JP2021064034A - Abnormality detection apparatus, security system, and abnormality detection method - Google Patents

Abstract

To provide an abnormality detection apparatus, a security system and an abnormality detection method capable of reducing the amount of data required for communication with an external apparatus.SOLUTION: A CPU 21 generates detailed information indicating a content of abnormality in an on-vehicle network, records the detailed information in a storage unit 23, generates summary information by summarizing the detailed information on the content of the abnormality, transmits the summary information to a management server outside a vehicle, and transmits the detailed information to the management server when acquiring a transmission request to request transmission of the detailed information from the management server.SELECTED DRAWING: Figure 3

Description

The present invention relates to an abnormality detection device, a security system, and an abnormality detection method.

In recent years, automobiles are equipped with various types of in-vehicle devices such as electronic control units (ECUs (Electronic Control Units)). These in-vehicle devices are connected to each other by an in-vehicle network such as CAN (Controller Area Network), and can cooperate with each other by communicating with each other. High security is required for the in-vehicle network in order to prevent unauthorized access to the in-vehicle device.

For example, Patent Document 1 discloses a communication system that enables high-speed and safe acquisition of diagnostic information that collects information transmitted and received between communication devices from the outside. Specifically, the output device can acquire the diagnostic information from the outside at high speed by outputting the diagnostic information obtained via the high-speed trunk line to the external device.

JP-A-2015-113002

However, according to the technique disclosed in Patent Document 1, when the output device outputs information to the external device, all the information stored in the storage device of the vehicle is output, so that communication with the external device is performed. There is a problem that the amount of data required for the data increases.

The present invention has been made in view of such a problem, and an object of the present invention is to provide an abnormality detection device, a security system, and an abnormality detection method capable of suppressing the amount of data required for communication with an external device outside the vehicle. That is.

The abnormality detection device according to one aspect of the present invention generates detailed information indicating the content of the abnormality in the vehicle-mounted network, records the detailed information in the storage device, and generates summary information summarizing the content of the abnormality rather than the detailed information. , Sends the summary information to the management server outside the vehicle, and when the transmission request requesting the transmission of the detailed information is obtained from the management server, the detailed information is transmitted to the management server.

According to the present invention, the amount of data required for communication with an external device can be suppressed.

FIG. 1 is a diagram schematically showing a configuration of a security system according to the present embodiment. FIG. 2 is a block diagram showing a configuration of a vehicle according to the present embodiment. FIG. 3 is a block diagram showing a gateway configuration. FIG. 4 is an explanatory diagram showing a procedure of processing related to detailed information. FIG. 5 is an explanatory diagram showing a procedure for processing the summary information. FIG. 6 is an explanatory diagram showing a procedure of processing related to reading detailed information. FIG. 7 is a block diagram showing a configuration of a vehicle according to a modified example.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

The configuration of the security system according to the present embodiment will be described with reference to FIGS. 1 to 3. The security system is a system that manages abnormalities in the in-vehicle network constructed in the vehicle.

The security system is mainly composed of one or more vehicles 10 and a management server 100. Each vehicle 10 and the management server 100 are configured to be able to communicate with each other via the external network 200. The external network 200 includes, for example, a mobile communication network such as a mobile phone network. However, the external network 200 may be the Internet or the like. In the example shown in FIG. 1, two vehicles 10 are shown, but the present invention is not limited to this.

The vehicle 10 is mainly composed of a gateway 20, a plurality of ECUs (Electronic Control Units) 30 and 31, and a TCU (Telematics Communication Unit) 50. The gateway 20, the plurality of ECUs 30, and the TCU 50 are connected to the communication buses 40, 41, and 42 to form an in-vehicle network.

Specifically, a plurality of ECUs 30 are connected to the communication bus 40 so as to be able to communicate with each other via the communication bus 40. A plurality of ECUs 31 are connected to the communication bus 41 so as to be able to communicate with each other via the communication bus 41. An arbitrary number of ECUs 30 and 31 can be connected to the communication buses 40 and 41 as needed for vehicle control. Further, the TCU 50 is connected to the communication bus 42.

In the following description, it is assumed that the in-vehicle network is a CAN (Controller Area Network). However, the in-vehicle network may be a network compliant with a communication protocol other than CAN, for example, LIN (Local Interconnect Network), FlexRay (registered trademark), Ethernet (registered trademark), or the like. In addition, a plurality of networks conforming to different communication protocols may coexist in the in-vehicle network.

The gateway 20 is connected to the communication buses 40, 41, and 42, respectively. The gateway 20 transfers communication data between the communication bus 40 and the communication bus 41, or transfers communication data between the communication bus 40 or the communication bus 41 and the communication bus 42.

Further, the gateway 20 has a function as an abnormality detection device that detects a security abnormality such as an attack on an in-vehicle network and notifies the management server 100 of the security abnormality. The gateway 20 is realized by using an ECU (electronic control unit).

The ECUs 30 and 31 are electronic control devices including a microprocessor, a ROM, a RAM, an input / output interface, and the like. Parts or sensors of the vehicle 10 are connected to the ECUs 30 and 31. The ECUs 30 and 31 execute various controls based on the detected value of the sensor and the state of the component.

The ECUs 30 and 31 include an ECU that controls the operation of a power train including an engine, an ECU that controls a transmission, an ECU that controls electrical components, and the like. Further, the ECUs 30 and 31 include an ECU that executes control related to the navigation system, an ECU that executes control related to safe driving and automatic driving, and the like. The ECUs 30 and 31 include various ECUs according to functions and applications.

The TCU 50 is a communication unit that communicates with another vehicle 10 or an external device (including a management server 100) outside the vehicle through the external network 200. The TCU 50 is also realized by using an ECU (electronic control unit).

The TCU 50 transfers the information transmitted from the external device or the other vehicle 10 to the corresponding ECUs 30 and 31 via the gateway 20. The TCU 50 transmits the information transmitted from the ECUs 30 and 31 via the gateway 20 to the external device or another vehicle 10. Further, the TCU 50 transmits the information transmitted from the gateway 20 to the management server 100, and transmits the information transmitted from the management server 100 to the gateway 20.

The TCU 50 and the gateway 20 may be connected by a dedicated communication line in addition to being connected by the communication bus 42.

Further, the gateway 20 is provided with a port (not shown), and a diagnostic device (not shown) is connected from the outside of the vehicle via this port. The diagnostic device communicates with the ECUs 30 and 31 via the communication buses 40 and 41. The diagnostic device collects diagnostic data related to control operations from the ECUs 30 and 31, and transmits diagnostic information such as measurement parameters necessary for collecting the diagnostic data to the ECUs 30 and 31. The diagnostic device may be configured to communicate with the ECUs 30 and 31 via the TCU 50.

In the gateway 20, communication buses 40, 41, 42 and ports for diagnostic devices are assigned channel numbers for identifying them.

In FIG. 2, the gateway 20 has a CPU 21, a memory 22, a storage unit 23, and a plurality of communication units 24.

The CPU 21 reads various computer programs stored in the memory 22 and the like, and executes various instructions included in the programs. By executing the program, the CPU 21 functions as a plurality of information processing circuits included in the gateway 20. In this embodiment, an example of realizing a plurality of information processing circuits included in the gateway 20 by software is shown. Of course, it is also possible to configure an information processing circuit by preparing dedicated hardware for executing each of the following information processing. Further, a plurality of information processing circuits may be configured by individual hardware.

The CPU 21 includes a processing unit 21a, a detection unit 21b, a detailed information generation unit 21c, a summary information generation unit 21d, and a reading unit 21e as a plurality of information processing circuits. The processing unit 21a has a function unique to the gateway 20, and the detection unit 21b, the detailed information generation unit 21c, the summary information generation unit 21d, and the reading unit 21e have a function as an abnormality detection device.

The processing unit 21a transfers communication data between the ECU 30 connected to the communication bus 40 and the ECU 31 connected to the communication bus 41. Further, the processing unit 21a transfers data between the ECUs 30 and 31 connected to the communication buses 40 and 41 and the TCU 50 connected to the communication bus 42.

The processing unit 21a communicates according to the communication data defined in the CAN communication protocol. Communication data is composed of a plurality of frames. Each frame is composed of various fields such as an ID and a data field, and each field stores an ID (CANID), which is a value indicating a type of data, and data.

The detection unit 21b detects an abnormality in the in-vehicle network. In the in-vehicle network constructed in the vehicle 10, an unauthorized attack can occur through a system having a communication function uniquely such as a TCU 50, a port for failure diagnosis, and a navigation system. The detection unit 21b detects a security abnormality such as an attack on the in-vehicle network.

The detailed information generation unit 21c generates detailed information indicating the details of the abnormality. The detailed information generation unit 21c records the generated detailed information in the storage unit 23.

The summary information generation unit 21d generates summary information based on the detailed information stored in the storage unit 23. The summary information corresponds to the information that summarizes the content of the anomaly rather than the detailed information. The summary information generation unit 21d transmits the summary information to the management server 100 by outputting the summary information to the TCU 50.

When the reading unit 21e acquires a transmission request requesting transmission of detailed information from the management server 100, the reading unit 21e reads the detailed information from the storage unit 23. The reading unit 21e transmits the detailed information to the management server 100 by outputting the detailed information to the TCU 50.

The storage unit 23 stores the detailed information generated by the detailed information generation unit 21c. The storage unit 23 stores detailed information for each abnormality detected by the detection unit 21b. Each detailed information is associated with an abnormality ID for identifying the abnormality for each abnormality detected by the detection unit 21b.

The plurality of communication units 24, 25, 26 are provided corresponding to the plurality of communication buses 40, 41, 42, and are connected to the communication buses 40, 41, 42. The individual communication units 24, 25, and 26 receive frames from the communication buses 40, 41, and 42 according to the CAN communication protocol, and temporarily store the received frames (received frames). The reception frames stored in the individual communication units 24, 25, and 26 are read by the CPU 21. Further, the individual communication units 24, 25, 26 store frames to be transmitted (transmission frames) input from the CPU 21 to the communication units 24, 25, 26. The individual communication units 24, 25, 26 transmit the stored transmission frame according to the CAN communication protocol.

The management server 100 is mainly composed of a computer 110 and a storage device 120.

The computer 110 is configured by using one or more computers having a CPU and a memory. The computer 110 manages an abnormality in the vehicle-mounted network based on the data received from the vehicle 10 via the external network 200 (controller). The management performed by the computer 110 includes analysis of abnormalities and the like. The computer 110 provides such a function by executing a predetermined program.

The CPU reads various computer programs stored in a memory or the like and executes various instructions included in the programs. By executing the program, the CPU realizes a plurality of functions included in the management server 100. In the present embodiment, an example of realizing the functions provided by the management server 100 by software is shown, but of course, it is also possible to prepare an information processing circuit by preparing dedicated hardware for executing the functions shown below. Is.

In the present embodiment, the computer 110 acquires the summary information from the gateway 20 and stores it in the storage device 120. The computer 110 selects whether or not detailed information is required for the summary information received from the gateway 20. When the computer 110 selects that the detailed information is necessary, the computer 110 transmits a request for transmitting the detailed information to the gateway 20 that has transmitted the summary information. When the detailed information is transmitted from the gateway 20 in response to this, the computer 110 receives the detailed information.

The storage device 120 records information received from the vehicle 10 via the external network 200. Specifically, the storage device 120 records summary information and, if necessary, detailed information.

Hereinafter, the flow of processing in the security system will be described with reference to FIGS. 4 to 6.

The flow of processing related to detailed information will be described with reference to FIG. First, the detection unit 21b detects an abnormality in the in-vehicle network, specifically, a security abnormality (S10). Examples of the security abnormality include a CANID abnormality, a data amount abnormality, and a data value abnormality.

The CANID abnormality is an abnormality in CANID, and corresponds to, for example, a case where a CANID that is not planned to be used in an in-vehicle network is used. The data amount abnormality is an abnormality related to the data amount of the communication data flowing through the communication buses 40, 41, and 42. For example, when the amount of frames flowing per unit time is larger than a predetermined reference value, it is determined that the amount of data is abnormal. Also, it is assumed that frames of the same type flow at regular intervals. Therefore, if the same type of frame does not flow at a constant cycle, it is judged that the amount of data is abnormal. Further, the data value abnormality is an abnormality related to the data value of the communication data flowing through the communication buses 40, 41, and 42. Frames of the same type are assumed to have continuity in the data content. Therefore, if there is a frame having a data value that is significantly different from the data value of the previous frame, it is determined that the data value is abnormal.

When a security abnormality is detected, the detection unit 21b notifies the detailed information generation unit 21c of the detection (S11).

The detailed information generation unit 21c generates detailed information indicating the details of the abnormality based on the abnormality detected by the detection unit 21b (S12). The detailed information includes type information, part information, timing information, state information, target data, and detection amount information. The detailed information is composed of, for example, 25 Kbytes of data.

The type information is information indicating the type of abnormality, and the type such as CANID abnormality, data amount abnormality, and data value abnormality is described. The site information is information indicating a site where an abnormality is detected, and describes a channel in which the abnormality is detected. The timing information is information indicating the timing at which an abnormality is detected, and describes the elapsed time from the timing at which the gateway 20 is first activated to the detection of the abnormality, the mileage at the detected timing, and the like. The state information is information indicating which operation mode the gateway 20 operating in a plurality of different operation modes was operating when the abnormality was detected. The target data information is the data itself included in the frame in which the abnormality is detected. The detected amount information is information indicating the total amount of abnormalities detected so far. The detection unit 21b has a counter that measures the number of detections for each type of abnormality, and the count value of each counter is described in the detection information.

When the detailed information generation unit 21c generates the detailed information, the detailed information generation unit 21c performs format conversion for recording in the storage unit 23. Then, the detailed information generation unit 21c records the detailed information in the storage unit 23 (S13). At this time, the detailed information generation unit 21c records the detailed information by associating the abnormality ID for identifying the abnormality detected by the detection unit 21b with the detailed information.

The flow of processing related to the summary information will be described with reference to FIG. First, the detection unit 21b detects an abnormality in the in-vehicle network, specifically, a security abnormality (S10). Then, the detection unit 21b notifies the summary information generation unit 21d of the detection (S21).

The summary information generation unit 21d refers to the detailed information recorded by the detailed information generation unit 21c in the storage unit 23 (S22). Then, the summary information generation unit 21d generates summary information that summarizes the contents of the abnormality rather than the detailed information based on the information extracted from the detailed information (S23).

The summary information is composed of, for example, 8 bytes corresponding to a data field of one frame, and is composed of a smaller amount of data than the detailed information. The summary information includes at least information that can identify the type of anomaly. Specifically, the summary information includes an abnormality type flag and an abnormality detection amount.

The abnormality type flag is a flag indicating whether or not an abnormality has occurred in each channel for each abnormality type. The anomaly detection amount is information indicating the amount of increase of all counters per unit time.

The summary information also includes a transmission information flag, which is a flag indicating whether or not the summary information is immediately transmitted to the management server 100. Whether or not to send the summary information immediately depends, for example, on the type of anomaly detected. Anomalies that have a large impact on security are determined to be transmitted immediately, and anomalies that have a small impact on security are determined not to be transmitted immediately. In addition, the summary information includes anomalous IDs for identifying the corresponding detailed information.

When the summary information generation unit 21d generates the summary information, the summary information is output to the TCU 50 to notify the TCU 50 of the transmission of the summary information (S24). That is, the summary information generation unit 21d outputs the summary information to the TCU 50 in order to transmit the summary information to the management server 100.

The TCU 50 transmits summary information to the management server 100 (S25). Specifically, the TCU 50 refers to the transmission information flag in the summary information. Then, when the summary information is immediately transmitted, the TCU 50 transmits the summary information to the management server 100. On the other hand, if the summary information is not transmitted immediately, the TCU 50 retains the summary information until a predetermined transmission cycle is reached. Then, when the transmission cycle arrives, the TCU 50 transmits the summary information to the management server 100. At this time, when a plurality of untransmitted summary information is held to the management server 100, the TCU 50 collectively collects the summary information accumulated between the previous transmission cycle and the current transmission cycle, and manage server 100. Send to. Further, the TCU 50 assigns a vehicle ID for identifying the vehicle 10 to the summary information and transmits the summary information.

When the summary information is acquired from the TCU 50, the computer 110 of the management server 100 selects whether or not detailed information is required for the acquired summary information. The operator of the management server 100 may analyze the summary information and then follow the operator's operation according to the analysis result to select whether or not the detailed information is required. Further, the computer 110 may analyze the summary information and select the summary information corresponding to a predetermined criterion (for example, a specific abnormality type) as the information requiring detailed information.

The flow of processing relating to reading detailed information will be described with reference to FIG. When the computer 110 of the management server 100 selects the detailed information as the required summary information, the computer 110 requests the TCU 50 to transmit the detailed information (S30). The TCU 50 that requests the transmission of this detailed information can be specified from the vehicle ID acquired together with the summary information. In addition, the request for transmission of detailed information includes information on the abnormal ID included in the summary information selected as requiring detailed information.

The TCU 50 notifies the gateway 20 of a request for transmission of detailed information (S31).

When the gateway 20 is notified of the transmission request, the reading unit 21e searches the storage unit 23 based on the abnormal ID included in the transmission request, and searches for detailed information (S32). Then, the reading unit 21e reads out the detailed information corresponding to the abnormal ID from the storage unit 23 (S33).

The reading unit 21e notifies the TCU 50 of the transmission of the detailed information by outputting the detailed information to the TCU 50 (S34).

The TCU 50 transmits detailed information to the management server 100 (S35).

When the detailed information is acquired from the TCU 50, the computer 110 of the management server 100 analyzes the detailed information and records it in the storage device 120.

As described above, in the present embodiment, the gateway 20 includes a CPU 21 (controller) that detects an abnormality in an in-vehicle network in which a plurality of ECUs 30 and 31 mounted on the vehicle communicate with each other, and a storage unit 23 (storage device) that stores information. ) And.

Then, the CPU 21 generates detailed information indicating the content of the abnormality, records the detailed information in the storage unit 23, generates summary information summarizing the content of the abnormality rather than the detailed information, and transmits the summary information to the management server 100. To do. Further, when the CPU 21 acquires a transmission request requesting transmission of detailed information from the management server 100, the CPU 21 reads the detailed information from the storage unit 23 and transmits the detailed information to the management server 100.

According to this configuration, the CPU 21 transmits the summary information to the management server 100 while generating the detailed information. Since the summary information is information that summarizes the contents of the abnormality rather than the detailed information, the amount of data of the summary information can be suppressed from the detailed information. As a result, the amount of data required for communication with the management server 100 can be suppressed.

Further, by transmitting detailed information in response to a request from the management server 100, detailed contents regarding the abnormality can be provided to the management server 100.

Further, in the present embodiment, the CPU 21 reads detailed information from the storage unit 23 and generates summary information based on the information extracted from the detailed information.

According to this configuration, since the summary information is generated based on the information extracted from the detailed information, the amount of data of the summary information can be suppressed. As a result, the amount of data required for communication with the management server 100 can be suppressed.

Further, in the present embodiment, the summary information has a smaller amount of data than the detailed information.

According to this configuration, the amount of data required for communication with the management server 100 can be suppressed.

Further, in the present embodiment, the summary information includes at least information that can identify the type of abnormality.

According to this configuration, the type of abnormality, which is an important item for the management server 100 to manage the abnormality, can be recognized from the summary information. As a result, it is possible to appropriately transmit information necessary for the management server 100 to manage security while performing communication with the management server 100 while suppressing the amount of data.

Further, in the present embodiment, the summary information includes the type of abnormality and the amount of increase in abnormality detected per unit time. Further, the detailed information includes the type of abnormality, the part where the abnormality is detected, the timing when the abnormality is detected, the data in which the abnormality is detected, and the number of times the abnormality is detected measured for each type of abnormality.

According to this configuration, since the summary information is information that summarizes the contents of the abnormality rather than the detailed information, it is possible to suppress the amount of data of the summary information. As a result, the amount of data required for communication with the management server 100 can be suppressed.

The CPU 21 outputs the summary information to the TCU 50 (communication device) that communicates with the management server 100, thereby transmitting the summary information to the management server 100 via the TCU 50. The summary information includes transmission information for the management server 100 to determine whether or not to immediately transmit the summary information to the management server 100.

According to this configuration, the TCU 50 side can determine from the transmission information whether or not the information should be immediately transmitted to the management server 100 without determining the specific type of abnormality in the summary information. As a result, the processing load on the TCU50 side can be reduced.

Further, the security system according to the present embodiment has a vehicle 10 and a management server 100. As described above, the vehicle 10 includes a gateway 20 having a CPU 21 for detecting an abnormality in an in-vehicle network and a storage unit 23 for storing information.

According to this security system, the gateway 20 transmits the summary information to the management server 100 while generating the detailed information. Since the summary information is information that summarizes the contents of the abnormality rather than the detailed information, the amount of data of the summary information can be suppressed from the detailed information. As a result, the amount of data required for communication with the management server 100 can be suppressed.

Further, the abnormality detection method according to the present embodiment detects an abnormality in the in-vehicle network, generates detailed information, stores the detailed information in the storage unit 23, generates summary information, and transmits the summary information to the management server. When a request for transmitting detailed information is obtained from the management server 100, the detailed information is read from the storage unit 23 and the detailed information is transmitted to the management server 100.

According to this method, the summary information is transmitted to the management server 100 while generating the detailed information. Since the summary information is information that summarizes the contents of the abnormality rather than the detailed information, the amount of data of the summary information can be suppressed from the detailed information. As a result, the amount of data required for communication with the management server 100 can be suppressed.

In the present embodiment, the CPU 21 of the gateway 20 transmits summary information at the timing when an abnormality in the in-vehicle network is detected. However, the CPU 21 may transmit the summary information at any timing after the timing at which the abnormality is detected.

Further, in the present embodiment, the gateway 20 has a gateway-specific function and an abnormality detection device function. In this case, since the abnormality can be detected at the entrance / exit of the in-vehicle network, the security abnormality can be detected at an early stage.

However, an abnormality detection device may be provided in the vehicle-mounted network independently of the gateway 20. For example, in FIG. 7, the gateway 20a has only the function of the processing unit 21a, and the abnormality detection device 20b has the functions of the detection unit 21b, the detailed information generation unit 21c, the summary information generation unit 21d, and the reading unit 21e. doing. Further, the detection unit 21b, the detailed information generation unit 21c, the summary information generation unit 21d, and the reading unit 21e do not all have to be composed of one hardware resource, and may be composed of a plurality of hardware resources.

Further, in the present embodiment, the TCU 50 is used to realize communication with the management server 100. However, the communication method with the management server 100 is not limited to this. For example, the gateway 20 may be connected to a communication adapter that performs wireless communication such as Wi-Fi (registered trademark). When the system (for example, a navigation system) connected to the in-vehicle network is wireless communication or wired communication and is connected to a communication terminal such as a mobile phone or a smartphone, the communication function of the communication terminal may be used. When the diagnostic device connected to the failure diagnosis port has a communication function, the communication function of the diagnostic device may be used.

Further, the gateway 20 may display information indicating that an abnormality has been detected by using a meter unit or an information providing device connected by an in-vehicle network. The information to be displayed may be a figure or a symbol indicating the abnormality detection, or may be a character, a figure or a symbol indicating the type of the abnormality.

Thus, although embodiments of the invention have been described, the statements and drawings that form part of this disclosure should not be understood to limit the invention. Various alternative embodiments, examples and operational techniques will be apparent to those skilled in the art from this disclosure.

10 Vehicle 20 Gateway 21 CPU (Controller)
21a Processing unit 21b Detection unit 21c Detailed information generation unit 21d Summary information generation unit 21e Reading unit 22 Memory 23 Storage unit (storage device)
24, 25, 26 Communication unit 30, 31 ECU
40, 41, 42 Communication bus 50 TCU (communication device)
100 Management server 110 Computer (controller)
120 storage device

Claims (8)

A controller that detects anomalies in an in-vehicle network in which multiple in-vehicle devices mounted on a vehicle communicate with each other,
A storage device that stores information and
Have,
The controller
Generate detailed information indicating the content of the abnormality,
The detailed information is recorded in the storage device, and the detailed information is recorded in the storage device.
Generate summary information that summarizes the content of the abnormality rather than the detailed information.
The summary information is transmitted to a management server provided outside the vehicle and managing the abnormality of the in-vehicle network.
An abnormality detection device that reads the detailed information from the storage device and transmits the detailed information to the management server when a transmission request for transmitting the detailed information is acquired from the management server. The controller
The abnormality detection device according to claim 1, wherein the detailed information is read from the storage device, and the summary information is generated based on the information extracted from the detailed information. The abnormality detection device according to claim 1 or 2, wherein the summary information is composed of a data amount smaller than that of the detailed information. The abnormality detection device according to any one of claims 1 to 3, wherein the summary information includes at least information capable of identifying the type of the abnormality. The summary information is
Including the type of the abnormality and the amount of increase in the abnormality detected per unit time.
The detailed information is
Claims 1 to 4 including the type of the abnormality, the part where the abnormality is detected, the timing when the abnormality is detected, the data in which the abnormality is detected, and the number of times the abnormality is detected measured for each type of abnormality. The abnormality detection device according to any one of the items. The controller
It is communicably connected to the communication device provided in the vehicle, and the summary information and the detailed information are transmitted to the management server via the communication device.
The summary information is
The abnormality detection device according to any one of claims 1 to 5, which includes transmission information for the communication device to determine whether or not to immediately transmit the summary information to the management server. Vehicles with an in-vehicle network in which multiple in-vehicle devices communicate with each other,
It has a management server that communicates with the vehicle.
The vehicle includes an abnormality detection device having a controller for detecting an abnormality in the vehicle-mounted network and a storage device for storing information.
The controller of the abnormality detection device is
Generate detailed information indicating the content of the abnormality,
The detailed information is recorded in the storage device, and the detailed information is recorded in the storage device.
Generate summary information that summarizes the content of the abnormality rather than the detailed information.
The summary information is transmitted to the management server, and the summary information is transmitted.
When a transmission request for transmitting the detailed information is acquired from the management server, the detailed information is read from the storage device, and the detailed information is transmitted to the management server.
The management server
It has a controller that manages the abnormality of the in-vehicle network, and has a controller.
The controller of the management server
The summary information is acquired from the abnormality detection device, and the summary information is acquired.
With respect to the summary information acquired from the abnormality detection device, it is selected whether or not the detailed information is required.
When the detailed information is selected as necessary, the transmission request is transmitted to the abnormality detection device that has transmitted the summary information.
A security system that receives the detailed information from the abnormality detection device. Detects anomalies in the in-vehicle network where multiple in-vehicle devices mounted on the vehicle communicate with each other,
Generate detailed information indicating the detailed contents of the abnormality, and generate detailed information.
The detailed information is recorded in a storage device, and the detailed information is recorded in a storage device.
Generate summary information that summarizes the content of the abnormality rather than the detailed information.
The summary information is transmitted to a management server provided outside the vehicle and managing the abnormality of the in-vehicle network.
An abnormality detection method in which, when a transmission request for transmitting the detailed information is acquired from the management server, the detailed information is read from the storage device and the detailed information is transmitted to the management server.

Images