Abnormality detection device, abnormality detection system, and abnormality detection method

Abstract

The purpose of the present invention is to obtain an abnormality detection device, an abnormality detection system, and an abnormality detection method with which it is possible, while preventing a resource shortage even in a resource-limited environment, to achieve abnormality detection by monitoring communication data.　An abnormality detection device (100) comprises: an abnormality detection unit (105) which assesses the presence or absence of an abnormality in communication data (D); a rule update unit (103) which updates a detection rule (R1) on the basis of usage data (P) indicating resource usage, and generates an updated detection rule (R2) in which the scope of the assessment process to be executed has been set to be within the scope of a resource surplus; and an un-executed process management unit (106) which, if there is an un-executed assessment process which is not executed in the updated detection rule (R2) and there is surplus space in storage, executes a temporary storage process for storing an assessment rule of the un-executed assessment process and communication data (D) in the storage.

Description

Anomaly detection device, anomaly detection system, and anomaly detection method

[0001] The present application relates to an anomaly detection device, an anomaly detection system, and an anomaly detection method.

[0002] In recent in-vehicle systems, ECUs (Electronic Control Units) installed in each vehicle are connected via a wired or wireless network, and each ECU is configured to be able to communicate. In such systems where multiple control devices are connected via a network, it is necessary to timely detect abnormalities, such as unauthorized intrusions due to cyberattacks. Therefore, from the perspective of in-vehicle security, it is important to have the ability to monitor data flowing through the communication network and determine whether the data is normal or abnormal. However, because the volume of data flowing through the communication network is enormous, inefficient monitoring and determination of this data can place excessive load on each ECU and gateway, resulting in false positives and false negatives. This can also hinder the ECU's primary function of vehicle control. This problem is particularly pronounced when available resources (hardware resources) are limited. To address this issue, an in-vehicle network device has been disclosed that reduces the processing load required to detect unauthorized data by changing the method of monitoring communication data according to predefined rules depending on the vehicle's status and data type (see, for example, Patent Document 1).

[0003] JP 2017-47835 A

[0004] The technology disclosed in Patent Document 1 may be able to reduce the processing load by simplifying the monitoring of some communication data according to rules corresponding to the current vehicle state. However, in the technology disclosed in Patent Document 1, the relationship between the rules and the resource state is not necessarily clear, and there is a risk of resource shortages if the monitoring and processing of communication data are performed according to the rules. Furthermore, it is difficult to comprehensively define the rules, including vehicle states that are not normally expected.

[0005] The present application has been made to solve the above-mentioned problems, and aims to provide an anomaly detection device, an anomaly detection system, and an anomaly detection method that can detect anomalies by monitoring communication data while preventing resource shortages even in resource-limited environments.

[0006] The anomaly detection device disclosed in the present application comprises a communication control unit connected to a network and receiving communication data flowing through the network; a detection rule memory unit that includes judgment rules indicating judgment processes used to determine whether or not there is an anomaly in the communication data and stores the detection rules used to detect an anomaly in the communication data; an anomaly detection unit that determines whether or not there is an anomaly in the communication data; a resource status management unit that manages the usage status of resources used by the anomaly detection unit and outputs usage status data indicating the resource usage status; a rule update unit that updates the detection rules based on the usage status data and generates updated detection rules that limit the range of judgment processes to be executed to within the available resource capacity; and an unexecuted process management unit that executes temporary storage processing to store the judgment rule of the unexecuted judgment process and the communication data in storage when there is an unexecuted judgment process that is not executed in the updated detection rules and there is available storage capacity, and the anomaly detection unit determines whether or not there is an anomaly in the communication data based on the updated detection rules, and when the temporary storage processing is being executed, the anomaly detection unit executes the unexecuted judgment process when there is available resource capacity to execute the unexecuted judgment process.

[0007] The anomaly detection system disclosed in the present application includes a communication control unit connected to a network and receiving communication data flowing through the network; a detection rule storage unit that stores the detection rules used for detecting anomalies in the communication data, including determination rules indicating determination processes used to determine whether or not there is an anomaly in the communication data; a first anomaly detection unit that determines whether or not there is an anomaly in the communication data; a second anomaly detection unit whose resources are physically or logically separated from those used by the first anomaly detection unit; and a resource status management unit that manages the usage status of the resources used by the first anomaly detection unit and outputs usage status data indicating the usage status of the resources. The system includes a rule update unit that updates the detection rules based on usage data and generates updated detection rules in which the range of judgment processes to be executed is within the resource reserve, and an unexecuted process management unit that, when there is an unexecuted judgment process that is not executed in the updated detection rules and the communication device has reserve capacity, executes a transfer process that causes the communication device to send the judgment rule of the unexecuted judgment process and the communication data to a second anomaly detection unit, where the first anomaly detection unit determines whether or not there is an abnormality in the communication data based on the updated detection rules, and the second anomaly detection unit executes the unexecuted judgment process when the transfer process is being executed.

[0008] The anomaly detection method disclosed in the present application is an anomaly detection method for detecting anomalies in communication data flowing through a network, and includes the steps of managing the usage status of resources used to determine whether or not there is an anomaly in the communication data and outputting usage status data indicating the usage status of the resources; updating the detection rules used to detect anomalies in the communication data, which include determination rules indicating determination processes used to determine whether or not there is an anomaly in the communication data, based on the usage status data, and generating updated detection rules in which the range of determination processes to be executed is within the range of available resource capacity; determining whether or not there is an anomaly in the communication data based on the updated detection rules by a first anomaly detection unit; if there is an unexecuted determination process that is not executed in the updated detection rules and the communication device has available capacity, executing a transfer process by the communication device to send the determination rule of the unexecuted determination process and the communication data to a second anomaly detection unit whose resources are physically or logically separated from those used by the first anomaly detection unit; and if the transfer process is being executed, executing the unexecuted determination process by the second anomaly detection unit.

[0009] According to the anomaly detection device, anomaly detection system, or anomaly detection method disclosed in the present application, it is possible to realize anomaly detection by monitoring communication data while preventing resource shortages even in resource-limited environments.

[0010] 1 is a block diagram showing a configuration of an anomaly detection system according to embodiment 1. FIG. 2 is a diagram showing an example of detection rules according to embodiment 1, showing the detection rules before update. FIG. 3 is a diagram showing an example of detection rules according to embodiment 1, showing the detection rules after update. FIG. 4 is a diagram showing another example of detection rules according to embodiment 1, showing the detection rules before update. FIG. 5 is a diagram showing another example of detection rules according to embodiment 1, showing the detection rules after update. FIG. 6 is a diagram showing an example of a hardware configuration of an anomaly detection device according to embodiment 1. FIG. 7 is a flow diagram showing operation of the anomaly detection system according to embodiment 1. FIG. 8 is a flow diagram showing rule update processing according to embodiment 1. FIG. 9 is a flow diagram showing anomaly detection processing according to embodiment 1. FIG. 10 is a flow diagram showing operation when an unexecuted determination processing is executed in embodiment 1. FIG. 11 is a block diagram showing a configuration of an anomaly detection system according to embodiment 2. FIG. 12 is a diagram showing an example of detection rules according to embodiment 2, showing the detection rules before update. FIG. 13 is a diagram showing an example of detection rules according to embodiment 2, showing the detection rules after update. FIG. 14 is a diagram showing an example of a detection log according to embodiment 2, showing an example of detection logs generated by different anomaly detection units and an example of a detection log after integrating the respective detection logs. FIG. 15 is a flow diagram showing anomaly detection processing according to embodiment 2. Fig. 10 is a flow diagram showing an operation when an unexecuted determination process is executed in embodiment 2. Fig. 11 is a block diagram showing a configuration of an anomaly detection system in embodiment 3. Fig. 12 is a flow diagram showing an anomaly detection process according to embodiment 3.

[0011] Embodiment 1. Embodiment 1 will be described with reference to Figures 1 to 8. Figure 1 is a block diagram showing the configuration of an anomaly detection system in embodiment 1. An anomaly detection system 1000 is configured by connecting an anomaly detection device 100 and an ECU 110 via an in-vehicle network 120, i.e., a network. The number of ECUs 110 in the anomaly detection device 100 is not particularly limited. Each ECU 110 transmits and receives communication data via the in-vehicle network 120, and the plurality of ECUs 110 and the in-vehicle network 120 constitute a single in-vehicle system.

[0012] The anomaly detection device 100 is connected to an in-vehicle network 120 and includes a communication control unit 101 that receives communication data D flowing through the in-vehicle network 120 and transmits data such as anomaly detection results to the in-vehicle network 120 as needed; a detection rule storage unit 102 that stores a detection rule R1, which is a detection rule for anomaly detection; a rule update unit 103 that updates the detection rule R1 in accordance with the resource usage status of the anomaly detection device 100; a resource management unit 104 that manages the resource usage status of the anomaly detection device 100; and an anomaly detection unit 105 that detects anomalies in the communication data D flowing through the in-vehicle network 120 based on an updated detection rule R2. The anomaly detection device 100 also includes an unexecuted process management unit 106 that changes the anomaly detection process based on the updated detection rule R2, and an undetermined information storage unit 107 that stores information on unexecuted determination processes. Note that the term "resources" in the first embodiment refers to hardware resources used to process the functions of the anomaly detection device 100, which will be described in detail below.

[0013] The configuration and network architecture shown in FIG. 1 are merely examples, and do not necessarily have to be exactly as shown in FIG. 1 as long as the anomaly detection device 100 includes a communication control unit 101, a detection rule storage unit 102, an anomaly detection unit 105, a resource management unit 104, a rule update unit 103, an unexecuted process management unit 106, and an undetermined information storage unit 107 and is connected to one or more ECUs 110 via one or more in-vehicle networks 120. For example, instead of including all of the components in the anomaly detection device 100 as in the example shown in FIG. 1, some of the components may be moved to another device connected to the in-vehicle network 120, and necessary data may be transmitted and received via the in-vehicle network 120. That is, the configuration of each functional unit included in the anomaly detection device 100 may be provided in any of multiple devices connected via a network that can communicate with each other within the anomaly detection system 1000, and the entire anomaly detection system 1000 may include each functional unit of the anomaly detection device 100 shown in FIG. 1. Furthermore, the anomaly detection device 100 may be configured as a device dedicated to anomaly detection, or may be configured to also function as an ECU. The ECU 110 may also have the functions of a gateway control device that relays communications between ECUs 110, an engine control device, an EPS (Electric Power Steering) control device, an ADAS (Advanced Driver Assistance System) control device, etc.

[0014] The communication control unit 101 is realized by a communication device 84 (described later), and transmits and receives communication data D to and from the ECU 110 via an in-vehicle network 120. The in-vehicle network 120 may be, for example, a Control Area Network (CAN) or Ethernet (registered trademark), but is not limited to these. The ECU 110 is also not particularly limited as long as it transmits and receives communication data D via the in-vehicle network 120. The communication control unit 101 transmits the received communication data D to the abnormality detection unit 105 and the undetermined information storage unit 107 as necessary.

[0015] The detection rule storage unit 102 stores a detection rule R1. The detection rule R1 is a pre-defined rule for determining whether communication data transmitted and received by the communication control unit 101 is normal. FIG. 2A is a diagram showing an example of a detection rule according to the first embodiment, illustrating the detection rule R1, which is a detection rule before updating. As shown in the diagram, the detection rule R1 before updating includes a list of determination rules configured from, for example, five determination rules Ra to Re. Each determination rule includes a "rule number," "data ID," "source," "destination," "data size," "data," "determination priority," "determination range," and "resource usage rate," and is used to determine whether or not there is an abnormality in the communication data D.

[0016] "Rule number" is a number that uniquely identifies each judgment rule. "Data ID" is the ID of the communication data D. "Source" and "Destination" indicate the device (ECU 110) that is the source and the device (ECU 110) that is the destination when the communication data D is transmitted and received on the in-vehicle network 120. "Data size" is the data size of the communication data D, and "Data" indicates a specific data value or range.

[0017] "Determination priority" indicates the priority with which the determination process according to that determination rule is executed, and indicates that the determination process of a determination rule with a higher determination priority is executed preferentially. "Determination range" indicates whether the determination process of that determination rule is executed by the anomaly detection unit 105. A circle (○) indicates that it is executed, and a cross (×) indicates that it is not executed. However, as will be described later, determination processes that were not executed will also be executed later depending on the resource usage status. "Resource usage rate" indicates the usage rate of resources required when executing the determination process according to that determination rule (the usage rate of resources consumed when the determination process is executed).

[0018] The detection rule R1 shown in FIG. 2A represents a so-called "whitelist-based" detection rule, and is an example of a rule for normal communication data D. Specifically, a determination process is performed in which the communication data D to be determined matches the content of each determination rule, starting with the rule with the highest determination priority. If the communication data D to be determined matches the content of any of the determination rules, the communication data D is determined to be normal. When comparing the communication data D with each determination rule, a "match" is determined only if all items match; if even one item does not match, a "mismatch" is determined. For example, if the communication data D to be determined has a data ID of 0x01, a source ECU_C, a destination ECU_A, a data size of 8 bytes, and a value of data x of 7, the source and other information do not match with the determination rule Ra with rule number 1, which has the highest determination priority and is determined first, resulting in a "mismatch." Subsequently, the communication data D is determined using the determination rules Rb and Rc with rule numbers 2 and 3, but the data ID does not match, resulting in a "mismatch." In the judgment by judgment rule Rd of rule number 4, all items match and the result is "match," so the communication data D is judged to be normal and the judgment process ends. If the value of data x were 10, the result would also be "mismatch" by judgment rule Rd of rule number 4, and the subsequent judgment by judgment rule Re would also not match the data ID and the result would be "mismatch," so all judgment rules would result in "mismatch," the communication data D would be judged to be "abnormal," and an abnormality would be detected.

[0019] 2A, as long as it is a detection rule that can determine whether the communication data D is normal or not. Furthermore, each item of the determination rules Ra to Re is also arbitrary, and other items may be used as long as they can uniquely identify each determination rule, can determine whether the communication data D is normal or not, and can be used by the anomaly detection unit 105 and the rule update unit 103.

[0020] The rule update unit 103 updates the detection rule R1 based on the resource usage status of the anomaly detection device 100 and generates an updated detection rule R2. FIG. 2B is a diagram illustrating an example of a detection rule according to the first embodiment, showing the updated detection rule. In the updated detection rule R2 shown in FIG. 2B , the rule update unit 103 assumes that the resource reserve (resources available for anomaly detection) is 30% in usage rate, and updates the pre-update detection rule R1 so that the total resource usage rate of the determination rules included in the determination range (with "Determination Range" marked "○") is 30% or less. The rule update unit 103 receives usage status data P indicating the resource usage status from the resource management unit 104, grasps the current resource usage status, and updates the detection rule R1 to include as many determination rules as possible within the range that can be executed within the resource reserve (30% in this case). The rule update unit 103 also prioritizes including determination rules with a high determination priority in the determination range. In the example shown in Figure 2B, the detection rule R1 before the update included all of the determination rules Ra to Re in its determination range, but the updated detection rule R2 includes only the determination rules Ra to Rc in its determination range, with the determination rules Rd and Re falling outside the determination range. As a result, the total resource usage rate of the determination rules included in the determination range is 30%. As described above, the updated detection rule R2 limits the range of the determination process to be executed to within the available resource capacity.

[0021] The rule update unit 103 transmits the updated detection rule R2 to the anomaly detection unit 105 and the unexecuted process management unit 106 .

[0022] When the rule update unit 103 updates the detection rule R1, the items to be updated are the "judgment priority" and the "judgment range." The "judgment priority" is updated because prioritizing a judgment rule with a low resource usage rate can sometimes result in more efficient anomaly detection. For example, in another example of detection rules shown in FIGS. 3A and 3B , the resource usage rate of judgment rule Rb is set to 20%, and the resource usage rate of judgment rule Rc is set to 10%. In this case, if the judgment range is simply expanded starting with the judgment rule with the highest judgment priority without changing the judgment priority, the resource usage rate would reach 40% when judgment rule Rc was included in the judgment range, leaving only judgment rules Ra and Rb in the judgment range. Furthermore, 10% of the resource capacity would remain. Therefore, in the updated detection rule R2 shown in FIG. 3B , the judgment priority of judgment rule Rc is updated to "2," and the judgment priority of judgment rule Rd is updated to "3." As a result, the judgment range of the updated detection rule R2 includes three judgment rules: judgment rules Ra, Rb, and Rd. Furthermore, the entire 30% of the resource capacity is utilized. Therefore, anomaly detection can be performed more efficiently than when the judgment priority is not updated. In this way, it is also possible to update the judgment priority to generate a combination of judgment rules that minimizes the difference between the available resources and the total amount of resources required for the judgment processes to be executed, and to include the judgment processes of this combination of judgment rules in the judgment range.

[0023] The resource management unit 104 manages the usage status of resources provided in the anomaly detection device 100. In the first embodiment, "resources" refer to hardware resources used to process the functions provided in the anomaly detection device 100, and are resources used when the anomaly detection unit 105 executes determination processing. In addition, if the anomaly detection device 100 also has functions such as an ECU, the resources are also used to realize the functions of the ECU. Specific examples of "resources" include a processor, memory, storage, and communication device. FIG. 4 is a diagram showing an example of the hardware configuration of the anomaly detection device in the first embodiment.

[0024] The functions of the anomaly detection device 100 are realized by a hardware configuration such as that shown in Fig. 4. Specifically, the anomaly detection device 100 is mainly composed of a processor 81, a memory 82 which also serves as a main storage device, and a storage 83 which serves as an auxiliary storage device. The processor 81 is composed of, for example, a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), or the like. The memory 82 is configured with a volatile storage device such as a RAM (Random Access Memory), and the storage 83 is configured with a non-volatile storage device such as an eMMC (embedded Multi Media Card) or a flash memory, or a hard disk.

[0025] The storage 83 stores predetermined programs to be executed by the processor 81, and the processor 81 reads and executes these programs as appropriate to perform various arithmetic processing. At this time, the predetermined programs are temporarily saved from the storage 83 to the memory 82, and the processor 81 reads the programs from the memory 82. The arithmetic processing by each functional unit shown in Fig. 1 is realized by the processor 81 executing the predetermined programs as described above. The results of the arithmetic processing by the processor 81 are temporarily stored in the memory 82 and then stored in the storage 83 according to the purpose of the executed arithmetic processing.

[0026] The abnormality detection device 100 also includes a communication device 84 that realizes sending and receiving data to and from external devices via the in-vehicle network 120. The communication device 84 is, for example, a network interface card (NIC), but is not limited to this.

[0027] The resource utilization status managed by the resource management unit 104 includes, for example, the utilization rate and processing speed of the processor 81, the usage amount of the memory 82, the usage amount of the storage 83, and the communication band and communication speed of the communication device 84.

[0028] The resource management unit 104 acquires and stores the usage status of resources included in the anomaly detection device 100. The resource management unit 104 transmits the stored usage status data to the rule update unit 103 and the unexecuted process management unit 106 as usage status data P. The resource management unit 104 updates the stored resource usage status each time. The frequency, timing, and scope of the update may be determined arbitrarily.

[0029] The anomaly detection unit 105 receives the communication data D via the communication control unit 101, and performs a determination process on the communication data D to determine whether the communication data D is normal and to determine whether an anomaly exists, thereby detecting an anomaly in the communication data D. The anomaly detection unit 105 performs the determination process based on the updated detection rule R2. The specific description of the determination process is as described above. The anomaly detection unit 105 outputs the determination result as a detection log (not shown). The detection log may be recorded within the anomaly detection device 100, or may be transmitted to the ECU 110 or the like via the in-vehicle network 120 (to notify the ECU 110 as an anomaly detection result).

[0030] In the updated detection rule R2, some or all of the determination rules are not included in the determination range, and there is a possibility that some or all of the determination processes by the anomaly detection unit 105 will not be executed. The unexecuted determination processes will be executed through processing by the unexecuted process management unit 106 and the undetermined information storage unit 107, as described below.

[0031] The unexecuted process management unit 106 changes the execution method of the judgment process based on the resource usage status when there is a judgment rule that is not included in the judgment range in the updated detection rule R2 and there is a judgment process that has not been executed by the anomaly detection unit 105. The unexecuted process management unit 106 receives the updated detection rule R2 from the rule update unit 103 and the usage status data P from the resource management unit 104. There are various possible cases where some judgment processes are not executed due to resource usage status, but in embodiment 1, a case where some judgment processes cannot be executed due to a usage rate or processing speed of the processor 81 or insufficient available capacity of the memory 82 will be described as an example. The unexecuted process management unit 106 acquires information regarding the available capacity of the storage 83 from the usage status data P and performs temporary storage processing to store the unexecuted detection rule R21 and the communication data D to be judged in the unjudged information storage unit 107 according to the available capacity of the storage 83. The communication data D to be judged is stored as received by the communication control unit 101. The unexecuted detection rule R21 is a part of the updated detection rule R2, and is obtained by extracting only those judgment rules Ra to Re of the updated detection rule R2 whose judgment range is "x". In the case of the updated detection rule R2 shown in FIG. 2B, the unexecuted detection rule R21 is composed of judgment rules Rd and Re. Note that the judgment process of a judgment rule whose judgment range is "x" in the updated detection rule R2 corresponds to the "unexecuted judgment process".

[0032] When the unexecuted process management unit 106 executes the temporary storage process, it periodically receives subsequent usage status data P and monitors the latest resource usage status. The unexecuted process management unit 106 appropriately determines whether the resource margin (the utilization rate or processing speed of the processor 81, or the margin of usage of the memory 82) required to execute the determination process of the determination rules Rd and Re constituting the unexecuted detection rule R21 can be secured, and when it determines that the resource margin can be secured, it transmits the unexecuted detection rule R21 and the communication data D to be determined stored in the undetermined information storage unit 107 to the anomaly detection unit 105. The anomaly detection unit 105 executes the determination process of the determination rules Rd and Re that have not been executed. Note that the undetermined information storage unit 107 is realized by the storage 83, and therefore, storing the information in the undetermined information storage unit 107 is equivalent to storing the information in the storage 83.

[0033] As described above, even if there is a limit to the available resources, the judgment process is first executed to the extent possible with the available resources, and information about the unexecuted judgment processes is stored in the undetermined information storage unit 107. When the necessary resources are secured, the unexecuted judgment processes are executed, thereby executing all judgment processes that should be executed without omission.

[0034] Next, the operation will be described. FIG. 5 is a flow diagram showing the operation of the anomaly detection system in embodiment 1. As shown in the figure, the anomaly detection device executes a rule update process (step ST001) and an anomaly detection process (step ST002). Since the anomaly detection process is performed using the updated detection rule R2, the rule update process is performed first. However, since both processes are performed on continuously received communication data D, the rule update process and the anomaly detection process are performed independently of each other and at arbitrary timings. Therefore, each process is executed at arbitrary timings. For example, it is conceivable that only the rule update process is executed after a software update or when an accessory power is turned on, and the anomaly detection process is executed, for example, after a certain time has elapsed.

[0035] First, the rule update process will be described. Fig. 6 is a flow diagram showing the rule update process according to the first embodiment. In the rule update process, first, information included in the detection rule R1 is acquired (step ST011). The rule update unit 103 acquires information on each rule number, judgment priority, and resource usage rate from the judgment rules Ra to Re included in the detection rule R1.

[0036] Next, the resource usage status is acquired (step ST012). The rule update unit 103 receives the usage status data P from the resource management unit 104 and acquires the available resources for the anomaly detection unit 105 to perform the determination process as the resource usage status of the anomaly detection device 100. Here, as an example, the available capacities of the processor 81 and the memory 82 are acquired.

[0037] Next, the rule update unit 103 determines the detection rule range (step ST013) based on the information on the detection priority and resource usage rate acquired in step ST011 and the information on the available resource capacity acquired in step ST012, and determines the detection rules to be included in the detection range in order of the detection priority, within a range in which the total of the resource usage rates required for the detection process of each detection rule does not exceed the available resource capacity.

[0038] Next, the detection rules are updated (step ST014). The rule update unit 103 updates the judgment range ("◯" or "X") of each judgment rule as determined in step ST103. The rule update unit 103 transmits the detection rule R1 updated as described above to the anomaly detection unit 105 as updated detection rule R2.

[0039] The rule update process may be executed at any timing, for example, when the resource management unit 104 updates the resource usage status (usage status data P), or when the communication control unit 101 receives the communication data D to be judged.

[0040] Next, the abnormality detection process will be described. Fig. 7 is a flow diagram showing the abnormality detection process according to embodiment 1. First, the communication control unit 101 receives communication data D (step ST101).

[0041] Next, the anomaly detection unit 105 refers to the determination range of the detection rule (updated detection rule R2) (step ST102).

[0042] In the updated detection rule R2, if all the determination rules are included in the determination range, the process proceeds to step ST104, and if there is a determination rule that is not included in the determination range, the process proceeds to step ST106 (step ST103).

[0043] If all judgment rules are included in the judgment range (step ST103: Y), the abnormality detection unit 105 judges the target communication data D based on the detection rule (updated detection rule R2) (step ST104), and outputs and records the judgment result as a detection log (step ST105).

[0044] If there is a judgment rule that is not included in the judgment range (step ST103: N), first, the resource usage status is acquired (step ST106). The unexecuted process management unit 106 receives the usage status data P from the resource management unit 104 and acquires the usage status of the resources provided in the anomaly detection device 100 from the usage status data P. The unexecuted process management unit 106 also determines whether there is spare capacity in the storage 83 from the acquired resource usage status. If there is spare capacity in the storage 83, the process proceeds to step ST108; if there is no spare capacity, the process ends.

[0045] If there is spare capacity in the storage 83 (step ST107: Y), the communication data D to be judged and the judgment rules that are not included in the judgment range in the updated detection rules R2 are stored (step ST108: temporary storage processing). The unjudged information storage unit 107 stores the communication data D to be judged received from the communication control unit 101 and the unexecuted detection rules R21 received from the unexecuted process management unit 106. As described above, the unexecuted detection rules R21 are configured from the judgment rules that are not included in the judgment targets among the updated detection rules R2.

[0046] Next, after the resource surplus (the surplus capacity of the processor 81 and the memory 82, as described above) is secured, the communication data D is judged (step ST109). The unexecuted process management unit 106 periodically receives the usage status data P to update the resource surplus. If it is determined that the resource surplus exceeds the resource usage rate required for the unexecuted judgment process, the process proceeds to step ST109. Note that, since it is sufficient that all judgment processes are eventually executed, the timing to proceed to step ST109 may be when all judgment processes of the judgment rules included in the unexecuted detection rule R21 become executable, or may proceed to step ST109 as appropriate when some of the judgment processes become executable. The process of step ST109 is executed at an uncertain timing, when sufficient resource surplus capacity for the judgment process is secured. Therefore, if another abnormality detection process is being executed, the process proceeds from step ST108 to step ST104, and step ST109 is executed separately in parallel.

[0047] The details of the process of step ST109 will be described. Fig. 8 is a flow diagram showing the operation when executing unexecuted determination process in embodiment 1. First, communication data D to be determined is acquired (step ST1091). The abnormality detection unit 105 acquires the communication data D to be determined from the undetermined information storage unit 107.

[0048] Next, the anomaly detection unit 105 acquires the determination rules that are not included in the determination range (step ST1092). The anomaly detection unit 105 acquires the unexecuted detection rules R21 from the undetermined information storage unit 107, thereby acquiring the determination rules that are not included in the determination range in the updated detection rules R2.

[0049] Next, the communication data is judged based on the detection rule (step ST1093).The same process as in step ST104 is executed for the judgment rules that are not included in the judgment range.

[0050] Next, the determination result is recorded in a log (step ST1094), which is the same as the process in step ST105.

[0051] In the abnormality detection process, the processes from step ST102 onwards may be executed each time communication data D is received, or a certain amount of communication data D may be accumulated as a queue and executed all at once at a certain timing.

[0052] According to the first embodiment, anomaly detection by monitoring communication data can be achieved while preventing resource shortages even in a resource-limited environment. More specifically, the system includes an anomaly detection unit that determines whether or not an anomaly exists in the communication data; a rule update unit that updates the detection rules based on usage status data indicating resource usage status and generates updated detection rules that limit the range of judgment processes to be executed within the available resource capacity; and an unexecuted process management unit that, if there is an unexecuted judgment process that has not been executed in the updated detection rules and there is available storage capacity, executes a temporary storage process to store the judgment rule of the unexecuted judgment process and the communication data in storage. The anomaly detection unit determines whether or not an anomaly exists in the communication data based on the updated detection rules, and, if the temporary storage process is being executed, executes the unexecuted judgment process when there is available resource capacity to execute the unexecuted judgment process. As a result, even in a resource-limited environment, resource shortages are prevented because the range of judgment processes to be executed is changed depending on the available resource capacity for the judgment process. This allows for continuous anomaly detection of communication data without stopping processing even under high load.

[0053] Furthermore, if there are any unexecuted judgment processes in the updated detection rules, the judgment processes are executed when there are spare resources available. This prevents oversight of the detection rules and enables monitoring through the detection of anomalies in communication data without increasing the processing load.

[0054] Second Embodiment Next, a second embodiment will be described with reference to FIGS. 9 to 13. Components identical to or corresponding to those shown in FIGS. 1 to 8 are designated by the same reference numerals, and their description will be omitted. In the second embodiment, when all determination processes are not included in the determination range, an anomaly detection process is executed by an anomaly detection unit of another device on the system. FIG. 9 is a block diagram showing the configuration of an anomaly detection system according to the second embodiment. The anomaly detection system 2000 differs from the first embodiment in that an anomaly detection unit 211, which is another anomaly detection unit, is provided in the ECU 210, separate from the anomaly detection device 200. The anomaly detection device 200 includes a communication control unit 201, a detection rule storage unit 202, a rule update unit 203, a resource management unit 104, and an anomaly detection unit 205. The anomaly detection device 200 also includes an unexecuted process management unit 206 and a log recording unit 207. The anomaly detection unit 205 and the anomaly detection unit 211 correspond to a "first anomaly detection unit" and a "second anomaly detection unit," respectively.

[0055] As shown in FIG. 1 , in the second embodiment, not only the anomaly detection device 200 but also the ECU 210 includes an anomaly detection unit. That is, the ECU 210 also functions as an anomaly detection device. Note that, as in the first embodiment, the anomaly detection device 200 may also have the function of an ECU. The anomaly detection unit 205 of the anomaly detection device 200 and the anomaly detection unit 211 of the ECU 210 can be configured without any particular limitations as long as their resources are physically or logically separated and they can independently execute anomaly detection processing. That is, it is sufficient that the resources used by the anomaly detection unit 211 are physically or logically separated from the resources used by the anomaly detection unit 205. For example, the anomaly detection unit 211 does not necessarily need to be provided in the ECU 210, and may be provided in another device connected to the in-vehicle network 120 as long as the above conditions are met. The ECU 210 may also be configured in any manner as long as it can execute the abnormality detection process by the abnormality detection unit 211, and may be, for example, a switch, a system-on-a-chip (SOC), a virtual machine (VM), or a processor with multiple cores.

[0056] The communication control unit 101 is basically the same as the communication control unit 101 of the first embodiment, but differs from the first embodiment in that it transmits the communication data D to be determined and the unexecuted detection rule R21* to the abnormality detection unit 211 of the ECU 210, and receives a detection log L2 from the abnormality detection unit 211. The unexecuted detection rule R21* and the detection log L2 will be described later.

[0057] The detection rule storage unit 202 is similar to the detection rule storage unit 102 of the first embodiment, but the detection rule R1* that it stores is different from that of the first embodiment. The detection rule R1* will be described later.

[0058] The rule update unit 203 is the same as the rule update unit 203 for rule 1 in the first embodiment, but since the detection rule R1* before the update is different from that in the first embodiment, the updated detection rule R2* is also different from that in the first embodiment.

[0059] The detection rules of the second embodiment will now be described. FIG. 10A is a diagram showing an example of a detection rule according to the second embodiment, specifically a diagram showing the detection rule before updating. FIG. 10B is a diagram showing an example of a detection rule according to the second embodiment, specifically a diagram showing the detection rule after updating. Note that FIGS. 10A and 10B omit some of the same items as those in FIGS. 2A and 2B, which show the detection rules according to the first embodiment, specifically, "source," "destination," "data size," and "data." As shown in FIGS. 10A and 10B , the detection rule R1* and the updated detection rule R2* also include a list of determination rules, for example, consisting of five determination rules Ra* to Re*. Each determination rule includes, as in the first embodiment, a "rule number," a "data ID," a "source," a "destination," a "data size," a "data," a "determination priority," a "determination range," and a "resource usage rate."

[0060] The judgment rules Ra* to Re* further include the items "risk value in the event of oversight" and "number of times included in the judgment range." The "risk value in the event of oversight" indicates the importance of the judgment rule from the perspective of risk assessment and is predetermined. The "number of times included in the judgment range" is the number of times the judgment rule was included in the judgment range over a certain period of time, and is calculated by counting the number of times it was included in the judgment range when the judgment range was determined in the rule update process. In the first embodiment, the judgment range was included in descending order of judgment priority. However, in the second embodiment, a combination of judgment rules is calculated that maximizes the sum of the product of the judgment priority and the risk value in the event of oversight, weighted by the number of times it was included in the judgment range, and the judgment rules comprising the calculated combination are included in the judgment range. In the example shown in FIG. 10B , in the updated detection rule R2, only the judgment rules Ra* and Rd* are included in the judgment range, while the judgment rules Rb*, Rc*, and Re* are outside the judgment range. As a result, the total resource usage rate of the judgment rules included in the judgment range is 30%.

[0061] The determination priority may also be updated based on a value obtained by weighting the product of the determination priority and the risk value of missed detection by the number of times the rule has been included in the determination range. For example, the determination priority of a determination rule that has been included in the determination range less frequently may be increased so that the rule is preferentially included in the determination range. In the example shown in FIGS. 10A and 10B , it can be seen that the determination priorities of the determination rules Ra*, Rb*, and Rd* are updated so that the determination rules Ra* and Rd are included in the determination range. Furthermore, the number of times the determination rules Ra* and Rd* are included in the determination range after the update has increased by 1. Note that the above is just one example, and other methods are also possible as long as the determination rules to be included in the determination range are determined based on at least one of the "risk value of missed detection," "determination priority," and "number of times included in the determination range."

[0062] The detection rule R1* and updated detection rule R2* in the second embodiment are as described above, but the detection rule R1 and updated detection rule R2 in the first embodiment may also be used in the second embodiment. It is also possible to use the detection rule R1* and updated detection rule R2* in the first embodiment.

[0063] The resource management unit 104 is the same as in embodiment 1. It manages the usage status of the resources provided in the anomaly detection device 200 and transmits data on the resource usage status as usage status data P to the rule update unit 203 and the unexecuted process management unit 206.

[0064] The anomaly detection unit 205 executes a determination process on the communication data D in the same manner as the anomaly detection unit 105 of the first embodiment to determine whether the communication data D is normal and to determine whether an anomaly exists, thereby detecting an anomaly in the communication data D. The anomaly detection unit 205 determines whether the communication data D is normal and detects an anomaly based on the updated detection rule R2*. The anomaly detection unit 205 also transmits the determination result to the log recording unit as a detection log L1. The detection log L1 will be described later.

[0065] The unexecuted process management unit 206 is basically similar to the unexecuted process management unit 106 in the first embodiment, and changes the execution method of the determination process when there is a determination rule that is not included in the determination range in the updated detection rule R2* and there is a determination process that has not been executed by the anomaly detection unit 205. However, whereas the unexecuted process management unit 106 in the first embodiment performs processing depending on the availability of spare capacity in the storage 83, the unexecuted process management unit 206 performs processing depending on the availability of spare capacity in the communication device 84. The unexecuted process management unit 206 receives the updated detection rule R2* from the rule update unit 203 and receives the usage status data P from the resource management unit 104. The unexecuted process management unit 206 acquires information regarding the spare capacity of the communication device 84 from the usage status data P, and executes a "transfer process" in which the communication control unit 201 transmits the unexecuted detection rule R21* and the communication data D to be determined to the anomaly detection unit 211 of the ECU 210 depending on the availability of the communication device 84. In the case of the updated detection rule R2* shown in Fig. 10B, the unexecuted detection rule R21* is composed of the determination rules Rb*, Rc*, and Re*. Note that since the communication control unit 201 is realized by the communication device 84, having the communication control unit 201 transmit the rule corresponds to having the communication device 84 transmit the rule.

[0066] When the unexecuted process management unit 206 executes the transfer process, the anomaly detection unit 211 receives the unexecuted detection rule R21* and the communication data D, and determines whether or not there is an anomaly in the communication data D based on the unexecuted detection rule R21*. That is, the anomaly detection unit 211 executes the determination process of the determination rules Rb*, Rc*, and Re*. The anomaly detection unit 211 transmits the result of the determination process as a detection log L2 to the log recording unit 207 via the in-vehicle network 120 and the communication control unit 201.

[0067] The log recording unit 207 acquires the detection log L1 from the anomaly detection unit 205 and the detection log L2 from the anomaly detection unit 211, integrates the detection log L1 and the detection log L2, and records the integrated detection log L. FIG. 11 is a diagram showing an example of a detection log according to the second embodiment, illustrating an example of detection logs generated by different anomaly detection units and an example of a detection log obtained by integrating the detection logs. The detection log L1, the detection log L2, and the integrated detection log L include the following: "transmission / reception time," "log recording time," "data ID," "sender," "destination," "data size," "data," "rule number," and "anomaly item." Note that the items to be recorded are arbitrary, and other items may be used as long as they can be used in log analysis to identify the cause of an anomaly, etc.

[0068] The "transmission / reception time" is the time when the communication data D to be judged is received by the anomaly detection unit (the anomaly detection unit 205 or the anomaly detection unit 211). The "log recording time" is the time when each log is recorded by the log recording unit 207 (or each device). The "data ID" is the data ID of the communication data to be judged. The "source" and "destination" indicate the source and destination devices when the communication data D is transmitted and received over the in-vehicle network 120. The "data size" is the data size of the communication data D, and the "data" indicates a specific data value or range. The "rule number" is the rule number of the judgment rule for the executed judgment process. The "abnormal item" is an item for which the communication data D did not conform to the judgment rule in the judgment process and is determined to be abnormal in relation to the judgment process in the judgment rule. However, the detection log shown in FIG. 11 is an example, and the items recorded in the detection logs L1 and L2 are arbitrary. Any other item may be used as long as it can be used in log analysis to identify the cause of an abnormality, etc.

[0069] The log recording unit 207 sequentially receives the detection logs L1 and L2 sent sequentially from the anomaly detection unit 205 and the anomaly detection unit 211. When recording a new detection log, the log recording unit 207 integrates the newly received detection log with the already recorded detection log and records the integrated detection log. In the example shown in FIG. 11 , the detection logs L1 and L2 are integrated so that each log (one line of log) in the integrated detection log L, which is the integrated log, is arranged in order of transmission and reception time, so that the order of each log matches the order of transmission and reception. Note that if the detection logs L1 and L2 are recorded without considering consistency, they will be recorded in the order of log recording time. Here, the anomaly detection unit 205 and the anomaly detection unit 211 each perform their own determination processes, and the detection logs L1 and L2 are also each sent to the log recording unit 207. Therefore, the chronological order of the transmission and reception times of the communication data D does not necessarily match the chronological order of the log recording times. In particular, in the second embodiment, the resources used by the anomaly detection unit 205 and the anomaly detection unit 211 are physically or logically separated. By ensuring that the order of each log is consistent with the order of transmission and reception as described above, even if the anomaly detection unit 205 and the anomaly detection unit 211 each perform their own judgment processes independently, the final integrated detection log L is arranged in the order in which the communication data D was transmitted and received, making it easy to analyze.

[0070] Generally, in log analysis, analysis is rarely performed from the log of a single device, but analysis may be performed from the log of the entire system, and time series information on the sending and receiving times of communication data may be important information in the analysis. Regarding methods for ensuring log consistency, a method of combining related detection logs L1 and L2 may also be considered. There are no particular limitations on the method, as long as it can improve the ease of log analysis when identifying the cause of an abnormality, etc.

[0071] Next, the operation will be described. In the second embodiment, rule update processing and anomaly detection processing are executed in the same manner as in the first embodiment. Although the specific method of rule update processing differs from that in the first embodiment, for example, the update is performed taking into account the "risk value in the event of oversight," the flow is the same. Also, like the first embodiment, the rule update processing and the anomaly detection processing are executed independently of each other at arbitrary timing. Therefore, only the anomaly detection processing will be described for the operation in the second embodiment. FIG. 12 is a flow diagram showing the anomaly detection processing according to the second embodiment. First, the communication control unit 201 receives communication data D (step ST201).

[0072] Next, the anomaly detection unit 205 refers to the determination range of the detection rule (updated detection rule R2*) (step ST202).

[0073] In the updated detection rule R2*, if all the determination rules are included in the determination range, the process proceeds to step ST204, and if there is a determination rule that is not included in the determination range, the process proceeds to step ST206 (step ST203).

[0074] If all the determination rules are included in the determination range (step ST203: Y), the anomaly detection unit 205 determines the target communication data D based on the detection rule (updated detection rule R2*) (step ST204), outputs the determination result as a detection log L1, and records it as an integrated detection log L by the log recording unit 207 (step ST105). If an integrated log has already been recorded, the log recording unit 207 integrates the detection log L1 into the integrated detection log L and records it. As described above, when integrating the detection logs, the integration is performed so that the order of each log matches the order of transmission and reception.

[0075] If there is a judgment rule that is not included in the judgment range (step ST203: N), first, the resource usage status is acquired (step ST206). The unexecuted process management unit 206 receives the usage status data P from the resource management unit 104 and acquires the usage status of the resources provided in the anomaly detection device 200 from the usage status data P. The unexecuted process management unit 206 also determines whether the communication device 84 has spare capacity from the acquired resource usage status. If the communication device 84 has spare capacity, the process proceeds to step ST208; if not, the process ends.

[0076] If the communication device 84 has spare capacity (step ST207: Y), the unexecuted process management unit 206 causes the communication control unit 201 to transmit the communication data D to be judged and the unexecuted detection rule R21*, which is composed of judgment rules not included in the judgment range of the updated detection rule R2*, to the abnormality detection unit 211 of the ECU 210 (step ST208: transfer process). The ECU 210 sends the received communication data D and the unexecuted detection rule R21* to the ECU 210.

[0077] When anomaly detection unit 211 receives communication data D and unexecuted detection rule R21* from communication control unit 201 of anomaly detection device 200, it executes unexecuted determination processing that has not been executed by anomaly detection unit 205, and determines communication data D (step ST209). As described above, the anomaly detection processing by anomaly detection unit 205 and the anomaly detection processing by anomaly detection unit 211 are executed independently, and therefore the processing of steps ST204 and ST205 and the processing of step ST209 are also executed in parallel.

[0078] The details of the process of step ST209 will be described. Fig. 13 is a flow diagram showing the operation when an unexecuted determination process is executed in the second embodiment. First, the communication data D to be determined is acquired (step ST2091). The abnormality detection unit 211 acquires the communication data D received by the ECU 210 from the communication control unit 201.

[0079] Next, the abnormality detection unit 205 acquires the determination rules that are not included in the determination range (step ST2092). The abnormality detection unit 205 acquires the unexecuted detection rules R21* that the ECU 210 has received from the communication control unit 201, thereby acquiring the determination rules that are not included in the determination range in the updated detection rules R2*.

[0080] Next, the communication data is judged based on the detection rules (step ST2093). The abnormality detection section 211 executes the same process as the process in step ST204 by the abnormality detection section 205 for the judgment rules that are not included in the judgment range.

[0081] Next, a log of the determination result is recorded (step ST2094). The abnormality detection unit 211 transmits the detection log L2 to the communication control unit 201 of the abnormality detection device 200. The communication control unit 201 transmits the received detection log L2 to the log recording unit 207. As in step ST205, if there is an already recorded integrated log, the log recording unit 207 integrates the detection log L2 into the integrated detection log L and records it. When integrating the detection logs, the integration is performed so that the order of each log matches the order of transmission and reception. The rest is the same as in embodiment 1.

[0082] According to the second embodiment, the same effect as that of the first embodiment can be achieved. More specifically, an updated detection rule is generated in the same manner as in the first embodiment, and the anomaly detection unit determines whether or not an anomaly exists in the communication data based on the updated detection rule within the available resources. Furthermore, the anomaly detection unit includes another anomaly detection unit whose resources are physically or logically separated. When there is an unexecuted determination process that has not been executed in the updated detection rule and the communication device has available resources, the unexecuted process management unit executes a transfer process to transmit the determination rule of the unexecuted determination process and the communication data to the other anomaly detection unit. When the transfer process is executed, the other anomaly detection unit executes the unexecuted determination process, thereby preventing the detection rule from being overlooked. Furthermore, since the other anomaly detection unit is provided in a device (ECU) separate from the anomaly detection device and uses resources separate from the anomaly detection unit, the other anomaly detection unit can continue to detect anomalies in the communication data without stopping processing even under high load, and can perform monitoring processing through the detection of anomalies in the communication data.

[0083] Furthermore, when updating detection rules, the scope of the judgment process to be executed and the judgment priority are changed according to the available resources for executing the judgment process, the judgment priority, and the risk value of missed detection, so that even under heavy loads, the effectiveness of the monitoring process can be maximized and monitoring of communication data can be continued.

[0084] Furthermore, when recording a detection result log that is the result of an anomaly detection, the detection log of the anomaly detection unit is integrated with the detection logs of other anomaly detection units, and when integrating, each detection log is arranged in the order of the transmission and reception time of the communication data. This aligns the order of each log with the order of transmission and reception, making it easier to analyze the logs and facilitates log analysis to identify the cause of an anomaly, etc.

[0085] Embodiment 3. Next, embodiment 3 will be described with reference to FIGS. 14 and 15. Note that components that are the same as or equivalent to those shown in FIGS. 1 to 13 are assigned the same reference numerals, and their description will be omitted. embodiment 3 is a combination of embodiment 1 and embodiment 2. FIG. 14 is a block diagram showing the configuration of an anomaly detection system in embodiment 3. FIG. 14 shows the anomaly detection system of embodiment 3 in a form that is based on embodiment 2 and adds components specific to embodiment 1, but the system will be similar even if it is based on embodiment 1 and adds components specific to embodiment 2. Also, to avoid cluttering the drawings, some of the data flow is omitted, but components that are assigned the same reference numerals as embodiments 1 and 2 are the same as those in embodiments 1 and 2, respectively. The anomaly detection device 300 of anomaly detection system 3000 differs from embodiment 2 in that it is provided with an undetermined information storage unit 107.

[0086] The unexecuted process management unit 306 changes the execution method of the judgment process based on the resource usage status when there is a judgment rule that is not included in the judgment range in the updated detection rule R2* and there is a judgment process that has not been executed by the anomaly detection unit 205. The unexecuted process management unit 306 receives the updated detection rule R2* from the rule update unit 203 and receives the usage status data P from the resource management unit 104. The unexecuted process management unit 306 obtains information regarding the available capacities of the storage 83 and the communication device 84 from the usage status data P, and manages the processes that have not been executed by the anomaly detection unit 205 according to the available capacities of the storage 83 and the communication device 84.

[0087] If there is room in the storage 83, the unexecuted process management unit 306 stores the unexecuted detection rule R21* and the communication data D to be judged in the undetermined information storage unit 107. Thereafter, similar to the unexecuted process management unit 106 in the first embodiment, at the timing when it is determined that the spare capacity of resources required to execute the unexecuted judgment process (the usage rate or processing speed of the processor 81, or the spare capacity of the memory 82 usage) can be secured, the unexecuted process management unit 306 causes the anomaly detection unit 205 to transmit the unexecuted detection rule R21* and the communication data D to be judged stored in the undetermined information storage unit 107, and causes the anomaly detection unit 205 to execute the unexecuted judgment process.

[0088] If the communication device 84 has capacity, the unexecuted process management unit 306 transmits the unexecuted detection rule R21* and the communication data D to be determined to the abnormality detection unit 211 of the ECU 210 via the communication control unit 201 and the in-vehicle network 120. The abnormality detection unit 211 executes the unexecuted determination process (determination process of the determination rules that constitute the unexecuted detection rule R21*) as in the second embodiment, and transmits the result of the determination process as a detection log L2 to the log recording unit 207 via the in-vehicle network 120 and the communication control unit 201. The log recording unit 207 integrates the received detection log with already recorded logs and records the integrated detection log L, as in the second embodiment.

[0089] Next, the operation will be described. Since the only difference between the third embodiment and the second embodiment is the abnormality detection processing, only the flow of the abnormality detection processing will be described here. Fig. 15 is a flow diagram showing the abnormality detection processing according to the third embodiment. Steps ST201 to ST206 are the same as those in the second embodiment.

[0090] After obtaining the resource usage status in step ST206, the unexecuted process management unit 306 determines whether the resource with spare capacity is the storage 83 or the communication device 84 based on the usage status data P. If the resource with spare capacity is the storage 83, the process proceeds to step ST308, and if the resource with spare capacity is the communication device 84, the process proceeds to step ST309 (step ST307). If both have spare capacity, the process may proceed to either one. For example, it is conceivable to proceed to the one with the larger spare capacity. Although not shown, if neither has spare capacity, the process ends.

[0091] If the storage 83 has spare capacity, the processes of steps ST108 and ST109 of the first embodiment are executed (step ST308). If the communication device 84 has spare capacity, the processes of steps ST208 and ST209 of the second embodiment are executed (step ST309). The rest is the same as in the second embodiment.

[0092] According to the third embodiment, if there is spare capacity in the storage, the same effect as that of the first embodiment can be obtained, and if there is spare capacity in the communication device, the same effect as that of the second embodiment can be obtained.

[0093] In the above embodiments, the anomaly detection system and the anomaly detection device of each embodiment are described as being applied to an ECU, but the present invention is not limited to this and may be applied to a control device or control system for mobility such as construction machinery, agricultural machinery, ships, railways, and aircraft. It may also be applied to industrial control systems for factories, buildings, infrastructure facilities, and the like.

[0094] Although various exemplary embodiments and examples are described in this application, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not illustrated are contemplated within the scope of the technology disclosed in this application. For example, this includes cases where at least one component is modified, added, or omitted, or where at least one component is extracted and combined with components of another embodiment.

[0095] 81 Processor, 82 Memory, 83 Storage, 84 Communication device, 100, 200, 300 Anomaly detection device, 101, 201 Communication control unit, 102, 202 Detection rule storage unit, 103, 203 Rule update unit, 104 Resource management unit, 105, 205, 211 Anomaly detection unit, 106, 206, 306 Unexecuted process management unit, 107 Undetermined information storage unit, 110, 210 ECU, 120 In-vehicle network, 207 Log recording unit, 1000, 2000, 3000 Anomaly detection system, D Communication data, L Integrated detection log, L1, L2 Detection log, P Usage status data, R1, R1* Detection rule, R2, R2* Updated detection rule, R21, R21* Unexecuted detection rules, Ra to Re, Ra* to Re* judgment rules

Claims

1. A communication control unit connected to a network and receiving communication data flowing through the network; A detection rule storage unit that stores a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data and a detection rule used for detecting an abnormality in the communication data; An abnormality detection unit that determines the presence or absence of an abnormality in the communication data; A resource status management unit that manages the usage status of resources used by the abnormality detection unit and outputs usage status data indicating the usage status of the resources; A rule update unit that updates the detection rule based on the usage status data and generates an updated detection rule in which the range of the determination process to be executed is within the remaining capacity range of the resources; An unexecuted process management unit that, when there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the storage, executes a temporary storage process of storing the determination rule and the communication data of the unexecuted determination process in the storage; The abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule; When the temporary storage process is being executed, the abnormality detection unit executes the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured. An abnormality detection device characterized by this.

2. The determination rule includes a determination priority, and the rule update unit includes the determination process of the determination rule with a higher determination priority in the range of the determination process to be preferentially executed. The abnormality detection device according to claim 1.

3. The determination rule includes data indicating the amount of resources required for the execution of the determination process, and the rule update unit updates the determination priority to minimize the difference between the remaining capacity of the resources and the total amount of resources required for the executed determination process. The abnormality detection device according to claim 2, which generates a combination of determination rules and includes the determination process of the combination of determination rules in the range of the determination process to be executed.

4. The determination rule includes a risk value when an abnormality detection is missed and data on the number of times included in the range of the determination process to be executed, and the rule update unit generates a combination of the determination processes based on at least one of the risk value, the determination priority, and the number of times, and includes the determination process of the combination of determination rules in the range of the determination process to be executed. The abnormality detection device according to claim 2.

5. The abnormal detection device according to claim 1, wherein the usage data includes at least one of the usage rate and processing speed of the processor, the amount of memory used, the amount of storage used, the communication bandwidth and communication speed of the communication device.

6. A communication control unit connected to a network and receiving communication data flowing through the network; A detection rule storage unit that stores a detection rule indicating a determination process used for determining the presence or absence of an abnormality in the communication data and stores a detection rule used for detecting an abnormality in the communication data; A first abnormality detection unit that determines the presence or absence of an abnormality in the communication data; A second abnormality detection unit in which the resources used by the first abnormality detection unit are physically or logically separated; A resource status management unit that manages the usage status of the resources used by the first abnormality detection unit and outputs usage data indicating the usage status of the resources; A rule update unit that updates the detection rule based on the usage data and generates an updated detection rule in which the range of the determination process to be executed is within the remaining capacity range of the resources; An unexecuted process management unit that, when there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the communication device, executes a transfer process that causes the communication device to transmit the determination rule of the unexecuted determination process and the communication data to the second abnormality detection unit; The first abnormality detection unit determines the presence or absence of an abnormality in the communication data based on the updated detection rule; The second abnormality detection unit executes the unexecuted determination process when the transfer process is being executed. An abnormality detection system characterized by this.

7. When there is an unexecuted determination process that is not executed in the updated detection rule, When there is remaining capacity in the storage and no remaining capacity in the communication device, the unexecuted process management unit executes a temporary storage process of storing the determination rule of the unexecuted determination process and the communication data in the storage; When there is remaining capacity in both the storage and the communication device, the unexecuted process management unit selects and executes either the temporary storage process or the transfer process; When the temporary storage process is executed by the unexecuted process management unit, The first abnormality detection unit determines the presence or absence of an abnormality in the communication data by executing the unexecuted determination process when the remaining capacity of the resources capable of executing the unexecuted determination process is secured. When the transfer process is executed by the unexecuted process management unit, The second abnormality detection unit determines the presence or absence of an abnormality in the communication data by executing the unexecuted determination process. The abnormality detection system according to claim 6.

8. Further comprising a log recording unit that records a detection log which is a result of determining the presence or absence of an abnormality in the communication data, When the transfer process is executed, the log recording unit integrates and records the detection logs respectively obtained from the first abnormality detection unit and the second abnormality detection unit. The abnormality detection system according to claim 6 or 7.

9. The determination rule includes a determination priority, and the rule update unit includes, in the range of the determination process, preferentially executing the determination process of the determination rule having a higher determination priority. The abnormality detection system according to claim 6 or 7.

10. The determination rule includes data indicating the amount of resources required for the execution of the determination process. The rule update unit updates the determination priority to generate a combination of determination rules that minimizes the difference between the remaining resources and the total amount of resources required for the executed determination process, and includes the determination process of the combination of determination rules in the range of the determination process to be executed. The abnormality detection system according to claim 9.

11. The determination rule includes a risk value when an abnormality detection is missed and data on the number of times included in the range of the determination process to be executed. The rule update unit generates a combination of the determination processes based on at least one of the risk value, the determination priority, and the number of times, and includes the determination process of the combination of determination rules in the range of the determination process to be executed. The abnormality detection system according to claim 9.

12. The usage status data includes at least one data of the usage rate and processing speed of the processor, the usage amount of the memory, the usage amount of the storage, the communication bandwidth and communication speed of the communication device. The abnormality detection system according to claim 6.

13. An abnormality detection method for detecting an abnormality in communication data flowing through a network, Managing the usage status of resources used for determining the presence or absence of an abnormality in the communication data, and outputting usage status data indicating the usage status of the resources. Including a determination rule indicating a determination process used to determine the presence or absence of an abnormality in the communication data, updating a detection rule used for detecting an abnormality in the communication data based on the usage status data, and generating an updated detection rule with the range of the determination process to be executed within the range of the remaining capacity of the resource. A step of determining the presence or absence of an abnormality in the communication data based on the updated detection rule by a first abnormality detection unit. When there is an unexecuted determination process that is not executed in the updated detection rule and there is remaining capacity in the communication device, the communication device transmits the determination rule and the communication data of the unexecuted determination process to a second abnormality detection unit in which the resources used are physically or logically separated from those of the first abnormality detection unit, and executes a transfer process. An abnormality detection method, comprising: when the transfer process is executed, a step of executing the unexecuted determination process by the second abnormality detection unit.