehicle network system in a modified example, and Figure 39 is a block diagram showing an example of a communication ECU included in the in-vehicle network system in a modified example. As shown in Figure 37, the in-vehicle network system includes a communication ECU 100e, which communicates with the server 500 via an external network 400, and the communication ECU 100e may include an external communication unit 390 as shown in Figure 39, which sends messages received from the in-vehicle network, the results of anomaly detection processing by the anomaly detection processing function group 370, and information regarding the executed judgment function to the server 500.

[0325] Figure 40 is a block diagram showing an example of a server in a modified example, and Figure 41 is a table showing the judgment function and the selection conditions for the judgment function in the modified example. As shown in Figure 40, the server 500 includes a receiving unit 510, a message holding unit 520, and a processing unit 530, and the first processing unit and the fourth processing unit described above may be the processing unit 530. The processing unit 530 also includes a display unit and an input unit, which display detection processing time, load rate, data volume, message volume, or vehicle status, and the operator may select a judgment function to execute from the displayed information or information obtained from elsewhere, and input the selection result via the input unit.

[0326] The input results are sent from the server 500 to the control unit 372, and the control unit 372 may control the judgment function of the anomaly detection unit 373 according to the input results. Furthermore, if the server 500 determines from the information regarding the judgment function executed by the anomaly detection unit 373 that a judgment function that should have been executed has not been executed, the processing unit 530 of the server 500 may perform anomaly detection processing for that message.

[0327] As a result, the in-vehicle network system of this disclosure can be implemented with a flexible configuration, allowing for a configuration that takes into account various system constraints.

[0328] (7) Specifically, each device in the above embodiment is a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, and mouse. A computer program is stored in the RAM or hard disk unit. Each device achieves its function by operating the microprocessor in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate commands to the computer in order to achieve a predetermined function.

[0329] (8) Some or all of the components constituting each device in the above embodiments may be made up of a single system LSI (Large Scale Integration). The system LSI is a multi-functional LSI manufactured by integrating multiple components onto a single chip, and specifically, it is a computer system comprising a microprocessor, ROM, and RAM. A computer program is stored in the RAM. The system LSI achieves its function by operating the microprocessor according to the computer program.

[0330] Furthermore, each component of the above-mentioned device may be individually integrated into a single chip, or some or all of the components may be integrated into a single chip.

[0331] Furthermore, while it is stated here that some or all of the components constituting each device in the embodiment are realized by a system LSI, they may also be referred to as IC, LSI, super LSI, or ultra LSI depending on the degree of integration. In addition, the method of integrated circuit implementation is not limited to LSI, but may also be implemented using dedicated circuits or general-purpose processors. An FPGA (Field Programmable Gate Array) that can be programmed after LSI manufacturing, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells inside the LSI, may also be used.

[0332] Furthermore, if advances in semiconductor technology, or derivative technologies, lead to the emergence of integrated circuit technologies that can replace LSIs, then naturally, those technologies may be used to integrate functional blocks. Potential alternatives to LSIs in integrated circuit technology include the application of biotechnology.

[0333] (9) Some or all of the components constituting each of the above devices may consist of a removable IC card or a standalone module. The IC card or module is a computer system consisting of a microprocessor, ROM, or RAM, etc. The IC card or module may include the above-mentioned multi-functional LSI. The IC card or module achieves its function by the operation of the microprocessor in accordance with a computer program. The IC card or module may be tamper-resistant.

[0334] (10) The disclosure may be a computer program that implements the methods described above using a computer, or it may be a digital signal consisting of a computer program.

[0335] Furthermore, this disclosure may also refer to a computer program or digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray® Disc), or semiconductor memory. Alternatively, it may refer to a digital signal recorded on such a recording medium.

[0336] Furthermore, this disclosure may also describe transmitting computer programs or digital signals via telecommunications lines, wireless or wired communication lines, networks such as the Internet, or data broadcasting, etc.

[0337] Furthermore, this disclosure may also describe a computer system comprising a microprocessor and memory, wherein the memory stores the computer program, and the microprocessor operates in accordance with the computer program.

[0338] Alternatively, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, and implemented by another independent computer system.

[0339] (11) The above embodiments and the above modified examples may be combined.

[0340] The above describes, based on embodiments and modified examples, the technology for determining messages used as criteria for detecting malicious communications aimed at malicious control using malicious messages in one or more in-vehicle networks.

[0341] In each of these embodiments and its variations, the message used as a criterion for detecting malicious communication is determined by a gateway or ECU connected to and communicating with the in-vehicle network system, or a combination thereof with a server computer.

[0342] In this disclosure, a system including one or more processors and memory units that performs such malicious communication detection is referred to as a malicious communication detection criteria determination system.

[0343] Therefore, the system for determining the criteria for detecting unauthorized communications includes systems implemented by a single device, such as a single gateway connected to an in-vehicle network system, as well as systems implemented by multiple devices, such as a combination of such a gateway and an ECU, or a combination of a gateway or ECU and a remote server computer.

[0344] Furthermore, this technology can be implemented in each of the above embodiments or its modifications as a method that includes some or all of the processing steps performed by each component, or as a program executed by the processor of the malicious communication detection criteria determination system to cause the malicious communication detection criteria determination system to perform this method.

[0345] Furthermore, in the above embodiment or its modified form, a process performed by a specific component may be performed by another component instead. Also, the order of multiple processes may be changed, or multiple processes may be executed in parallel.

[0346] The above anomaly detection method may be performed by an anomaly detection device comprising one or more processors and a storage unit accessible from those one or more processors. This anomaly detection device may be a gateway 300 or a server 500, or may be included in them.

[0347] [Effects, etc.] An anomaly detection method in this disclosure is an anomaly detection method for determining an anomaly in a received message, and receives as a received message each of a plurality of periodic messages, each having a first field containing a fixed value and a second field containing a changing value, and selects, according to one or more criteria among the time, load, data volume, or number of messages in which the anomaly detection method can be executed, which of a plurality of combinations each consisting of one or more of the following: an anomaly detection using the reception timing based on the periodicity or the number of received messages, an anomaly detection using the field with a fixed value, and an anomaly detection using the field with a changing value.

[0348] As a result, the anomaly detection method described in this disclosure can proceed with processing while selecting the anomaly detection to be performed within a limited time. Therefore, the anomaly detection method described in this disclosure can effectively detect anomalies in received messages.

[0349] Furthermore, the abnormality determination method in this disclosure may be performed using the selected combination of the abnormality determinations.

[0350] As a result, the anomaly detection method described herein can effectively determine anomalies in received messages within a limited time by executing a pre-selected combination of anomaly detection methods.

[0351] Furthermore, if, when the abnormality determination method described herein is performed, the abnormality determination using the previous information among the multiple abnormality determinations has not been performed, the previous information used for the abnormality determination using the previous information may be reset when the abnormality determination method is performed again.

[0352] As a result, the anomaly detection method according to this disclosure can avoid a situation where, after an anomaly detection has been skipped, the same anomaly detection is performed again, but because normal data was not recorded due to the skipping of the anomaly detection, a normal detection is not performed when the same anomaly detection is performed again. Therefore, the anomaly detection method according to this disclosure can effectively detect anomalies in received messages.

[0353] Furthermore, the abnormality detection method according to this disclosure may use information from a different type of received message received immediately before the network load rate for receiving the received message falls below a predetermined threshold, as replacement information for the previously reset information.

[0354] As a result, the anomaly detection method relating to this disclosure can avoid a situation where, after an anomaly detection has been skipped, the same anomaly detection process cannot be performed when the same anomaly detection is attempted again, because normal data was not recorded due to the skipping of the anomaly detection. In other words, in the above case, the anomaly detection method relating to this disclosure can perform the same anomaly detection process as the skipped anomaly detection process by using information from a received message with a different ID that was received immediately before.

[0355] Furthermore, if there is sufficient time after the selected determination process has been executed to execute the abnormality determination method described herein, the abnormality determination that was not selected may be executed.

[0356] As a result, the anomaly detection method described herein can perform a greater number of anomaly detections. Therefore, the anomaly detection method described herein can more effectively detect anomalies in received messages.

[0357] An anomaly detection device according to this disclosure is an anomaly detection device in an in-vehicle network system including a network and one or more electronic control units connected to the network, comprising one or more processors and a storage unit accessible from the one or more processors, wherein the one or more processors receive from the network a plurality of messages including a plurality of periodic messages, each of which includes a first field having a fixed value and a second field having a changing value, as a received message, and selects whether to perform a determination using one or more of a plurality of anomaly determinations, each consisting of one or more of a plurality of anomaly determinations including a reception timing based on the periodicity, an anomaly determination using the number of received messages, an anomaly determination using the first field, and an anomaly determination using the second field, according to one or more criteria among the time, load, data amount, or number of messages for which the anomaly detection method performed by the anomaly detection device can be executed.

[0358] As a result, the anomaly detection device described herein can achieve the same effects as the anomaly detection method described above.

[0359] Furthermore, the program relating to this disclosure may be a program that causes a computer to perform the anomaly detection method relating to this disclosure.

[0360] As a result, the program relating to this disclosure can achieve the same effect as the anomaly detection method described above.

[0361] Furthermore, if it is determined that the time during which the abnormality determination method can be executed is shorter than a predetermined time, the abnormality determination method described herein may execute one or more combinations of abnormality determinations from among the reception timing based on periodicity, abnormality determination using the number of received messages, abnormality determination using the first field, or abnormality determination using the second field, which have a lower false detection rate and a higher detection rate than a predetermined standard.

[0362] As a result, the anomaly detection method described herein can more effectively determine anomalies in received messages.

[0363] Furthermore, if the time during which the abnormality determination method can be executed is determined to be shorter than a predetermined time, the abnormality determination using the reception timing based on periodicity, the abnormality determination using the number of received messages, and the abnormality determination using the second field may be omitted.

[0364] As a result, the anomaly detection method described herein can more effectively determine anomalies in received messages within a limited time by performing anomaly detection only on fields that have changing values.

[0365] The anomaly detection method according to this disclosure may, if it is determined that the time during which the anomaly detection method can be executed is shorter than a predetermined time, choose to terminate processing before any of the anomaly detection methods, such as the reception timing based on periodicity, the number of received messages, the first field, or the second field. This allows the anomaly detection method according to this disclosure to more effectively determine anomalies in received messages within a limited time.

[0366] If the time during which the abnormality determination method can be executed is determined to be shorter than a predetermined time, the abnormality determination method described herein may store in memory information regarding abnormality determinations that have been determined not to be executed, or information regarding messages for which abnormality determinations that have been determined not to be executed are to be performed, among abnormality determinations using the reception timing based on periodicity, or the number of received messages, or abnormality determinations using a field whose value is fixed, or abnormality determinations using a field whose value changes.

[0367] This allows the anomaly detection method described herein to perform anomaly detection that was initially decided not to be performed, depending on the circumstances. As a result, the anomaly detection method described herein can more effectively determine anomalies in received messages. [Industrial applicability]

[0368] The anomaly detection methods described herein can be used for detecting anomalies in messages within in-vehicle networks. Furthermore, the anomaly detection methods described herein can perform appropriate anomaly detection processing according to the detection processing time available for anomaly detection processing. As a result, the anomaly detection methods described herein can accurately identify normal messages even at times when anomaly detection processing could not be performed conventionally, thereby protecting the network. [Explanation of symbols]

[0369] 10. In-vehicle network systems 100, 100a, 100b, 100c, 100d, 100e, 100f, 100g ECU 101 Engine 102 Brake 103 Door Open / Close Sensor 104 Window Open / Close Sensor 110 Frame transmission / reception unit 120 Frame Interpretation Unit 130 Receiving ID Determination Unit 140 Receiving ID List Holding Unit 150 Frame Processing Unit 170 Data Acquisition Unit 171 Data Acquisition Unit 180, 380 frame generation unit 200, 200a, 200b buses 300 Gateways 310 Frame transmission and reception unit 320 Frame Interpretation Unit 330 Receiving ID determination unit 340 Receiving ID List Holding Unit 350 Frame Processing Unit 360 Transfer Rule Holding Unit 370 Anomaly detection processing function group 371 Judgment Function Selection Unit 372, 374, 376, 377 Control Unit 373 Anomaly detection unit 375 Non-selected information holding unit 381 Detection Rule Holding Unit 390 External Communications Department 400 External Network 500 servers 510 Receiver 520 Message storage unit 530 Processing Unit

Claims

1. An anomaly detection method for determining anomalies in received messages, A plurality of messages having periodicity, each of which contains a first field having a fixed value, is received as the received message. The time available for determining anomalies in the received message is calculated, and a level determined by the calculated time is obtained. Depending on the aforementioned level, (i) Select all n anomaly detections from n anomaly detections (where n is a positive integer). (ii) Select k abnormality judgments (where k is a positive integer and k ≤ n) from the n abnormality judgments. (iii) None of the n abnormality judgments are selected. Select one of them, The n anomaly determinations include an anomaly determination that uses the reception timing based on the periodicity or the number of received messages, and an anomaly determination that uses the first field. Abnormality determination method.

2. The aforementioned level is defined in at least three stages. The abnormality determination method according to claim 1.

3. Anomaly detection using the reception timing based on the aforementioned periodicity, or the number of received messages, includes DoS attack detection. An abnormality determination method according to claim 1 or 2.

4. The k abnormality detections include a DoS attack detection, An abnormality determination method according to claim 1 or 2.

5. The aforementioned k abnormality detections consist solely of DoS attack detection. An abnormality determination method according to claim 1 or 2.

6. Furthermore, if the k anomaly detections are selected, the selected anomaly detections will be notified. An abnormality determination method according to claim 1 or 2.

7. If the calculated time is longer than the time required to process all of the n anomaly detections, select all n anomaly detections. An abnormality determination method according to claim 1 or 2.

8. Execute the selected anomaly detection. An abnormality determination method according to claim 1 or 2.

9. If there is time remaining for another anomaly determination after the k anomaly determinations have been performed, the anomaly determinations that were not selected will be executed. The abnormality determination method according to claim 8.

10. If, among the n anomaly detections, the anomaly detection using the previous information was not performed, the previous information used in the anomaly detection using the previous information is reset when the anomaly detection for the next received message is performed. An abnormality determination method according to any one of claims 1 to 9.

11. When the network load rate for receiving the aforementioned received message falls below a predetermined threshold, the information of the previously received message of a different type is used as replacement information for the reset previous information. The abnormality determination method according to claim 10.

12. An anomaly detection device in an in-vehicle network system including a network and one or more electronic control units connected to the network, One or more processors, A storage unit accessible from one or more processors, The aforementioned one or more processors are: From the aforementioned network, a plurality of messages, each containing a first field having a fixed value, is received as a received message. The time available for determining anomalies in the received message is calculated, and a level determined by the calculated time is obtained. Depending on the aforementioned level, (i) Select all n anomaly detections from n anomaly detections (where n is a positive integer). (ii) Select k abnormality judgments (where k is a positive integer and k ≤ n) from the n abnormality judgments. (iii) None of the n abnormality judgments are selected. Select one of them, The n anomaly determinations include an anomaly determination that uses the reception timing based on the periodicity or the number of received messages, and an anomaly determination that uses the first field. Abnormality determination device.

13. A program for causing a computer to perform the abnormality detection method described in any one of claims 1 to 11.

Images