Detection device, detection method, and computer program

Abstract

A device according to one embodiment of the present disclosure is a device for detecting unauthorized intrusion into a network, the device comprising: an acquisition unit that acquires a communication frame from a plurality of monitoring targets; and a monitoring execution unit that monitors the presence or absence of an abnormality related to the communication frame for each of the plurality of monitoring targets. The monitoring execution unit executes at least one of first time division monitoring for switching the monitoring target in a time division manner and second time division monitoring for switching a monitoring program for the monitoring target in a time division manner.

Description

Detection device, detection method, and computer program

[0001] This application claims priority to Japanese Patent Application No. 2023-124460, filed on July 31, 2023, and incorporates by reference all of the contents of that application.

[0002] Patent Literature 1 describes a technology that divides multiple device operations into time intervals, creates an operation model from the chronological order of the operations, and detects anomalies using the created model. Patent Literature 2 describes a technology that calculates a trust score according to the type of detected anomaly and switches between multiple robot control modes according to the calculated trust score. Patent Literature 3 describes a technology that selects a transfer device whose traffic volume does not exceed the resources of a defense device in order to increase the possibility of appropriately dealing with attack traffic.

[0003] Patent Document 4 describes a technology for allocating packets to be transferred to a security device and compressing the payload of the allocated packets. Patent Documents 5 and 6 describe technologies for transmitting sampled information under normal circumstances and transmitting a full log when a detector in a vehicle determines an abnormality, in order to reduce the amount of monitoring data transmitted while maintaining an appropriate monitoring level.

[0004] Patent Literature 7 describes a technology for identifying a device suspected of being attacked among multiple devices connected to a CAN bus and collecting logs from that device. Patent Literature 8 describes a technology for detecting a vehicle in which an attacker may be conducting reverse engineering activities and for intensively monitoring attacks against that vehicle. Patent Literature 9 describes a technology for changing at least one of a communication method, a defense method, and a log storage method depending on the depth of the attack.

[0005] Japanese Patent Application Laid-Open No. 2019-101895 International Publication No. 2022 / 049894 Japanese Patent Application Laid-Open No. 2020-14089 Japanese Patent Application Laid-Open No. 2020-17826 International Publication No. 2018 / 105321 International Publication No. 2018 / 105319 International Publication No. 2022 / 091754 International Publication No. 2021 / 038869 Japanese Patent Application Laid-Open No. 2019-125344

[0006] A detection device according to one aspect of the present disclosure is a device that detects unauthorized intrusions into a network, and includes an acquisition unit that acquires communication frames from multiple monitoring targets, and a monitoring execution unit that monitors the presence or absence of abnormalities in the communication frames for each of the multiple monitoring targets, and executes at least one of first time-division monitoring that switches between the monitoring targets in a time-division manner, and second time-division monitoring that switches between monitoring programs for the monitoring targets in a time-division manner.

[0007] The embodiments of the present disclosure may be realized by an apparatus, a system, a method, an integrated circuit, a computer program, or a non-transitory computer-readable recording medium, or any combination thereof. The recording medium may be either volatile or non-volatile. The apparatus may be composed of multiple individual devices. When composed of multiple individual devices, they may be arranged in a single housing or may be arranged separately in two or more separate housings.

[0008] FIG. 1 is a network configuration diagram showing an example of the configuration of an in-vehicle communication system. FIG. 2 is a block diagram showing an example of the configuration of an IDS function. FIG. 3 is an explanatory diagram showing an example of first setting information. FIG. 4 is an explanatory diagram showing an example of second setting information. FIG. 5 is an explanatory diagram showing an example of third setting information. FIG. 6 is an explanatory diagram showing an example of fourth setting information. FIG. 7 is an explanatory diagram showing an example of fifth setting information. FIG. 8 is an explanatory diagram showing an example of sixth setting information. FIG. 9 is a network configuration diagram showing a modified example of an in-vehicle communication system. FIG. 10 is a block diagram showing a modified example of the IDS function.

[0009] <Problem to be Solved by the Present Disclosure> An in-vehicle communication system is considered that detects unauthorized intrusions into a network using an electronic control unit (ECU) for an IDS (Intrusion Detection System) that monitors multiple subnetworks. In this case, if IDS processing is performed on all communication frames circulating in each monitored network at once, the processing load on the ECU becomes excessive, making appropriate monitoring difficult. In view of the above conventional problems, the present disclosure aims to provide a detection device that can appropriately monitor multiple monitored networks.

[0010] Effect of the Present Disclosure According to the present disclosure, it is possible to appropriately monitor a plurality of monitoring targets.

[0011] <Outline of Embodiments of the Present Disclosure> Below, an outline of embodiments of the present disclosure will be listed and described.

[0012] (1) A detection device according to this embodiment is a device for detecting unauthorized intrusions into a network, and includes an acquisition unit that acquires communication frames from multiple monitoring targets, and a monitoring execution unit that monitors the communication frames for each of the multiple monitoring targets for abnormalities, wherein the monitoring execution unit executes at least one of first time-sharing monitoring that switches between the monitoring targets in a time-sharing manner and second time-sharing monitoring that switches between monitoring programs for the monitoring targets in a time-sharing manner. According to the detection device of this embodiment, the monitoring execution unit executes at least one of the first time-sharing monitoring and the second time-sharing monitoring, thereby enabling appropriate monitoring of multiple monitoring targets while reducing the processing load on the monitoring execution unit.

[0013] (2) In the detection device of (1) above, the monitoring execution unit may perform the first time-sharing monitoring during normal times when no abnormality is present, and when the abnormality is detected by the first time-sharing monitoring, the monitoring execution unit may increase the execution frequency of the monitoring program for the monitoring target in which the abnormality is detected or may execute the monitoring program alone. In this case, monitoring after the abnormality is detected by the first time-sharing monitoring is strengthened, thereby improving the accuracy of monitoring compared to when only the first time-sharing monitoring is performed.

[0014] (3) The detection device according to (1) or (2) above may further include a bandwidth control unit that equalizes the bandwidth of the communication frames acquired by the acquisition unit, and the monitoring execution unit may perform equalization monitoring by applying monitoring programs, each defined for a respective one of the plurality of monitoring targets, to the communication frames whose bandwidths have been equalized. In this case, the monitoring execution unit performs equalization monitoring by applying monitoring programs, each defined for a respective one of the plurality of monitoring targets, to the communication frames whose bandwidths have been equalized, thereby making it possible to appropriately monitor the plurality of monitoring targets while reducing the processing load on the monitoring execution unit.

[0015] (4) In the detection device of (3) above, the monitoring execution unit may perform the leveling monitoring during normal times when no abnormality is present, and when the abnormality is detected by the leveling monitoring, the monitoring execution unit may cancel the bandwidth leveling and increase the execution frequency of the monitoring program for the monitoring target where the abnormality was detected, or may execute the monitoring program alone. In this case, monitoring is strengthened after the abnormality is detected by leveling monitoring, thereby improving the accuracy of monitoring compared to when only leveling monitoring is performed.

[0016] (5) In the detection device according to any one of (1) to (4) above, the monitoring execution unit may further switch the predetermined monitoring function when a predetermined trigger condition is met. In this case, the monitoring execution unit switches the predetermined monitoring function, thereby further improving the accuracy of monitoring.

[0017] (6) In the detection device of (5) above, the trigger condition may be detection of the abnormality by a normal monitoring function, and the monitoring function to be switched to may have a narrower monitoring range and higher detection accuracy than the normal monitoring function. In this case, the monitoring function becomes more functional than normal in response to the establishment of the trigger condition, thereby improving the monitoring accuracy.

[0018] (7) In the detection device of (5) or (6) above, if the network includes an internal network and an external network terminating at a gateway, the trigger condition may be the detection of the abnormality by a monitoring function applied to communication between the external network and the internal network, and the monitoring function to be switched may be the monitoring function applied to the internal network. In this case, the monitoring function is switched from the external network to the internal network in response to the establishment of the trigger condition, thereby more effectively preventing external attacks than when the monitoring function is applied only to the external network.

[0019] (8) In the detection device according to any one of (5) to (7) above, the trigger condition may be detection of a target event representing a predetermined operation input by a user, and the monitoring function to be switched may be a monitoring function applied to the communication frames expected to increase due to the target event. In this case, when the trigger condition is satisfied, the monitoring function switches to the communication frames expected to increase due to the target event, thereby enabling appropriate monitoring focusing on the target event.

[0020] (9) In the detection device according to any one of (1) to (8), the detection device may be an ECU or a gateway mounted on a vehicle, and the plurality of monitoring targets may be a plurality of CAN buses connected to the gateway. In this way, it is possible to appropriately monitor the plurality of CAN buses connected to the gateway while reducing the processing load on the monitoring execution unit.

[0021] (10) In the detection device according to any one of (1) to (8), the detection device may be an ECU or a gateway mounted on a vehicle, and the plurality of monitoring targets may be a plurality of Ethernet communication networks connected to the gateway. In this way, it is possible to appropriately monitor the plurality of Ethernet communication networks connected to the gateway while reducing the processing load on the monitoring execution unit.

[0022] (11) The method according to this embodiment is a detection method performed by the detection devices described above in (1) to (10). Therefore, the detection method according to this embodiment has the same effects as the detection devices described above in (1) to (10).

[0023] (12) The computer program according to this embodiment is a computer program for causing a computer to function as the detection device described above in (1) to (10). Therefore, the computer program according to this embodiment has the same effects as the detection devices described above in (1) to (10).

[0024] <Details of the Embodiments of the Present Invention> Hereinafter, the details of the embodiments of the present invention will be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any manner.

[0025] [Configuration Example of In-Vehicle Communication System] Fig. 1 is a network configuration diagram showing a configuration example of an in-vehicle communication system 100. As shown in Fig. 1, the in-vehicle communication system 100 of this embodiment is an in-vehicle local area network (LAN) built inside a vehicle 1. The in-vehicle communication system 100 includes, as communication nodes that make up the network, a gateway 10 which is a type of in-vehicle relay device, an ECU 20 having an IDS function which is a type of device for detecting fraudulent messages, and a plurality of ECUs 50.

[0026] The gateway 10 is, for example, a central gateway. Therefore, the in-vehicle communication system 100 includes an internal network 120 and an external network 130 that terminate at the gateway 10. The internal network 120 also includes multiple sub-networks 110 that are connected to the gateway 10 in a tree configuration. The gateway 10 has a function of relaying communications between the sub-networks 110 included in the internal network 120, and a function of relaying communications between the external network 130 and each sub-network 110.

[0027] Hereinafter, communication between communication nodes (ECUs 50) belonging to the internal network 120 and communication between the communication nodes and the gateway 10 will be referred to as "internal communication." Furthermore, communication between the gateway 10 and a communication node (not shown) that is directly connected to the gateway 10 among communication nodes belonging to the external network 130 will be referred to as "external communication."

[0028] Similarly, the communication protocol and communication frame used for internal communication are referred to as the "internal protocol" and "internal frame," respectively. The communication protocol and communication frame used for external communication are referred to as the "external protocol" and "external frame," respectively.

[0029] The internal protocol may be, for example, CAN (Control Area Network: registered trademark), CAN-FD (CAN with Flexible Data rate), LIN (Local Interconnect Network), or FlexRay (registered trademark). In this embodiment, as an example, it is assumed that the internal protocol is "CAN." Hereinafter, communication conforming to CAN will be referred to as "CAN communication," and a communication frame conforming to CAN will be referred to as a "CAN frame."

[0030] The external protocol may also be the same as the above. However, the external protocol may be different from or the same as the internal protocol. Furthermore, the external protocol may employ Ethernet (registered trademark) to increase transmission speed. Examples of communication nodes belonging to the external network 130 include a gateway (on-board relay device) similar to the gateway 10 in FIG. 1 , an ECU that controls on-board equipment, and a TCU (Telematics Control Unit) for mobile communications.

[0031] The ECU 20 is an electronic control unit having an IDS (Intrusion Detection System) function. The ECU 20 of this embodiment monitors the internal network 120 and the external network 130 to detect whether or not there is unauthorized access. If the ECU 20 detects unauthorized access, it notifies the detection result to, for example, a management server (not shown) of the vehicle 1 via a TCU or the like belonging to the external network 130. Details of the ECU 20 will be described later.

[0032] ECU 50 is an electronic control unit that controls various on-board devices such as sensors and actuators mounted on vehicle 1. ECU 50 transmits CAN frames containing measurement information from sensors (such as a speed sensor, an acceleration sensor, and a temperature sensor) connected to itself to CAN bus 60. ECU 50 also controls various actuators (such as an electric motor) connected to itself based on the measurement information contained in the CAN frames received from CAN bus 60.

[0033] 1, the gateway 10 includes a switch 11 and a protocol conversion unit 12. The gateway 10 also includes three types of communication ports Pi, Q, and R defined below.

[0034] Communication port Pi: A port for CAN communication (internal communication). Also called "CAN port Pi." "i" is the port number, where i = 1, 2, ... N. Communication port Q: A port for transferring frames received by the protocol conversion unit 12 to the ECU 20. Also called "transfer port Q." Communication port R: A communication port for external communication. Also called "external port R."

[0035] The switch 11 is a switch device that includes the following first communication C11 and second communication C12 as communications to be relayed. Therefore, each port of the switch 11 is electrically connected to a plurality of CAN ports Pi and a predetermined port of the protocol conversion unit 12. First communication C11: Communication between CAN buses 60 Second communication C12: Communication between the CAN buses 60 and the protocol conversion unit 12

[0036] The switch 11 holds, for example, a relay table that specifies the relay destination (transmission port) for each CANID value. The switch 11 determines the transmission destination of a received CAN frame based on the CANID value included in the received CAN frame and the relay table. The protocol conversion unit 12 is a signal processing unit that performs protocol conversion of communication frames, and performs, for example, the following processes RC1, RC2, RC3, and RC4.

[0037] Process RC1: Converts a CAN frame received from the switch 11 into an external frame, and sends the converted external frame to external port R. Process RC2: Converts an external frame received from external port R into a CAN frame, and sends the converted CAN frame to the switch 11. Process RC3: Sends the external frame received from external port R to transfer port Q. Process RC4: Sends the external frame received from transfer port Q to external port R.

[0038] At least one CAN bus 60 is connected to the CAN port Pi. The CAN bus 60 is a communication line composed of high-side and low-side wiring. At least one ECU 50 is bus-connected to the CAN bus 60. When multiple ECUs 50 are connected to the CAN bus 60, the sub-network 110 becomes a bus-type network in which multiple ECUs 50 are lined up in a row. The communication nodes connected to the CAN bus 60 may be not only ECUs 50 but also sensors or actuators capable of CAN communication.

[0039] A plurality of ECUs 50 with the same or similar control systems may be centrally connected to each CAN bus 60. In this case, the internal network 120 is divided into a plurality of sub-networks 110 with different types of control systems. The types of control systems that can be adopted for the sub-networks 110 include, for example, a powertrain system, a chassis system, a body system, a driving assistance system (including autonomous driving), and a multimedia system (including car navigation).

[0040] The ECU 20 has two types of communication ports Si and T defined below. Communication port Si: A port for snooping of CAN communication (internal communication). Also called "CAN port Si." The CAN bus 60 connected to the CAN port Pi of the gateway 10 is also connected to the CAN port Si of the ECU 20. Communication port T: A communication port for external communication. Also called "external port T." The external port T is connected to the transfer port Q by a communication cable for external communication.

[0041] [Configuration Example of IDS Function] Fig. 2 is a block diagram showing a configuration example of an IDS function. More specifically, Fig. 2 is a block diagram showing an example of the internal configuration of an ECU (hereinafter also referred to as a "detection device") 20 having an IDS function. In Fig. 2, solid arrows indicate the transmission direction of communication frames within the detection device 20, and dashed arrows indicate the input / output direction of control signals generated within the detection device 20.

[0042] 2, the detection device 20 includes a forwarding processing unit 30 and an IDS processing unit 40. The forwarding processing unit 30 is configured by, for example, an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), an ASSP (Application Specific Standard Product), or two or more integrated circuits selected from these.

[0043] The transfer processing unit 30 includes, as functional units realized by the integrated circuit, a PHY (PHYsical layer) unit 31, a limiter 32, a selector 33, and a bandwidth control unit 34. The PHY unit 31 is a PHY device for CAN communication, and is provided in one-to-one correspondence with the communication ports Si (i = 1, 2 ... N). The PHY unit 31 decodes the differential signals input from the communication ports Si into digital signals to generate CAN frames, and outputs the generated CAN frames to the limiter 32.

[0044] The limiter 32 is, for example, a bandwidth limiter for the input signal (CAN frame) from the PHY unit 31, and is provided in one-to-one correspondence with the PHY unit 31. Specifically, the limiter 32 limits the output bandwidth of the CAN frame to an upper limit bandwidth or less instructed by the bandwidth control unit 34. The bandwidth limitation method used by the limiter 32 may include a method of reducing the output cycle of the buffered CAN frames, and a method of outputting the type instructed by the bandwidth control unit 34 from among the CAN frames sorted and buffered by data type.

[0045] The selector 33 is, for example, a logic circuit with N inputs and one output. Each input port of the selector 33 is connected to the output side of each limiter 32, and the output signal of the selector 33 is supplied to an IDS execution unit 46 (described later). Based on a control signal from the bandwidth control unit 34, the selector 33 can switch which of the N input ports to output the input signal from.

[0046] Note that, other than the selector 33 made up of a logic circuit (e.g., a multiplexer), a selector 33 that determines the target based on identification information such as a CANID may be employed. Furthermore, as in a modified example described below, when the monitoring target is an Ethernet frame, the target may be selected based on various identification information of the communication layer (destination address, source address, connection, protocol, etc.) or application-specific identification information.

[0047] The band control unit 34 is a circuit that controls the operations of the limiters 32 and the selector 33. Based on a control signal CS2 from a function switching unit 47 (described later), the band control unit 34 executes at least one of the upper limit band of each limiter 32, the switching order of the input ports of the selector 33, and the switching timing of the input ports.

[0048] Bandwidth control unit 34 may execute bandwidth control based on identification information such as the CANID. In this case, for example, selector 33 may be provided with several CANID tables to select from, and function switching unit 47 may instruct selector 33 which table to use via bandwidth control unit 34. In this case, for example, a circuit configuration without limiter 32 may also be employed.

[0049] The IDS processing unit 40 is configured by an integrated circuit including, for example, a central processing unit (CPU), a ROM (Read Only Memory), and a RAM (Random Access Memory). In addition to the CPU, ROM, and RAM, the IDS processing unit 40 may also include, for example, an FPGA, a GPU, an ASIC, an ASSP, or a combination of two or more integrated circuits selected from these.

[0050] The CPU loads a computer program stored in the ROM into the RAM and performs predetermined information processing in accordance with the computer program loaded into the RAM. The ROM may be, for example, a writable memory (e.g., a PROM), a rewritable memory (e.g., a flash memory), or a read-only memory.

[0051] The ROM stores a computer program that causes the CPU to execute predetermined information processing. The ROM is not limited to a single storage medium, but may be a collection of multiple storage media. Some of the collection of multiple storage media may be removable memory. The RAM provides a working area into which the computer program stored in the ROM is temporarily loaded upon startup. The RAM is not limited to a single storage medium, but may be a collection of multiple storage media.

[0052] The IDS processing unit 40 includes, as functional units realized by the integrated circuit, a PHY unit 41, a first acquisition unit 42, a second acquisition unit 43, a first storage unit 44, a second storage unit 45, an IDS execution unit 46, and a function switching unit 47. The IDS execution unit 46 of this embodiment functions as a "monitoring execution unit" that uses multiple monitoring programs (specifically, multiple "IDS programs" described below) to monitor for abnormalities in communication frames for each of multiple monitoring targets.

[0053] The first acquisition unit 42 is an acquisition unit for internal frames (CAN frames in this embodiment). Specifically, the input side of the first acquisition unit 42 is connected to branch lines leading to the communication lines connecting the PHY units 31 and the limiters 32 in the transfer processing unit 30 (see section A). Therefore, the first acquisition unit 42 receives the CAN frames input to the communication ports Si (i = 1, 2 ... N), i.e., the CAN frames being transmitted on all the CAN buses 60 connected to the gateway 10.

[0054] The second acquisition unit 43 is an acquisition unit for external frames. Specifically, the second acquisition unit 43 is connected to the PHY unit 41, which is a PHY device for external communication, and the PHY unit 41 is connected to a communication port T for external communication. The PHY unit 41 decodes a carrier signal input from the communication port T into a digital signal and outputs the digital signal to the second acquisition unit 43. The PHY unit 41 modulates a digital signal including the detection result output from the IDS execution unit 46 and sends it to the communication port T.

[0055] The first storage unit 44 is, for example, a ROM that stores programs to be executed by the IDS execution unit 46. The programs stored in the first storage unit 44 include multiple IDS programs. The multiple IDS programs are programs that monitor at least one of the internal network 120 and the external network 130, and may employ, for example, a simple IDS, IDS_A, IDS_B, IDS_C, etc. An overview of these programs is as follows:

[0056] Simple IDS: A program for executing a simple IDS with a relatively low processing load that can be executed simultaneously for all monitored objects (for example, all connected CAN buses 60). The algorithm for the simple IDS may employ a method such as determining that a CAN bus 60 or CAN frame whose moving average of the communication load over a predetermined period exceeds a threshold is abnormal.

[0057] IDS_A: Periodic Anomaly Monitoring This is a method of monitoring abnormalities in the message (CAN frame) transmission period. Specifically, this method determines an attack when the message transmission interval differs from normal. The period parameters to be monitored can be, for example, the transmission period itself, the amount of shift in the transmission period, or the cumulative sum of the transmission periods.

[0058] IDS_B: Event Anomaly Monitoring This is a method of monitoring abnormalities in the data content (events) of messages. Specifically, this method grasps the behavior of message data under normal circumstances in advance, and if a message containing data that behaves differently from normal behavior is detected, it is determined to be an attack. Since this monitoring is based on data content, it is suitable for monitoring non-periodic messages.

[0059] IDS_C: Hybrid monitoring This is a method that performs both periodic anomaly monitoring and event anomaly monitoring in parallel. Specifically, it is a method that grasps in advance both the normal periodicity and data behavior of specified data, and if a message is detected whose grasped periodicity and behavior differ from normal, it is judged to be an attack.

[0060] The IDS execution unit 46 is an information processing device including, for example, a CPU and RAM. The IDS execution unit 46 reads a predetermined IDS program from the first storage unit 44, loads it into the RAM, and operates according to the loaded IDS program. The control signal CS1 from the function switching unit 47 indicates which IDS program to load into the RAM. Note that although the IDS execution unit 46 and the function switching unit 47 are depicted as separate blocks in FIG. 2, they may both be configured as a single CPU.

[0061] The second storage unit 45 is, for example, a ROM that stores a switching program 48 executed by the function switching unit 47 and setting information 49 that defines the IDS switching content. The setting information 49 is, for example, data in a table format that includes the content of the conditions for switching the IDS (hereinafter referred to as "trigger conditions") and the content of the IDS to be executed when the trigger conditions are met. As the setting information 49, for example, first setting information 49A to sixth setting information 49F (see Figures 3 to 8) described below can be used.

[0062] The function switching unit 47 is an information processing device including, for example, a CPU and a RAM. The function switching unit 47 reads a switching program 48 and setting information 49 from the second storage unit 45, loads them into the RAM, and operates in accordance with the loaded switching program 48. Specifically, the function switching unit 47 generates the following two types of control signals CS1 and CS2 according to the contents of the IDS defined in the setting information 49, based on input information from the first acquisition unit 42 and the second acquisition unit 43. The function switching unit 47 outputs the generated control signals CS1 and CS2 to the IDS execution unit 46 and the bandwidth control unit 34, respectively.

[0063] Control signal CS1: A control signal for the IDS execution unit 46. The control signal CS1 includes the type of IDS program to be executed by the IDS execution unit 46. Control signal CS2: A control signal for the bandwidth control unit 34. The control signal CS2 includes the control content to be executed by the limiter 32 and the selector 33 (such as the upper limit bandwidth of the limiter 32 and the switching timing by the selector 33).

[0064] [Example of First Setting Information] Fig. 3 is an explanatory diagram showing an example of the first setting information 49 A. As shown in Fig. 3, the first setting information 49 A includes a "vehicle state" and a "monitoring situation" as trigger conditions.

[0065] The "vehicle status" is obtained, for example, from the CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Furthermore, the driving mode (manual / automatic driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be, for example, manual driving, automatic driving, or low power consumption mode.

[0066] The "monitoring status" indicates the status of abnormalities detected in all monitored objects, and the default is normal times when no abnormalities are considered to exist. The "monitoring status" can be obtained not only from the status of the monitored objects (buses A, B, and C) in the IDS processing unit, but also from HIDS, sensors, and external networks. In other words, information from anywhere can be obtained as long as it can identify the monitored objects that the IDS processing unit needs to monitor.

[0067] In the first setting information 49A, the monitoring target of IDS_A is one of the CAN buses 60 (hereinafter referred to as "bus A") connected to the gateway 10. Similarly, the monitoring target of IDS_B is another of the CAN buses 60 (hereinafter referred to as "bus B") connected to the gateway 10, and the monitoring target of IDS_C is yet another of the CAN buses 60 (hereinafter referred to as "bus C") connected to the gateway 10.

[0068] 3, when the monitoring status is the default (normal), the IDS execution unit 46 executes the simple IDS regardless of whether the monitoring target is bus A, bus B, or bus C. Furthermore, the bandwidth control unit 34 switches the monitoring target in a time-sharing manner in the order of bus A, bus B, bus C, bus A, etc., triggered by the lapse of a predetermined time (for example, two minutes). This makes it possible to monitor all monitoring targets evenly while suppressing the processing load on the IDS execution unit 46. The order in which the monitoring targets are switched is arbitrary, and may be an order other than the above, or may be random.

[0069] Next, if an increase in load on bus A is detected while the loads on buses A, B, and C acquired by the first acquisition unit 42 are being monitored, the IDS execution unit 46 executes, for example, only IDS_A (periodic abnormality monitoring) for bus A. The bandwidth control unit 34 switches the monitoring target to bus A only, maximizes the upper limit bandwidth of bus A, and transfers CAN frames. As a result, when a minor abnormality is detected by the simple IDS, information processing resources are concentrated on bus A, the monitoring target where the abnormality occurred, and IDS_A dedicated to bus A is executed intensively.

[0070] The following embodiments can be adopted as embodiments for intensively executing a predetermined IDS function: Aspect 1: Execute only the predetermined IDS function (single execution) Aspect 2: Increase the frequency of execution of the predetermined IDS function compared to other IDS functions (increased frequency) Therefore, in this embodiment, "intensive execution" means performing either aspect 1 or aspect 2 above.

[0071] Similarly, when a load increase on bus B is detected, the IDS execution unit 46 executes IDS_B (event abnormality monitoring) for bus B, and the bandwidth control unit 34 switches the monitoring target to only bus B, maximizes the upper limit bandwidth of bus B, and transfers CAN frames. Furthermore, when a load increase on bus C is detected, the IDS execution unit 46 executes IDS_C (hybrid monitoring) for bus C, and the bandwidth control unit 34 switches the monitoring target to only bus C, maximizes the upper limit bandwidth of bus C, and transfers CAN frames.

[0072] In the default (normal) time-sharing monitoring of Fig. 3, instead of switching the monitoring target (bus), the monitoring program may be switched in a time-sharing manner. Also, both the monitoring target (bus) and the monitoring program may be switched in a time-sharing manner. That is, the "time-sharing monitoring" of this embodiment includes the following two types of time-sharing monitoring. First time-sharing monitoring: monitoring in which the monitoring target is switched in a time-sharing manner. Second time-sharing monitoring: monitoring in which the monitoring program for the monitoring target is switched in a time-sharing manner.

[0073] [Example of Second Setting Information] Fig. 4 is an explanatory diagram showing an example of the second setting information 49B. As shown in Fig. 4, the second setting information 49B includes a "vehicle state" and a "monitoring situation" as trigger conditions.

[0074] The "vehicle status" is obtained, for example, from the CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Furthermore, the driving mode (manual / automatic driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be, for example, manual driving, automatic driving, or low power consumption mode.

[0075] The "monitoring status" indicates the status of abnormalities detected in all monitored objects, and the default is normal times when no abnormalities are considered to exist. The "monitoring status" can be obtained not only from the status of the monitored objects (buses A, B, and C) in the IDS processing unit, but also from HIDS, sensors, and external networks. In other words, information from anywhere can be obtained as long as it can identify the monitored objects that the IDS processing unit needs to monitor.

[0076] In the second setting information 49B, the monitoring target of IDS_A is bus A, the monitoring target of IDS_B is bus B, and the monitoring target of IDS_C is bus C.

[0077] As shown in Fig. 4, when the monitoring status is the default (normal), the IDS execution unit 46 executes the simple IDS regardless of whether the monitoring target is bus A, bus B, or bus C. In addition, the bandwidth control unit 34 equalizes the upper limit bandwidths of all buses A, B, and C to one-third of the normal bandwidth (leveling monitoring). This reduces the processing load on the IDS execution unit 46 while enabling all monitoring targets to be monitored evenly. Note that instead of uniformly narrowing the upper limit bandwidth for all monitoring targets, differences may be made depending on the monitoring target.

[0078] Next, when an increase in load on bus A is detected, for example, the IDS execution unit 46 executes IDS_A (periodic abnormality monitoring) for bus A, and the bandwidth control unit 34 switches the monitoring target to bus A only, maximizes the upper limit bandwidth of bus A, and transfers CAN frames. As a result, when a minor abnormality is detected by the simple IDS, information processing resources are concentrated on bus A, which is the monitoring target where the abnormality occurred, and IDS_A dedicated to bus A is executed intensively.

[0079] Similarly, when a load increase on bus B is detected, the IDS execution unit 46 executes IDS_B (event abnormality monitoring) for bus B, and the bandwidth control unit 34 switches the monitoring target to only bus B, maximizes the upper limit bandwidth of bus B, and transfers CAN frames. Furthermore, when a load increase on bus C is detected, the IDS execution unit 46 executes IDS_C (hybrid monitoring) for bus C, and the bandwidth control unit 34 switches the monitoring target to only bus C, maximizes the upper limit bandwidth of bus C, and transfers CAN frames.

[0080] [Example of Third Setting Information] Fig. 5 is an explanatory diagram showing an example of the third setting information 49C. As shown in Fig. 5, the third setting information 49C includes "vehicle state" and "monitoring status" as trigger conditions.

[0081] The "vehicle status" is obtained, for example, from a CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Also, the driving mode (manual / automatic driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be, for example, that the engine is running (IG on).

[0082] The "monitoring status" indicates the status of abnormalities detected in all monitored objects, and the default is normal times when no abnormalities are considered to exist. The "monitoring status" can be obtained not only from the status of the monitored objects (buses A, B, and C) in the IDS processing unit, but also from HIDS, sensors, and external networks. In other words, information from anywhere can be obtained as long as it can identify the monitored objects that the IDS processing unit needs to monitor.

[0083] 5, the bandwidth control unit 34 instructs the selector 33 on which CAN ID or table to select in response to a control signal CS2 from the function switching unit 47, and the selector 33 outputs a CAN frame of the instructed CAN ID (table). In addition, time-division monitoring or leveling monitoring is performed during normal times.

[0084] In the third setting information 49C, the monitoring targets in the default (normal) state are divided into units of CAN IDs rather than units of CAN buses 60, and for example, the simple IDS is being executed for all CAN IDs. In other words, when the monitoring status is the default (normal), the IDS execution unit 46 executes the simple IDS for all CAN frames by time-sharing monitoring or leveling monitoring.

[0085] In the above monitoring situation, if an abnormality is detected in a CAN frame with a specific CAN ID (hereinafter referred to as the "specific ID") among the CAN frames acquired by the first acquisition unit 42, the function switching unit 47 outputs control signals CS1 and CS2 to the IDS execution unit 46 and the bandwidth control unit 34, respectively, and a more advanced IDS is executed for the specific ID. As a result, when a minor abnormality is detected in the simple IDS, the more advanced IDS is executed intensively for the detected ID where the abnormality occurred. Note that when an abnormality is detected in a CAN frame with a specific ID, the default simple IDS is stopped. Furthermore, the advanced IDS may be either a signature type or an anomaly type.

[0086] [Example of Fourth Setting Information] Fig. 6 is an explanatory diagram showing an example of the fourth setting information 49D. As shown in Fig. 6, the fourth setting information 49D includes a "vehicle state" and a "monitoring situation" as trigger conditions.

[0087] The "vehicle status" is obtained, for example, from a CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Also, the driving mode (manual / automatic driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be, for example, that the engine is running (IG on).

[0088] "Monitoring status" indicates the current status of all monitored objects, and the default is normal times when no abnormalities are considered. The "monitoring status" can be obtained not only from the status of the monitored objects (buses A, B, and C) in the IDS processing unit, but also from HIDS, sensors, and external networks. In other words, information from anywhere can be obtained as long as it can identify the monitored objects that the IDS processing unit needs to monitor. In addition, in Figure 6, "NIDS" stands for network IDS, and "HIDS" stands for host IDS.

[0089] 6, the bandwidth control unit 34 instructs the selector 33 on which CAN ID or table to select in response to the control signal CS2 from the function switching unit 47, and the selector 33 outputs the CAN frame of the instructed CAN ID (table). Furthermore, in normal times, time-division monitoring or leveling monitoring is performed.

[0090] In the fourth setting information 49D, when the monitoring status is the default (normal), the monitoring target is not a CAN frame but an external frame, and for example, a predetermined NIDS1 is being executed on the external network 130. In other words, when the monitoring status is the default (normal), the IDS execution unit 46 monitors attack behavior 1 from outside the gateway 10 using NIDS1.

[0091] In the above monitoring situation, if an abnormality due to NIDS1 is detected, the IDS execution unit 46 selects frames for a specific bus into which communications from the external network 130 enter, for example. The IDS execution unit 46 also switches the IDS to be executed to NIDS2 for the internal network 120, and monitors attack behavior 2 against the internal network 120. In the above monitoring situation, if an abnormality due to NIDS2 is detected, the IDS execution unit 46 notifies the gateway 10 of a request to activate the HIDS of the ECU 50, and prepares for attack behavior 3 against the ECU 50.

[0092] Specifically, IDS execution unit 46 notifies gateway 10 of the CANID of a communication frame in which an abnormality has been detected by NIDS2. Upon receiving this notification, gateway 10 instructs ECU 50 of the notified CANID to activate HIDS. In this way, by adopting fourth setting information 49D, the monitoring target is changed in the order of external network 130, internal network 120, and ECU 50, making it possible to appropriately respond to external attacks while minimizing the processing load.

[0093] [Example of Fifth Setting Information] Fig. 7 is an explanatory diagram showing an example of the fifth setting information 49E. As shown in Fig. 7, the fifth setting information 49E includes a "vehicle state" and a "target event" as trigger conditions.

[0094] The "vehicle status" is obtained, for example, from a CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Also, the driving mode (manual / automatic driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be, for example, that the engine is running (IG on).

[0095] The "target event" represents a predetermined operation input by the user (the driver in the case of a vehicle) or an event related to a change in the vehicle state or monitoring status, and the default refers to normal times when no target event occurs. Target events may include, in addition to the pedal operation shown in the figure, notifications of abnormal conditions based on security functions and sensor information, and changes in operation mode. Examples of switching between operation modes include switching between sleep and low power consumption modes, turning IG on or off, and installing OTA / OBD.

[0096] 7, the bandwidth control unit 34 instructs the selector 33 on which CAN ID or table to select in response to the control signal CS2 from the function switching unit 47, and the selector 33 outputs the CAN frame of the instructed CAN ID (table). Furthermore, in normal times, time-division monitoring or leveling monitoring is performed.

[0097] In the fifth setting information 49E, the target event is the operation of the accelerator pedal and the brake pedal, and if the target event is the default (normal), the IDS execution unit 46 does not execute the IDS or executes an IDS such as a simple IDS when the target event is the default (normal).

[0098] In the above monitoring situation, for example, when a target event of accelerator pedal operation is detected from the CAN frame acquired by the first acquisition unit 42, the monitoring target is changed to the communication traffic of the acceleration control system. Specifically, the IDS execution unit 46 executes IDS on the CAN frame including the CAN ID of the acceleration control system.

[0099] In the above monitoring situation, for example, when a target event of brake pedal operation is detected from the CAN frame acquired by the first acquisition unit 42, the monitoring target is changed to the communication traffic of the brake control system. Specifically, the IDS execution unit 46 executes IDS on the CAN frame including the CAN ID of the brake control system.

[0100] [Example of Sixth Setting Information] Fig. 8 is an explanatory diagram showing an example of the sixth setting information 49F. As shown in Fig. 8, the sixth setting information 49F includes a "vehicle state" and a "target event" as trigger conditions.

[0101] The "vehicle status" is obtained, for example, from a CAN frame acquired by the first acquisition unit 42, but may be acquired not only from the CAN frame of the internal network (buses A, B, and C), but also from an external network or status information within the ECU. For example, information such as security functions and sensor information may be acquired from the internal network. Furthermore, the driving mode (manual / automated driving) may be acquired from an external network. Here, the "vehicle status" is assumed to be when the engine is stopped (IG off) or when the engine is running (IG on).

[0102] The meaning of "target event" is as described above, and the default means normal times when there is no target event.

[0103] 8, the bandwidth control unit 34 instructs the selector 33 on the CAN ID or table to be selected in response to the control signal CS2 from the function switching unit 47, and the selector 33 outputs the CAN frame of the instructed CAN ID (table). Furthermore, in normal times, time-division monitoring or leveling monitoring is performed.

[0104] In the sixth setting information 49F, when the target event is the default (normal time) while the engine is stopped (IG off), the IDS execution unit 46 does not execute the IDS or executes a minimal IDS such as a simple IDS.

[0105] In the above monitoring situation, when the first acquisition unit 42 detects an event of IG on from the acquired CAN frame, the IDS execution unit 46 monitors the infotainment system. Furthermore, when the first acquisition unit 42 detects an event of sensor detection, such as remote key signal recognition, from the acquired CAN frame, the IDS execution unit 46 monitors wireless communication used for authentication with the remote key.

[0106] In the above monitoring state, if the first acquisition unit 42 detects an event that is subject to anomaly detection by other security functions from the acquired CAN frame, the IDS execution unit 46 activates all IDS functions related to the other security functions. Furthermore, if the first acquisition unit 42 detects an event that is subject to over-the-air (OTA) initiation from the acquired CAN frame, the IDS execution unit 46 monitors communications related to program updates. If the first acquisition unit 42 detects an event that is subject to the installation of an on-board diagnostic device (OBD), the IDS execution unit 46 monitors diagnostic functions and communications from the diagnostic communication port.

[0107] In the sixth setting information 49F, when the target event is the default (normal time) while the engine is running (IG on), the IDS execution unit 46 monitors the infotainment system. If the target event occurs after that, when the IG is off, the IDS execution unit 46 does not execute the IDS or executes a minimal IDS such as a simple IDS.

[0108] In the above monitoring state, when a target event occurs, such as the start of vehicle 1 traveling, the IDS execution unit 46 monitors the infotainment system and the control data of the vehicle 1. In the above monitoring state, when a target event occurs for abnormality detection by other security functions, the IDS execution unit 46 continues monitoring the infotainment system and activates all IDS functions related to the other security functions. Furthermore, when a target event occurs, such as the start of OTA or the installation of an on-board diagnostic device, the IDS execution unit 46 activates all IDSs.

[0109] [First Modification] Fig. 9 is a network configuration diagram showing a modification of the in-vehicle communication system 100. The modification of Fig. 9 differs from the configuration example of Fig. 1 in the following points. Difference A1: The internal network 120 conforms to Ethernet. Difference A2: The switch 11 of the gateway 10 is an Ethernet switch.

[0110] Difference A3: The subnetwork 110 connected to the gateway 10 is composed of an Ethernet switch 60E and an ECU 50E that performs Ethernet communication and is connected to the Ethernet switch 60E. Difference A4: The communication port Si of the ECU 20 is connected to the mirror port M of the Ethernet switch 60E. As shown in the modified example (first modified example) of Figure 9, the monitored subnetwork 110 may be an Ethernet communication network.

[0111] [Second Modification] Fig. 10 is a block diagram showing a modification of the IDS function. The modification of Fig. 10 differs from the configuration example of Fig. 2 in the following points. Difference B1: The forwarding processing unit 30 is mounted on the gateway 10 instead of the ECU 20. Difference B2: The forwarding processing unit 30 is provided with a monitoring unit 35 that monitors the communication state and type of communication frame for each communication port Pi. Difference B3: The monitoring unit 35 is connected to each PHY unit 31 and the mirror port M of the Ethernet switch 11. The monitoring results by the monitoring unit 35 are input to the first acquisition unit 42.

[0112] As shown in the modified example (second modified example) of Fig. 10 , the transfer processing unit 30 may be mounted on the gateway 10. In the modified example (second modified example) of Fig. 10 , if the gateway 10 is for CAN communication, a CAN bus is connected to the communication port Pi, and if the gateway 10 is for Ethernet communication, an Ethernet cable is connected to the communication port Pi.

[0113] 10, the IDS processing unit 40 may be a processing unit that executes a program in a cloud server (not shown) instead of the ECU 20. In this case, the ECU 20 may be provided with a communication processing unit, instead of the IDS processing unit 40, that relays communication between the cloud server (IDS processing unit 40) and the gateway 10 (transfer processing unit 30).

[0114] [Other Modifications] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is not limited to the above-described embodiments, and includes all modifications within the scope of equivalents to the configurations described in the claims. For example, in the above-described embodiments, the ECU (detection device) 20 may be a device integrated with the gateway 10 by being housed within the housing of the gateway 10. In this case, the communication port Pi and the communication port Si can be shared.

[0115] In the above-described embodiment, the object to be monitored by the detection device 20 is not limited to an in-vehicle LAN. For example, the object to be monitored by the detection device 20 may be a monitoring network using multiple monitoring cameras as communication nodes, a factory LAN using multiple manufacturing machines as communication nodes, or an in-house LAN in which sub-networks are established on multiple floors.

[0116] REFERENCE SIGNS LIST 1 Vehicle 10 Gateway (detection device) 11 Switch 12 Protocol conversion unit 20 IDS ECU (detection device) 30 Transfer processing unit 31 PHY unit 32 Limiter 33 Selector 34 Bandwidth control unit 40 IDS processing unit 41 PHY unit 42 First acquisition unit (acquisition unit) 43 Second acquisition unit (acquisition unit) 44 First storage unit 45 Second storage unit 46 IDS execution unit (monitoring execution unit) 47 Function switching unit 48 Computer program 49 Setting information 49A First setting information 49B Second setting information 49C Third setting information 49D Fourth setting information 49E Fifth setting information 49F Sixth setting information 50 ECU 60 CAN bus 100 In-vehicle communication system 110 Sub-network 120 Internal network 130 External network Pi CAN port (communication port) Q Transfer port (communication port) R External port (communication port) Si CAN port (communication port) T External port (communication port)

Claims

1. A detection device for detecting unauthorized intrusions into a network, comprising: an acquisition unit that acquires communication frames from a plurality of monitoring targets; and a monitoring execution unit that monitors the presence or absence of abnormalities in the communication frames for each of the plurality of monitoring targets, wherein the monitoring execution unit executes at least one of a first time-division monitoring that switches the monitoring targets in a time-division manner, and a second time-division monitoring that switches monitoring programs for the monitoring targets in a time-division manner.

2. The detection device described in claim 1, wherein the monitoring execution unit executes the first time-sharing monitoring during normal times when no abnormality is present, and when the abnormality is detected by the first time-sharing monitoring, increases the frequency of execution of the monitoring program for the monitoring target in which the abnormality was detected, or executes the monitoring program alone.

3. A detection device as described in claim 1, further comprising a bandwidth control unit that equalizes the bandwidth of the communication frames acquired by the acquisition unit, wherein the monitoring execution unit performs equalization monitoring by applying monitoring programs respectively defined for the multiple monitoring targets to the communication frames whose bandwidth has been equalized.

4. The detection device according to claim 3, wherein the monitoring execution unit executes the leveling monitoring during normal times when no abnormality is present, and when an abnormality is detected by the leveling monitoring, cancels the bandwidth leveling and increases the frequency of execution of the monitoring program for the monitored target in which the abnormality was detected, or executes the monitoring program alone.

5. A detection device as claimed in any one of claims 1 to 4, wherein the monitoring execution unit further switches a predetermined monitoring function when a predetermined trigger condition is met.

6. The detection device according to claim 5, wherein the trigger condition is detection of the abnormality by a normal monitoring function, and the monitoring function to be switched to has a narrower monitoring range and higher accuracy of detecting the abnormality than the normal monitoring function.

7. The detection device according to claim 5, wherein the network includes an internal network and an external network terminating in a gateway, the trigger condition is detection of the abnormality by a monitoring function applied to communication between the external network and the internal network, and the monitoring function to be switched to is a monitoring function applied to the internal network.

8. The detection device according to claim 5, wherein the trigger condition is detection of a target event representing a specified operational input by a user, and the monitoring function to be switched is a monitoring function to be applied to the communication frames expected to increase due to the target event.

9. A detection device as described in any one of claims 1 to 4, wherein the detection device is an ECU or a gateway mounted in a vehicle, and the multiple monitored objects are multiple CAN buses connected to the gateway.

10. A detection device as described in any one of claims 1 to 4, wherein the detection device is an ECU or a gateway mounted in a vehicle, and the multiple monitored objects are multiple Ethernet communication networks connected to the gateway.

11. A detection method performed by a device that detects unauthorized intrusions into a network, comprising: a first step of acquiring communication frames from a plurality of monitoring targets; and a second step of monitoring the presence or absence of abnormalities in the communication frames for each of the plurality of monitoring targets, wherein the second step includes executing at least one of a first time-division monitoring that switches the monitoring targets in a time-division manner, and a second time-division monitoring that switches monitoring programs for the monitoring targets in a time-division manner.

12. A computer program for causing a computer to function as a device for detecting unauthorized intrusions into a network, the computer program causing the computer to function as an acquisition unit that acquires communication frames from a plurality of monitoring targets, and a monitoring execution unit that monitors the presence or absence of abnormalities in the communication frames for each of the plurality of monitoring targets, the monitoring execution unit executing at least one of a first time-division monitoring that switches the monitoring targets in a time-division manner, and a second time-division monitoring that switches monitoring programs for the monitoring targets in a time-division manner.

Images