JP7375619B2 - Anomaly detection device - Google Patents

Description

The present invention relates to a device for detecting an abnormality caused by a cyber attack or the like, and mainly relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program in a mobile object such as an automobile.

In recent years, technologies that perform driving support and automatic driving control, including V2X such as vehicle-to-vehicle communication and road-to-vehicle communication, have been attracting attention. Along with this, vehicles have come to be equipped with communication functions, and so-called connected vehicles are progressing. As a result, the possibility that vehicles will be subject to cyber attacks has increased.

Cyber-attacks on vehicles can disrupt the control of the vehicle, so it is important to detect them in advance and take countermeasures when there is a possibility of a cyber-attack.

For example, Patent Document 1 discloses that when a predetermined condition is met, parameters used for abnormality determination are updated, and it is determined whether a received frame is an attack frame based on the updated parameters. is listed. Then, as a predetermined condition, if the ID of the received frame is a predetermined ID, and the reception interval of two frames with the same ID of the received frame is out of a predetermined range, the ID of the received frame is 2 with the same ID. If the transmission frequency of one frame exceeds the upper limit of a predetermined tolerance range, it is described.

Further, Patent Document 2 describes that when monitoring data passing through a network, the monitoring method is changed depending on the state of the own vehicle. For example, it is described that a priority level corresponding to the state of the own vehicle is set for data to be monitored, and a monitoring method is set in accordance with the priority level. As an example of changing the monitoring method, it is described that the type of network to be monitored, the frequency of monitoring, or the portion of data to be monitored is changed.

JP2017-73765A JP2017-47835A

Here, the present inventor discovered the following problem.
When there is a change in the power supply state of the vehicle or a change in the sleep/wake-up state of the electronic control unit installed in the vehicle, the reception interval of communication frames changes, but each patent document does not take this change into account. Therefore, there is a possibility that a regular frame with a changed reception interval may be mistakenly determined to be abnormal.

An object of the present invention is to reduce the possibility of erroneously detecting a normal frame as abnormal even when the activation state of a component device mounted on a moving object such as a vehicle changes.

The abnormality detection device (100) of the present disclosure includes:
a receiving unit (101) that receives communication frames via a network;
an abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating a communication interval of the communication frame;
an activation state detection unit (104) that detects a change in the activation state of a component device mounted on the mobile body;
The apparatus further includes a parameter changing section (105) that changes the parameters based on the detection result of the activation state detecting section.

Note that the numbers in parentheses attached to the claims and the constituent features of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. do not have.

With the above-described configuration, the abnormality detection device of the present disclosure can reduce the possibility of erroneously detecting a normal frame as abnormal even when the activation state of a component device mounted on a moving object changes.

Block diagram showing a configuration example of an electronic control system common to each embodiment of the present disclosure A block diagram showing a configuration example of an abnormality detection device according to Embodiments 1 to 4 of the present disclosure An explanatory diagram showing an example of abnormality detection in the abnormality detection unit of the abnormality detection device according to Embodiment 1 of the present disclosure Explanatory diagram illustrating parameter change and abnormality detection necessity determination operation of the abnormality detection device according to Embodiment 1 of the present disclosure An explanatory diagram illustrating the abnormality detection operation of the abnormality detection device according to Embodiment 1 of the present disclosure Flowchart explaining the operation of the abnormality detection device according to Embodiment 1 of the present disclosure An explanatory diagram illustrating a power source of a vehicle detected by an abnormality detection device according to Embodiment 2 of the present disclosure Flowchart explaining the operation of the abnormality detection device according to Embodiment 2 of the present disclosure Flowchart explaining the operation of the abnormality detection device according to Embodiment 3 of the present disclosure An explanatory diagram showing the relationship between an abnormality detection device and an electronic control system according to Embodiment 4 of the present disclosure Block diagram showing a configuration example of an abnormality detection device according to Embodiment 5 of the present disclosure Explanatory diagram illustrating parameter changing operation of the abnormality detection device according to Embodiment 5 of the present disclosure

Embodiments of the present invention will be described below with reference to the drawings.

Note that the present invention refers to the invention described in the claims or the means for solving the problems, and is not limited to the following embodiments. In addition, at least the words and phrases in angle brackets mean the words and phrases described in the claims or the means for solving the problem, and are not limited to the following embodiments.

The structures and methods described in the dependent claims are arbitrary structures and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims are arbitrary configurations and methods in the present invention. In the case where the description of the claims is broader than the description of the embodiments, the configurations and methods described in the embodiments are also arbitrary configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. . In either case, what is described in the independent claims of the claims constitutes an essential structure and method of the present invention.

The effects described in the embodiments are effects obtained when the present invention has the configuration of the exemplary embodiment, and are not necessarily effects that the present invention has.

When there are multiple embodiments, the configuration disclosed in each embodiment is not limited to each embodiment alone, but can be combined across the embodiments. For example, the configuration disclosed in one embodiment may be combined with other embodiments. Further, configurations disclosed in each of a plurality of embodiments may be collected and combined.

The problems described in "Problems to be Solved by the Invention" are not known problems, but were independently discovered by the present inventor, and are facts that affirm the inventive step of the invention together with the structure and method of the present invention.

1. Electronic Control System Common to Each Embodiment Using FIG. 1, an example of an electronic control system 1 common to each embodiment will first be described. Here, an example will be described of an electronic control system that is a vehicle architecture installed in a car that is a moving object, but other examples are not excluded.

The electronic control system 1 includes an external communication electronic control unit (external communication ECU) 11, a central gateway device (CGW) 12, an electronic control unit (ECU) 13, and a network 14 connecting these.

The external communication ECU 11 is an electronic control device that communicates with the outside using various communication methods.
Examples of communication methods include wireless communication methods such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), and HSPA. (High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. can be used. Alternatively, DSRC (Dedicated Short Range Communication) can be used. In the case of a wired communication method, for example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

The CGW 12 is an electronic control device that relays communication between the external communication ECU 11 and the ECU 13 or between the ECUs 13 via the network 14.

The ECU 13 is an electronic control device that implements each function. Any ECU can be assigned to the ECU 13. For example, drive system electronic control units that control the engine, steering wheel, brakes, etc., vehicle system electronic control units that control meters, power windows, etc., information system electronic control units such as navigation devices, or obstacles and pedestrians. An example is a safety control system electronic control device that performs control to prevent collisions with vehicles.

Note that the ECUs may not be arranged in parallel but may be classified so as to have a master-slave relationship. That is, they may be classified into master and slave. Further, a plurality of ECUs 13 may be further provided under a specific ECU 13 via a sub-network. In that case, the specific ECU 13 has a function as a sub-gateway.

The network 14 is a network that connects the external communication ECU 11, CGW 12, and ECU 13. In the case of this embodiment, the network 14 is an in-vehicle network, and includes communication methods such as CAN (Controller Area Network) and LIN (Local Interconnect Network), as well as Ethernet (registered trademark), Wi-Fi (registered trademark), and Bluetooth. Any communication method such as (registered trademark) can be used.

2. Embodiment 1
(1) Configuration of abnormality detection device The configuration of the abnormality detection device 100 of this embodiment will be described using FIG. 2. The abnormality detection device 100 is “mounted” in a vehicle, which is a moving object. The abnormality detection device 100 includes a frame reception section 101, a sensor data reception section 102, an abnormality detection section 103, an activation state detection section 104, a parameter change section 105, a parameter storage section 106, and an abnormality detection necessity determination section 107. .

Here, "mounted" includes not only the case where the device is directly fixed to the movable body but also the case where it is not fixed to the movable body but moves together with the movable body. For example, when the vehicle is carried by a person riding on a moving body, or when it is carried on cargo placed on the moving body.

In Embodiments 1 to 3, including this embodiment, the abnormality detection device 100 will be described as being provided inside the CGW 12 in FIG. However, the location where the abnormality detection device 100 is provided is not limited to this, and may be provided at any location connected to the network 14, for example. For example, it may be provided as an independent dedicated ECU, or it may be provided in the ECU 13 having the role of a sub-gateway. Further, it may be provided outside the electronic control system 1, but this will be explained in the fourth embodiment.

The abnormality detection device 100 may be in the form of a component, a semi-finished product, or a finished product. In this embodiment, the abnormality detection device 100 is realized by a semiconductor circuit inside the CGW 12, and therefore belongs to the form of a component.
Other examples of components include semiconductor modules, semi-finished products such as independent ECUs, and finished products such as servers, workstations, personal computers (PCs), smartphones, mobile phones, and navigation systems. Not exclusively.

The abnormality detection device 100 can be configured with a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, nonvolatile memory such as ROM, flash memory, or hard disk, various interfaces, and an internal bus that connects these. can. By executing software on these hardware, it is possible to configure the system so that the functions of each functional block shown in FIG. 2 are exhibited.

The frame receiving unit 101 receives communication frames transmitted from the ECU 13, the CGW 12, or the external communication ECU 11 via the network 14 (corresponding to "network"). In this embodiment, an example in which CAN is used as the network 14 will be described. Then, the frame receiving unit 101 adds a time stamp to the received communication frame, and outputs the ID and payload of the communication frame to the abnormality detection unit 103. Note that when the abnormality detection device 100 is provided outside the electronic control system 1, the communication frame is received via an external network such as 4G, but this will be explained in the fourth embodiment.

Here, the "network" may be a communication network provided outside the mobile body as well as a communication network provided inside the mobile body. Further, in addition to a wired communication network, a wireless communication network may be used, or a combination of these may be used.

The sensor data receiving unit 102 receives sensor data output from various sensors connected to the abnormality detection device 100. Examples of sensors connected to the abnormality detection device 100 include a global positioning system (GPS), a temperature sensor, a humidity sensor, a throttle position sensor, a cam position sensor, an oxygen (O2) sensor, a vehicle speed sensor, an acceleration sensor, and a yaw rate sensor. These include, but are not limited to: In addition, a sensor that measures the voltage of each power supply line may be used.

The abnormality detection unit 103 detects an abnormality in the communication frame based on a “parameter” for evaluating the “communication interval” of the communication frame received by the frame reception unit 101. Specifically, a communication interval is determined using a timestamp added to a communication frame, and an abnormality in the communication frame is detected based on whether the communication interval is within a range that is evaluated as a normal frame. The parameters are acquired by reading them from the parameter storage unit 106, which will be described later.

Here, the "communication interval" includes not only the reception interval but also the transmission interval. Further, the communication interval may be expressed by frequency or number of times in addition to time.
Further, the "parameter" may be a constant value or a variable value that changes depending on conditions.

An example of an abnormality detection method performed by the abnormality detection unit 103 will be explained using FIG. 3.
Regular frames are transmitted from the ECU 13 and the like at specified communication intervals. For example, when the ECU 13 is a vehicle speed ECU, the vehicle speed is measured at prescribed communication intervals, for example, every 100 ms, and a communication frame with an ID indicating the vehicle speed is transmitted to the CAN bus.

In response to this, the abnormality detection device 100 receives the communication frame. However, due to congestion, etc., frames are not necessarily sent or received at the specified communication interval, so the specified communication interval has some width, and if a frame is sent or received during that period, it is determined to be a regular frame. If the frame is sent or received outside of this period, it is determined to be an abnormal frame (attack frame). In the example of FIG. 3, based on the scheduled reception time determined by the specified communication interval, α is the time range in which it is determined to be normal even if it is received early, and β is the time range in which it is determined to be normal even if it is received late. . In the example of FIG. 3, the frame F2 received next to the frame F1 is received within the range of β, so it is determined to be a regular frame. That is, in the case of this embodiment, α and β are parameters for evaluating the communication interval of communication frames.

In this embodiment, α and β are used as parameters, but the parameters are not limited to these. For example, the time range that is determined to be normal may be expressed as a range centered around the scheduled reception time and expressed as a function of a defined communication interval. For example, it may be 10% of the specified communication interval. In addition, the time range for determining normality may be changed depending on the error rate and temperature.

The activation state detection unit 104 uses the communication frame received by the frame reception unit 101 or the sensor data received by the sensor data reception unit 102 to detect the component devices “mounted” on a vehicle (corresponding to a “mobile object”). Detect changes in "starting state". Examples of the component devices include, but are not limited to, the ECU 13, the CGW 12, the external communication ECU 11, various drive system parts, various vehicle system parts, and various electrical system parts.

Here, the term "moving object" refers to a movable object, and the moving speed is arbitrary. Naturally, this also includes cases where the moving object is stopped. Examples include, but are not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these.
Furthermore, the term "mounted" includes not only the case where the component device is separable from the moving object, but also the case where the component device is integrated with the moving object and becomes a part of the moving object.
"Activation state" refers to the extent or rate at which the functions of a mobile object or an electronic control device can be performed. The degree or proportion does not need to be specified numerically; it is sufficient that the degree or proportion is specified by definition.

As a more specific example, the startup state detection unit 104 detects that the state of the component device installed in the vehicle changes from "start" to "stop" or from "stop" to "start". .

Here, "activation" refers to a state in which the function of the mobile object or the electronic control device is exerted to a greater degree or ratio than in the "stopped" state.
Furthermore, "stopped" refers to a state in which the function of the moving object or the electronic control device is less effective than in the "started" state.

In this embodiment, an example will be described in which the activation state detection unit 104 detects sleep or wake-up of a specific ECU 13. Sleep refers to a state in which all or part of the functions of a specific ECU 13 are put to rest by, for example, restricting the supply of electric power. Further, wake-up refers to a state in which a dormant function of a specific ECU 13 is recovered by, for example, starting the supply of electric power.

The activation state detection unit 104 detects that the state of the specific ECU 13 has changed from wake-up to sleep when the frame reception unit 101 receives the sleep control frame of the specific ECU 13. Furthermore, when the frame receiving unit 101 receives a wake-up control frame for a specific ECU 13, the activation state detection unit 104 detects that the state of the specific ECU 13 has changed from sleep to wakeup.

Then, the activation state detection unit 104 outputs the detection result to the parameter change unit 105 and the abnormality detection necessity determination unit 107.

The parameter changing unit 105 changes the parameters used by the abnormality detecting unit 103 based on the detection result of the activation state detecting unit 104.
As a more specific example, when the activation state detection unit 104 detects that the state of the component device changes from activation to stop, or from stop to activation, the parameter change unit 105 changes the parameter to the initial value. Reset.

Note that a plurality of initial values set at the time of reset may be held. For example, if the bus load is different during startup and steady state, and the load is larger at startup than during steady state, set the initial value at startup to a value that allows more communication delay than the initial value at steady state. It is possible to do so. In this case, when transitioning to normal operation after startup, it may be further reset to the initial value during normal operation. Further, the initial value during steady state may be used when resetting is performed due to a factor other than starting or stopping the component device.

Note that the parameter change by the parameter change unit 105 is not limited to resetting to one initial value. For example, when the startup state of a component device changes, a selection may be made from among a plurality of initial values to allow communication delays depending on the current startup state and the degree of bus load. Furthermore, when the startup state of a component device changes, a value that is corrected from the initial value may be used to allow for communication delays depending on the current startup state and the degree of bus load. It is also possible to use values obtained by correcting the parameters.

The parameter storage unit 106 stores parameters and also overwrites and stores parameters changed by the parameter changing unit 105. Further, the parameter storage unit 106 stores initial values of parameters.

The abnormality detection necessity determination unit 107 activates or stops abnormality detection in the abnormality detection unit 103 based on the detection result of the activation state detection unit 104.
As a more specific example, when the startup state detection unit 104 detects that the state of a component device has changed from startup to stop, the abnormality detection necessity determining unit 107 determines whether the abnormality detection unit 103 has detected a change in the state of the component device from startup to stop. It is determined that abnormality detection is not necessary, and abnormality detection by the abnormality detection unit 103 for the component device is stopped. Further, when the startup state detection unit 104 detects that the state of the component device has changed from stop to startup, the abnormality detection necessity determining unit 107 determines whether the abnormality detection unit 103 needs to detect an abnormality for the component device. Then, the abnormality detection unit 103 activates abnormality detection for the component device.

That is, the abnormality detection necessity determination unit 107 controls the abnormality detection operation of the abnormality detection unit 103 for each component device by outputting the determined necessity of abnormality detection to the abnormality detection unit 103.

A specific example of the operation of the parameter changing unit 105 and the abnormality detection necessity determining unit 107 in this embodiment will be described using FIG. 4.
As shown in FIG. 4(A), ECU_A transmits communication frames at a prescribed communication interval of 100 ms. ECU_B transmits communication frames at a specified communication interval of 200 ms. ECU_A's α is 10 ms, β is 11 ms, and the previous reception time is 300 ms, and ECU_B's α is 21 ms, β is 20 ms, and the previous reception time is 200 ms. For each ECU, detection by the abnormality detection unit 103 is required, and abnormality detection is activated.

Here, when the frame reception unit 101 receives the sleep control frame of ECU_B, the activation state detection unit 104 detects that ECU_B has changed from activation to stoppage. Then, as shown in FIG. 4B, the parameter changing unit 105 resets α and β to the initial value of 20 ms, and deletes the previous reception time. Further, the abnormality detection necessity determining unit 107 determines that abnormality detection by the abnormality detection unit 103 is not necessary, and stops abnormality detection by the abnormality detection unit 103 for ECU_B.

Subsequently, when the frame reception unit 101 receives the wake-up control frame of ECU_B, the activation state detection unit 104 detects that ECU_B has changed from stopped to activated. Then, as shown in FIG. 4C, the abnormality detection necessity determination unit 107 determines that abnormality detection by the abnormality detection unit 103 is necessary, and activates abnormality detection by the abnormality detection unit 103 for ECU_B.

Note that in FIG. 4, when the startup state detection unit 104 detects that the ECU_B changes from startup to stop, α and β are reset to initial values, but instead of this, the startup state detection unit 104 However, when it is detected that ECU_B changes from stop to start, α and β may be reset to their initial values. That is, it is sufficient to reset the parameters only in either case.

A specific example of the operation of the abnormality detection unit 103 in the case of FIG. 4 will be described using FIG. 5.
In the state of FIG. 4(A), when the ECU_B receives the frame F2 transmitted, the abnormality detection unit 103 uses 400ms, which is the previous reception time of the frame F1 of 200ms plus the prescribed communication interval of 200ms, as a reference point. It is detected whether frame F2 is received within the width of α (21 ms) and β (20 ms) as the scheduled reception time. In the case of FIG. 5, frame F2 is received within the range of α, so frame F2 is determined to be a regular frame.

Next, upon receiving the sleep control frame of ECU_B, the parameter changing unit 105 resets α and β to the initial value of 20 ms, and erases the previous reception time, as shown in FIG. 4(B). Furthermore, the abnormality detection necessity determination unit 107 determines that abnormality detection by the abnormality detection unit 103 for ECU_B is unnecessary. Therefore, while ECU_B is in the sleep state, no communication frame is transmitted from ECU_B, and abnormality detection by abnormality detection unit 103 is not performed.

Furthermore, upon receiving the wake-up control frame for ECU_B, as shown in FIG. 4(C), the abnormality detection necessity determination unit 107 determines that abnormality detection by the abnormality detection unit 103 for ECU_B is necessary. However, when the first frame F3 received after wake-up is received, the previous reception time has been erased. Therefore, since the scheduled reception time that is the reference for α and β cannot be determined, abnormality detection for frame F3 is not performed. Therefore, even though frame F3 is a normal frame, it will not be determined to be abnormal due to false detection.

Then, when frame F4 is received, the abnormality detection unit 103 uses 300 ms, which is the reception time of the previous frame F3 newly calculated from the time of wake-up as 100 ms, plus 200 ms, which is the prescribed communication interval, as the standard reception time. As the scheduled time, it is detected whether frame F4 is received within the width of α (20 ms) after reset and β (20 ms) after reset. In the case of FIG. 5, frame F4 is received within the range of β, so frame F4 is determined to be a regular frame.

(2) Operation of the abnormality detection device Next, the operation of the abnormality detection device 100 of this embodiment will be explained using FIG. 6.
Note that the following operations not only indicate the anomaly detection method in the anomaly detection device 100 but also show the processing procedure of the anomaly detection program executed by the anomaly detection device 100.
These processes are not limited to the order shown in FIG. 6. That is, the order may be changed unless there is a restriction such that a certain step uses the result of the previous step.
The above description applies not only to this embodiment but also to other embodiments.

The frame receiving unit 101 receives a communication frame via the network 14 (S101).

The activation state detection unit 104 interprets the communication frame received by the frame reception unit 101, and detects reception of a sleep control frame or a wake-up control frame (S102).

When the activation state detection unit 104 receives the sleep control frame (S102), it detects whether the sleep control frame is a regular frame (S103). Examples of the detection method include, but are not limited to, a method of monitoring the communication interval and payload and determining that it is abnormal if it exceeds a predetermined range. If the frame is a normal frame, the process moves to S104, and if it is an abnormal frame (attack frame), the abnormality detection process of S108 is continued.

The abnormality detection necessity determination unit 107 determines that the abnormality detection by the abnormality detection unit 103 is unnecessary (S104), and ends the process.

When the activation state detection unit 104 receives the wake-up control frame (S102), it detects whether the wake-up control frame is a regular frame (S105). An example of the detection method is the same as in S103. If the frame is a normal frame, the process moves to S106, and if it is an abnormal frame (attack frame), the process ends.

The abnormality detection necessity determination unit 107 determines that abnormality detection by the abnormality detection unit 103 is necessary (S106).

The parameter changing unit 105 resets the parameters stored in the parameter storage unit 106 to initial values (S107).

The abnormality detection unit 103 detects an abnormality in the communication frame received by the frame reception unit 101 based on the parameters stored in the parameter storage unit 106 (S108).

When the activation state detection unit 104 does not receive the sleep control frame or the wake-up control frame (S102), the abnormality detection process of S108 is continued.

(3) Summary As described above, according to the abnormality detection device 100 of the present embodiment, a change in the activation state of a component device mounted on a moving object is detected, and the parameters are changed based on this, so that a normal frame is Erroneous detection of abnormality can be reduced. In particular, when detecting a sleep control frame or a wake-up control frame of a specific ECU and changing parameters based on the detected sleep control frame or wake-up control frame, it is possible to reduce false detection of communication frames transmitted and received by the specific ECU.
Furthermore, according to the abnormality detection device 100 of the present embodiment, a change in the activation state of a component device mounted on a moving body is detected, and based on this, it is determined whether or not the abnormality detection unit detects an abnormality. , it is possible to not perform abnormality detection in situations where abnormality detection is not required, there is no need to allocate resources to wasteful processing, and power consumption can be reduced. In particular, when detecting the sleep control frame or wake-up control frame of a specific ECU and deciding whether or not to detect an abnormality in the abnormality detection section based on this, communication sent and received by a specific ECU that does not require abnormality detection It is possible to prevent abnormality detection from being performed only in frames.

3. Embodiment 2
In this embodiment, the detection target of the activation state detection unit 104 of the abnormality detection device 200 is the type of power supply supplied to the automobile.
FIG. 7 shows the types of power sources of the automobile, and the switchable combinations and directions.

+B is a battery power supply, which is a power supply that is supplied even when the engine is stopped and the engine key is OFF. +B supplies power to equipment that needs to be used even when the engine is stopped and the car is stationary, such as horns, hazard lights, stop lights, and keyless entry systems.

ACC is an accessory power source, and is a power source that is supplied while the ACC is ON even when the engine is stopped. The ACC supplies power to electrical components of a vehicle that consume relatively little power, such as a car navigation system, a car audio system, an ETC, and a drive recorder.

IG is an ignition power supply, which is basically a power supply that is supplied while the engine is operating. The IG supplies power to devices that are intended to be used while the engine is running, such as starter motors, turn signals, wipers, and air conditioners.

The type of power source of a vehicle specifies the power source supplied to the component devices that constitute the vehicle, and therefore can be said to represent the activation state of the component devices of the vehicle. Therefore, it can be said that when the type of power source of the vehicle is switched, the activation state of the component devices of the vehicle changes. Hereinafter, the activation state of the component devices of the vehicle will be abbreviated as the state of the vehicle.

In FIG. 7, the thickness of the arrow indicates whether the state of the vehicle is in the starting direction or in the stopping direction. For example, switching from ACC to IG indicates that the vehicle is in the starting direction, ie, the state of the vehicle is changing from stopped to started. Furthermore, switching from ACC to +B indicates that the vehicle is in a stopping direction, that is, the state of the vehicle is changing from starting to stopping.

In the example of FIG. 7, the power supplies of +B, ACC, and IG can be mutually switched, but other switchable combinations may be used. For example, if it is necessary to go through ACC between +B and IG, it is possible to switch the power supply between +B and ACC and between ACC and IG.

(1) Configuration of abnormality detection device The abnormality detection device 200 of this embodiment is the same as the abnormality detection device 100 of the first embodiment, so the configuration of the abnormality detection device 200 will be described with reference to FIG. 2. Further, FIG. 3 will also be referred to as this embodiment.

The sensor data receiving unit 102 receives a vehicle power signal indicating the type of power source from a sensor that detects the type of power source. The starting state detection unit 104 detects that the type of power source of the vehicle has been switched by periodically receiving the vehicle power signal output from the sensor data receiving unit 102. Then, the activation state detection unit 104 outputs a signal indicating the type of power source before switching and the type of power source after switching to the parameter changing unit 105 and the abnormality detection necessity testing unit 107. The operations of the parameter changing unit 105 and the abnormality detection necessity testing unit 107 will be described later.
In addition, the sensor data receiving unit 102 may directly monitor the power lines of each power source.

Note that the activation state detection unit 104 detects that the type of power source of the automobile has been switched using the vehicle power supply signal from the sensor data reception unit 102, but instead of this, or in combination with this, The communication frame received by the frame receiving unit 101 may be used to detect that the type of power source of the vehicle has been switched. For example, it is possible to detect that the type of power source of the vehicle has been switched using a communication frame that conveys the status of ACC or IG. Alternatively, by detecting the presence or absence of a specific communication frame for a navigation system, meter, etc., ACC ON/OFF can be detected, or by detecting the presence or absence of a specific communication frame for an air conditioner, etc., IG ON/OFF can be detected. can be detected.

(2) Operation of the abnormality detection device Next, the operation of the abnormality detection device 100 of this embodiment will be explained using FIG. 8. In addition, in this embodiment, when the power source is IG, the description will be made assuming that power is also supplied to devices using ACC.

The activation state detection unit 104 detects the type of current power source from the vehicle power signal received from the sensor data reception unit 102 (S201). Further, the activation state detection unit 104 detects a change in the type of power source from the vehicle power signal received from the sensor data reception unit 102 thereafter (S202, S203, S204).

When it is detected that the power supply has been switched from +B to ACC (S202), the abnormality detection necessity determining unit 107 determines that abnormality detection using a communication frame having a CAN ID that allows communication to be performed only by ACC is necessary. (S205), the abnormality detection unit 103 detects an abnormality in the communication frame (S211).

When it is detected that the power supply has been switched from +B to IG (S202), the abnormality detection necessity determining unit 107 determines that abnormality detection using a communication frame having a CAN ID in which communication is performed in IG or ACC is necessary. (S206), and the abnormality detection unit 103 detects an abnormality in the communication frame (S211).

When it is detected that the power source has been switched from ACC to IG (S203), the abnormality detection necessity determining unit 107 determines that abnormality detection using a communication frame having a CAN ID that allows communication to be performed only by IG is necessary. (S207), and the abnormality detection unit 103 detects an abnormality in the communication frame (S211).

When it is detected that the power supply has been switched from ACC to +B (S203), the parameter change unit 105 resets the parameters for evaluating the communication interval of the communication frame having the CAN ID in which communication is performed only with ACC (S208). ), the abnormality detection necessity determining unit 107 determines that abnormality detection using the communication frame is not necessary (S212).

When it is detected that the power source has been switched from IG to ACC (S204), the parameter changing unit 105 resets the parameters for evaluating the communication interval of the communication frame having the CAN ID in which communication is performed only by IG (S209). ), the abnormality detection necessity determining unit 107 determines that abnormality detection using the communication frame is not necessary (S213).

When it is detected that the power source has been switched from IG to +B (S204), the parameter change unit 105 resets the parameters for evaluating the communication interval of the communication frame having the CAN ID in which communication is performed using ACC or IG (S204). S210), the abnormality detection necessity determining unit 107 determines that abnormality detection using the communication frame is not necessary (S214).

Note that in the example of FIG. 8, parameter reset is performed when abnormality detection is not required and abnormality detection is to be stopped, but instead, it is performed when abnormality detection is necessary and abnormality detection is restarted. You can do it like this.

(3) Summary As described above, according to the abnormality detection device 200 of this embodiment, the parameters are changed according to the change in the type of power source, and the necessity of operation of the abnormality detection section is determined. Accordingly, abnormality detection for related communication frames can be collectively controlled.

4. Embodiment 3
In this embodiment, the detection target of the startup state detection unit 104 of the abnormality detection device 300 is the state of the engine due to the idling stop function.
ON/OFF of an automobile engine indicates the starting state of the engine, which is a component installed in the automobile. Therefore, it can be said that when the ON/OFF state of the automobile engine is switched, the starting state of the automobile engine changes.

(1) Configuration of anomaly detection device The anomaly detection device 300 of this embodiment is the same as the anomaly detection device 100 of Embodiment 1, so the configuration of the anomaly detection device 300 will be described with reference to FIG. 2. Further, FIG. 3 will also be referred to as this embodiment.

The sensor data receiving unit 102 receives an engine start signal from a sensor that detects ON/OFF of the engine. The starting state detection unit 104 detects switching of the engine of the automobile between ON and OFF by receiving the engine starting signal output from the sensor data receiving unit 102. Then, the startup state detection unit 104 outputs a signal indicating that the engine has been switched to ON or a signal indicating that the engine has been switched to OFF to the parameter change unit 105 and the abnormality detection necessity verification unit 107. The operations of the parameter changing unit 105 and the abnormality detection necessity testing unit 107 will be described later.

Note that the activation state detection unit 104 detects switching between ON and OFF of the automobile engine using the engine activation signal from the sensor data reception unit 102, but instead of this, or in combination with this, The communication frame received by the frame receiving unit 101 may be used to detect whether the engine of the automobile is turned on or off. For example, a communication frame that conveys the ON/OFF state of the engine, a communication frame that conveys an instruction to turn the engine ON/OFF, and a communication frame that conveys the engine rotation speed can be used.

(2) Operation of abnormality detection device Next, the operation of the abnormality detection device 300 of this embodiment will be explained using FIG. 9.
The starting state detection unit 104 detects the state of the engine from the engine starting signal received from the sensor data receiving unit 102 (S301). Further, the starting state detection unit 104 detects a change in the engine state from the engine starting signal received from the sensor data receiving unit 102 thereafter (S302, S303).

When the engine is switched from OFF to ON, that is, when it starts idling (S302), the abnormality detection necessity determining unit 107 needs to detect an abnormality using a communication frame with a CAN ID that communicates only when the engine is running. (S304), and the abnormality detection unit 103 detects an abnormality in the communication frame (S307).

When the engine is switched from ON to OFF, that is, when idling has stopped (S303), the parameter change unit 105 changes the parameter for evaluating the communication interval of the communication frame having the CANID, which is communicated only when the engine is running. At the same time as resetting (S305), the abnormality detection necessity determining unit 107 determines that abnormality detection using the communication frame is not necessary (S306).

Note that in the example of FIG. 9, parameter reset is performed when abnormality detection is not required and abnormality detection is to be stopped; however, instead of this, parameter reset is performed when abnormality detection is necessary and abnormality detection is restarted. You can do it like this.

(3) Summary As described above, according to the abnormality detection device 300 of the present embodiment, the parameters are changed according to the ON/OFF switching of the engine, and the necessity of operation of the abnormality detection section is determined. According to the change in /OFF, abnormality detection for related communication frames can be controlled all at once.

5. Embodiment 4
In this embodiment, an abnormality detection device 400 is provided outside an automobile, which is a moving object.
FIG. 10 shows the relationship between the abnormality detection device 400 and the electronic control system 1 installed in the automobile.

An electronic control system 1 is installed in a vehicle and communicates with an abnormality detection device 400 via a communication network 2. The electronic control system 1 and the abnormality detection device 400 are the same as those described in FIGS. 1 and 2 of the first embodiment, so the description of the first embodiment will be omitted.

In the case of a wireless communication system, the communication network 2 uses, for example, IEEE802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA ( High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. can be used. Alternatively, DSRC (Dedicated Short Range Communication) can be used.
In the case of a wired communication system, the communication network 2 can use, for example, a wired LAN (Local Area Network), the Internet, or a fixed telephone line.

Frame receiving section 101 of abnormality detection device 400 receives a communication frame transmitted from external communication ECU 11 of electronic control system 1 via network 2 (corresponding to "network").

Note that the sensor data receiving section 102 does not necessarily need to be provided in this embodiment.

According to this embodiment, by providing the abnormality detection device 100 outside the electronic control system 1, for example, in a server or the like, abnormality detection can be performed using a stable device with abundant resources.

6. Embodiment 5 (Other invention 1)
According to the first to fourth embodiments, the parameters are reset to the initial values, but this is because the parameters are scheduled to be changed from the initial values by some trigger. The abnormality detection device 500 of this embodiment is disclosed as a configuration for changing parameters in the abnormality detection devices 100 and the like of Embodiments 1 to 4. That is, the anomaly detection device 500 of the fifth embodiment can be superimposed and applied to the configuration of the anomaly detection device 100 and the like of the first to fourth embodiments.
Further, this embodiment can be understood as a different invention from Embodiments 1 to 4.

Here, the present inventor discovered the following problem.
If the frequency of notification frames and error frames when abnormality detection results are notified via CAN bus etc. is high, the reception interval of communication frames may change, but each patent document does not take this change into account. Therefore, there is a possibility that a regular frame whose reception interval has changed may be erroneously determined to be abnormal.

An object of the present invention is to reduce the possibility that a normal frame is erroneously detected as abnormal even when the communication state changes.

(1) Configuration of abnormality detection device The configuration of the abnormality detection device 500 of this embodiment will be described using FIG. 11. The abnormality detection device 500 includes a frame reception section 101, an abnormality detection section 103, a communication state detection section 501, a parameter change section 105, and a parameter storage section 106. Note that the same configuration as the abnormality detection device 100 of Embodiment 1 is given the same number, and the description of Embodiment 1 is cited. Furthermore, in this embodiment, the description will be given assuming that the abnormality detection device 500 is provided inside the CGW 12 in FIG. 1, as in the first to third embodiments. However, the location where the abnormality detection device 500 is provided is not limited to this, and may be provided at any location connected to the network 14, for example. For example, it may be provided as an independent dedicated ECU, or it may be provided in the ECU 13 having the role of a sub-gateway. Further, it may be provided outside the electronic control system 1.

The frame receiving unit 101 receives communication frames transmitted from the ECU 13, the CGW 12, or the external ECU 11 via the network 14. In this embodiment, in addition to regular communication frames, an error frame transmitted when an error is detected and an anomaly detection result notification frame that notifies an anomaly detection result are also received as communication frames.

The abnormality detection unit 103 detects an abnormality in the communication frame based on a parameter for evaluating the communication interval of the communication frame received by the frame reception unit 101.

The communication state detection unit 501 detects the communication state of the network 14. Specifically, for example, it is detected whether the reception frequency of error frames or abnormality detection result notification frames received by the frame receiving unit 101 exceeds a predetermined threshold. Then, when the predetermined threshold value is exceeded, the detection result is output to the parameter changing unit 105.

The parameter changing unit 105 changes the parameters based on the detection results. The changed parameters are then stored in the parameter storage unit 106. A specific example of the parameter changing process will be described later.

FIG. 12 shows an example of a parameter changing operation.
Regular frames are transmitted from the ECU 13 and the like at specified communication intervals. However, when an error frame or an abnormality detection result notification frame is transmitted, these frames are generally transmitted consecutively, so as shown in FIG. 12(A), the normal frame is used as a parameter. There is a possibility that the frame may fall outside the range of α and β, and in this case, the frame will be falsely detected as an abnormality (attack frame) even though it is a normal frame.

Therefore, when the error frame or abnormality detection result notification frame exceeds a predetermined threshold, the parameter β is expanded as shown in FIG. 12(B). That is, the value of β is changed to a larger value. For example, β is extended by a period corresponding to 10% of β before the change. As a result, a normal frame will not exceed the range of β, and will not be falsely detected as an abnormality (attack frame).

As described above, according to the present embodiment, even when an error frame or an abnormality detection result notification frame is received, it is possible to prevent a normal frame from being erroneously detected as abnormal.

The invention disclosed in this embodiment is as follows.
a receiving unit (101) that receives communication frames via a network;
an abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating a communication interval of the communication frame;
a communication state detection unit (501) that detects the communication state of the network;
a parameter changing unit (105) that changes the parameters based on the detection result of the communication state detecting unit;
Anomaly detection device (500).

7. Summary The features of the abnormality detection device and the like in each embodiment of the present invention have been described above.

Since the terms used in each embodiment are merely examples, they may be replaced with synonymous terms or terms that include synonymous functions.

The block diagram used to explain the embodiment is a diagram in which the configuration of the device is classified and organized by function. Blocks representing respective functions are realized by any combination of hardware or software. Further, since the block diagram shows the functions, it can also be understood as a disclosure of the invention of the method and the invention of the program that implements the method.

Regarding the functional blocks that can be understood as processes, flows, and methods described in each embodiment, the order may be changed unless there is a restriction such that one step uses the result of another step before it. Good too.

The terms first, second, to Nth (N is an integer) used in each embodiment and the claims are used to distinguish two or more configurations or methods of the same type. , it does not limit the order or superiority.

Although each embodiment is premised on a vehicle device mounted on a vehicle, the present invention also includes dedicated or general-purpose devices other than vehicles, unless otherwise specified in the claims.

Although each embodiment has been described on the assumption that the device disclosed in each embodiment is mounted on a vehicle, it may also be assumed that the device is carried by a pedestrian.

Further, examples of the form of the abnormality detection device of the present invention include the following.
Examples of the form of parts include semiconductor elements, electronic circuits, modules, and microcomputers.
Examples of semi-finished products include electronic control units (ECUs) and system boards.
Examples of finished products include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers.
Other devices include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

Further, necessary functions such as an antenna and a communication interface may be added to the abnormality detection device.

It is envisaged that the abnormality detection device of the present invention will be used for the purpose of providing various services, especially by being used on the server side. In providing such services, the apparatus of the present invention is used, the method of the present invention is used, and/or the program of the present invention is executed.

In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk. It can also be realized in combination with general-purpose hardware having an executable dedicated or general-purpose CPU, memory, and the like.

A program stored in a non-transitional physical recording medium of dedicated or general-purpose hardware (for example, an external storage device (hard disk, USB memory, CD/BD, etc.) or an internal storage device (RAM, ROM, etc.)) is It can also be provided to dedicated or general-purpose hardware via a recording medium or from a server via a communication line without using a recording medium. This allows us to always provide the latest functionality through program upgrades.

Although the abnormality detection device of the present invention is primarily intended for electronic control systems installed in automobiles, it may also be applied to ordinary systems that are not installed in automobiles.

100 abnormality detection device, 101 frame receiving unit, 103 abnormality detection unit, 104 activation state detection unit, 105 parameter change unit, 107 abnormality detection necessity determining unit

Claims (10)

a receiving unit (101) that receives communication frames via a network;
an abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating a communication interval of the communication frame;
an activation state detection unit (104) that detects a change in the activation state of a component device mounted on the mobile body;
a parameter changing unit (105) that changes the parameters based on the detection result of the activation state detecting unit ;
When the activation state detection unit detects that the state of the component device changes from activation to stop, or from stop to activation, the parameter change unit resets the parameter to an initial value.
Anomaly detection device (100). a receiving unit (101) that receives communication frames via a network;
an abnormality detection unit (103) that detects an abnormality in the communication frame based on a parameter for evaluating a communication interval of the communication frame;
an activation state detection unit (104) that detects a change in the activation state of a component device mounted on the mobile body;
a parameter changing unit (105) that changes the parameters based on the detection result of the activation state detecting unit ;
The activation state detection section includes at least
detecting sleep and wake-up of the component device; or
detecting the type of power supply being supplied to the component device; or
detecting starting and stopping of an engine included in the moving body;
Anomaly detection device (100) . Furthermore, it has an abnormality detection necessity determination unit (107) that starts or stops abnormality detection in the abnormality detection unit based on the detection result of the activation state detection unit.
The abnormality detection device according to claim 1 or 2. When the startup state detection unit detects that the state of the component device has changed from startup to stop,
The abnormality detection necessity determining unit causes the abnormality detection unit to stop detecting an abnormality with respect to communication frames transmitted by the component device.
The abnormality detection device according to claim 3 . When the activation state detection unit detects that the state of the component device has changed from stopped to activated,
The abnormality detection necessity determining unit activates abnormality detection in the abnormality detection unit with respect to the communication frame transmitted by the component device.
The abnormality detection device according to claim 3 . The abnormality detection device is mounted on the mobile object,
The abnormality detection device according to any one of claims 1 to 5 . Receive a communication frame via a communication network (S101),
detecting a change in the activation state of a component device mounted on a mobile object (S102);
changing parameters for evaluating the communication interval of the communication frame based on the change in the activation state (S107);
detecting an abnormality in the communication frame based on the parameters (S108);
An abnormality detection method ,
resetting the parameters to initial values when detecting that the state of the component device changes from starting to stopping or from stopping to starting;
Anomaly detection method. Receive a communication frame via a communication network (S101),
detecting a change in the activation state of a component device mounted on a mobile object (S102);
changing parameters for evaluating the communication interval of the communication frame based on the change in the activation state (S107);
detecting an abnormality in the communication frame based on the parameters (S108);
An abnormality detection method ,
The detection of the change in the activation state includes at least
detecting sleep and wake-up of the component device; or
detecting the type of power supply being supplied to the component device; or
detecting starting and stopping of an engine included in the moving body;
Anomaly detection method. Receive a communication frame via a communication network (S101),
detecting a change in the activation state of a component device mounted on a mobile object (S102);
changing parameters for evaluating the communication interval of the communication frame based on the change in the activation state (S107);
detecting an abnormality in the communication frame based on the parameters (S108);
An anomaly detection program executed by an anomaly detection device ,
resetting the parameters to initial values when detecting that the state of the component device changes from starting to stopping or from stopping to starting;
Anomaly detection program. Receive a communication frame via a communication network (S101),
detecting a change in the activation state of a component device mounted on a mobile object (S102);
changing parameters for evaluating the communication interval of the communication frame based on the change in the activation state (S107);
detecting an abnormality in the communication frame based on the parameters (S108);
An anomaly detection program executed by an anomaly detection device ,
The detection of the change in the activation state includes at least
detecting sleep and wake-up of the component device; or
detecting the type of power supply being supplied to the component device; or
detecting starting and stopping of an engine included in the moving body;
Anomaly detection program.