Log collection device, on-vehicle device, and log collection system

Abstract

The purpose of the present invention is to make it possible to expeditiously deal with a vehicle in which an abnormality has been detected while suppressing a processing load on a log collection device. This log collection device comprises: a communication unit that receives, from a vehicle, an abnormality report for reporting an abnormality detected in the vehicle on the basis of an operation log of the vehicle; and a determination unit that determines, on the basis of the threat level of the abnormality, whether or not to request the vehicle that has transmitted the abnormality report to transmit the operation log. The communication unit requests the vehicle to transmit the operation log in accordance with the determination result by the determination unit.

Description

Log collection device, in-vehicle device, and log collection system

[0001] The present invention relates to a log collection device, an in-vehicle device, and a log collection system.

[0002] In recent years, the proliferation of on-board ECUs (Electrical Control Units) due to the spread of connected cars has increased the risk of vehicles being exposed to cyberattacks, such as unauthorized access to ECUs or the installation of unauthorized ECUs. Accordingly, attention has been focused on the introduction of systems, such as Vehicle Security Operation Centers (VSOCs), in which a server collects and analyzes vehicle data. In such systems, multiple vehicles are connected via a network to a server operated by a vehicle dealer or a third-party organization that provides connected services. The main ECU of each vehicle connected to this network acquires operation logs of other ECUs in the vehicle and transmits the acquired operation logs to the server, thereby collecting operation logs from each vehicle.

[0003] However, in such a system in which multiple vehicles are connected to a log collection server via a network, an enormous number of vehicles are connected to the server. As a result, if each vehicle sends its own operation log to the server at its own timing, there is a possibility that the processing capacity of the server will be exceeded. In addition, there is a risk that the operation logs of abnormal vehicles will be mixed in with the operation logs of normal vehicles, making it difficult to quickly analyze and respond to the operation logs of vehicles where an abnormality has occurred. A prior patent that solves this problem is a log collection system such as that disclosed in Patent Document 1.

[0004] Patent Application No. 2019-530507

[0005] In Patent Document 1, the server determines target vehicles for log collection and transmits a log transmission request to the target vehicles. The server analyzes the operation log received from the target vehicles, and if no abnormality is detected, determines the next target vehicle and transmits a log transmission request. If an abnormality is detected, the server selects a vehicle related to the abnormality, such as a vehicle equipped with the same ECU as the ECU in which the abnormality was detected, and transmits a log transmission request. In this way, the server reduces the amount of data transmitted from the vehicles by determining target vehicles for log collection, and enables response to the vehicle in which the abnormality was detected by transmitting a log transmission request to the vehicle related to the detected abnormality.

[0006] However, in Patent Document 1, the server repeatedly determines the next target vehicle and sends a log transmission request until an abnormality is detected in the analysis on the server, which results in a time lag between when the abnormality is detected and when that vehicle is actually determined as a log collection target. Therefore, in Patent Document 1, if the threat of the abnormality is high, there is a risk that damage will spread until logs are collected and analyzed, leading to a serious situation.

[0007] The present invention has been made in consideration of the above-mentioned circumstances, and aims to enable rapid response to a vehicle in which an abnormality is detected while reducing the processing load on the log collection device.

[0008] In order to solve the above-mentioned problems, the log collection device of the present invention comprises a communication unit that receives an abnormality notification from the vehicle that notifies of an abnormality detected in the vehicle based on the vehicle's operation log, and a judgment unit that judges whether to request the vehicle that sent the abnormality notification to send the operation log based on the threat level of the abnormality, and is characterized in that the communication unit requests the vehicle to send the operation log depending on the judgment result of the judgment unit.

[0009] According to the present invention, it is possible to quickly respond to a vehicle in which an abnormality is detected while suppressing the processing load of the log collection device. Further features related to the present invention will become apparent from the description of this specification and the accompanying drawings. In addition, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0010] A block diagram showing the configuration of a log collection system of this embodiment. A diagram showing an example of an anomaly detection frame. A diagram showing an example of an anomaly category and a threat level. A diagram showing an example of a vehicle database. A flowchart showing processing performed by a log collection device. A flowchart continuing from FIG. 5. A flowchart showing processing performed by an in-vehicle device. A flowchart continuing from FIG. 7.

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that components with the same reference numerals in each embodiment have similar components in each embodiment unless otherwise specified, and description thereof will be omitted.

[0012] Fig. 1 is a block diagram showing the configuration of a log collection system 1 according to this embodiment. Fig. 2 is a diagram showing an example of an anomaly detection frame. Fig. 3 is a diagram showing an example of anomaly categories and threat levels. Fig. 4 is a diagram showing an example of a vehicle database 260.

[0013] The log collection system 1 includes an on-board device 100 mounted on a vehicle 10, and a log collection device 200 communicatively connected to the on-board device 100. The log collection device 200 is configured by a server connected to the vehicle 10 via a wireless communication network. For simplicity, only one vehicle 10 having the on-board device 100 is shown in FIG. 1 , but in reality, a plurality of vehicles 10 are connected to the log collection device 200.

[0014] In the log collection system 1, the log collection device 200 can request the vehicle 10 to transmit an operation log. When the on-board device 100 mounted on the vehicle 10 receives a log transmission request from the log collection device 200, the on-board device 100 transmits operation logs acquired from each of the ECUs 30a to 30c in the vehicle 10 to the log collection device 200 in accordance with the request. The on-board device 100 also constantly diagnoses the state and operation log within the vehicle 10. When the on-board device 100 detects an abnormality, it generates an abnormality detection frame that simply notifies the content of the detected abnormality and transmits the abnormality detection frame to the log collection device 200. The abnormality notification frame is an example of an abnormality notification that notifies the abnormality detected in the vehicle 10 based on the operation log of the vehicle 10.

[0015] In this embodiment, if the log collection device 200 has not received an anomaly detection frame from a vehicle 10, it determines a vehicle 10 from which to collect operation logs and transmits a log transmission request. If an anomaly detection frame has been received, the log collection device 200 determines whether operation logs should be collected and the processing priority based on the anomaly detection content included in the anomaly detection frame, and transmits a log transmission request to the vehicle 10 from which to collect operation logs. The processing priority indicates the priority for requesting the vehicle 10 that transmitted the anomaly detection frame to transmit an operation log and analyzing the operation log. In other words, the processing priority indicates the priority for transmitting the log transmission request and analyzing the operation log.

[0016] First, a description will be given of the functional configuration of the on-vehicle device 100. The on-vehicle device 100 is mounted on a vehicle 10. The on-vehicle device 100 is connected to an external communication device 20, ECUs 30a to 30c, and a GNSS (Global Navigation Satellite System) receiver 40 via an in-vehicle communication path conforming to an in-vehicle communication standard such as CAN (Control Area Network), and communicates with these components.

[0017] The exterior communication device 20 is compatible with long-distance wireless communication standards such as 5G, and performs wireless communication with the log collection device 200. Note that the ECUs 30a to 30c represent one or more ECUs, and although they are illustrated in FIG. 1 as being connected on the same communication path, they may be connected via separate communication paths.

[0018] The in-vehicle device 100 is a microcomputer equipped with a memory and a CPU, and includes an external communication unit 110, an internal communication unit 120, a diagnosis unit 130, a condition update unit 140, a transmission determination unit 150, a frame generation unit 160, a log acquisition unit 170, and a storage unit 180.

[0019] The storage unit 180 further includes a log storage unit 181, a transmission condition storage unit 182, and an acquisition condition storage unit 183. Although the log storage unit 181, the transmission condition storage unit 182, and the acquisition condition storage unit 183 are shown as separate blocks in Fig. 1, they may be individually allocated to the storage area of ​​a single storage medium, or may be arbitrarily arranged in the storage areas of multiple storage media.

[0020] The external communication unit 110 is a communication module having a function of communicating with the log collection device 200 via wireless communication conforming to a long-distance communication standard such as 5G. The external communication unit 110 transmits an anomaly detection frame to the log collection device 200 in accordance with the determination result of the transmission determination unit 150. The external communication unit 110 is an example of an in-vehicle communication unit that transmits the anomaly detection frame to the log collection device 200 in accordance with the determination result of the transmission determination unit 150. Furthermore, when the log collection device 200 requests the external communication unit 110 to transmit an operation log, the external communication unit 110 transmits the operation log stored in the log storage unit 181 to the log collection device 200. Note that although both are described as an exterior-vehicle communication device 20 in this embodiment, it is sufficient that the vehicle 10 is equipped with either of the communication functions.

[0021] The internal communication unit 120 communicates with each of the external communication device 20, the ECUs 30a to 30c, and the GNSS receiver 40 using an in-vehicle communication standard such as CAN.

[0022] The diagnosing unit 130 diagnoses the operation log acquired by the log acquiring unit 170 to detect abnormalities. Specifically, the diagnosing unit 130 constantly diagnoses whether any abnormalities have occurred in the in-vehicle device 100 based on the operation log of the in-vehicle device 100. Furthermore, the diagnosing unit 130 has functions to directly diagnose the ECUs 30a to 30c based on the operation logs of the ECUs 30a to 30c, diagnose the ECUs 30a to 30c based on the communication logs of the in-vehicle communication paths, and detect abnormalities based on the self-diagnosis results of the ECUs 30a to 30c. The diagnosing unit 130 stores the diagnosis results in the log storage unit 181.

[0023] When the condition update unit 140 receives a request from the log collection device 200 to change at least one of the acquisition conditions for the operation log in the vehicle 10 and the transmission conditions for the abnormality detection frame, the condition update unit 140 changes at least one of the transmission conditions stored in the transmission condition memory unit 182 and the acquisition conditions stored in the acquisition condition memory unit 183 in accordance with the request content.

[0024] The transmission determination unit 150 determines, based on preset transmission conditions, whether to transmit an anomaly detection frame notifying the log collection device 200 of an anomaly detected by the diagnosis unit 130. Specifically, the transmission determination unit 150 determines, in accordance with the transmission conditions stored in the transmission condition storage unit 182, whether the anomaly detected by the diagnosis unit 130 satisfies the transmission conditions. If the anomaly detected by the diagnosis unit 130 satisfies the transmission conditions, the transmission determination unit 150 requests the frame generation unit 160 to generate an anomaly detection frame.

[0025] When the frame generation unit 160 receives a request to generate an anomaly detection frame from the transmission determination unit 150, it generates an anomaly detection frame that provides a simple notification of an anomaly detected by the diagnosis unit 130, as shown in Fig. 2. As shown in Fig. 2, the anomaly detection frame includes information such as the location where the anomaly was detected, the details of the detected anomaly, and the number of detected anomalies. Note that the anomaly detection zones shown in Fig. 2 indicate which zones the ECUs 30a to 30c are located in when the zone architecture is supported, and therefore, in the case of other architectures, only information on the anomaly detection ECU may be displayed.

[0026] The log acquisition unit 170 acquires operation logs of the vehicle 10 based on preset acquisition conditions. Specifically, the log acquisition unit 170 acquires operation logs of the vehicle 10, such as operation logs or self-diagnosis results of the ECUs 30a to 30c, communication logs of in-vehicle communication paths, or operation logs of the in-vehicle device 100, in accordance with the acquisition conditions stored in the acquisition condition storage unit 183, and stores the acquired logs in the log storage unit 181.

[0027] The log storage unit 181 stores the operation log of the vehicle 10 and the diagnosis results of the diagnosis unit 130 .

[0028] The transmission condition storage unit 182 stores transmission conditions that the transmission determination unit 150 uses to determine whether to transmit an anomaly detection frame to the log collection device 200 when the diagnosis unit 130 detects an anomaly. The transmission conditions refer to rules that determine under what circumstances an anomaly detection frame should be transmitted to the log collection device 200, such as, for example, "when an interruption in periodic communication is detected, if the interruption in periodic communication is detected intermittently n times or more within a certain period of time, an anomaly detection frame should be transmitted to the log collection device 200." However, these conditions determine whether an anomaly detection frame should be transmitted to the log collection device 200, and the acquisition of the operation log itself is determined by acquisition conditions, which will be described later. Furthermore, the transmission conditions can be changed in response to a request from the log collection device 200, as will be described later.

[0029] The acquisition condition storage unit 183 stores acquisition conditions used by the log acquisition unit 170 to determine what kind of operation log to acquire and store in the log storage unit 181. The acquisition conditions refer to rules that determine what information to acquire, from what point in time, and to what extent when an abnormality is detected, such as, for example, "when an abnormality is detected in ECU_A present on bus A, acquire transmission data from ECU_B and ECU_C present on bus A and ECU_D present on bus B for n seconds after the abnormality is detected." In addition, the acquisition conditions can be changed in response to a request from the log collection device 200, as will be described later.

[0030] Next, a description will be given of the functional configuration of the log collection device 200. The log collection device 200 includes a determination unit 210, a communication unit 220, a log analysis unit 230, a database update unit 240, a mode setting unit 250, a vehicle database 260, and a log / analysis result storage unit 270.

[0031] The determination unit 210 determines whether to request the vehicle 10 that transmitted the anomaly detection frame to transmit an operation log, based on the threat level of the anomaly that is set based on the anomaly detection frame transmitted from the vehicle 10. The determination unit 210 includes a threat level setting unit 211, a log necessity determination unit 212, a priority determination unit 213, and a request destination determination unit 214.

[0032] The threat level setting unit 211 sets a threat level of an abnormality detected in the vehicle 10 that transmitted the abnormality detection frame, based on the abnormality detection frame received by the communication unit 220. Specifically, when the threat level setting unit 211 receives an abnormality detection frame from the vehicle 10, it classifies the category of the abnormality detected in the vehicle 10 based on the content of the frame and sets a threat level of the abnormality detected in the vehicle 10 based on the classified category. The abnormality category includes the ECU system where the abnormality was detected and the type of abnormality, such as an attack or malfunction. As shown in FIG. 3 , the threat level setting unit 211 classifies the ECU system where the abnormality was detected and the type of abnormality by detection content based on the information notified in the abnormality detection frame of FIG. 2 , and sets the threat level in descending order of the risk to the occupants or the vehicle 10 when the abnormality is detected. For example, the threat level setting unit 211 sets a high threat level for an abnormality related to the recognition or safety of various sensors or airbags, etc., and sets a low threat level for an abnormality that is not directly related to the driving and control of the vehicle, such as multimedia. It should be noted that FIG. 3 is merely an example, and the order of threat levels and the number of categories of detection contents can be set arbitrarily.

[0033] The log necessity determination unit 212 determines whether it is necessary to collect an operation log (send a log transmission request) from the vehicle 10 that transmitted the anomaly detection frame based on the category and threat level of the anomaly classified and set by the threat level setting unit 211 and the analysis results of the log analysis unit 230 (described later). Basically, it is desirable to collect all operation logs when an anomaly is detected. However, for example, if the anomaly type is "failure" and the threat level is low, and the cause of the anomaly has been identified from previous log analysis and is deemed hazardous, the log necessity determination unit 212 can determine that it is not necessary to collect an operation log. Furthermore, the administrator of the log collection device 200 can change the conditions for this determination at any time. For example, the conditions can be arbitrarily set, such as collecting operation logs for threat levels 1 to 20 in FIG. 3 or collecting operation logs for an anomaly type of "attack."

[0034] The priority determination unit 213 determines the above-mentioned processing priority based on the threat level set by the threat level setting unit 211. Specifically, when the log necessity determination unit 212 determines that collection of an operation log is necessary, the priority determination unit 213 determines a processing priority for the vehicle 10 that transmitted the anomaly detection frame based on the threat level set by the threat level setting unit 211 and the log request priority in the vehicle database 260, which will be described later. Basically, the same processing priority is determined so that vehicles 10 in which anomalies with the same threat level have been detected can be collectively requested to transmit their operation logs. In other words, when multiple anomaly detection frames are received simultaneously from multiple vehicles 10, the priority determination unit 213 determines the same processing priority for these vehicles 10 so that the request destination determination unit 214 can collectively determine multiple vehicles 10 that transmitted identical or similar anomaly detection frames as destinations to which a request to transmit operation logs should be made.

[0035] However, if there are vehicles 10 in which anomalies of the same threat level have been detected but have different log request priorities in the vehicle database 260, the priority determination unit 213 performs processing such that the processing priority of the vehicle with the higher log request priority is increased. If the processing priority is high, the log collection device 200 promptly transmits a log transmission request and analyzes the operation log. If the processing priority is low, the log collection device 200 postpones transmitting a log transmission request and analyzing the operation log.

[0036] The request destination determination unit 214 determines a requested vehicle 10 to which a request for transmission of an operation log is to be made. Specifically, in a normal case where an anomaly detection frame has not been received from any vehicle 10, the request destination determination unit 214 searches the vehicle database 260 to determine a requested vehicle 10 to which a log transmission request is to be sent. For example, the request destination determination unit 214 increments the target numbers assigned to each vehicle 10 listed in the vehicle database 260 shown in FIG. 4 and sequentially determines the vehicle 10 to which a log transmission request is to be sent, starting with the vehicle 10 with the lowest number. When determining the requested vehicle 10 in this manner, the request destination determination unit 214 stores the vehicle 10 to which the last log transmission request was sent in this manner in the vehicle database 260 so that the vehicle 10 can be identified. When resuming, the request destination determination unit 214 resumes from the vehicle 10 next to the vehicle 10 to which the last log transmission request was sent. In the example shown in FIG. 4, the request destination determination unit 214 can identify the vehicle 10 to which the last log transmission request was sent by checking the final log collection history in the vehicle database 260. Furthermore, the request destination determination unit 214 does not need to select only one vehicle 10 from the plurality of vehicles 10 stored in the vehicle database 260, but may select a plurality of vehicles 10 in parallel by arbitrarily dividing the target numbers, for example, one vehicle from among target numbers 1 to 100, one vehicle from among target numbers 101 to 200, etc. Then, the request destination determination unit 214 may determine the selected plurality of vehicles 10 as request destination vehicles 10 so that a log transmission request is sent to the selected plurality of vehicles 10 collectively.

[0037] Furthermore, when the request destination determination unit 214 receives an anomaly detection frame from a vehicle 10, it determines the vehicle 10 to which it requests the transmission of an operation log, based on the anomaly detection frame. In particular, when multiple anomaly detection frames are received simultaneously from multiple vehicles 10, the request destination determination unit 214 determines the vehicle 10 to which it requests the transmission of an operation log in accordance with the processing priority determined by the priority determination unit 213. In other words, when the request destination determination unit 214 receives multiple anomaly detection frames from multiple vehicles 10, it determines the vehicle 10 to which it requests the transmission of an operation log based on the identity or similarity of the multiple anomaly detection frames received simultaneously. However, if there is a difference in the log request priorities in the vehicle database 260, the request destination determination unit 214 determines the vehicle 10 to which it requests the transmission of a log in order from the vehicle 10 with the highest log request priority, and it ... sends log transmission requests collectively to vehicles 10 with the same log request priority.

[0038] The log analysis unit 230 analyzes the operation log transmitted from the vehicle 10. Specifically, the log analysis unit 230 performs a detailed abnormality analysis on the operation log received by the communication unit 220. For example, the log analysis unit 230 has a trained model that has been machine-learned to determine the relationship between the output value of each of the ECUs 30a to 30c and the failure degree of each of the ECUs 30a to 30c. The log analysis unit 230 may calculate the failure degree of each of the ECUs 30a to 30c by inputting the operation log of each of the ECUs 30a to 30c transmitted from the vehicle 10 into the trained model. The failure degree of each of the ECUs 30a to 30c may be the degree of deviation from the normal output value of each of the ECUs 30a to 30c. Alternatively, the log analysis unit 230 may create an average distribution of the output values ​​of each of the ECUs 30a to 30c from the operation logs transmitted from multiple vehicles 10, compare the created distribution with the operation log of the vehicle 10, and statistically process the extent to which the operation log of the vehicle 10 deviates from the distribution to calculate the failure degree of the ECUs 30a to 30c of the vehicle 10. Furthermore, the analysis of the operation log does not necessarily need to be automated by the system. For example, an operator of the VSOC may analyze the operation log, or the operator may reanalyze the failure degree calculated by the learned model or statistical processing described above. The log analysis unit 230 stores the analysis results in the log / analysis result storage unit 270.

[0039] If it is necessary to update the data of the vehicle 10 stored in the vehicle database 260 based on the analysis results of the log analysis unit 230, the database update unit 240 updates the target data.

[0040] The mode setting unit 250 switches the operation log collection mode between a normal collection mode in which an operation log is requested to be transmitted from any vehicle 10, and an abnormality collection mode in which an operation log is requested to be transmitted from a vehicle 10 that has transmitted an abnormality detection frame. The mode setting unit 250 sets the operation log collection mode to the normal collection mode when an abnormality detection frame has not been received from the vehicle 10, and sets the operation log collection mode to the abnormality collection mode when an abnormality detection frame has been received from the vehicle 10.

[0041] The vehicle database 260 includes individual data such as the vehicle models of the multiple vehicles 10 connected to the log collection device 200, the installed ECUs 30a-30c, ID information used for communication, the region of use, the latest log collection history, and the log request priority determined by the log analysis unit 230. An example of the vehicle database 260 is shown in FIG. 4 . The log request priority is one of the factors used by the request destination determination unit 214 when determining the vehicle 10 to which a request is to be sent in the normal collection mode. The log request priority is set, for example, on a scale of 0 to 5. It is normally set to 0 and is incremented when an irregularity occurs, such as when a log transmission request is sent but an operation log is not sent from the vehicle 10. Alternatively, the log request priority may be arbitrarily set by the administrator of the log collection device 200.

[0042] The log / analysis result storage unit 270 stores the operation log transmitted from the vehicle 10 and the analysis results of the log analysis unit 230 .

[0043] The communication unit 220 is a communication module having a function of communicating with the vehicle 10 (the external communication unit 110 of the in-vehicle device 100 or the external communication device 20) via wireless communication based on a long-distance communication standard such as 5G. The communication unit 220 receives an anomaly detection frame transmitted from the vehicle 10.

[0044] Furthermore, the communication unit 220 requests the vehicle 10 to transmit an operation log (transmits a log transmission request) in accordance with the determination result of the determination unit 210. Specifically, the communication unit 220 requests the requested vehicle 10 determined by the request destination determination unit 214 to transmit an operation log. That is, the communication unit 220 requests the vehicle 10 to transmit an operation log in accordance with the processing priority determined by the priority determination unit 213. The communication unit 220 requests the vehicle 10 to transmit an operation log in accordance with the collection mode set by the mode setting unit 250.

[0045] Furthermore, based on the analysis results of the log analysis unit 230, the communication unit 220 requests the vehicle 10 to change the conditions for acquiring operation logs and the conditions for transmitting anomaly detection frames in the vehicle 10 (transmits a change request).

[0046] Next, the processing performed by the log collection system 1 will be described with reference to Fig. 5 to Fig. 8. Fig. 5 is a flowchart showing the processing performed by the log collection device 200. Fig. 6 is a flowchart following Fig. 5.

[0047] In step S100, the log collection device 200 resets the remaining number n of anomaly detection frames currently waiting to be processed to 0, and then proceeds to step S101.

[0048] In step S101, the log collection device 200 checks whether an abnormality detection frame has been received from any vehicle 10, and then proceeds to step S102.

[0049] In step S102, if the log collection device 200 receives an anomaly detection frame, the process proceeds to step S119, and if not, the process proceeds to step S103.

[0050] In step S103, the log collection device 200 searches the vehicle database 260, and then proceeds to step S104.

[0051] In step S104, the log collection device 200 determines the vehicle 10 to which the log transmission request is to be sent based on multiple factors such as the log request priority and the latest log collection history in the vehicle database 260, and proceeds to step S105.

[0052] In step S105, the log collection device 200 transmits a log transmission request to the requested vehicle 10 determined in step S104, and then proceeds to step S106.

[0053] In step S106, the log collection device 200 waits for a response to the log transmission request sent in step S105, and if there is a response, the process proceeds to step S108, and if there is no response, the process proceeds to step S107.

[0054] In step S107, the log collection device 200 updates the latest log collection history and the previous log collection success / failure status in the vehicle database 260 for the vehicle 10 that did not respond to the log transmission request, and proceeds to step S100.

[0055] In step S108, the log collection device 200 analyzes the operation log received from the vehicle 10 that transmitted the log transmission request, and then proceeds to step S109.

[0056] In step S109, the log collection device 200 checks the results of the analysis of the operation log performed in step S108, and if an abnormality is detected, proceeds to step S110, and if no abnormality is detected, proceeds to step S111.

[0057] In step S110, the log collection device 200 updates the log request priority in the vehicle database 260 for the vehicle 10 in which an abnormality has been detected from the analysis result of the operation log, and proceeds to step S111.

[0058] In step S111, the log collection device 200 determines whether at least one of the operation log acquisition conditions and the anomaly detection frame transmission conditions needs to be changed for the vehicle 10 whose operation log has been analyzed. If a change is needed, the process proceeds to step S112. If a change is not needed, the process proceeds to step S113. Regarding the determination of whether a change is needed, the log collection device 200 changes at least one of the acquisition conditions and the transmission conditions if the analysis of the operation log indicates that continuous monitoring of the vehicle 10 is necessary. For example, regarding the change of the acquisition conditions, the log collection device 200 implements a change such as increasing the number of ECUs 30a to 30c from which operation logs are acquired. For example, regarding the change of the transmission conditions, the log collection device 200 implements a change such as lowering the anomaly detection frequency threshold that distinguishes whether or not an anomaly detection frame is transmitted and increasing the transmission frequency of the anomaly detection frame.

[0059] In step S112, the log collection device 200 transmits a request to change at least one of the acquisition conditions and transmission conditions that need to be changed, as determined in step S111, to the vehicle 10 that needs to be changed, and then proceeds to step S113.

[0060] In step S113, the log collection device 200 determines whether or not additional logs need to be collected for the vehicle 10 whose operation log was analyzed. If additional logs need to be collected, the process proceeds to step S114. If not, the process proceeds to step S115. Regarding the determination of whether additional logs need to be collected, the log collection device 200 determines that additional logs need to be collected if the analysis of the operation logs indicates that continuous monitoring of the vehicle 10 is necessary. For example, if unauthorized access is detected, such as when the ECU_A detects that an ID that was originally intended to be used by the ECU_A has been used by an unknown device (this can be detected when the ECU_A receives an ID that was intended to be transmitted by the ECU_A), the log collection device 200 determines that additional communication logs need to be collected in order to monitor the communication pattern of the unknown device. Additional logs are used for such purposes. Step S113 is a function that allows the log collecting device 200 to actively collect operation logs, rather than collecting operation logs in response to a request from the vehicle 10. Note that the log collecting device 200 may combine step S113 with the determination of whether or not the acquisition conditions, etc., need to be changed, which is performed in step S111, and indirectly determine whether or not additional logs need to be collected.

[0061] In step S114, the log collection device 200 transmits a request to acquire additional logs to the vehicle 10 for which additional logs need to be collected, and then proceeds to step S115.

[0062] In step S115, the log collection device 200 updates the latest log collection history and the previous log collection success / failure status in the vehicle database 260 for the vehicle 10 that has responded to the log transmission request, and proceeds to step S116.

[0063] In step S116, the log collection device 200 checks whether the remaining number n of anomaly detection frames currently waiting to be processed is 0. If the remaining number n is 0, the process proceeds to step S100. If the remaining number n is 1 or greater, the process proceeds to step S117.

[0064] In step S117, the log collection device 200 decrements the remaining number n by one, and then proceeds to step S118.

[0065] In step S118, the log collection device 200 checks whether the remaining number n is 0. If the remaining number n is 0, the process proceeds to step S100. If the remaining number n is 1 or greater, the process proceeds to step S123.

[0066] In step S119, the log collection device 200 classifies the received anomaly detection frame into a category of an anomaly detected in the vehicle 10 that transmitted the anomaly detection frame, and proceeds to step S120.

[0067] In step S120, the log collection device 200 sets the threat level of the abnormality detected in the vehicle 10 that transmitted the abnormality detection frame from the category classified in step S119, and proceeds to step S121.

[0068] In step S121, the log collection device 200 checks whether an abnormality detection frame has been received at the same time, and if an abnormality detection frame has been received at the same time, the log collection device 200 proceeds to step S122, and if an abnormality detection frame has not been received at the same time, the log collection device 200 proceeds to step S123.

[0069] In step S122, the log collection device 200 sets the number of anomaly detection frames received simultaneously to the remaining number n of anomaly detection frames currently waiting to be processed, and then proceeds to step S123.

[0070] In step S123, the log collection device 200 determines whether it is necessary to collect an operation log from the vehicle 10 that transmitted the abnormality detection frame based on the threat level set in step S120, and if it is necessary to collect an operation log, it proceeds to step S125, and if it is not necessary, it proceeds to step S124.

[0071] In step S124, the log collection device 200 transmits a log non-transmission request to the vehicle 10 that transmitted the anomaly detection frame, notifying the vehicle 10 that it is not necessary to transmit an operation log, and then proceeds to step S117.

[0072] In step S125, the log collection device 200 determines a processing priority for the vehicle 10 for which operation logs need to be collected, based on the threat level set in step S120. Then, the log collection device 200 proceeds to step S127 if an immediate response is required for the vehicle 10, or proceeds to step S126 if an immediate response is not required.

[0073] In step S126, the log collection device 200 sends a log retention request to vehicles 10 that do not require immediate response, requesting them to retain their operation logs until the next time they are requested by the log collection device 200, in order to postpone responses such as sending a log transmission request and analyzing the operation logs, and then proceeds to step S117.

[0074] In step S127, the log collection device 200 determines the vehicle 10 requiring immediate attention as the requested vehicle 10 to which the log transmission request is to be sent, and proceeds to step S128.

[0075] In step S128, the log collection device 200 transmits a log transmission request to the requested vehicle 10 determined in step S127, and then proceeds to step S129.

[0076] In step S129, the log collection device 200 waits for a response to the log transmission request sent in step S128, and if there is a response, the process proceeds to step S108, and if there is no response, the process proceeds to step S130.

[0077] In step S130, the log collection device 200 updates the latest log collection history and the previous log collection success / failure status in the vehicle database 260 for the vehicle 10 that did not respond to the log transmission request, and proceeds to step S117.

[0078] Fig. 7 is a flowchart showing the process performed by the in-vehicle device 100. Fig. 8 is a flowchart following Fig. 7.

[0079] In step S200, the in-vehicle device 100 acquires an operation log of the vehicle 10, and then proceeds to step S201.

[0080] In step S201, the in-vehicle device 100 diagnoses the operation log acquired in step S200 to determine whether or not an abnormality has occurred in the vehicle 10.

[0081] In step S202, the in-vehicle device 100 checks whether an abnormality has been detected in the diagnosis of step S201, and if an abnormality has been detected, proceeds to step S203, and if an abnormality has not been detected, proceeds to step S210.

[0082] In step S203, the in-vehicle device 100 determines whether the abnormality detected in the diagnosis of step S201 meets the transmission conditions according to the transmission conditions stored in the transmission condition memory unit 182, and if the transmission conditions are met, proceeds to step S204, and if the transmission conditions are not met, proceeds to step S200.

[0083] In step S204, the in-vehicle device 100 generates an abnormality detection frame to be transmitted to the log collection device 200 based on simple information about the abnormality detected in the diagnosis in step S201, and proceeds to step S205.

[0084] In step S205, the in-vehicle device 100 transmits the anomaly detection frame generated in step S204 to the log collection device 200, and then proceeds to step S206.

[0085] In step S206, the in-vehicle device 100 checks whether a log non-transmission request has been received from the log collection device 200, and if so, proceeds to step S207, and if not, proceeds to step S208.

[0086] In step S207, the in-vehicle device 100 excludes the operation log corresponding to the received log non-transmission request from the log collection device 200, and proceeds to step S200.

[0087] In step S208, the in-vehicle device 100 checks whether a log retention request has been received from the log collection device 200, and if so, proceeds to step S209, and if not, proceeds to step S210.

[0088] In step S209, the in-vehicle device 100 sets the operation log corresponding to the received log retention request as a retention target to be retained until a request is made from the log collection device 200, and then proceeds to step S200.

[0089] In step S210, the in-vehicle device 100 checks whether a log transmission request has been received from the log collection device 200, and if so, proceeds to step S211, and if not, proceeds to step S200.

[0090] In step S211, the in-vehicle device 100 transmits the operation log corresponding to the received log transmission request to the log collection device 200, and then proceeds to step S212.

[0091] In step S212, the in-vehicle device 100 checks whether a request to change the acquisition conditions has been received from the log collection device 200, and if so, proceeds to step S213, and if not, proceeds to step S214.

[0092] In step S213, the in-vehicle device 100 changes the acquisition conditions stored in the acquisition condition storage unit 183 in accordance with the received request to change the acquisition conditions, and then proceeds to step S214.

[0093] In step S214, the in-vehicle device 100 checks whether a request to change the transmission conditions has been received from the log collection device 200, and if so, proceeds to step S215, and if not, proceeds to step S216.

[0094] In step S215, the in-vehicle device 100 changes the transmission conditions stored in the transmission condition storage unit 182 in accordance with the received request to change the transmission conditions, and then proceeds to step S216.

[0095] In step S216, the in-vehicle device 100 checks whether a request to acquire additional logs has been received from the log collection device 200, and if so, proceeds to step S217; if not, proceeds to step S200.

[0096] In step S217, the in-vehicle device 100 acquires the additional log in accordance with the received request to acquire the additional log, stores the additional log in the log storage unit 181, and then proceeds to step S200.

[0097] In the flowcharts shown in Figures 5 to 8, there is a process in which the log collection device 200 or the in-vehicle device 100 waits for a response from the other party, but this is not necessarily limited to continuing to wait for a response from the other party, and if there is no response for a certain period of time, a timeout process may be performed, such as terminating the process.

[0098] As described above, the log collection device 200 of this embodiment includes the communication unit 220 that receives from the vehicle 10 an anomaly detection frame (anomaly notification) that notifies of an anomaly detected in the vehicle 10 based on the operation log of the vehicle 10, and the determination unit 210 that determines, based on the threat level of the anomaly, whether to request the vehicle 10 that transmitted the anomaly detection frame to transmit an operation log. The communication unit 220 requests the vehicle 10 to transmit an operation log according to the determination result of the determination unit 210.

[0099] As a result, in normal cases where no abnormality is detected in the vehicle 10, the log collecting device 200 can determine by itself the vehicle 10 from which to collect operation logs. Therefore, the log collecting device 200 can control the amount of data transmitted as operation logs to the log collecting device 200, thereby preventing the log collecting device 200 from exceeding its processing capacity. On the other hand, when an abnormality is detected in the vehicle 10, the log collecting device 200 receives an abnormality detection frame, which has a much smaller amount of data than the operation log. This allows the log collecting device 200 to quickly identify the vehicle 10 in which the abnormality was detected and quickly collect operation logs from vehicles 10 with a high level of threat of the abnormality. Furthermore, even when an abnormality is detected in the vehicle 10, operation logs with a large amount of data are not transmitted indiscriminately from multiple vehicles 10. Therefore, even when an abnormality is detected in the vehicle 10, the log collecting device 200 can suppress the amount of data transmitted as operation logs to the log collecting device 200, thereby preventing the log collecting device 200 from exceeding its processing capacity. Therefore, the log collection device 200 can quickly take action to deal with the vehicle 10 in which an abnormality is detected, while suppressing the processing load on the log collection device 200.

[0100] Furthermore, in the log collection device 200 of this embodiment, the determination unit 210 has a threat level setting unit 211 that sets the threat level of an abnormality detected in the vehicle 10 that transmitted the anomaly detection frame, based on the anomaly detection frame received by the communication unit 220, and a priority determination unit 213 that determines a processing priority that indicates the priority for performing a process of requesting the vehicle 10 that transmitted the anomaly detection frame to transmit an operation log and analyzing the operation log, based on the threat level set by the threat level setting unit 211. The communication unit 220 requests the vehicle 10 to transmit the operation log in accordance with the processing priority determined by the priority determination unit 213.

[0101] This allows the log collection device 200 to collect operation logs in order of the vehicle 10 with the highest threat of abnormality, and also to reliably reduce the amount of data transmitted to the log collection device 200. Therefore, the log collection device 200 can more quickly respond to the vehicle 10 in which an abnormality has been detected, while reliably reducing the processing load on the log collection device 200.

[0102] The log collection device 200 of this embodiment also includes a mode setting unit 250 that switches the collection mode of operation logs between a normal collection mode in which any vehicle 10 is requested to transmit an operation log, and an abnormality collection mode in which a vehicle 10 that has transmitted an abnormality detection frame is requested to transmit an operation log. The mode setting unit 250 sets the collection mode to the normal collection mode when the communication unit 220 has not received an abnormality detection frame, and sets the collection mode to the abnormality collection mode when the communication unit 220 has received an abnormality detection frame. The communication unit 220 requests the vehicle 10 to transmit an operation log according to the collection mode set by the mode setting unit 250.

[0103] This allows the log collection device 200 to selectively use the operation log collection mode depending on whether an abnormality is detected in the vehicle 10 or not, and when an abnormality is detected in the vehicle 10, it can quickly collect the operation log from the vehicle 10. Therefore, the log collection device 200 can more quickly respond to the vehicle 10 in which an abnormality is detected, while reliably suppressing the processing load on the log collection device 200.

[0104] In the log collection device 200 of this embodiment, the anomaly detection frame includes information on the location where the anomaly was detected, the number of detected anomalies, and the details of the detected anomaly. The threat level setting unit 211 sets the threat level based on the information.

[0105] This allows the log collection device 200 to precisely and accurately set the threat level of the abnormality, thereby enabling the log collection device 200 to collect operation logs in a more appropriate order from the vehicle 10. Therefore, the log collection device 200 can appropriately and quickly respond to the vehicle 10 in which an abnormality has been detected, while reliably suppressing the processing load on the log collection device 200.

[0106] Furthermore, in the log collection device 200 of this embodiment, the determination unit 210 has a request destination determination unit 214 that determines the vehicle 10 to which a request to transmit an operation log is to be made. The request destination determination unit 214 determines the vehicle 10 to which a request to transmit a request to transmit an operation log is to be made based on the abnormality detection frame received by the communication unit 220. The communication unit 220 requests the vehicle 10 to which the request destination determined by the request destination determination unit 214 is to transmit an operation log.

[0107] As a result, the log collection device 200 can collect operation logs in an order appropriate to the current situation, such as collecting operation logs from the vehicle 10 with the highest urgency, even when anomaly detection frames are transmitted from multiple vehicles 10. Therefore, the log collection device 200 can more appropriately and quickly respond to the vehicle 10 in which an abnormality is detected, while reliably suppressing the processing load on the log collection device 200.

[0108] Furthermore, in the log collection device 200 of this embodiment, the communication unit 220 simultaneously receives a plurality of anomaly detection frames from a plurality of vehicles 10. The request destination determination unit 214 determines the vehicle 10 to which the request is to be sent, based on the identity or similarity of the plurality of anomaly detection frames simultaneously received by the communication unit 220.

[0109] This allows the log collection device 200 to collect and analyze operation logs collectively from multiple vehicles 10 in which the same or similar abnormality has been detected, thereby enabling rapid and collective response to these vehicles 10. Thus, the log collection device 200 can more quickly respond to the vehicles 10 in which an abnormality has been detected, while reliably suppressing the processing load on the log collection device 200.

[0110] The log collection device 200 of this embodiment further includes a log analysis unit 230 that analyzes the operation log transmitted from the vehicle 10. Based on the analysis result of the log analysis unit 230, the communication unit 220 requests the vehicle 10 to change at least one of the conditions for acquiring the operation log in the vehicle 10 and the conditions for transmitting the anomaly detection frame.

[0111] As a result, when an abnormality is detected by analyzing the operation logs, the log collecting device 200 can actively change the acquisition conditions and transmission conditions. Therefore, the log collecting device 200 can effectively collect the operation logs necessary to investigate the cause of the abnormality while controlling the amount of data transmitted from the operation logs to the log collecting device 200. Therefore, the log collecting device 200 can quickly take action on the vehicle 10 in which an abnormality has been detected while reliably suppressing the processing load on the log collecting device 200.

[0112] The in-vehicle device 100 of this embodiment also includes a log acquisition unit 170 that acquires an operation log of the vehicle 10 based on preset acquisition conditions, a diagnosis unit 130 that diagnoses the operation log acquired by the log acquisition unit 170 to detect an abnormality, a transmission determination unit 150 that determines whether to transmit an abnormality detection frame notifying an abnormality detected by the diagnosis unit 130 to an external log collection device 200 based on preset transmission conditions, and an external communication unit 110 that transmits the abnormality detection frame to the log collection device 200 based on the determination result of the transmission determination unit 150. When the log collection device 200 requests the external communication unit 110 to transmit the operation log, the external communication unit 110 transmits the operation log to the log collection device 200.

[0113] As a result, the on-board device 100 can notify the log collecting device 200 of the detection of an abnormality using an anomaly detection frame with a small amount of data, and can transmit the operation log with a large amount of data to the log collecting device 200 in response to a request from the log collecting device 200. Therefore, the on-board device 100 can prompt the log collecting device 200 to take action on the vehicle 10 in which an abnormality has been detected, and can reduce the amount of data transmitted as the operation log to the log collecting device 200. Therefore, the on-board device 100 can quickly take action on the vehicle 10 in which an abnormality has been detected, while reducing the processing load on the log collecting device 200.

[0114] The log collection system 1 of this embodiment is a log collection system including an in-vehicle device 100 mounted on a vehicle 10 and a log collection device 200 communicatively connected to the in-vehicle device 100. The in-vehicle device 100 includes a log acquisition unit 170 that acquires an operation log of the vehicle 10 based on preset acquisition conditions, a diagnosis unit 130 that diagnoses the operation log acquired by the log acquisition unit 170 to detect an abnormality, a transmission determination unit 150 that determines, based on preset transmission conditions, whether to transmit an anomaly detection frame to the log collection device 200 notifying the abnormality detected by the diagnosis unit 130, and an external communication unit 110 that transmits the anomaly detection frame to the log collection device 200 based on the determination result of the transmission determination unit 150. The log collection device 200 includes a communication unit 220 that receives the anomaly detection frame from the in-vehicle device 100, and a determination unit 210 that determines, based on the threat level of the abnormality, whether to request the vehicle 10 that transmitted the anomaly detection frame to transmit an operation log. The communication unit 220 requests the in-vehicle device 100 to transmit an operation log in accordance with the determination result of the determination unit 210. When the external communication unit 110 is requested by the log collection device 200 to transmit an operation log, the external communication unit 110 transmits the operation log to the log collection device 200.

[0115] As a result, the log collection system 1 can notify the log collection device 200 of the detection of an abnormality using an anomaly detection frame with a small amount of data, and can transmit the operation log with a large amount of data to the log collection device 200 at the discretion of the log collection device 200. Therefore, the log collection system 1 can promptly allow the log collection device 200 to identify the vehicle 10 in which an abnormality has been detected, and can reduce the amount of data transmitted as the operation log to the log collection device 200. Therefore, the log collection system 1 can promptly respond to the vehicle 10 in which an abnormality has been detected, while reducing the processing load on the log collection device 200.

[0116] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those including all of the described components. Furthermore, some of the components of one embodiment can be replaced with components of another embodiment, and components of another embodiment can be added to components of one embodiment. Furthermore, some of the components of each embodiment can be added, deleted, or replaced with other components.

[0117] Furthermore, the above-described components, functions, processing units, or processing means may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described components or functions may also be implemented in software, with a processor interpreting and executing a program that implements each function. Information such as programs, tables, or files that implement each function may be stored in a storage device such as a memory, a hard disk, or an SSD (solid state drive), or in a storage medium such as an IC card, an SD card, or a DVD.

[0118] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected.

[0119] 1...log collection system, 10...vehicle, 20...external communication device, 30a to 30c...ECU, 40...GNSS receiver, 100...in-vehicle device, 110...external communication unit (in-vehicle communication unit), 120...internal communication unit, 130...diagnosis unit, 140...condition update unit, 150...transmission determination unit, 160...frame generation unit, 170...log acquisition unit, 180...storage unit, 181...log storage unit, 182...transmission condition storage unit, 183...acquisition condition storage unit, 200...log collection device, 210...determination unit, 211...threat level setting unit, 212...log necessity determination unit, 213...priority determination unit, 214...request destination determination unit, 220...communication unit, 230...log analysis unit, 240...database update unit, 250...mode setting unit, 260...vehicle database, 270...log / analysis result storage unit

Claims

1. A log collection device comprising: a communication unit that receives an abnormality notification from the vehicle that notifies of an abnormality detected in the vehicle based on the vehicle's operation log; and a judgment unit that judges, based on the threat level of the abnormality, whether to request the vehicle that sent the abnormality notification to send the operation log, wherein the communication unit requests the vehicle to send the operation log depending on the judgment result of the judgment unit.

2. The log collection device described in claim 1, characterized in that the judgment unit has: a threat level setting unit that sets the threat level of the abnormality detected in the vehicle that sent the abnormality notification based on the abnormality notification received by the communication unit; and a priority determination unit that determines a processing priority that indicates the priority of requesting the vehicle that sent the abnormality notification to send the operation log and performing the process of analyzing the operation log based on the threat level set by the threat level setting unit, and the communication unit requests the vehicle to send the operation log in accordance with the processing priority determined by the priority determination unit.

3. The log collection device described in claim 1 is further provided with a mode setting unit that switches the collection mode of the operation log between a normal collection mode that requests any of the vehicles to send the operation log and an abnormal collection mode that requests the vehicle that sent the abnormality notification to send the operation log, wherein the mode setting unit sets the collection mode to the normal collection mode when the communication unit has not received the abnormality notification, and sets the collection mode to the abnormal collection mode when the communication unit receives the abnormality notification, and wherein the communication unit requests the vehicle to send the operation log according to the collection mode set by the mode setting unit.

4. The log collection device described in claim 2, characterized in that the abnormality notification includes information on the location where the abnormality was detected, the number of abnormalities detected, and the content of the detected abnormality, and the threat level setting unit sets the threat level based on the information.

5. The log collection device described in claim 1, characterized in that the judgment unit has a request destination determination unit that determines the vehicle to which the request to send the operation log will be made, the request destination determination unit determines the vehicle to which the request will be made based on the abnormality notification received by the communication unit, and the communication unit requests the vehicle to which the request is made determined by the request destination determination unit to send the operation log.

6. The log collection device described in claim 5, characterized in that the communication unit simultaneously receives multiple abnormality notifications from multiple vehicles, and the request destination determination unit determines the vehicle to which the request is to be made based on the identity or similarity of the multiple abnormality notifications simultaneously received by the communication unit.

7. The log collection device described in claim 1, further comprising a log analysis unit that analyzes the operation log transmitted from the vehicle, and wherein the communication unit requests the vehicle to change at least one of the conditions for acquiring the operation log and the conditions for transmitting the abnormality notification based on the analysis results of the log analysis unit.

8. An in-vehicle device comprising: a log acquisition unit that acquires a vehicle operation log based on preset acquisition conditions; a diagnosis unit that diagnoses the operation log acquired by the log acquisition unit to detect abnormalities; a transmission determination unit that determines whether to send an abnormality notification notifying an external log collection device of the abnormality detected by the diagnosis unit based on preset transmission conditions; and an in-vehicle communication unit that transmits the abnormality notification to the log collection device based on the determination result of the transmission determination unit, wherein the in-vehicle communication unit transmits the operation log to the log collection device when the log collection device requests it to transmit the operation log.

9. A log collection system having an on-board device mounted on a vehicle and a log collection device communicatively connected to the on-board device, wherein the on-board device comprises: a log acquisition unit that acquires operation logs of the vehicle based on preset acquisition conditions; a diagnosis unit that diagnoses the operation logs acquired by the log acquisition unit to detect abnormalities; a transmission determination unit that determines, based on preset transmission conditions, whether to send an abnormality notification to the log collection device that notifies the abnormality detected by the diagnosis unit; and an on-board communication unit that transmits the abnormality notification to the log collection device based on the determination result of the transmission determination unit; the log collection device comprises: a communication unit that receives the abnormality notification from the on-board device; and a determination unit that determines, based on the threat level of the abnormality, whether to request the vehicle that sent the abnormality notification to transmit the operation log; the communication unit requests the on-board device to transmit the operation log based on the determination result of the determination unit; and the on-board communication unit transmits the operation log to the log collection device when requested to transmit the operation log by the log collection device.

Images