Anomaly frame detection device, anomaly frame detection method, and anomaly frame detection program

Abstract

To provide a device and the like that determine which data frame among a plurality of data frames is an abnormal frame.SOLUTION: An abnormal frame determination device that is connected to an ECU transmitting a data frame at a predetermined period includes: a reception unit 101 that receives a first data frame that is estimated to be transmitted from the ECU; a reception interval calculation unit 104 that calculates a reception interval between the first data frame and a second data frame which is received by the reception unit immediately before the first data frame; a storage unit 106 that stores a determination value used for detecting an abnormal frame; a determination value update unit 107 that adds a predetermined value to the determination value when the reception interval is shorter than a threshold; and an abnormal frame determination unit 110 that when the determination value reaches a limit value and the reception interval is longer than a proximity reception interval that is a reference for determining whether the first data frame and the second data frame are received in proximity, determines that the second data frame is an abnormal frame.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a device for determining abnormal data frames from data frames transmitted from an electronic control device, as well as a method and program executed by said device. [Background technology]

[0002] Traditionally, automobiles have been equipped with various types of electronic control devices, and these devices are interconnected via a communication network to form an in-vehicle system. In such in-vehicle systems, it is known that network-based intrusion detection systems (NIDS) are used to detect any suspicious access or data from external sources.

[0003] For example, Patent Document 1 discloses a communication system that can determine whether a message being communicated in a communication system is valid or invalid with a simple configuration. In this communication system, multiple ECUs are connected to a communication bus to enable message communication. Each ECU has a predetermined communication interval set, and the ECU that sends a message sends the message based on this predetermined communication interval. If the communication interval of a received message is shorter than the predetermined communication interval, the message is determined to be invalid.

[0004] Patent Document 2 discloses a relay connection unit that relays messages transmitted and received between electronic control units. This relay connection unit counts the number of times a message is received within a predetermined set time, and determines that the message is not normal if the number of received messages exceeds the set number. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] International Publication No. 2013 / 094072 [Patent Document 2] Japanese Patent Publication No. 2009-253557 [Overview of the Initiative] [Problems that the invention aims to solve]

[0006] The message communication interval described in Patent Document 1 can be calculated using the time indicated by the timestamp attached to the received message. However, depending on the time resolution of the timestamp, there may be a discrepancy between the actual time and the time indicated by the attached timestamp. As a result, such a time discrepancy may lead to an incorrect determination of whether a message is legitimate or invalid. Furthermore, while the method described in Patent Document 2 reduces the possibility of misjudgment due to the time resolution of the timestamp, it requires temporarily storing the reception time of all messages received within the set time, which may increase memory consumption. Moreover, the method described in Patent Document 2 cannot identify which of the messages whose reception count has been recorded is an invalid message.

[0007] Therefore, the object of the present invention is to determine whether there are any invalid data frames among the received data frames, and to determine which of the received data frames are invalid. [Means for solving the problem]

[0008] An abnormal frame determination device (10) according to one aspect of the present disclosure is an abnormal frame determination device connected to an electronic control device (20) that transmits data frames at a predetermined period, and comprises: a receiving unit (101) that receives a first data frame which is presumed to have been transmitted from the electronic control device; a receiving interval calculation unit (104) that calculates the reception interval between the first data frame and a second data frame which the receiving unit received immediately before the first data frame; a storage unit (106) that stores a determination value used for detecting abnormal frames; a determination value update unit (107) that adds a predetermined value to the determination value when the reception interval is shorter than a threshold; and an abnormal frame determination unit (110) that determines that the second data frame is an abnormal frame when the determination value reaches a limit value and the reception interval is longer than the proximity reception interval which is a criterion for determining whether the first data frame and the second data frame were received in close proximity. [Effects of the Invention]

[0009] With the configuration described above, the abnormal frame detection device of this disclosure can determine with high accuracy whether the received data frame contains an invalid data frame, and can also determine which of the received data frames is an abnormal data frame. [Brief explanation of the drawing]

[0010] [Figure 1] A diagram illustrating an in-vehicle system having a log determination device according to Embodiment 1 or 2. [Figure 2] A diagram showing an example configuration of the log determination device of Embodiment 1 or 2. [Figure 3] A diagram illustrating the timestamp assigned by the timestamp assignment unit of Embodiment 1 or 2. [Figure 4] Diagram illustrating the reception interval and determination value of the data frame in Embodiment 1. [Figure 5] Diagram illustrating the reception interval and determination value of the data frame in Embodiment 1. [Figure 6]Diagram illustrating the reception interval and determination value of the data frame in Embodiment 1. [Figure 7] Diagram illustrating the reception interval and determination value of the data frame in Embodiment 1. [Figure 8] Diagram illustrating the operation of the abnormal frame detection device of Embodiment 1. [Figure 9] Diagram illustrating the operation of the abnormal frame detection device of Embodiment 1. [Figure 10] Diagram illustrating the operation of the abnormal frame detection device of Embodiment 2. [Figure 11] Diagram illustrating the operation of the abnormal frame detection device of Embodiment 2. [Modes for carrying out the invention]

[0011] Embodiments of the present invention will be described below with reference to the drawings.

[0012] Furthermore, "the present invention" means the invention described in the claims or means for solving the problem, and is not limited to the following embodiments. Also, at least the words in quotation marks mean the words described in the claims or means for solving the problem, and are likewise not limited to the following embodiments.

[0013] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods in embodiments corresponding to the configurations and methods described in the dependent claims, as well as configurations and methods described only in embodiments and not in the claims, are optional configurations and methods in the present invention. The configurations and methods described in embodiments when the claims are broader than the descriptions in embodiments are also optional configurations and methods in the present invention, in the sense that they are illustrative examples of the configurations and methods of the present invention. In any case, by describing them in the independent claims, they become essential configurations and methods of the present invention.

[0014] The effects described in the embodiments are those that occur when the configuration is that of an exemplary embodiment of the present invention, and are not necessarily effects of the present invention itself.

[0015] When there are multiple embodiments, the configuration disclosed in each embodiment is not confined to that embodiment alone, but can be combined across embodiments. For example, the configuration disclosed in one embodiment may be combined with another embodiment. Alternatively, the configuration disclosed in each of multiple embodiments may be combined.

[0016] The problems described in the section on the problems that the invention aims to solve are not publicly known problems, but rather problems that the inventors have discovered independently, and together with the structure and method of the present invention, these facts affirm the inventive step of the invention.

[0017] 1. Configuration common to each embodiment (1) In-vehicle system 1 Figure 1 shows an in-vehicle system 1 consisting of an abnormal frame detection device 10, a plurality of electronic control units 20 (hereinafter referred to as ECUs (Electric Control Units)), and a communication network 2 connecting these devices to each other. In each embodiment described below, an electronic control unit configured as a gateway functions as the abnormal frame detection device 10, receiving data frames transmitted from the ECUs 20 and performing a series of abnormal frame detection processes described later. However, the abnormal frame detection device 10 in this embodiment is not limited to the electronic control unit of the gateway. For example, the abnormal frame detection device 10 in this embodiment may be provided in the in-vehicle system 1 as an electronic control unit dedicated to abnormal frame detection, or each ECU 20 constituting the in-vehicle system 1 may have the function of an abnormal frame detection device 10.

[0018] Communication network 2 can use any communication method, such as CAN (Controller Area Network), LIN (Local Interconnect Network), Ethernet®, Wi-Fi®, Bluetooth®, etc., but the following example will explain the use of CAN.

[0019] The ECU 20 is an "electronic control unit" that periodically transmits data frames to the abnormal frame detection device 10, that is, at a predetermined interval. The data frames transmitted by the ECU 20 at the predetermined interval include various data detected by sensors mounted on the vehicle, control values ​​that control the vehicle, etc.

[0020] Here, "electronic control device" may refer to a physically independent electronic control device, or a virtualized electronic control device implemented using virtualization technology.

[0021] In each embodiment, examples are given in which the abnormal frame detection device 10 and the ECU 20 constitute an in-vehicle system 1 mounted on a vehicle. However, the abnormal frame detection device 10 is not limited to devices mounted on a vehicle and can be applied to any system.

[0022] (2) Configuration of the abnormal frame detection device 10 The configuration of the abnormal frame detection device 10 will be explained using Figure 2. The abnormal frame detection device 10 includes a receiving unit 101, a timer 102, a timestamp assignment unit 103, a reception interval calculation unit 104, a database 105, a storage unit 106, a determination value update unit 107, and a determination unit 108. The determination unit 108 implements the abnormality presence / absence determination unit 109 and the abnormal frame determination unit 110.

[0023] The receiver 101 receives data frames (corresponding to the "first data frame") that are presumed to have been transmitted from the ECU 20 via CAN. In principle, the data frames received by the receiver 101 are data frames transmitted from the ECU 20. However, if an external attacker inserts a data frame that is disguised as having been sent from the ECU 20 through unauthorized access, the receiver 101 will mistakenly receive the fraudulent data frame as a data frame transmitted from the ECU 20. In other words, the receiver 101 receives not only data frames that were actually transmitted from the ECU 20, but also data frames that are mistakenly identified as having been transmitted from the ECU 20.

[0024] Timer 102 is the clock for the abnormal frame detection device 10. The configuration of Timer 102 is arbitrary; for example, it may consist of a free-running counter that counts the internal clock simultaneously with the startup of the abnormal frame detection device 10, or a frequency divider counter that counts by dividing the internal clock, or it may be a timer that references the absolute time acquired by GPS.

[0025] The timestamping unit 103 assigns a timestamp to the data frame, indicating the time the receiving unit 101 received the data frame, based on the time of the timer 102. The timestamping unit 103 samples the data frame received by the receiving unit 101 at a preset period and assigns a timestamp. Therefore, the timestamp assigned to the data frame and the time the receiving unit 101 actually received the data frame may differ in strict terms.

[0026] Referring to Figure 3, the timestamps assigned by the timestamp assignment unit 103 and the reception interval of the data frames will be explained. Figure 3(a) shows data frames F1 to F4 at the time the receiving unit 101 actually received the data frames. In this example, the receiving unit 101 receives the data frames at an interval of approximately 10 ms. Figures 3(b) and 3(c) show data frames F1 to F4 at the time of the timestamps assigned when each data frame in Figure 3(a) is sampled at periods of 2.5 ms and 5 ms, respectively. As is clear from comparing Figure 3(a) with Figures 3(b) and 3(c), there is a discrepancy between the actual reception time of the data frames and the time the timestamps are assigned to the data frames, and this discrepancy becomes more pronounced as the sampling period lengthens.

[0027] For example, although the actual reception interval between data frames F1 and F2 is approximately 10ms, the reception interval based on the timestamp shown in Figure 3(b) is 7.5ms. Also, the reception interval based on the timestamp shown in Figure 3(c) is 5ms. Thus, the reception intervals between data frames F1 and F2 shown in Figures 3(b) and 3(c) are shorter than the transmission interval at which the ECU20 actually sent the data frames. Therefore, if the determination of whether a data frame is abnormal is based solely on the reception intervals of the two data frames, it is possible that data frame F1 or data frame F2 may be incorrectly determined to be an abnormal data frame (hereinafter referred to as an abnormal frame).

[0028] Furthermore, although the actual reception interval between data frames F3 and F4 is approximately 10 ms, the reception interval based on the timestamp shown in Figure 3(b) is 12.5 ms. Also, the reception interval based on the timestamp shown in Figure 3(c) is 15 ms. Thus, the reception intervals between data frames F3 and F4 shown in Figures 3(b) and 3(c) are longer than the transmission interval at which the ECU20 actually transmitted the data frames.

[0029] The reception interval calculation unit 104 calculates the reception interval P between the data frame received by the reception unit 101 (corresponding to the "first data frame") and the data frame received by the reception unit 101 immediately before that data frame (corresponding to the "second data frame"), based on the time of the timestamp attached to the data frame.

[0030] As described above, the ECU 20 transmits data frames at predetermined intervals. Therefore, the reception interval of data frames received by the receiving unit 101 of the abnormal frame detection device 10 is, in principle, equal to the transmission interval of the ECU 20. However, if an abnormal frame inserted due to unauthorized access is received, the data frame reception interval will be shorter than the transmission interval. Also, as shown in Figure 3, the data frame reception interval may be shorter or longer than the transmission interval due to a discrepancy between the timestamp and the actual reception time, or due to delays in data frames caused by congestion in the communication network 2.

[0031] The database 105 is the threshold P of the reception interval for the data frames received by the receiving unit 101. T The database 105 further stores the criteria used by the abnormality detection unit 109 (described later) to determine whether or not there are abnormal frames in the data frames received by the receiving unit 101, that is, the limit value C of the determination value C which serves as the criterion for detecting abnormal frames. L The database 105 is assumed to be a non-volatile memory such as ROM, flash memory, or hard disk. When the receiving unit 101 receives multiple types of data frames having different identification information (e.g., ECU-ID, CAN-ID, etc.) or different data types, the database 105 stores threshold and limit values ​​for the reception interval for each type of data frame. The determination unit 108, described later, then determines whether there are any abnormal frames among data frames having the same identification information or data type, and which data frame is the abnormal frame.

[0032] This embodiment assumes that the threshold and limit values ​​are fixed values. In this case, the threshold and limit values ​​are stored in a database 105, for example, at the manufacturing plant of the abnormal frame detection device 10 or at a dealer that sells vehicles equipped with the in-vehicle system 1. However, the threshold and limit values ​​may be variable values ​​that change dynamically depending on various parameters. For example, if the communication network 2 is congested, there is a high possibility that data frames will be received with a delay. Therefore, when the load on the communication network 2 is high, the threshold and limit values ​​of the reception interval may be automatically set to be larger than under normal conditions. Threshold P stored in database 105 T , limit value C L This will be discussed later.

[0033] The storage unit 106 stores the judgment value C used for detecting abnormal frames. The judgment value stored in the storage unit 106 is updated as needed by the judgment value update unit 107, which will be described later. The storage unit 106 is assumed to be a volatile memory such as RAM, and the judgment value data is erased when the power to the abnormal frame detection device 10 is turned OFF. In this case, when the power is turned ON again, the judgment value will be reset to a preset initial value (C). Ini ) is reset. However, the storage unit 106 may be a hard disk drive (HDD), flash memory, etc.

[0034] The storage unit 106 may further store the value of the determination value before it is updated by the determination value update unit 107. For example, the storage unit 106 may store at least two values ​​of the determination value before it is updated, namely, the determination value C1 immediately before it is updated by the determination value update unit 107, and the determination value C2 before it is updated to determination value C1. These determination values ​​(C, C1, C2) change each time the determination value update unit 107 performs an update. When the determination value is newly updated, the value that was previously stored as determination value C becomes determination value C1, and the value that was stored as determination value C1 becomes determination value C2.

[0035] The judgment value update unit 107 combines the reception interval P calculated by the reception interval calculation unit 104 with the threshold P stored in the database 105. TThe system compares the two values. Based on the comparison result, the system updates the judgment value stored in the storage unit 106. Specifically, the judgment value update unit 107 updates the judgment value by adding a predetermined value to it if the reception interval is shorter than the threshold. The judgment value update unit 107 further updates the judgment value by subtracting a predetermined value from it if the reception interval is longer than the threshold. The updated judgment value is overwritten and saved in the storage unit 106.

[0036] Here, "more than" includes both cases where the comparison target has the same value and cases where it does not. "Predetermined" includes not only cases that are always constant, but also cases that are uniquely determined depending on the conditions. "Addition" includes not only operations that add positive values, but also operations that add negative values. Furthermore, "addition" only requires that an operation to add a predetermined value has been performed; for example, the value before and after the operation does not need to change, as it may be due to reaching the maximum or minimum value of the judgment. "Subtraction" includes not only operations that subtract positive values, but also operations that subtract negative values. Furthermore, "subtraction" only requires that an operation that subtracts a predetermined value has been performed; for example, the value before the operation does not necessarily have to change, as it may be due to reaching the maximum or minimum value of the judgment.

[0037] The predetermined value is, for example, a value calculated based on the "difference" between the reception interval of the data frame calculated by the reception interval calculation unit 104 and the threshold value of the reception interval. As an example, the "difference" between the reception interval and the threshold value itself may be used as the predetermined value. Specifically, if the reception interval is shorter than the threshold value, the determination value update unit 107 adds the difference between the reception interval of the data frame and the threshold value (i.e., P) as the predetermined value to the determination value stored in the storage unit 106. T The determination value is updated by adding -P). Also, if the reception interval is longer than the threshold, the determination value update unit 107 adds a predetermined value to the determination value, which is the difference between the reception interval of the data frame and the threshold (i.e., PP). T) is subtracted to update the determination value. In this case, it can be said that the determination value is the total value of the difference between the reception interval and the threshold value. The following embodiments will be described by taking the case where a predetermined value is the difference between the reception interval and the threshold value as an example.

[0038] Here, the "difference" in the present invention only needs to include subtraction. Not only the simple difference (y - x), but also the squared difference (y 2 -x 2 ), the square root of the difference ((y - x) 1 / 2 ), the weighted difference (by - ax: a and b are constants), etc. are also included.

[0039] The determination value does not necessarily have to be the total value of the difference itself between the reception interval and the threshold value, and may be the total value of numerical values pre-associated with the magnitude of the difference. For example, the difference between the reception interval of the data frame and the threshold value is classified into a plurality of ranges in advance, and in the database 105, the range of the difference between the reception interval and the threshold value and the numerical value corresponding to each range are stored in a table in a table. And when the difference between the reception interval and the threshold value is within a specific difference range, the determination value is updated by adding or subtracting the numerical value corresponding to the range as a predetermined value.

[0040] In another example, the determination value is a value indicating the number of times the reception interval of the data frame is shorter than the threshold value. For example, when the reception interval is shorter than the threshold value, the determination value update unit 107 adds "1" as a predetermined value to the determination value stored in the storage unit 106, and when the reception interval is longer than the threshold value, "1" is subtracted from the determination value as a predetermined value. Note that the predetermined value added to the determination value does not necessarily have to be "1", and any other arbitrary numerical value may be set.

[0041] A minimum and maximum value may be set in advance for the determination value. In this case, if the determination value is at its minimum value and the reception interval is longer than the threshold, the determination value update unit 107 may replace the determination value after subtraction with the minimum value, or it may not perform the subtraction process. Similarly, if the determination value has reached its maximum value and the reception interval is shorter than the threshold, the determination value update unit 107 may replace the determination value after addition with the maximum value, or it may not perform the addition process. However, as will be described later, if the abnormal frame determination unit 110 determines whether the determination value first reached the limit value based on the order in which addition and subtraction were performed, the determination value update unit 107 will consider that subtraction was performed if the reception interval is longer than the threshold, and that addition was performed if the reception interval is shorter than the threshold, even if subtraction or addition is not actually performed. As an example, the maximum value of the determination value is the limit value C of the determination value. L It may also be equal to . Furthermore, as an example, the minimum value of the judgment value may be set to zero (0). In this case, the judgment value will always be a positive value. Also, the minimum value of the judgment value is equal to the initial value C of the judgment value. Ini It may also be considered equal to.

[0042] The abnormality determination unit 109 of the determination unit 108 uses the determination value C updated by the determination value update unit 107 and the limit value C stored in the database 105. L Compare the two. Then, the judgment value C is the limit value C. L If it is determined that the threshold value C has been reached, that is, if the determination value C is the limit value C L If it is determined that the above (C≧C) L ), the receiving unit 101 determines that there is an abnormal frame in the received data frame. Note that if the maximum value of the determination value and the limit value are equal, the determination value will not be greater than the limit value, so the determination value C will be equal to the limit value C. L If it is equal to (C=C L The abnormality detection unit 109 determines that there is an abnormal frame.

[0043] The abnormal frame determination unit 110 of the determination unit 108 determines which of the data frames received by the receiving unit 101 is the abnormal frame when the abnormality presence / absence determination unit 109 determines that there is an abnormal frame. The determination method by the abnormal frame determination unit 110 will be described later in each embodiment.

[0044] Furthermore, if the abnormal frame determination unit 110 determines that a particular data frame is an abnormal frame, the abnormal frame determination unit 110 may discard the data frame it determined to be an abnormal frame. Alternatively, it may add information to the data frame indicating that it is an abnormal frame.

[0045] (3) Setting various parameters Next, we will describe the settings for the parameters used in each embodiment. (a) Threshold (P T ) Reception interval threshold P T This is set to a value less than or equal to a predetermined period T during which the ECU20 transmits data frames (i.e., threshold P). T ≤ predetermined period T). If the reception interval between two data frames is less than or equal to the predetermined period T, it is possible that one of the data frames is an abnormal frame that has been improperly inserted. However, as mentioned above, the reception time of the data frame transmitted from ECU20 may be shifted due to the discrepancy between the timestamp and the actual reception time, or congestion in the communication network 2. Therefore, it is possible that the reception interval between two normal data frames may be less than or equal to the predetermined period T. Thus, more preferably, the reception interval threshold P T P is the minimum value of the reception interval between two normal data frames transmitted from ECU20. Min Set to a value equal to (i.e., threshold P) T = Minimum reception interval P Min ). By setting the threshold to a value equal to the minimum reception interval, if the receiving unit 101 does not receive abnormal frames and only receives normal data frames transmitted from the ECU 20, the reception interval of the two data frames will always be the threshold P T It will be longer than that.

[0046] Minimum reception interval P Min For example, the minimum value P is the minimum value of the reception interval measured when a data frame is transmitted at a predetermined period T using the ECU 20 actually installed in the in-vehicle system 1. Min Alternatively, it may be set to a minimum value P that is 90% or 80% of a predetermined period T during which the ECU20 transmits data frames. Min You can set it as such.

[0047] (b) Limit value (C L ) Limit value C of the judgment value L It is desirable that the threshold value be set such that if an invalid data frame is inserted between two normal data frames transmitted from the ECU20, the judgment value reaches the limit value when the later normal data frame is received. For example, the limit value is the threshold P. T Set the value to be less than or equal to the value obtained by subtracting a predetermined T from twice the value (i.e., the limit value C). L ≤2 × threshold P T - A predetermined period (T).

[0048] Figure 4 illustrates an example where an abnormal frame F2 is inserted between two normal data frames F1 and F3. Figure 4(a) shows the timestamps attached to the data frames and the reception interval based on the timestamps. The times at which data frames F1 to F3 were received are t, t+x, and t+T, respectively. In other words, in this example, the reception interval for normal data frames F1 and F3 is equal to a predetermined period T transmitted by the ECU20. Figure 4(b) shows the determination value that changes according to the reception interval for data frames F1 to F3. The determination value C at the time data frame F1 is received is equal to the initial value C of the determination value. Ini And in this example, it is 0.

[0049] As shown in Figure 4, the reception interval P1 for data frames F1 and F2 is the threshold P T Because it is shorter than the reception interval P1 of data frames F1 and F2, the judgment value update unit 107 sets the threshold P T The difference (PT Add the difference (P1) to the judgment value C. Here, the reception times of data frames F1 and F2 are t and t+x respectively, so the reception interval P1 is (t+x)-x, i.e., x. Therefore, the difference (P T -x) is added to the judgment value C. Also, the reception interval P2 of data frames F2 and F3 is the threshold P T Because it is shorter than the reception interval P2 of data frames F2 and F3, the determination value update unit 107 sets the threshold P T The difference (P T -P2) is added to the judgment value C. Here, the reception times of data frames F2 and F3 are t+x and t+T respectively, so the reception interval P2 is (t+T)-(t+x), i.e., Tx. Therefore, the difference P T -Tx) is added to the judgment value C.

[0050] In the example in Figure 4, after receiving data frame F3, the judgment value C is the limit value C. L It reaches [value]. Therefore, the following equation holds true. C L ≤(P T -x)+(P T -(Tx)) C L ≤2P T -T As shown in the above equation, the limit value C L The threshold P T It is set to a value less than or equal to twice the value minus a predetermined T.

[0051] Figure 4 illustrates the case where the reception interval for normal data frames F1 and F3 is a predetermined period T. However, if the reception interval for normal data frames F1 and F3 becomes longer than the predetermined period T due to a discrepancy between the timestamp and the actual reception time, or delays caused by congestion in the communication network 2, then, with the limit value setting described above, the judgment value C will not reach the limit value C after receiving data frame F3. L It is possible that it will not reach the target.

[0052] Therefore, more preferably, the limit value C LThis ranges from twice the threshold to the maximum value P, which represents the reception interval between two normal data frames transmitted from ECU20. Max Set the value to be equal to the value obtained by subtracting (i.e., limit value C) L = 2 × threshold P T - Maximum reception interval P Max By setting a limit value in this way, if an invalid data frame is inserted between two normal data frames transmitted from the ECU20, the judgment value will always reach the limit value when the subsequent normal data frame is received.

[0053] Maximum value P of the reception interval Max For example, the maximum value P is the maximum value of the reception interval measured when a data frame is transmitted at a predetermined period T using the ECU 20 actually installed in the in-vehicle system 1. Max It may also be set to a maximum value P that is 110% or 120% of a predetermined period T during which the ECU20 transmits data frames. Max You can set it as such.

[0054] The limit values ​​described above are merely one example of settings used when the difference between the reception interval and the threshold is set to a predetermined value, and are not limited to this example. For example, if the predetermined value is a numerical value associated with the magnitude of the difference between the reception interval and the threshold, the limit values ​​may be set to values ​​different from those described above.

[0055] (c) Proximity reception interval (D) Next, the proximity reception interval D used in the embodiment described later will be explained. The proximity reception interval D is the reception interval that serves as the criterion for determining whether or not two data frames were received in close proximity. That is, if the reception interval between two data frames is less than or equal to the proximity reception interval, these two data frames are determined to be data frames that were received in close proximity.

[0056] The proximity reception interval D is set so that when two data frames are received in close proximity, the judgment value immediately reaches the limit value. In other words, threshold P TThe proximity reception interval D is set such that the difference between the signal and the proximity reception interval D is greater than or equal to the limit value. In this case, the following equation holds true. P T -D≧C L D≦P T -C L As shown in the above equation, the proximity reception interval D is equal to the threshold P T From the limit value C L Set the value to a value less than or equal to the value obtained by subtracting [the specified value].

[0057] Furthermore, as described above, preferably, threshold P T P is the minimum reception interval for a normal data frame. Min It is set to a value equal to and the limit value C L The maximum value P for the normal data frame reception interval is twice the threshold. Max The value is set to the value obtained by subtracting from it. Threshold P T , limit value C L When these values ​​are set, the proximity reception interval D may be expressed by the following formula: D = (Minimum reception interval P) Min )-{2×(minimum reception interval P) Min )-Maximum value P of the reception interval Max} D = Maximum reception interval P Max - Minimum reception interval P Min In other words, the proximity reception interval D is the maximum value P of the reception interval for a normal data frame. Max Therefore, P is the minimum value of the reception interval for a normal data frame. Min It is set to a value equal to the value obtained by subtracting from it.

[0058] 2. First Embodiment (1) Method for determining abnormal frames Next, the method for determining abnormal frames by the abnormal frame determination unit 110 in this embodiment will be described.

[0059] The abnormal frame determination unit 110 first determines whether the determination value has reached the limit value "for the first time". For example, the abnormal frame determination unit 110 determines that the determination value has reached the limit value for the first time when the determination value reaches the limit value due to the addition of a predetermined value to a determination value that is less than the limit value. In another example, the initial value C of the determination value. Ini The abnormal frame determination unit 110 may determine that the determination value has reached the limit value for the first time if the determination value reaches the limit value due to a predetermined value being added to the initial value a predetermined number of times after a predetermined value has been subtracted by the determination value update unit 107, or if the determination value reaches the limit value for the first time due to a predetermined value being added to the determination value a predetermined number of times. For example, as described above, if the limit value is set so that when an abnormal frame is inserted between two normal data frames, the determination value reaches the limit value when the subsequent normal data frame is received, it is desirable to set the predetermined number of times to 2. In this case, when an abnormal frame is inserted between two normal data frames, and the predetermined value is added to the initial value 2 times, the abnormal frame determination unit 110 determines that the determination value has reached the limit value for the first time.

[0060] Here, "firstly" includes not only the first time it is reached after the device is started, but also the first time it is reached within a specified period of time, or the first time it is reached after a specified condition has been met.

[0061] Figure 5 illustrates an example of receiving four data frames (F1 to F4). Figure 5(a) shows the timestamps assigned to the data frames and the reception interval based on the timestamps, while Figure 5(b) shows the judgment value that changes according to the reception interval of data frames F1 to F4. In the example in Figure 5, of the four data frames, data frames (F1, F2, and F4) are normal data frames, and data frame F3 is an abnormal frame.

[0062] In the following example, the initial value of the judgment value is C. Ini Let's take the example where the minimum value of the judgment is set to 2 times.

[0063] For example, in the example shown in FIG. 5, the reception interval P1 between the data frame F1 and the data frame F2 is longer than the threshold value P T , so the determination value update unit 107 subtracts the difference (P1 - P T ) between the reception interval and the threshold value from the determination value. However, in this example, since the value of the determination value before the subtraction process is the initial value (C Ini = 0) which is the minimum value of the determination value, the updated determination value remains the initial value. Next, both the reception interval P2 between the data frame F2 and the data frame F3 and the reception interval P3 between the data frame F3 and the data frame F4 are shorter than the threshold value P T , so the determination value update unit 107 adds the difference between the reception interval and the threshold value to the determination value. As shown in FIG. 5(b), when adding the difference (P<0********* - P3) between the reception interval and the threshold value to the determination value, the determination value C reaches the limit value C L , so the abnormality presence / absence determination unit 109 determines that there is an abnormal frame.

[0064] Here, in FIG. 5, after the determination value update unit 107 subtracts a predetermined value after receiving the data frame F2, and then adds the predetermined value twice to the determination value after receiving the data frame F3 and the data frame F4, the determination value reaches the limit value. Therefore, when the abnormality presence / absence determination unit 109 determines that there is an abnormal frame after receiving the data frame F4, the abnormal frame determination unit 110 determines that the determination value first reached the limit value.

[0065] Note that in FIG. 5, the determination value update unit 107 reaches the limit value by adding a predetermined value twice to the initial value C Ini of the determination value. Also, the determination value update unit 107 reaches the limit value by adding a predetermined value to the determination value less than the limit value (that is, the determination value after adding P Ini to the initial value C T - P2). Therefore, from these facts as well, the abnormal frame determination unit 110 can determine that the determination value first reached the limit value.

[0066] Figure 6 shows the case where an abnormal frame F5 is received after data frame F4 in Figure 5. The reception interval P4 between data frame F4 and data frame F5 is the threshold P T Because it is shorter than the interval, the judgment value update unit 107 adds the difference between the reception interval and the threshold (P) to the judgment value. T Add -P4). However, since the judgment value before the update is the limit value of the judgment value, i.e., the maximum value, the judgment value after the update is the limit value C L It remains the same. And the updated judgment value C is the limit value C. L Because it has reached this limit, the abnormality detection unit 109 determines that there is an abnormal frame. Here, when the abnormality detection unit 109 determines that there is an abnormal frame after receiving data frame F5, the determination value has reached the limit value because the determination value update unit 107 has added to the determination value three times. Therefore, the abnormal frame detection unit 110 does not determine that the determination value has reached the limit value for the first time. As explained in Figure 5, since the determination value has reached the limit value after receiving data frame F4, it is clear that when the determination value reaches the limit value after receiving data frame F5, it is not the first time that the determination value has reached the limit value.

[0067] Furthermore, in the example shown in Figure 6, when the abnormality detection unit 109 determines that there is an abnormal frame after receiving data frame F5, the determination value update unit 107 adds a predetermined value to the determination value that is above the limit value. From this, it can also be determined that when the determination value reaches the limit value after receiving data frame F5, it is not the first time that the determination value has reached the limit value.

[0068] Alternatively, the abnormal frame determination unit 110 may determine that the determination value has reached the limit value for the first time if the determination value has reached the limit value due to the predetermined value being subtracted and then added twice, and the determination value after the subtraction of the predetermined value is the initial value of the determination value. If the determination value after the addition of the predetermined value for the second time is C, and the determination value before being updated to determination value C, and the determination value after the addition of the predetermined value for the first time is C1, then the determination value after subtraction is the determination value C2 before being updated to determination value C1, and is stored in the storage unit 106. If the determination value after the subtraction of the predetermined value is a value other than the initial value, the determination value includes values ​​added due to abnormal frames received when the abnormality presence / absence determination unit 109 determined that there was an abnormal frame, or values ​​added due to abnormal frames received even earlier than the data frame received immediately before that. In contrast, if the determination value after the subtraction of the predetermined value is the initial value, this determination value is not affected by values ​​added due to the reception of abnormal frames in the past. Therefore, the determination value may be determined to have reached the limit value for the first time if the determination value after the subtraction of the predetermined value is the initial value of the determination value.

[0069] The method by which the abnormal frame determination unit 110 determines whether or not the determination value has reached the limit value for the first time is not limited to the example described above. For example, if a predetermined period of time has elapsed since the abnormality presence / absence determination unit 109 previously determined that there was an abnormal frame, the abnormal frame determination unit 110 may determine that the determination has reached the limit value for the first time.

[0070] Then, if the abnormal frame determination unit 110 determines that the determination value has not reached the limit value for the first time, it determines that at least one of the data frame received when it determined that there is an abnormal frame, or the data frame received immediately before that, is an abnormal frame. In the example in Figure 6, if the abnormality determination unit 109 determines that there is an abnormal frame when it receives data frame F5, the abnormal frame determination unit 110 determines that the determination value has not reached the limit value for the first time, and determines that at least one of the data frame F5 received when it determined that there is an abnormal frame, or the data frame F4 received immediately before that, is an abnormal frame. In other words, if a predetermined value is added to the determination value which is above the limit value, the abnormal frame determination unit 110 determines that at least one of the data frame F5 received when it determined that there is an abnormal frame, or the data frame F4 received immediately before that, is an abnormal frame.

[0071] In response, if the abnormal frame determination unit 110 determines that the determination value has reached the limit for the first time, the abnormal frame determination unit 110 further determines whether the data frame received when it determined that there was an abnormal frame and the data frame received immediately before it were received in close proximity. Whether the two data frames were received in close proximity is determined by whether the reception interval between the two data frames is shorter than the proximity reception interval D.

[0072] As described above, the proximity reception interval D is the reception interval used as a criterion for determining whether two data frames were received in close proximity. If the reception interval between two data frames is longer than the proximity reception interval, it is determined that these data frames were not received in close proximity. Conversely, if the reception interval between two data frames is less than or equal to the proximity reception interval, it is determined that these two data frames were received in close proximity. When the reception interval between two data frames is less than or equal to the proximity reception interval, the difference between the threshold and the reception interval of the two data frames becomes greater than the limit value, and the judgment value immediately reaches the limit value.

[0073] When the abnormal frame determination unit 110 determines that the reception interval between two data frames is longer than the close reception interval, the abnormal frame determination unit 110 determines that the data frame received immediately before the data frame received when it is determined that there is an abnormal frame is an abnormal frame. In contrast, when it is determined that the reception interval between two data frames is less than or equal to the close reception interval and the two data frames are received close to each other, it is determined that at least one of the data frame received when it is determined that there is an abnormal frame or the data frame received immediately before it is an abnormal frame. For example, in the example of FIG. 5, after the reception of data frame F4, the determination value first reaches the limit value. Also, the reception interval between data frame F3 and data frame F4 is longer than the close reception interval. Therefore, the abnormal frame determination unit 110 determines that the data frame F3 received immediately before the data frame F4 received when it is determined that there is an abnormal frame is an abnormal frame.

[0074] FIG. 7 is a diagram for explaining an example when three data frames (F1 to F3) are received. FIGS. 7(a) and 7(b) show the times of the timestamps attached to the data frames and the reception intervals based on the times of the timestamps, and FIG. 7(c) shows the determination values that change according to the reception intervals of data frames F1 to F3. Both FIGS. 7(a) and 7(b) show the case where data frame F2 and data frame F3 are received close to each other, but in FIG. 7(a), data frame F2 is an abnormal frame, while in FIG. 7(b), data frame F3 is an abnormal frame.

[0075] In FIG. 7(a), as described above, since data frame F2 and data frame F3 are received close to each other, their reception interval P2 is shorter than the close reception interval D. Here, when the reception interval (P1 + P2) between the normal data frame F1 and the data frame F3 is the same as the predetermined period T that is the transmission interval of the ECU 20, the reception interval between the normal data frame F1 and the abnormal frame F2 is the threshold value P TIt becomes longer than that. Therefore, when data frame F2 is received, no addition is made to the judgment value. Then, when data frame F3 is received, threshold P T The difference between and the reception interval P2 (P T -P2) is added to the judgment value, so the judgment value C becomes the limit value C. L It reaches.

[0076] Similarly, in Figure 7(b), since data frames F2 and F3 are received in close proximity, their reception interval P2 is shorter than the proximity reception interval D. Here, the reception interval P1 for normal data frames F1 and F2 is the threshold P T Because it is longer than the threshold P, when data frame F2 is received, the judgment value is not added. Then, when data frame F3 is received, the threshold P T The difference between and the reception interval P2 (P T -P2) is added to the judgment value, so the judgment value C becomes the limit value C. L It reaches.

[0077] In Figures 7(a) and 7(b), the reception interval P1 between data frame F1 and data frame F2, and the reception interval (P1+P2) between data frame F1 and data frame F3 are both threshold P T This is longer than the normal interval between receiving data frames. In other words, the reception time of the next normal data frame received after a normal data frame F1 can be either the reception time of data frame F2 or the reception time of data frame F3. Also, in both Figure 7(a) and Figure 7(b), the judgment value changes as shown in Figure 7(c), making it difficult to determine whether data frame F2 or data frame F3 is an abnormal frame. In other words, when two data frames are received in close proximity, it is difficult to determine which of the two data frames is an abnormal frame. Therefore, in this case, it is determined that at least one of the data frame at the time of anomaly detection and the data frame received immediately before it is an abnormal frame. In the case of Figure 7, it is determined that at least one of data frames F2 and F3 is an abnormal frame.

[0078] (2) Operation of the abnormal frame detection device 10

[0079] Next, the operation of the abnormal frame detection device 10 will be explained with reference to Figure 8. Figure 8 not only shows the method for determining abnormal frames in the abnormal frame detection device 10, but also the processing steps of the program executed by the abnormal frame detection device 10. These processes are not limited to the order shown in Figure 8. That is, the order can be changed unless there are constraints such as a relationship where a step utilizes the result of a preceding step. The same applies to the flowcharts of the following embodiments. Furthermore, the processing steps shown in Figure 8 are repeatedly executed each time the abnormal frame detection device 10 receives a data frame.

[0080] The receiving unit 101 receives a data frame that is presumed to have been transmitted from the ECU 20 (S101). The timestamping unit 103 adds a timestamp to the received data frame (S102). The reception interval calculation unit 104 calculates the reception interval P between the data frame received in S101 and the data frame immediately preceding the said data frame, based on the time indicated by the timestamp assigned in S102 (S103). The judgment value update unit 107 uses the reception interval P calculated in S103 and the reception interval threshold P. T The results are compared (S104). If the reception interval is shorter than the threshold (S104: YES), the process proceeds to S105. Conversely, if the reception interval is longer than the threshold (S104: NO), the process proceeds to S106. Note that Figure 8 illustrates a flowchart in which the process proceeds to S106 even when the reception interval is equal to the threshold. However, the process may also proceed to S105 when the reception interval is equal to the threshold. Both S105 and S106 are processes for updating the determination value in the determination value update unit 107.

[0081] If the reception interval is shorter than the threshold (S104: YES), the judgment value update unit 107 adds the reception interval P calculated in S103 and the threshold P to the judgment value C stored in the storage unit 106.T The difference (P T -P) is added and the judgment value is updated (S105). Here, the judgment value C after addition is the maximum value C of the judgment value. max If the above conditions are met, the maximum value of the judgment value will be used as the updated judgment value.

[0082] Next, the abnormality determination unit 109 uses the determination value C updated in S105 and the limit value C L Compare with (S107). If the judgment value has reached the limit value (S107: YES), the abnormality determination unit 109 determines that there is an abnormal frame in the data frame (S108). The abnormal frame determination unit 110 then determines which of the received data frames is an abnormal frame (S109). The details of the process in S109 will be described in detail below.

[0083] In contrast, if the reception interval is longer than the threshold (S104:NO), the judgment value update unit 107 uses the judgment value C stored in the storage unit 106 to determine the reception interval P and threshold P calculated in S103. T The difference (PP T Subtract ) and update the judgment value (S106). Here, the judgment value C after subtraction is the minimum judgment value C. min If the following conditions are met, the minimum value of the judgment value will be used as the updated judgment value.

[0084] Then, the judgment value C updated in S105 or S106 is recorded in the storage unit 106 and the process ends (S110).

[0085] Figure 9 is a diagram illustrating the process in S109. The abnormal frame determination unit 110 determines whether or not the determination value has reached the limit value for the first time (S201). As described above, any method can be used to determine whether or not the determination value has reached the limit value for the first time. If the system determines that the judgment value has reached the limit value for the first time (S201: YES), the abnormal frame determination unit 110 further determines whether the reception interval between the data frame received in S101 and the data frame received immediately before it is shorter than the proximity reception interval, that is, whether the two data frames were received in close proximity (S202). Furthermore, if the reception interval is longer than the nearest reception interval, and the received data frame and the data frame immediately preceding it are not received in close proximity, it is determined that the preceding frame is an abnormal frame (S203). In contrast, if the judgment value is not the first to reach the limit (S201: NO), or if the reception interval is less than or equal to the nearest reception interval, it is determined that at least one of the received data frame and the data frame received immediately before it is an abnormal frame (S204).

[0086] (3) Summary According to this embodiment, if predetermined conditions are met, it is determined that the data frame received immediately before the received data frame is an abnormal frame. Even if the predetermined conditions are not met, it is possible to determine that at least one of the received data frame or the data frame immediately preceding it is an abnormal frame.

[0087] 3. Second Embodiment In the above-described embodiment, after the determination value reaches the limit value, the determination value is stored in the storage unit 106 at its maximum value, the limit value. In this embodiment, when the determination value reaches the limit value, the determination value is reset to its initial value. The configuration of this embodiment will be described below, focusing on the differences from Embodiment 1.

[0088] The configuration of the abnormal frame detection device 10 in this embodiment is the same as in Embodiment 1 and will be described with reference to Figure 2. Each component of the abnormal frame detection device 10 has the same function as in Embodiment 1. In this embodiment, when the determination value reaches the limit value, the determination value returns to the initial value C IniSince it is reset, the case where the judgment value reaches the limit corresponds to the first time the judgment value reaches the limit after it has been reset. Therefore, the abnormal frame determination unit 110 of this embodiment does not need to determine whether or not it is the first time the judgment value has reached the limit.

[0089] The operation of the abnormal frame detection device 10 of this embodiment will be explained with reference to Figures 10 and 11. Processes common to Figure 8 will be omitted from the explanation. In Figure 8, after detecting an abnormal frame in S109, the updated detection value was stored in the storage unit 106 (S110) in S105 or S106. However, in this embodiment, as shown in Figure 10, after detecting an abnormal frame in S109, the detection value C is set to the initial value C Ini The judgment value is reset by updating it (S301). Also, only if the reception interval calculated in S103 is longer than the threshold (S104:NO), or if the judgment value has not reached the limit value (S107:NO), the updated judgment value is saved to the storage unit 106 in S105 or S106 (S302).

[0090] Furthermore, Figure 11 is a diagram illustrating the process of S109 in Figure 10. Unlike Figure 9, the process of S201 is not performed. This is because, in this embodiment, the case in which the judgment value reaches the limit value is always the case in which the judgment value first reaches the limit value after it has been reset.

[0091] According to this embodiment, it is possible to determine that a data frame received immediately before the received data frame, or at least one of the received data frame or the data frame immediately preceding it, is an abnormal frame, without having to determine whether the judgment value first reached the limit value.

[0092] 4. Summary The features of the abnormal frame detection device and the like of the present invention have been described above.

[0093] The terms used in each embodiment are illustrative and may be replaced with synonymous terms or terms that include synonymous functions.

[0094] The block diagram used in describing the embodiment classifies and organizes the device configuration by function. Each block representing a function can be realized by any combination of hardware or software. Furthermore, since it represents a function, such a block diagram can also be understood as a disclosure of a method invention and a program invention that realizes said method.

[0095] The functional blocks that can be understood as processes, flows, and methods described in each embodiment may be reordered, unless there are constraints such as a relationship where one step utilizes the results of other preceding steps.

[0096] The terms "first," "second," through "nth" (where N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same kind, and do not imply any order or hierarchy.

[0097] Each embodiment is based on an abnormal frame detection device mounted on a vehicle, but the present invention also includes dedicated or general-purpose devices other than those for vehicles, unless otherwise specifically limited by the claims.

[0098] Furthermore, the following are examples of the form of the abnormal frame detection device of the present invention. Examples of component forms include semiconductor elements, electronic circuits, modules, and microcomputers. Examples of semi-finished products include electronic control units (ECUs) and system boards. Examples of finished products include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other devices with communication capabilities include, for example, video cameras, still cameras, and car navigation systems.

[0099] Furthermore, necessary functions such as an antenna and a communication interface may be added to the abnormal frame detection device.

[0100] In addition, the present invention can be realized not only with dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing this program.

[0101] Programs stored on non-transitional physical recording media of dedicated or general-purpose hardware (e.g., external storage devices (hard disks, USB memory, CD / BD, etc.) or internal storage devices (RAM, ROM, etc.)) can also be provided to the dedicated or general-purpose hardware via the recording media, or via a communication line from a server without using the recording media. This allows for the provision of the latest functions at all times through program upgrades. [Explanation of Symbols]

[0102] 10 Anomaly frame detection device, 20 Electronic control unit, 101 Receiving unit, 104 Reception interval calculation unit, 106 Storage unit, 107 Judgment value update unit, 110 Anomaly frame detection unit

Claims

1. An abnormal frame determination device connected to an electronic control device (20) that transmits data frames at a predetermined interval, A receiving unit (101) that receives a first data frame which is presumed to have been transmitted from the electronic control unit, A reception interval calculation unit (104) calculates the reception interval between the first data frame and the second data frame that the receiving unit received immediately before the first data frame, A storage unit (106) that stores a judgment value used to detect abnormal frames, A determination value update unit (107) adds a predetermined value to the determination value if the reception interval is shorter than a threshold, An abnormal frame determination unit (110) determines that the second data frame is an abnormal frame when the determination value reaches a limit value and the reception interval is longer than the proximity reception interval which is the criterion for determining whether the first data frame and the second data frame were received in close proximity, An abnormal frame detection device (10) is provided.

2. The abnormal frame determination unit further determines that at least one of the first data frame or the second data frame is an abnormal frame when the reception interval is less than or equal to the nearest reception interval. The abnormal frame detection device according to claim 1.

3. The abnormal frame determination unit determines that the second data frame is an abnormal frame when the determination value first reaches the limit value and the reception interval is longer than the nearest reception interval. The abnormal frame detection device according to claim 1.

4. The abnormal frame determination unit determines that the determination value has reached the limit value for the first time when the determination value reaches the limit value due to the addition of the predetermined value to the initial value of the determination value a predetermined number of times. The abnormal frame determination device according to claim 3.

5. The determination value update unit further subtracts the predetermined value from the determination value if the reception interval is longer than the threshold. The abnormal frame determination unit determines that the determination value has reached the limit value for the first time when the determination value reaches the limit value after the predetermined value has been subtracted from the determination value and then the predetermined value has been added to it a predetermined number of times. The abnormal frame determination device according to claim 3.

6. The abnormal frame determination unit determines that the second data frame is an abnormal frame when the determination value reaches the limit value due to the addition of a predetermined value to the determination value which is less than the limit value, and the reception interval is longer than the nearest reception interval. The abnormal frame detection device according to claim 1.

7. The abnormal frame determination unit determines that at least one of the first data frame or the second data frame is an abnormal frame if the predetermined value is added to the determination value which is equal to or greater than the limit value. The abnormal frame detection device according to claim 1.

8. The threshold is a value less than or equal to the predetermined period. The abnormal frame detection device according to claim 1.

9. The threshold is equal to the minimum reception interval between the first data frame and the second data frame, which are data frames transmitted from the electronic control device. The abnormal frame determination device according to claim 8.

10. The predetermined value is the difference between the reception interval and the threshold, The limit value is a value less than or equal to the value obtained by subtracting the predetermined period from twice the threshold value. The abnormal frame detection device according to claim 1.

11. The limit value is equal to twice the threshold value minus the maximum reception interval between the first data frame and the second data frame, which are data frames transmitted from the electronic control device. The abnormal frame determination device according to claim 10.

12. The determination value update unit further subtracts the difference from the determination value if the reception interval is longer than the threshold. The abnormal frame determination unit determines that the second data frame is an abnormal frame when the determination value reaches the limit value after the difference has been subtracted and then added twice, and the reception interval is longer than the nearest reception interval. The abnormal frame determination device according to claim 10.

13. The predetermined value is the difference between the reception interval and the threshold, The proximity reception interval is a value less than or equal to the value obtained by subtracting the limit value from the threshold value. The abnormal frame detection device according to claim 1.

14. The proximity reception interval is equal to the value obtained by subtracting the minimum value of the reception interval between the first data frame and the second data frame, which are data frames transmitted from the electronic control device, from the maximum value of the reception interval between the first data frame and the second data frame, which are data frames transmitted from the electronic control device. The abnormal frame determination device according to claim 13.

15. The predetermined value is a value based on the difference between the reception interval and the threshold. The abnormal frame detection device according to claim 1.

16. The maximum value of the judgment value is equal to the limit value. The abnormal frame detection device according to claim 1.

17. An abnormal frame determination method performed by an abnormal frame determination device (10) connected to an electronic control device (20) that transmits data frames at predetermined intervals, The first data frame, which is presumed to have been transmitted from the electronic control unit, is received (S101). The reception interval between the first data frame and the second data frame received immediately before the first data frame is calculated (S103). If the reception interval is shorter than the threshold, a predetermined value is added to the determination value stored in the storage unit and used for detecting abnormal frames (S105). If the determination value reaches the limit value, and the reception interval is longer than the proximity reception interval which is the criterion for determining whether the first data frame and the second data frame were received in close proximity, the second data frame is determined to be the abnormal frame (S109). Method for detecting abnormal frames.

18. An abnormal frame determination program that can be executed by an abnormal frame determination device (10) connected to an electronic control device (20) that transmits data frames at predetermined intervals, The first data frame, which is presumed to have been transmitted from the electronic control unit, is received (S101). The reception interval between the first data frame and the second data frame received immediately before the first data frame is calculated (S103). If the reception interval is shorter than the threshold, a predetermined value is added to the determination value stored in the storage unit and used for detecting abnormal frames (S105). If the determination value reaches the limit value, and the reception interval is longer than the proximity reception interval which is the criterion for determining whether the first data frame and the second data frame were received in close proximity, the second data frame is determined to be the abnormal frame (S109). An abnormal frame detection program.

Images