JP2021141507A - Abnormality detection device - Google Patents

Abstract

To provide an abnormality detection device capable of reducing the possibility of falsely detecting a regular frame as abnormal even when the startup state of a component mounted on a moving body such as a vehicle changes.SOLUTION: A disclosed abnormality detection device 100 includes: a reception unit 101 that receives communication frames via a network; an abnormality detection unit 103 that detects an abnormality of the communication frame based on parameters for evaluating the communication interval of the communication frame; and a parameter change unit 105 that changes the parameters based on detection results by an activation state detection unit 104, which detects changes in the activation state of the components mounted on the mobile body and the startup status detector.SELECTED DRAWING: Figure 2

Description

The present invention relates to an abnormality detection device for a moving body such as an automobile, an abnormality detection method, and an abnormality detection program, which is a device for detecting an abnormality caused by a cyber attack or the like.

In recent years, technologies for driving support and automatic driving control, including V2X such as vehicle-to-vehicle communication and road-to-vehicle communication, have been attracting attention. Along with this, vehicles have come to have a communication function, and so-called vehicles are becoming more connected. As a result, vehicles are more likely to be attacked by cyber attacks.

Since a cyber attack on a vehicle may hinder the control of the vehicle due to the cyber attack, it is important to detect this in advance and take countermeasures when there is a possibility of a cyber attack.

For example, in Patent Document 1, when a predetermined condition is satisfied, the parameter used for abnormality determination is updated, and it is determined whether or not the received frame is an attack frame based on the updated parameter. Is described. Then, as a predetermined condition, when the ID of the receiving frame is a predetermined ID, when the reception interval of two frames having the same value of the ID of the receiving frame is out of the predetermined range, the ID of the receiving frame is 2 having the same value. When the transmission frequency of one frame exceeds the upper limit of a predetermined allowable range, is described.

Further, Patent Document 2 describes that when monitoring data passing through a network, the monitoring method is changed according to the state of the own vehicle. For example, it is described that a priority corresponding to the state of the own vehicle is set in the data to be monitored, and a monitoring method is set according to the priority. As an example of changing the monitoring method, it is described that the network type to be monitored, the monitoring frequency, or the monitored part of the data is changed.

Japanese Unexamined Patent Publication No. 2017-73765 Japanese Unexamined Patent Publication No. 2017-47835

Here, the present inventor has found the following problems.
When there is a change in the power supply state of the vehicle or a change in the sleep / wakeup state of the electronic control device mounted on the vehicle, the reception interval of the communication frame changes, but each patent document takes this change into consideration. Therefore, there is a possibility that a regular frame whose reception interval has changed may be erroneously determined as abnormal.

An object of the present invention is to reduce the possibility of erroneously detecting a regular frame as an abnormality even when the activation state of a constituent device mounted on a moving body such as a vehicle changes.

The abnormality detection device (100) of the present disclosure is
A receiver (101) that receives a communication frame via a network,
An abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating the communication interval of the communication frame, and an abnormality detection unit (103).
A start-up state detection unit (104) that detects changes in the start-up state of the components mounted on the mobile body, and
It has a parameter changing unit (105) that changes the parameter based on the detection result of the activation state detecting unit.

The claims and the numbers in parentheses attached to the constituent requirements of the invention described in this section indicate the correspondence between the present invention and the embodiments described later, and are intended to limit the present invention. No.

With the above-described configuration, the abnormality detection device of the present disclosure can reduce the possibility of erroneously detecting a normal frame as an abnormality even when the activation state of the configuration device mounted on the moving body changes.

A block diagram showing a configuration example of an electronic control system common to each embodiment of the present disclosure. Block diagram showing a configuration example of the abnormality detection device of the first to fourth embodiments of the present disclosure. Explanatory drawing which shows the abnormality detection example in the abnormality detection part of the abnormality detection apparatus of Embodiment 1 of this disclosure. Explanatory drawing explaining parameter change and abnormality detection necessity determination operation of the abnormality detection apparatus of Embodiment 1 of this disclosure Explanatory drawing explaining the abnormality detection operation of the abnormality detection apparatus of Embodiment 1 of this disclosure. A flowchart illustrating the operation of the abnormality detection device according to the first embodiment of the present disclosure. Explanatory drawing explaining the power source of the automobile detected by the abnormality detection device of Embodiment 2 of this disclosure. A flowchart illustrating the operation of the abnormality detection device according to the second embodiment of the present disclosure. A flowchart illustrating the operation of the abnormality detection device according to the third embodiment of the present disclosure. Explanatory drawing which shows the relationship between the abnormality detection apparatus of Embodiment 4 of this disclosure and an electronic control system. A block diagram showing a configuration example of the abnormality detection device according to the fifth embodiment of the present disclosure. Explanatory drawing explaining parameter change operation of the abnormality detection apparatus of Embodiment 5 of this disclosure

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The present invention means the invention described in the section of claims or means for solving the problem, and is not limited to the following embodiments. Further, at least the words and phrases in brackets mean the words and phrases described in the section of claims or means for solving the problem, and are not limited to the following embodiments.

The configurations and methods described in the dependent terms of the claims are arbitrary configurations and methods in the invention described in the independent terms of the claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent terms, and the configurations and methods described only in the embodiments that are not described in the claims are arbitrary configurations and methods in the present invention. The configuration and method described in the embodiment when the description of the claims is wider than the description of the embodiment is also an arbitrary configuration and method in the present invention in the sense that it is an example of the configuration and method of the present invention. .. In either case, the description in the independent clause of the claims provides an essential configuration and method of the present invention.

The effects described in the embodiments are effects in the case of having the configuration of the embodiment as an example of the present invention, and are not necessarily the effects of the present invention.

When there are a plurality of embodiments, the configuration disclosed in each embodiment is not closed only in each embodiment, but can be combined across the embodiments. For example, the configuration disclosed in one embodiment may be combined with another embodiment. Further, the disclosed configurations may be collected and combined in each of the plurality of embodiments.

The problem described in the problem to be solved by the invention is not a known problem, but is an original knowledge of the present inventor, and is a fact that affirms the inventive step of the invention together with the structure and method of the present invention.

1. 1. Electronic Control System Common to Each Embodiment Using FIG. 1, first, an example of the electronic control system 1 common to each embodiment will be described. Here, an electronic control system, which is a vehicle architecture mounted on a moving vehicle, will be described as an example, but other examples are not excluded.

The electronic control system 1 includes an external communication electronic control device (external communication ECU) 11, a central gateway device (CGW) 12, an electronic control device (ECU) 13, and a network 14 connecting them.

The external communication ECU 11 is an electronic control device that communicates with the outside using various communication methods.
As an example of the communication method, in the case of the wireless communication method, for example, IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G and the like can be used. Alternatively, DSRC (Dedicated Short Range Communication) can be used. Further, in the case of the wired communication method, for example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

The CGW 12 is an electronic control device that relays communication between the external communication ECUs 11 and 13 or between the ECUs 13 via the network 14.

The ECU 13 is an electronic control device that realizes each function. Any ECU can be assigned to the ECU 13. For example, a drive system electronic control device that controls an engine, a handle, a brake, etc., a vehicle body system electronic control device that controls a meter, a power window, etc., an information system electronic control device such as a navigation device, or an obstacle or a pedestrian. An example is a safety control system electronic control device that controls to prevent collision with the vehicle.

The ECUs may be classified so as to have a master-slave relationship instead of being parallel to each other. That is, it may be classified into a master and a slave. Further, a plurality of ECUs 13 may be provided under the specific ECU 13 via a sub-network. In that case, the specific ECU 13 has a function as a sub-gateway.

The network 14 is a network that connects the external communication ECU 11, the CGW 12, and the ECU 13. In the case of the present embodiment, the network 14 is an in-vehicle network, for example, in addition to communication methods such as CAN (Controller Area Network) and LIN (Local Interconnect Network), Ethernet (registered trademark), Wi-Fi (registered trademark), and Bluetooth. Any communication method such as (registered trademark) can be used.

2. Embodiment 1
(1) Configuration of Abnormality Detection Device The configuration of the abnormality detection device 100 of the present embodiment will be described with reference to FIG. The abnormality detection device 100 is "mounted" on a moving vehicle. The abnormality detection device 100 includes a frame reception unit 101, a sensor data reception unit 102, an abnormality detection unit 103, an activation state detection unit 104, a parameter change unit 105, a parameter storage unit 106, and an abnormality detection necessity determination unit 107. ..

Here, the term "mounted" includes not only the case where it is directly fixed to the moving body but also the case where it is not fixed to the moving body but moves together with the moving body. For example, it may be carried by a person riding on a moving body, or it may be mounted on a cargo placed on the moving body.

In the first to third embodiments including the present embodiment, the abnormality detection device 100 will be described as being provided inside the CGW 12 of FIG. However, the place where the abnormality detection device 100 is provided is not limited to this, and can be provided at any place connected to the network 14, for example. For example, it may be provided as an independent dedicated ECU, or may be provided in the ECU 13 having a role of a sub-gateway. Further, it may be provided outside the electronic control system 1, but this will be described in the fourth embodiment.

The form of the abnormality detection device 100 may be a part, a semi-finished product, or a finished product. In the present embodiment, the abnormality detection device 100 is realized by the semiconductor circuit inside the CGW 12, and therefore belongs to the form of the component.
Other examples of parts include semiconductor modules, independent ECUs as semi-finished products, and servers, workstations, personal computers (PCs), smartphones, mobile phones, and navigation systems as finished products. Not exclusively.

The abnormality detection device 100 may be composed of a general-purpose CPU (Central Processing Unit), a volatile memory such as RAM, a ROM, a flash memory, a non-volatile memory such as a hard disk, various interfaces, and an internal bus connecting them. can. Then, by executing the software on these hardware, it can be configured to exert the function of each functional block shown in FIG.

The frame receiving unit 101 receives a communication frame transmitted from the ECU 13, the CGW 12, or the external communication ECU 11 via the network 14 (corresponding to the “network”). In this embodiment, an example in which CAN is used as the network 14 will be described. Then, the frame receiving unit 101 adds a time stamp to the received communication frame, and outputs the ID and payload of the communication frame to the abnormality detection unit 103. When the abnormality detection device 100 is provided outside the electronic control system 1, the communication frame is received via an external network such as 4G, which will be described in the fourth embodiment.

Here, the "network" may be a communication network provided inside the mobile body or a communication network provided outside the mobile body. Further, in addition to the wired communication network, a wireless communication network may be used, or a combination of these may be used.

The sensor data receiving unit 102 receives sensor data output from various sensors connected to the abnormality detection device 100. Examples of sensors connected to the abnormality detection device 100 include a global positioning system (GPS), a temperature sensor, a humidity sensor, a throttle position sensor, a cam position sensor, an oxygen (O2) sensor, a vehicle speed sensor, an acceleration sensor, and a yaw rate sensor. However, it is not limited to these. In addition, a sensor that measures the voltage of each power supply line may be used.

The abnormality detection unit 103 detects an abnormality in the communication frame based on the "parameter" for evaluating the "communication interval" of the communication frame received by the frame reception unit 101. Specifically, the communication interval is obtained using the time stamp given to the communication frame, and the abnormality of the communication frame is detected based on whether or not this is within the range evaluated as a normal frame. The parameters are acquired by reading from the parameter storage unit 106 described later.

Here, the "communication interval" includes not only the reception interval but also the transmission interval. In addition to time, the communication interval may be represented by frequency or number of times.
Further, the "parameter" may be a variable value that changes depending on a condition in addition to a constant value.

An example of the abnormality detection method performed by the abnormality detection unit 103 will be described with reference to FIG.
The regular frame is transmitted from the ECU 13 or the like at a specified communication interval. For example, when the ECU 13 is a vehicle speed ECU, the vehicle speed is measured at a specified communication interval, for example, every 100 ms, and a communication frame with an ID indicating the vehicle speed is transmitted to the CAN bus.

In response to this, the abnormality detection device 100 receives the communication frame. However, due to the influence of congestion, etc., it is not always transmitted or received at the specified communication interval. Therefore, if the specified communication interval is widened and the transmission or reception is performed during that period, it is determined as a regular frame. , If it is transmitted or received other than during that time, it is judged as an abnormal frame (attack frame). In the example of FIG. 3, based on the scheduled reception time determined by the specified communication interval, the width of the time for determining normal even if the reception is early is α, and the width of the time for determining normal even if the reception is late is β. .. In the example of FIG. 3, since the frame F2 to be received next to the frame F1 is received within the range of β, it is determined to be a normal frame. That is, in the case of this embodiment, α and β are parameters for evaluating the communication interval of the communication frame.

In this embodiment, α and β are used as parameters, but the parameters are not limited to this. For example, the width of the time determined to be normal may be represented by the width represented by the function of the specified communication interval centering on the scheduled reception time. For example, it may be 10% of the specified communication interval. In addition, the range of time for determining normality may be changed depending on the error rate and temperature.

The activation state detection unit 104 uses the communication frame received by the frame receiving unit 101 or the sensor data received by the sensor data receiving unit 102 to form a component device "mounted" on an automobile (corresponding to a "mobile body"). Detect changes in "startup status". Examples of the constituent device include, but are not limited to, various parts of the drive system, various parts of the vehicle body system, and various parts of the electrical system in addition to the ECU 13, the CGW 12, and the external communication ECU 11.

Here, the "moving body" means a movable object, and the moving speed is arbitrary. Of course, it also includes the case where the moving body is stopped. For example, including, but not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on them.
Further, "mounted" includes not only the case where the constituent device can be separated from the moving body, but also the case where the constituent device itself becomes a part of the moving body together with the moving body.
The "activated state" refers to the degree or ratio at which the function of the mobile body or the electronic control device can be exhibited. The degree or ratio does not have to be specified numerically, it is sufficient if the degree or ratio is specified by the definition.

As a more specific example, the start-up state detection unit 104 detects that the state of the component device mounted on the automobile has changed from "start" to "stop" or from "stop" to "start". ..

Here, "starting" means that the function of the mobile body or the electronic control device can be exerted to a greater extent or ratio than in the "stopped" state.
Further, "stop" means that the function of the moving body or the electronic control device can be exhibited to a smaller extent or a smaller ratio than that in the "started" state.

In the present embodiment, an example in which the activation state detection unit 104 detects the sleep or wakeup of a specific ECU 13 will be described. The sleep means a state in which all or a part of the functions of the specific ECU 13 are put to sleep by limiting the supply of electric power or the like. Further, the wake-up refers to a state in which the dormant function of the specific ECU 13 is restored by starting the supply of electric power or the like.

When the frame receiving unit 101 receives the sleep control frame of the specific ECU 13, the activation state detecting unit 104 detects that the state of the specific ECU 13 has changed from wakeup to sleep. Further, when the frame receiving unit 101 receives the wake-up control frame of the specific ECU 13, the activation state detecting unit 104 detects that the state of the specific ECU 13 has changed from sleep to wake-up.

Then, the activation state detection unit 104 outputs the detection result to the parameter change unit 105 and the abnormality detection necessity determination unit 107.

The parameter changing unit 105 changes the parameters used by the abnormality detecting unit 103 based on the detection result of the activation state detecting unit 104.
As a more specific example, when the start state detection unit 104 detects that the state of the constituent device has changed from start to stop or from stop to start, the parameter change unit 105 resets the parameter to the initial value. Reset.

It should be noted that a plurality of initial values set at the time of reset may be retained. For example, if the bus load is different between startup and steady, and the load is heavier at startup than at steady, set the initial value at startup to a value that allows more communication delay than the initial value at steady. It is conceivable to do. In this case, it may be reset to the initial value at the steady state when the steady operation is started after the start-up. Further, the initial value in the steady state may be used when resetting is performed due to a factor other than the start or stop of the constituent device.

The parameter change by the parameter change unit 105 is not limited to resetting to one initial value. For example, when the startup state of the constituent device changes, it may be selected from a plurality of initial values so as to allow a communication delay according to the current startup state and the degree of bus load. Furthermore, when the startup state of the component device changes, a value corrected for the initial value is used or currently used so as to allow communication delay according to the current startup state and the degree of bus load. You may use the corrected value of the parameter.

The parameter storage unit 106 stores the parameters and overwrites and stores the parameters changed by the parameter changing unit 105. Further, the parameter storage unit 106 stores the initial values of the parameters.

The abnormality detection necessity determination unit 107 starts or stops the abnormality detection by the abnormality detection unit 103 based on the detection result of the activation state detection unit 104.
As a more specific example, when the start-up state detection unit 104 detects that the state of the component device has changed from start-up to stop, the abnormality detection necessity determination unit 107 is the abnormality detection unit 103 for the component device. It is determined that the abnormality detection is unnecessary, and the abnormality detection by the abnormality detection unit 103 for the constituent device is stopped. Further, when the start-up state detection unit 104 detects that the state of the component device has changed from stopped to start-up, the abnormality detection necessity determination unit 107 needs to detect the abnormality of the component device by the abnormality detection unit 103. Is determined, and the abnormality detection unit 103 for the constituent device is activated.

That is, the abnormality detection necessity determination unit 107 controls the abnormality detection operation of the abnormality detection unit 103 for each component device by outputting the determined abnormality detection necessity to the abnormality detection unit 103.

A specific example of the operation of the parameter changing unit 105 and the abnormality detection necessity determination unit 107 in the present embodiment will be described with reference to FIG.
As shown in FIG. 4A, the ECU_A transmits a communication frame at a specified communication interval of 100 ms. The ECU_B transmits a communication frame at a specified communication interval of 200 ms. The α of ECU_A is 10 ms, β is 11 ms, and the previous reception time is 300 ms, and α of ECU_B is 21 ms, β is 20 ms, and the previous reception time is 200 ms. Then, for any of the ECUs, the abnormality detection unit 103 needs to detect the abnormality, and the abnormality detection is activated.

Here, when the frame receiving unit 101 receives the sleep control frame of the ECU_B, the activation state detection unit 104 detects that the ECU_B has changed from start to stop. Then, as shown in FIG. 4B, the parameter changing unit 105 resets α and β to the initial values of 20 ms and erases the previous reception time. Further, the abnormality detection necessity determination unit 107 determines that the abnormality detection by the abnormality detection unit 103 is unnecessary, and stops the abnormality detection by the abnormality detection unit 103 for the ECU_B.

Subsequently, when the frame receiving unit 101 receives the wake-up control frame of the ECU_B, the start-up state detection unit 104 detects that the ECU_B has changed from stop to start. Then, as shown in FIG. 4C, the abnormality detection necessity determination unit 107 determines that the abnormality detection by the abnormality detection unit 103 is necessary, and activates the abnormality detection by the abnormality detection unit 103 for the ECU_B.

In FIG. 4, when the start state detection unit 104 detects that the ECU_B has changed from start to stop, α and β are reset to the initial values, but instead of this, the start state detection unit 104 However, when it is detected that ECU_B has changed from stop to start, α and β may be reset to the initial values. That is, it is sufficient to reset the parameters only in either case.

A specific example of the operation of the abnormality detection unit 103 in the case of FIG. 4 will be described with reference to FIG.
When the frame F2 transmitted by the ECU_B is received in the state of FIG. 4A, the abnormality detection unit 103 uses 400 ms, which is the sum of the reception time of the previous frame F1 of 200 ms and the specified communication interval of 200 ms, as a reference. It is detected whether or not the frame F2 is received within the widths of α (21 ms) and β (20 ms) as the scheduled reception time. In the case of FIG. 5, since the frame F2 is received within the range of α, it is determined that the frame F2 is a normal frame.

Next, when the sleep control frame of ECU_B is received, as shown in FIG. 4B, the parameter changing unit 105 resets α and β to the initial values of 20 ms and erases the previous reception time. Further, the abnormality detection necessity determination unit 107 determines that the abnormality detection unit 103 for the ECU_B does not need to detect the abnormality. Therefore, while the ECU_B is in the sleep state, the communication frame is not transmitted from the ECU_B, and the abnormality detection unit 103 does not detect the abnormality.

Further, upon receiving the wake-up control frame of ECU_B, as shown in FIG. 4C, the abnormality detection necessity determination unit 107 determines that the abnormality detection unit 103 needs to detect the abnormality with respect to ECU_B. However, when the first frame F3 to be received after wakeup is received, the previous reception time is erased. Therefore, since the scheduled reception time that serves as a reference for α and β cannot be obtained, the abnormality detection for the frame F3 is not performed. Therefore, even though the frame F3 is a normal frame, it is not determined to be abnormal by false detection.

Then, when the frame F4 is received, the abnormality detection unit 103 receives 300 ms as a reference, which is obtained by adding 200 ms, which is a specified communication interval, to the reception time 100 ms of the previous frame F3 newly calculated from the time of wakeup. As the scheduled time, it is detected whether or not the frame F4 is received within the width of α (20 ms) after the reset and β (20 ms) after the reset. In the case of FIG. 5, since the frame F4 is received within the range of β, it is determined that the frame F4 is a normal frame.

(2) Operation of the Abnormality Detection Device Next, the operation of the abnormality detection device 100 of the present embodiment will be described with reference to FIG.
The following operation not only shows the abnormality detection method in the abnormality detection device 100, but also shows the processing procedure of the abnormality detection program executed by the abnormality detection device 100.
And these processes are not limited to the order shown in FIG. That is, the order may be changed as long as there is no restriction that the result of the previous step is used in a certain step.
As described above, the same applies not only to this embodiment but also to other embodiments.

The frame receiving unit 101 receives the communication form via the network 14 (S101).

The activation state detection unit 104 interprets the communication frame received by the frame reception unit 101, and detects the reception of the sleep control frame or the wakeup control frame (S102).

When the activation state detection unit 104 receives the sleep control frame (S102), it detects whether or not the sleep control frame is a normal frame (S103). Examples of the detection method include, but are not limited to, a method of monitoring the communication interval and the payload and determining that the abnormality exceeds a predetermined range. If it is a normal frame, the process is transferred to S104, and if it is an abnormal frame (attack frame), the abnormality detection process of S108 is continued.

The abnormality detection necessity determination unit 107 determines that the abnormality detection by the abnormality detection unit 103 is unnecessary (S104), and ends the process.

When the activation state detection unit 104 receives the wakeup control frame (S102), it detects whether or not the wakeup control frame is a normal frame (S105). The example of the detection method is the same as that of S103. If it is a normal frame, the process is transferred to S106, and if it is an abnormal frame (attack frame), the process is terminated.

The abnormality detection necessity determination unit 107 determines that the abnormality detection unit 103 needs to detect the abnormality (S106).

The parameter changing unit 105 resets the parameters stored in the parameter storage unit 106 to the initial values (S107).

The abnormality detection unit 103 detects an abnormality in the communication frame received by the frame reception unit 101 based on the parameters stored in the parameter storage unit 106 (S108).

If the activation state detection unit 104 does not receive the sleep control frame or the wakeup control frame (S102), the abnormality detection process of S108 is continued.

(3) Summary As described above, according to the abnormality detection device 100 of the present embodiment, it is detected that the activation state of the constituent device mounted on the moving body has changed, and the parameter is changed based on this, so that the normal frame can be set. It is possible to reduce the false detection that it is abnormal. In particular, when a sleep control frame or a wakeup control frame of a specific ECU is detected and parameters are changed based on the detection frame, erroneous detection of a communication frame transmitted / received by the specific ECU can be reduced.
Further, according to the abnormality detection device 100 of the present embodiment, it is detected that the activation state of the constituent device mounted on the moving body has changed, and based on this, the necessity of abnormality detection in the abnormality detection unit is determined. In situations where anomaly detection is not required, it is possible to prevent anomaly detection, it is not necessary to devote resources to wasteful processing, and power consumption can be reduced. In particular, when detecting a sleep control frame or a wakeup control frame of a specific ECU and deciding whether or not an abnormality detection is necessary in the abnormality detection unit based on the detection frame, communication sent and received by a specific ECU that does not require abnormality detection. It is possible to prevent abnormality detection only in the frame.

3. 3. Embodiment 2
In this embodiment, the detection target of the activation state detection unit 104 of the abnormality detection device 200 is the type of power supply supplied to the automobile.
FIG. 7 shows the types of power sources for automobiles and the combinations and directions that can be switched.

+ B is a battery power source, which is a power source supplied even when the engine is stopped and the engine key is OFF. + B supplies power to equipment that needs to be used even when the engine is stopped and the vehicle is stopped, for example, horns, hazards, stop lamps, and keyless entry systems.

The ACC is an accessory power source, and is a power source supplied with the ACC turned on even when the engine is stopped. ACC supplies power to electrical components of vehicles with relatively low power consumption, for example, car navigation systems, car audio systems, ETCs, and drive recorders.

The IG is an ignition power source, which is basically a power source supplied while the engine is running. The IG supplies power to equipment that is supposed to be used while the engine is running, and supplies power to, for example, a starter motor, a winker, a wiper, and an air conditioner.

Since the type of the power source of the automobile specifies the power supply supplied to the constituent device which is a component of the automobile, it can be said to represent the activated state of the constituent device of the automobile. Therefore, it can be said that when the type of the power source of the automobile is switched, the activation state of the constituent devices of the automobile changes. Hereinafter, the activated state of the constituent devices of the automobile will be abbreviated as the state of the automobile.

In FIG. 7, the thickness of the arrow indicates whether the state of the automobile is in the starting direction or the stopping direction. For example, switching from ACC to IG indicates that the vehicle changes in the starting direction, i.e. the state of the vehicle from stop to start. Also, switching from ACC to + B indicates that the vehicle changes in the stopping direction, that is, the state of the vehicle changes from start to stop.

In the example of FIG. 7, the + B, ACC, and IG can switch the power supply to each other, but other switchable combinations may be used. For example, if it is necessary to pass through ACC between + B and IG, it is possible to switch the power supply between + B and ACC and between ACC and IG.

(1) Configuration of Abnormality Detection Device Since the abnormality detection device 200 of the present embodiment is the same as the abnormality detection device 100 of the first embodiment, the configuration of the abnormality detection device 200 will be described with reference to FIG. In addition, FIG. 3 is also cited as the present embodiment.

The sensor data receiving unit 102 receives a vehicle power supply signal indicating the type of power supply from a sensor that detects the type of power supply. The start-up state detection unit 104 periodically receives the vehicle power supply signal output from the sensor data reception unit 102 to detect that the type of the power supply of the automobile has been switched. Then, the activation state detection unit 104 outputs a signal indicating the type of the power supply before the switching and the type of the power supply after the switching to the parameter changing unit 105 and the abnormality detection necessity verification unit 107. The operations of the parameter changing unit 105 and the abnormality detection necessity verification unit 107 will be described later.
In addition, the sensor data receiving unit 102 may directly monitor the power supply line of each power supply.

The start-up state detection unit 104 detects that the type of the power supply of the automobile has been switched by using the vehicle power supply signal from the sensor data reception unit 102. It may be detected that the type of the power source of the automobile is switched by using the communication frame received by the frame receiving unit 101. For example, it is possible to detect that the type of power source of an automobile has been switched by using a communication frame that conveys the state of ACC or IG. Alternatively, ACC ON / OFF is detected by detecting the presence / absence of a specific communication frame such as a navigation system or a meter, or IG ON / OFF is detected by detecting the presence / absence of a specific communication frame such as an air conditioner. Can be detected.

(2) Operation of the Abnormality Detection Device Next, the operation of the abnormality detection device 100 of the present embodiment will be described with reference to FIG. In this embodiment, when the power source is IG, the power source is also supplied to the device using the ACC.

The activation state detection unit 104 detects the current power supply type from the vehicle power supply signal received from the sensor data reception unit 102 (S201). Further, the activation state detection unit 104 detects a change in the type of power supply from the vehicle power supply signal subsequently received from the sensor data reception unit 102 (S202, S203, S204).

When it is detected that the power supply is switched from + B to ACC (S202), the abnormality detection necessity determination unit 107 determines that abnormality detection using a communication frame having a CANID in which communication is performed only by ACC is necessary. (S205), the abnormality detection unit 103 detects an abnormality in the communication frame (S211).

When it is detected that the power supply is switched from + B to IG (S202), the abnormality detection necessity determination unit 107 determines that abnormality detection using a communication frame having a CANID in which communication is performed by IG or ACC is necessary. (S206), the abnormality detection unit 103 detects the abnormality of the communication frame (S211).

When it is detected that the power supply has been switched from ACC to IG (S203), the abnormality detection necessity determination unit 107 determines that abnormality detection using a communication frame having a CANID in which communication is performed only by the IG is necessary. (S207), the abnormality detection unit 103 detects an abnormality in the communication frame (S211).

When it is detected that the power supply has been switched from ACC to + B (S203), the parameter changing unit 105 resets the parameter for evaluating the communication interval of the communication frame having the CANID in which communication is performed only by ACC (S208). ), The abnormality detection necessity determination unit 107 determines that the abnormality detection using the communication frame is unnecessary (S212).

When it is detected that the power supply has been switched from IG to ACC (S204), the parameter changing unit 105 resets the parameter for evaluating the communication interval of the communication frame having the CANID in which communication is performed only by the IG (S209). ), The abnormality detection necessity determination unit 107 determines that the abnormality detection using the communication frame is unnecessary (S213).

When it is detected that the power supply is switched from IG to + B (S204), the parameter changing unit 105 resets the parameter for evaluating the communication interval of the communication frame having the CANID in which communication is performed by ACC or IG (S204). S210), the abnormality detection necessity determination unit 107 determines that the abnormality detection using the communication frame is unnecessary (S214).

In the example of FIG. 8, the parameter is reset when the abnormality detection is unnecessary and the abnormality detection is stopped. Instead, the parameter is reset when the abnormality detection is required and the abnormality detection is restarted. You may do so.

(3) Summary As described above, according to the abnormality detection device 200 of the present embodiment, the parameters are changed according to the change of the type of the power supply and the necessity of the operation of the abnormality detection unit is determined. Therefore, the type of the power supply is changed. It is possible to collectively control the abnormality detection for the related communication frames according to the above.

4. Embodiment 3
In the present embodiment, the detection target of the start-up state detection unit 104 of the abnormality detection device 300 is the state of the engine by the idling stop function.
The ON / OFF of the engine of an automobile indicates the starting state of the engine, which is a constituent device mounted on the automobile. Therefore, it can be said that when the automobile engine is switched on / off, the starting state of the automobile engine changes.

(1) Configuration of Abnormality Detection Device Since the abnormality detection device 300 of the present embodiment is the same as the abnormality detection device 100 of the first embodiment, the configuration of the abnormality detection device 300 will be described with reference to FIG. In addition, FIG. 3 is also cited as the present embodiment.

The sensor data receiving unit 102 receives an engine start signal from a sensor that detects ON / OFF of the engine. The start-up state detection unit 104 detects switching between ON and OFF of the automobile engine by receiving the engine start signal output from the sensor data reception unit 102. Then, the start-up state detection unit 104 outputs a signal indicating that the engine has been switched to ON or a signal indicating that the engine has been switched to OFF to the parameter change unit 105 and the abnormality detection necessity verification unit 107. The operations of the parameter changing unit 105 and the abnormality detection necessity verification unit 107 will be described later.

The start-up state detection unit 104 detects switching between ON and OFF of the automobile engine by using the engine start signal from the sensor data reception unit 102. Instead of or in combination with this, the start-up state detection unit 104 detects switching between ON and OFF. The switching between ON and OFF of the engine of the automobile may be detected by using the communication frame received by the frame receiving unit 101. For example, a communication frame that conveys the ON / OFF state of the engine, a communication frame that conveys an ON / OFF instruction of the engine, and a communication frame that conveys the engine speed can be used.

(2) Operation of the Abnormality Detection Device Next, the operation of the abnormality detection device 300 of the present embodiment will be described with reference to FIG.
The start-up state detection unit 104 detects the engine state from the engine start-up signal received from the sensor data receiving unit 102 (S301). Further, the start-up state detection unit 104 detects the engine state change from the engine start-up signal received from the sensor data receiving unit 102 (S302, S303).

When the engine is switched from OFF to ON, that is, when idling is started (S302), the abnormality detection necessity determination unit 107 needs to detect an abnormality using a communication frame having a CANID that communicates only when the engine is running. (S304), the abnormality detection unit 103 detects the abnormality of the communication frame (S307).

When the engine is switched from ON to OFF, that is, when idling is stopped (S303), the parameter changing unit 105 sets a parameter for evaluating the communication interval of the communication frame having a CANID in which communication is performed only when the engine is operating. Upon resetting (S305), the abnormality detection necessity determination unit 107 determines that abnormality detection using the communication frame is unnecessary (S306).

In the example of FIG. 9, the parameter is reset when the abnormality detection is unnecessary and the abnormality detection is stopped. Instead, the parameter is reset when the abnormality detection is required and the abnormality detection is restarted. You may do so.

(3) Summary As described above, according to the abnormality detection device 300 of the present embodiment, the parameters are changed according to the ON / OFF switching of the engine and the necessity of the operation of the abnormality detection unit is determined. Therefore, the engine is turned on. It is possible to collectively control the abnormality detection for the related communication frames according to the change of / OFF.

5. Embodiment 4
In this embodiment, the abnormality detection device 400 is provided outside the moving vehicle.
FIG. 10 shows the relationship between the abnormality detection device 400 and the electronic control system 1 mounted on the automobile.

The electronic control system 1 is mounted on an automobile and communicates with the abnormality detection device 400 via the communication network 2. Since the electronic control system 1 and the abnormality detection device 400 are the same as those described with reference to FIGS. 1 and 2 of the first embodiment, the first embodiment will be cited and the description thereof will be omitted.

In the case of a wireless communication system, the communication network 2 includes, for example, IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA ( High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G and the like can be used. Alternatively, DSRC (Dedicated Short Range Communication) can be used.
In the case of a wired communication system, the communication network 2 can use, for example, a wired LAN (Local Area Network), the Internet, or a fixed telephone line.

The frame receiving unit 101 of the abnormality detection device 400 receives the communication frame transmitted from the external communication ECU 11 of the electronic control system 1 via the network 2 (corresponding to the “network”).

The sensor data receiving unit 102 does not necessarily have to be provided in this embodiment.

According to the present embodiment, by providing the abnormality detection device 100 outside the electronic control system 1, for example, a server or the like, it is possible to perform abnormality detection with a stable device having abundant resources.

6. Embodiment 5 (Other Invention 1)
According to the first to fourth embodiments, the parameters are reset to the initial values because the parameters are scheduled to be changed from the initial values by some trigger. The abnormality detection device 500 of the present embodiment is disclosed as a configuration for changing parameters in the abnormality detection devices 100 and the like of the first to fourth embodiments. That is, the abnormality detection device 500 of the fifth embodiment can be superimposed and applied to the configuration of the abnormality detection device 100 and the like of the first to fourth embodiments.
Further, the present embodiment can be grasped as an invention different from the first to fourth embodiments.

Here, the present inventor has found the following problems.
If the frequency of notification frames and error frames when the abnormality detection result is notified by the CAN bus or the like is high, the reception interval of the communication frame may change, but each patent document does not take this change into consideration. Therefore, there is a possibility that a regular frame whose reception interval has changed may be erroneously determined as abnormal.

An object of the present invention is to reduce the possibility that a regular frame is erroneously detected as an abnormality even when the communication state changes.

(1) Configuration of Abnormality Detection Device FIG. 11 will be described with reference to the configuration of the abnormality detection device 500 of the present embodiment. The abnormality detection device 500 includes a frame receiving unit 101, an abnormality detecting unit 103, a communication state detecting unit 501, a parameter changing unit 105, and a parameter storage unit 106. The same configuration as the abnormality detection device 100 of the first embodiment is assigned the same number, and the description of the first embodiment is quoted. Further, in the present embodiment, the abnormality detection device 500 will be described as being provided inside the CGW 12 of FIG. 1 as in the first to third embodiments. However, the place where the abnormality detection device 500 is provided is not limited to this, and can be provided at any place connected to the network 14, for example. For example, it may be provided as an independent dedicated ECU, or may be provided in the ECU 13 having a role of a sub-gateway. Further, it may be provided outside the electronic control system 1.

The frame receiving unit 101 receives the communication frame transmitted from the ECU 13, the CGW 12, or the external ECU 11 via the network 14. In the present embodiment, as the communication frame, in addition to the regular communication frame, an error frame transmitted when an error is detected and an abnormality detection result notification frame for notifying the abnormality detection result are also received.

The abnormality detection unit 103 detects an abnormality in the communication frame based on a parameter for evaluating the communication interval of the communication frame received by the frame reception unit 101.

The communication state detection unit 501 detects the communication state of the network 14. Specifically, for example, it detects whether or not the reception frequency of the error frame or the abnormality detection result notification frame received by the frame receiving unit 101 exceeds a predetermined threshold value. Then, when the predetermined threshold value is exceeded, the detection result is output to the parameter changing unit 105.

The parameter changing unit 105 changes the parameter based on the detection result. Then, the changed parameter is stored in the parameter storage unit 106. A specific example of the parameter change process will be described later.

FIG. 12 shows an example of the parameter changing operation.
The regular frame is transmitted from the ECU 13 or the like at a specified communication interval. However, when an error frame or an abnormality detection result notification frame is transmitted, these frames are generally transmitted continuously, so that the normal frame is a parameter as shown in FIG. 12 (A). There is a possibility that it is out of the range of α and β, and in this case, it is erroneously detected as an abnormality (attack frame) even though it is a normal frame.

Therefore, when the error frame or the abnormality detection result notification frame exceeds a predetermined threshold value, the parameter β is expanded as shown in FIG. 12B. That is, the value of β is changed to a larger value. For example, β is extended by a period corresponding to 10% of β before the change. As a result, the normal frame does not exceed the range of β, and it is not falsely detected as an abnormality (attack frame).

As described above, according to the present embodiment, even when an error frame or an abnormality detection result notification frame is received, it is possible to prevent erroneous detection that the normal frame is abnormal.

The invention disclosed in this embodiment is as follows.
A receiver (101) that receives a communication frame via a network,
An abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating the communication interval of the communication frame, and an abnormality detection unit (103).
A communication state detection unit (501) that detects the communication state of the network, and
It has a parameter changing unit (105) that changes the parameter based on the detection result of the communication state detecting unit.
Anomaly detection device (500).

7. Summary The features of the abnormality detection device and the like in each embodiment of the present invention have been described above.

Since the terms used in each embodiment are examples, they may be replaced with synonymous terms or terms including synonymous functions.

The block diagram used in the description of the embodiment is a classification and arrangement of the configuration of the device according to the function. The blocks showing each function are realized by any combination of hardware or software. Further, since the block diagram shows the function, the block diagram can be grasped as the disclosure of the invention of the method and the invention of the program that realizes the method.

The order of the processes, flows, and functional blocks that can be grasped as a method described in each embodiment is changed unless there is a restriction that one step uses the results of other steps in the previous stage. May be good.

The terms first, second, and N (where N is an integer), which are used in each embodiment and in the claims, are used to distinguish two or more configurations and methods of the same type. , Does not limit the order or superiority or inferiority.

Although each embodiment is premised on a device for a vehicle mounted on a vehicle, the present invention also includes a dedicated or general-purpose device other than the one for a vehicle, unless otherwise limited in the scope of claims.

In each embodiment, the description has been made on the premise that the device disclosed in each embodiment is mounted on the vehicle, but it may be assumed that the pedestrian possesses the device.

Further, as an example of the form of the abnormality detection device of the present invention, the following can be mentioned.
Examples of the form of the component include a semiconductor element, an electronic circuit, a module, and a microcomputer.
Examples of the semi-finished product include an electronic control unit (ECU) and a system board.
Examples of finished products include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers.
In addition, a device having a communication function and the like are included, and examples thereof include a video camera, a still camera, and a car navigation system.

Further, necessary functions such as an antenna and a communication interface may be added to the abnormality detection device.

It is assumed that the abnormality detection device of the present invention is used for the purpose of providing various services, especially by being used on the server side. With the provision of such services, the devices of the invention will be used, the methods of the invention will be used, and / and the programs of the invention will be executed.

In addition, the present invention can be realized not only by the dedicated hardware having the configuration and the function described in each embodiment, but also a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and a program thereof. It can also be realized as a combination with an executable dedicated or general-purpose CPU and general-purpose hardware having a memory or the like.

Programs stored in a non-transitional substantive recording medium of dedicated or general-purpose hardware (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) It can also be provided to dedicated or general-purpose hardware via a recording medium or via a communication line from a server without a recording medium. This ensures that you always have the latest features through program upgrades.

The abnormality detection device of the present invention is mainly intended for an electronic control system mounted on an automobile, but may be intended for a normal system not mounted on an automobile.

100 anomaly detection device, 101 frame receiver, 103 anomaly detection unit, 104 startup status detection unit, 105 parameter change unit, 107 abnormality detection necessity determination unit

Claims (11)

A receiver (101) that receives a communication frame via a network,
An abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating the communication interval of the communication frame, and an abnormality detection unit (103).
A start-up state detection unit (104) that detects changes in the start-up state of the components mounted on the mobile body, and
It has a parameter changing unit (105) that changes the parameter based on the detection result of the activation state detecting unit.
Anomaly detection device (100). When the start-up state detection unit detects that the state of the component device has changed from start-up to stop or from stop-to-start.
The parameter changing unit resets the parameter to an initial value.
The abnormality detection device according to claim 1. The activation state detection unit
Detecting sleep and wakeup of the components,
The abnormality detection device according to claim 1. The activation state detection unit
Detects the type of power supplied to the component.
The abnormality detection device according to claim 1. The activation state detection unit
Detecting the start and stop of the engine of the moving body,
The abnormality detection device according to claim 1. Further, it has an abnormality detection necessity determination unit (107) for starting or stopping the abnormality detection in the abnormality detection unit based on the detection result of the activation state detection unit.
The abnormality detection device according to claim 1 or 2. When the start-up state detection unit detects that the state of the component device has changed from start-up to stop.
The abnormality detection necessity determination unit stops the abnormality detection by the abnormality detection unit for the communication frame transmitted by the configuration device.
The abnormality detection device according to claim 6. When the start-up state detection unit detects that the state of the component device has changed from stop to start-up,
The abnormality detection necessity determination unit activates the abnormality detection by the abnormality detection unit for the communication frame transmitted by the configuration device.
The abnormality detection device according to claim 6. The abnormality detection device is mounted on the moving body.
The abnormality detection device according to any one of claims 1 to 8. Receives a communication frame via the communication network (S101),
Detecting a change in the activation state of the constituent device mounted on the mobile body (S102),
Based on the change in the activation state, the parameter for evaluating the communication interval of the communication frame is changed (S107).
Detecting an abnormality in the communication frame based on the parameters (S108),
Anomaly detection method. Receives a communication frame via the communication network (S101),
Detecting a change in the activation state of the constituent device mounted on the mobile body (S102),
Based on the change in the activation state, the parameter for evaluating the communication interval of the communication frame is changed (S107).
Detecting an abnormality in the communication frame based on the parameters (S108),
Anomaly detection program executed by the anomaly detection device.

Images