JP2021034833A - Fraud detection device and fraud detection method - Google Patents

Abstract

To provide a fraud detection device and a fraud detection method capable of detecting a fraudulent node with high accuracy.SOLUTION: A fraud detection device 1 includes an acquisition unit 21 and a determination unit 23. The acquisition unit 21 acquires behavior information concerning the behavior of a vehicle from device nodes 10-1 to 10-n in a network for a vehicle. The determination unit 23 determines whether the device node is a fraud node based on a comparison of pattern information 32 regarding a pattern of vehicle behavior generated in advance and a behavior pattern based on the behavior information acquired by the acquisition unit 21.SELECTED DRAWING: Figure 2

Description

The present invention relates to a fraud detection device and a fraud detection method.

Conventionally, for example, a fraud detection device for detecting whether various devices serving as nodes in a vehicle network such as CAN (Controller Area Network) are regular nodes or fraudulent nodes such as modified devices has been known. In this type of fraud detection device, a technique for detecting a fraudulent node based on identification information (for example, CAN ID) of information transmitted from a device serving as a node, an information transmission interval, or the like has been proposed.

Japanese Unexamined Patent Publication No. 2017-50841

However, for example, when information is transmitted with the same CAN ID and transmission interval as the regular node, even a modified device is treated as a regular node. In this case, even if the information transmitted from the modified device regarded as the normal node is abnormal information, it may be reflected in the vehicle control.

The present invention has been made in view of the above, and an object of the present invention is to provide a fraud detection device and a fraud detection method capable of detecting a fraudulent node with high accuracy.

In order to solve the above-mentioned problems and achieve the object, the fraud detection device according to the present invention includes an acquisition unit and a determination unit. The acquisition unit acquires behavior information regarding the behavior of the vehicle from the device node in the vehicle network. In the determination unit, the device node is an invalid node based on the comparison result between the pattern information regarding the behavior pattern of the vehicle generated in advance and the behavior pattern based on the behavior information acquired by the acquisition unit. Judge whether or not.

According to the present invention, an unauthorized node can be detected with high accuracy.

FIG. 1A is a diagram showing an outline of a fraud detection method according to an embodiment. FIG. 1B is a diagram showing an outline of a fraud detection method according to an embodiment. FIG. 2 is a functional block diagram showing the configuration of the fraud detection device according to the embodiment. FIG. 3 is a diagram showing an example of driver information. FIG. 4 is a diagram showing an example of pattern information. FIG. 5 is a diagram showing a determination process by the determination unit. FIG. 6 is a flowchart showing a processing procedure of processing executed by the fraud detection device according to the embodiment.

Hereinafter, embodiments of the fraud detection device and fraud detection method disclosed in the present application will be described in detail with reference to the accompanying drawings. The present invention is not limited to the embodiments shown below.

First, the outline of the fraud detection method according to the embodiment will be described with reference to FIGS. 1A and 1B. 1A and 1B are diagrams showing an outline of a fraud detection method according to an embodiment. FIG. 1A shows a vehicle C equipped with a fraud detection device 1 that executes the fraud detection method according to the embodiment.

As shown in FIG. 1A, the fraud detection device 1 according to the embodiment is connected to, for example, a vehicle network N such as CAN. In addition to the fraud detection device 1, various devices A to D (hereinafter, referred to as device nodes A to D) that serve as nodes in the vehicle network N are connected to the vehicle network N.

The device nodes A to D are devices that output behavior information regarding the behavior of the vehicle C (general control of the running state, the environment inside the vehicle, etc.). The device nodes A to D are, for example, a navigation device, a drive recorder, various sensors (vehicle speed sensor, acceleration sensor, etc.) and the like.

Here, as shown in FIG. 1A, it is assumed that the device node D is a device modified for the purpose of hijacking (hacking) the vehicle C or the like. That is, it is assumed that the node is illegally connected to the vehicle network N (hereinafter, referred to as an unauthorized node).

Conventionally, when the identification information (CAN ID) associated with the information transmitted from the device node or the information transmission interval is different from that of the normal node, it is detected as an invalid node. However, in the past, when the CAN ID and the transmission interval were the same as the normal node, there was a possibility that the node would be detected as a normal node even though it was an invalid node. Therefore, even if the information transmitted from the device of the unauthorized node regarded as the legitimate node is abnormal, it may be reflected in the vehicle control.

Therefore, in the fraud detection method according to the embodiment, it is determined whether or not there is a fraudulent node based on the content of the information transmitted from the device nodes A to D. Specifically, as shown in FIG. 1A, first, in the fraud detection method according to the embodiment, behavior information related to the behavior information of the vehicle C is acquired from the device nodes A to D in the vehicle network N (step S1).

Subsequently, in the fraud detection method according to the embodiment, it is determined whether or not the device nodes A to D are fraudulent nodes based on the acquired behavior information (step S2). Specifically, in the fraud detection method according to the embodiment, the device nodes A to D are based on the comparison result between the pattern information related to the behavior pattern of the vehicle C generated in advance and the behavior pattern based on the acquired behavior information. Determine if it is an invalid node. Here, a method for determining an unauthorized node will be specifically described with reference to FIG. 1B.

FIG. 1B schematically shows the relationship between the pattern information regarding the behavior pattern of the vehicle C and the behavior pattern based on the behavior information. In FIG. 1B, the range of the behavior pattern that the vehicle C can take is shown as the pattern information, and the range of the behavior pattern generated based on the behavior information is shown as the behavior pattern. The behavior pattern 1 is a behavior pattern based on the behavior information of the device node A which is a normal node, and the behavior pattern 2 is a behavior pattern based on the behavior information of the device node D which is an invalid node.

The range of the pattern information and the behavior pattern shown in FIG. 1B corresponds to, for example, the range of the vehicle speed, the range of acceleration / deceleration, the traveling position, the traveling path, the driving characteristics (habit), and the like. The pattern information and the behavior pattern may be generated for each behavior information of the vehicle speed range, acceleration / deceleration range, traveling position, traveling route, and driving characteristic (habit), and all the above behavior information may be generated. It may be generated as one pattern as a whole.

As shown in FIG. 1B, the behavior pattern 1 is within the range of the pattern information. This indicates that the behavior pattern 1 generated based on the device node A is a behavior pattern that can actually be taken.

On the other hand, the behavior pattern 2 deviates from the range of pattern information. This indicates that the behavior pattern 2 generated based on the device node D is a behavior pattern that cannot actually be taken.

In other words, the behavior pattern 1 is a behavior pattern generated based on the normal behavior information, and the behavior pattern 2 is a behavior pattern generated based on the abnormal behavior information.

That is, in the fraud detection method according to the embodiment, the device node A corresponding to the behavior pattern 1 is determined to be a normal node, and the device node D corresponding to the behavior pattern 2 is determined to be a fraud node.

Thereby, for example, even if the CAN ID and the transmission interval of the behavior information transmitted from the device of the unauthorized node are the same, it can be determined that the node is an unauthorized node by deviating from the pattern information in the behavior pattern. That is, in the fraud detection method according to the embodiment, the fraudulent node can be detected with high accuracy.

Next, the configuration of the fraud detection device 1 according to the embodiment will be described with reference to FIG. FIG. 2 is a functional block diagram showing the configuration of the fraud detection device 1 according to the embodiment.

As shown in FIG. 2, the fraud detection device 1 according to the embodiment is connected to a plurality of device nodes 10-1, 10-2 ..., 10-n via the vehicle network N. In the following, the device nodes 10-1, 10-2 ..., 10-n may be collectively referred to as the device node 10.

The device node 10 is an electronic device that transmits behavior information regarding the behavior of the vehicle C. The device node 10 includes, for example, a navigation device, a drive recorder, various sensors (vehicle speed sensor, acceleration sensor, etc.) and the like.

The behavior information includes, for example, information on the running control of vehicle C (vehicle speed, acceleration, current position), the vehicle interior environment of vehicle C (opening / closing of doors and windows, the status of in-vehicle contents such as music, navigation device and drive recorder). Information about settings, etc.) is included.

The fraud detection device 1 according to the embodiment includes a communication unit IF, a control unit 2, and a storage unit 3. The communication unit IF is a communication interface for transmitting and receiving information to and from the device node 10 via the vehicle network N. The control unit 2 includes an acquisition unit 21, a generation unit 22, a determination unit 23, an update unit 24, and a vehicle control unit 25. The storage unit 3 stores the driver information 31 and the pattern information 32.

Here, the fraud detection device 1 includes, for example, a computer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), a flash memory, an input / output port, and various circuits.

The CPU of the computer functions as the acquisition unit 21, the generation unit 22, the determination unit 23, the update unit 24, and the vehicle control unit 25 of the control unit 2, for example, by reading and executing the program stored in the ROM.

Further, at least one or all of the acquisition unit 21, the generation unit 22, the determination unit 23, the update unit 24, and the vehicle control unit 25 of the control unit 2 are ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). It can also be configured with hardware such as.

Further, the storage unit 3 corresponds to, for example, a RAM or a flash memory. The RAM or flash memory can store driver information 31, pattern information 32, information on various programs, and the like. The fraud detection device 1 may acquire the above-mentioned program and various information via another computer or a portable recording medium connected by a wired or wireless network.

The driver information 31 stored in the storage unit 3 is information about the driver of the vehicle C. The driver information 31 may be, for example, information input by a manual operation by a user who is a driver, or may be, for example, information acquired from a terminal device possessed by the user.

FIG. 3 is a diagram showing an example of driver information 31. As shown in FIG. 3, the driver information 31 includes items such as "driver ID" and "driver information".

The "driver ID" is identification information that identifies a user who is a driver. "Driver information", information about a user who is a driver. "Driver information" includes, for example, demographic attribute information such as the user's gender, age, address, occupation, family structure, annual income, birthplace, educational background, and demographic attribute information, and the user. Includes information on psychographic attributes, which is information on psychological attributes such as values, lifestyle, personality, and preferences.

Next, the pattern information 32 stored in the storage unit 3 is information regarding the behavior pattern of the vehicle C. The pattern information 32 is information generated in advance based on the behavior information acquired from the device node. FIG. 4 is a diagram showing an example of pattern information 32. As shown in FIG. 4, the pattern information 32 includes information such as "pattern ID", "pattern type", and "driver ID".

The "pattern ID" is identification information that identifies a pattern of behavior. The "pattern type" is information indicating the type of behavior pattern. The past behavior pattern in the "pattern type" is a behavior pattern generated based on the past behavior information, and the limit behavior pattern is a behavior pattern indicating the performance limit of the vehicle C. The details of the past behavior pattern and the limit behavior pattern will be described later in FIG.

For example, the pattern in which the pattern ID is identified by "M1" is a past behavior pattern, which is associated with the driver whose driver ID is identified by "D1", and the pattern ID is identified by "M2". The pattern is a past behavior pattern and is associated with a driver whose driver ID is identified by "D2". That is, in the example shown in FIG. 4, the past behavior pattern is generated for each driver. The limit behavior pattern is generated for each vehicle type (vehicle type, model year, mileage, model, equipment).

Next, each function of the control unit 2 (acquisition unit 21, generation unit 22, determination unit 23, update unit 24, and vehicle control unit 25) will be described.

The acquisition unit 21 acquires various types of information. For example, the acquisition unit 21 acquires behavior information regarding the behavior of the vehicle C from the device node 10 in the vehicle network N.

The generation unit 22 generates a behavior pattern based on the behavior information acquired by the acquisition unit 21. For example, the generation unit 22 extracts information on the tendency of vehicle speed (average speed, range of maximum speed and minimum speed, degree of acceleration, traveling position, etc.) in the behavior information acquired in a certain period, and uses the extracted information as a behavior pattern. Generate as.

The behavior pattern generated by the generation unit 22 may be generated for each device node 10, or may be generated by integrating the behavior information of a plurality of device nodes 10.

The determination unit 23 determines that the device node 10 is an invalid node based on the comparison result between the pattern information 32 regarding the behavior pattern of the vehicle C generated in advance and the behavior pattern based on the behavior information acquired by the acquisition unit 21. Judge whether or not.

Here, the determination process by the determination unit 23 will be described with reference to FIG. 5 by giving a specific example. FIG. 5 is a diagram showing a determination process by the determination unit 23. FIG. 5 schematically shows a limit behavior pattern, a past behavior pattern, and six behavior patterns in the pattern information 32.

The limit behavior pattern is a behavior pattern indicating the performance limit of the vehicle C, and indicates the maximum range of patterns that can be taken by the vehicle C. Further, the past behavior pattern is, for example, a behavior pattern generated based on the past behavior information of a predetermined driver, and is the maximum range of the behavior pattern taken by the driver in the past, in other words, driving. The range of behavior patterns that a person is likely to take is shown.

The determination unit 23 determines the invalid node based on the comparison result of comparing the limit behavior pattern and the past behavior pattern with the behavior pattern. Hereinafter, each of the behavior patterns 1 to 6 will be specifically described.

<Behavior pattern 1>
The behavior pattern 1 is a behavior pattern within the range of the past behavior pattern. When the behavior pattern 1 is within the range of the past behavior pattern (and within the range of the limit behavior pattern), the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 1 is a normal node. That is, since the behavior pattern 1 is a behavior pattern that the driver is likely to be able to take, there is a high possibility that normal behavior information is transmitted from the device node 10, so that the device node 10 is a regular node. Judge that there is.

<Behavior pattern 2 and behavior pattern 3>
The behavior pattern 2 and the behavior pattern 3 are behavior patterns that are within the range of the limit behavior pattern but partially deviate from the past behavior pattern. Specifically, the behavior pattern 2 has a deviation range of less than a predetermined value (less than half), and the behavior pattern 3 has a deviation range of a predetermined value or more (half or more).

In such a case, the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 2 is a normal node because the deviation range from the past behavior pattern is less than a predetermined value for the behavior pattern 2. On the other hand, the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 3 is an invalid node because the deviation range from the past behavior pattern is equal to or greater than the predetermined value for the behavior pattern 3.

That is, although the behavior pattern 2 deviates from the past behavior pattern, the deviation range is less than a predetermined value, and in such a situation, for example, the driver temporarily operates differently from usual due to an emergency or the like. There are cases where In this way, when the deviation range from the past behavior pattern is less than the predetermined value, it is determined that the node is a normal node. It is possible to reduce the possibility that a certain device node 10 is erroneously determined as an invalid node.

On the other hand, when the deviation range from the past behavior pattern is equal to or more than a predetermined value as in the behavior pattern 3, it is not caused by the driver temporarily driving differently than usual. Since there is a high possibility that the behavior information is abnormal, the device node 10 corresponding to the behavior pattern 3 is determined to be an invalid node. As a result, the device node 10 or the like modified so as to be able to transmit behavior information that resembles the driver's habit can be determined as an unauthorized node.

<Behavior pattern 4>
The behavior pattern 4 is a behavior pattern that is within the range of the limit behavior pattern but is outside the range of the past behavior pattern. In such a case, the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 4 is an invalid node.

That is, since the behavior pattern 4 completely deviates from the past behavior pattern and is a behavior pattern that the driver cannot take, it is assumed that the behavior information transmitted from the device node 10 is abnormal, and the device node 10 is set. Determined to be an invalid node. As a result, the device node 10 that transmits behavior information that is clearly different from the driver's past behavior pattern can be detected as an unauthorized node.

<Behavior pattern 5>
The behavior pattern 5 is a behavior pattern that completely deviates from the limit behavior pattern. In such a case, the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 5 is an invalid node. That is, since the behavior pattern 5 is a behavior pattern that cannot be taken due to the performance of the vehicle C, in such a case, it is determined to be an illegal node. As a result, it is possible to reliably prevent the behavior information that the vehicle C cannot take from being reflected in the vehicle control.

<Behavior pattern 6>
The behavior pattern 6 is a behavior pattern in which the deviation range from the past behavior pattern is less than a predetermined value, but partially deviates from the limit behavior pattern. In such a case, the determination unit 23 determines that the device node 10 corresponding to the behavior pattern 6 is an invalid node.

That is, the behavior pattern 6 is a behavior pattern that is highly likely to be taken by the driver, and a part of the range exceeds the performance limit of the vehicle C and cannot be taken as an actual behavior pattern. Judge that there is. The deviation range of the limit behavior pattern is not considered. That is, if it deviates from the limit behavior pattern even a little, it is determined that the node is an invalid node.

The determination unit 23 notifies the update unit 24 of the determination result. Further, when there is a device node 10 determined to be an invalid node, the determination unit 23 indicates that the device node 10 is an invalid node together with information for identifying the device node 10 (CAN ID, etc.). Notify 10. As a result, it is possible to prevent the behavior information of the unauthorized node from being used by the other device node 10.

In this way, by comparing with the limit behavior pattern and the past behavior pattern, it is possible to determine with high accuracy whether or not the device node 10 corresponding to the behavior pattern is an invalid node.

The update unit 24 updates the pattern information 32 based on the behavior pattern associated with the determination result by the determination unit 23. For example, the update unit 24 stores in the storage unit 3 information in which the information indicating the presence / absence of an unauthorized node by the determination unit 23 and the behavior pattern (or behavior information) are associated with each other. By updating the pattern information 32 in this way, the determination unit 23 can always perform the determination processing of the illegal node based on the latest pattern information 32, so that the determination accuracy can be improved.

The vehicle control unit 25 controls the behavior of the vehicle based on the behavior information acquired from the device node 10. Specifically, the vehicle control unit 25 performs vehicle control based on the behavior information of the device node 10 determined to be a normal node by the determination unit 23 among the information acquired from the update unit 24.

On the other hand, when the determination unit 23 determines that the device node 10 is an unauthorized node, the vehicle control unit 25 prohibits the use of the behavior information acquired from the device node 10. More specifically, the vehicle control unit 25 discards the behavior information acquired from the device node 10 determined to be an unauthorized node. As a result, it is possible to prevent the behavior information acquired from the unauthorized node from being reflected in the vehicle control with high accuracy.

Next, the process executed by the fraud detection device 1 according to the embodiment will be described with reference to FIG. FIG. 6 is a flowchart showing a procedure of processing executed by the fraud detection device 1 according to the embodiment.

As shown in FIG. 6, first, the acquisition unit 21 acquires the behavior information regarding the behavior of the vehicle C from the device node 10 in the vehicle network N (step S101).

Subsequently, the generation unit 22 generates a behavior pattern based on the behavior information acquired by the acquisition unit 21 (step S102).

Subsequently, the determination unit 23 determines whether or not the behavior pattern generated by the generation unit 22 is within the range of the limit behavior pattern (step S103).

When the generated behavior pattern is within the range of the limit behavior pattern (step S103: Yes), the determination unit 23 determines whether or not it is within the range of the past behavior pattern (step S104).

When the generated behavior pattern is within the range of the past behavior pattern (step S104: Yes), the determination unit 23 determines that the device node 10 corresponding to the behavior pattern is a normal node (step S105).

Subsequently, the vehicle control unit 25 performs vehicle control based on the behavior information acquired from the device node 10 determined to be the normal node (step S106).

Subsequently, the update unit 24 updates the pattern information 32 based on the behavior pattern associated with the determination result by the determination unit 23 (step S107), and ends the process. The processing order of step S106 (or step S109 described later) and step S107 may be interchanged with each other.

On the other hand, in step S103, when the generated behavior pattern deviates from the range of the limit behavior pattern (step S103: No), the determination unit 23 determines that the device node 10 corresponding to the behavior pattern is an invalid node (step S103). S108).

Subsequently, the vehicle control unit 25 prohibits the use of the behavior information acquired from the device node 10 determined to be an unauthorized node for vehicle control (step S109), and proceeds to the process of step S107.

On the other hand, in step S104, when the generated behavior pattern deviates from the past behavior pattern (step S104: No), the determination unit 23 determines whether or not the deviation range is less than a predetermined value (step S110).

When the deviation range from the past behavior pattern is less than a predetermined value (step S110: Yes), the determination unit 23 shifts to the process of step S105.

On the other hand, when the deviation range from the past behavior pattern is equal to or greater than a predetermined value (step S110: No), the determination unit 23 shifts to the process of step S108.

As described above, the fraud detection device 1 according to the embodiment includes an acquisition unit 21 and a determination unit 23. The acquisition unit 21 acquires behavior information regarding the behavior of the vehicle C from the device node 10 in the vehicle network N. The determination unit 23 determines that the device node 10 is an invalid node based on the comparison result between the pattern information 32 regarding the behavior pattern of the vehicle C generated in advance and the behavior pattern based on the behavior information acquired by the acquisition unit 21. Judge whether or not. As a result, it is possible to detect an unauthorized node such as a modified device with high accuracy.

Further effects and variations can be easily derived by those skilled in the art. For this reason, the broader aspects of the invention are not limited to the particular details and representative embodiments expressed and described as described above. Therefore, various modifications can be made without departing from the spirit or scope of the general concept of the invention as defined by the appended claims and their equivalents.

1 Fraud detection device 2 Control unit 3 Storage unit 10 Equipment node 21 Acquisition unit 22 Generation unit 23 Judgment unit 24 Update unit 25 Vehicle control unit 31 Driver information 32 Pattern information C Vehicle IF communication unit N Vehicle network

Claims (5)

An acquisition unit that acquires behavior information related to vehicle behavior from equipment nodes in the vehicle network,
It is determined whether or not the device node is an unauthorized node based on the comparison result between the pattern information regarding the behavior pattern of the vehicle generated in advance and the behavior pattern based on the behavior information acquired by the acquisition unit. A fraud detection device characterized in that it is provided with a determination unit. The pattern information includes
A limit behavior pattern indicating the performance limit of the vehicle and a past behavior pattern based on past behavior information are included.
The determination unit
The fraud detection device according to claim 1, wherein the fraudulent node is determined based on a comparison result of comparing each of the limit behavior pattern and the past behavior pattern with the behavior pattern. The fraud detection device according to claim 1 or 2, further comprising an update unit that updates the pattern information based on the behavior pattern associated with the determination result by the determination unit. A vehicle control unit that controls the vehicle based on the behavior information is further provided.
The vehicle control unit
The invention according to any one of claims 1 to 3, wherein when the determination unit determines that the device node is an unauthorized node, the use of the behavior information acquired from the device node is prohibited. Fraud detection device. The acquisition process for acquiring behavior information related to vehicle behavior from the device node in the vehicle network,
Based on the comparison result between the pattern information related to the behavior pattern of the vehicle generated in advance and the behavior pattern based on the behavior information acquired by the acquisition process, it is determined whether or not the equipment node is an unauthorized node. A fraud detection method comprising a determination step.

Images