WO2019142456A1

WO2019142456A1 - Abnormality determination device, abnormality detection model creation server, and program

Info

Publication number: WO2019142456A1
Application number: PCT/JP2018/041277
Authority: WO
Inventors: 良太高橋; 崇光佐々木
Original assignee: パナソニックインテレクチュアルプロパティコーポレーションオブアメリカ
Priority date: 2018-01-22
Filing date: 2018-11-07
Publication date: 2019-07-25

Abstract

An abnormality determination device (125) which is included in a first node being monitored in a network, and includes a processor that: acquires log information, which includes the time of day and information about the state of the first node at the relevant time of day, as indicated by sensor data or control data at the first node; executes a first abnormality determination related to the occurrence of an abnormality in the first node at the relevant time of day; executes a second abnormality determination related to the occurrence of an abnormality in a second node at the relevant time of day, on the basis of second node information acquired from a second node and related to an abnormality in the second node, which is a node that is in the vicinity of the first node and is another monitoring subject; and, when an abnormality has occurred in the second node, appends abnormality information indicating that an abnormality has occurred in the second node to the log information, and transmits the log information to at least a portion of the nodes on the network.

Description

Abnormality determination device, abnormality detection model creation server and program

The present invention relates to a V2X network in which an abnormality determination is made using an abnormality detection model.

Communication paths with the exterior used by increasingly advanced vehicles are increasing not only through mobile communication lines such as LTE (Long Term Evolution). A V2X (meaning of Vehicle-to-everything) network in which a car traveling on a road is supposed to communicate with other cars, traffic base equipment such as traffic lights, pedestrian smart phones etc. Practical application of technology for realization is underway with a view to realization of more advanced automatic driving.

On the other hand, the risk to cyber attacks also increases for automotive in-vehicle network systems that receive information from more routes, including outside. Technologies for countering such risks have been proposed for the safe realization of more sophisticated vehicles (see, for example, Patent Documents 1 and 2).

JP 2017-33186 A JP, 2017-111796, A

However, in the technique proposed in Patent Document 1 or 2, with regard to the information used to generate the model used for abnormality detection, the influence that the node providing the information may receive from the peripheral nodes in the V2X communication is considered. Not.

Therefore, the present invention provides an abnormality determination device or the like that enables selection of information used to generate a model used for abnormality detection, taking into consideration the influence of peripheral nodes on the transmission source node.

The abnormality determining apparatus according to an aspect of the present invention is an abnormality determining apparatus including a processor, which is included in a first node to be monitored in a V2X network, wherein the processor is configured to measure time and a sensor on the first node. A log information acquisition step of acquiring log information including state information of the first node at the time indicated by at least one of data and control data; a first abnormality related to occurrence of an abnormality on the first node at the time A second abnormality determination step of performing determination, and a second node related to an abnormality of the second node acquired from a second node in the vicinity of the first node, which is another node to be monitored in the V2X network Performing a second anomaly determination on occurrence of an anomaly on the second node at the time based on information; In the determination step, when the result of the second abnormality determination indicates the occurrence of an abnormality on the second node, abnormality information that adds the abnormality information indicating the occurrence of the abnormality on the second node to the log information Performing an adding step and a log information transmitting step of transmitting the log information to which the abnormality information is added to at least a part of nodes constituting the V2X network.

Further, the abnormality detection model creating server according to an aspect of the present invention is a server including a processing unit, and the processing unit is a log for acquiring log information generated by a first node to be monitored in the V2X network. The monitoring node monitoring the first node in the V2X network using the information acquisition step, the information selection step of selecting predetermined information from the acquired log information, and the selected predetermined information as learning data Performing a model creation step of executing machine learning for creation of an abnormality detection model used for detection, and the log information is indicated by at least one of time and sensor data or control data on the first node, The state information of the first node at the time, and the presence or absence of an abnormality on the first node at the time Anomaly information is associated with second anomaly information indicating presence or absence of an anomaly on a second node that is in the vicinity of the first node at the time and communicates with the first node, and in the information selection step, The predetermined information is selected based on the first abnormality information and the second abnormality information.

Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, a system, a method, an integrated circuit, a computer program And any combination of recording media.

According to the present invention, it is possible to select information used to generate a model used for abnormality detection, taking into consideration the influence of a node at the provision source from the peripheral nodes.

FIG. 1 is a diagram for describing an overview of a V2X network. FIG. 2 is a block diagram showing a configuration example of an in-vehicle network system provided in a vehicle in the embodiment. FIG. 3 is a block diagram showing a configuration example of the abnormality determination device included in the above-described in-vehicle network system. FIG. 4 is a diagram showing an example of a data configuration of log information acquired by the abnormality determination device. FIG. 5 is a diagram showing another example of the data configuration of the log information acquired by the abnormality determination device. FIG. 6 is a diagram showing still another example of the data configuration of the log information acquired by the abnormality determination device. FIG. 7 is a block diagram showing a configuration example of the roadside apparatus in the V2X network described above. FIG. 8 is a block diagram showing a configuration example of the abnormality monitoring server in the V2X network described above. FIG. 9 is a sequence diagram showing an example of a procedure related to uploading of data from a vehicle, which is a monitoring target node, to the abnormality monitoring server. FIG. 10 is a sequence diagram showing another example of the procedure relating to the uploading of data from the vehicle, which is the monitoring target node, to the abnormality monitoring server. FIG. 11 is a flowchart showing an example of a procedure of processing by the abnormality determination device in the embodiment. FIG. 12 is a sequence diagram showing still another example of the procedure relating to the uploading of data from the vehicle, which is a monitoring target node, to the abnormality monitoring server. FIG. 13 is a flowchart showing another example of the procedure of the process performed by the abnormality determining device in the embodiment. FIG. 14 is a sequence diagram showing still another example of the procedure relating to the uploading of data from the vehicle, which is a monitoring target node, to the abnormality monitoring server. FIG. 15 is a sequence diagram showing still another example of the procedure relating to the uploading of data from the vehicle which is the node to be monitored to the anomaly monitoring server. FIG. 16 is a flow chart showing an example of a procedure of abnormality detection by the above-mentioned abnormality monitoring server. FIG. 17 is a flow chart showing an example of an abnormality detection procedure by the monitoring node in the V2X network described above. FIG. 18 is a flow chart showing an example of a procedure of creating an anomaly detection model by the above-mentioned anomaly monitoring server. FIG. 19 is a flow chart showing an example of a procedure of selection processing of learning data in the above-mentioned abnormality monitoring server. FIG. 20 is a flowchart showing another example of the procedure of the process of selecting learning data in the abnormality monitoring server described above. FIG. 21 is a flowchart showing still another example of the procedure of the process of selecting learning data in the above-mentioned abnormality monitoring server. FIG. 22 is a flow chart showing an example of a procedure of selection processing of supervised learning data in the above-mentioned abnormality monitoring server. FIG. 23A is a flow chart showing an example of a procedure of processing for selecting supervised learning data in the above-mentioned anomaly monitoring server. FIG. 23B is a flow chart showing an example of a procedure of selection processing of supervised learning data in the above-mentioned abnormality monitoring server.

(Findings, etc. that formed the basis of this disclosure)
The communication performed on the V2X network can be subdivided into several types based on the party with which the vehicle communicates. One example is vehicle-to-vehicle communication (hereinafter referred to as V2V). In the V2V communication, for example, information on the speed of a leading vehicle is transmitted to a succeeding vehicle in real time, and the information on the following vehicle can be used to adjust an inter-vehicle distance or speed. In addition, by exchanging information between the emergency vehicle in emergency travel and the general vehicle in travel, the general vehicle avoids the route on which the emergency vehicle travels or avoids the route in which the emergency vehicles are congested There is a possibility of doing. Another example is vehicle-to-roadside-infrastructure (hereinafter referred to as V2I) communication. The communication partner of the vehicle in V2I communication is various roadside devices. Roadside equipment here refers to equipment installed on the road or in the vicinity as equipment of a traffic infrastructure system, for example, traffic light, ETC (Electronic Toll Collection) gate, traffic measuring device, automatic speed control device, and altitude Other various devices used in the computerized traffic infrastructure, such as a road traffic system (Intelligent Transport Systems, hereinafter referred to as ITS) or a new traffic management system (Universal Traffic Management System, hereinafter referred to as UTMS) is there. Some of these devices, even those that did not have a communication function before computerization, are now equipped with a communication function to exchange information with a traveling vehicle. Besides, communication for acquiring information or enjoying services on the Internet by a mobile communication line such as LTE is also counted as one aspect of V2X as V2N (Vehicle-to-cellular-Network) communication.

The acquisition and provision of such information in the V2X network aims to enhance traffic safety and improve convenience as in the above example. However, data exchanged in the V2X network is not necessarily data of such useful information. A node that has an anomaly due to a cyber attack or a failure From the node that has an anomaly, such as false information or an illegal command, it disturbs the judgment on the information processing equipment of other nodes or causes a malfunction to cause anomaly It is also possible that the data of information which makes it expand.

In order to suppress the occurrence or expansion of such an abnormality, for example, a system that monitors data flowing through the network to detect an abnormality (hereinafter also referred to as an abnormality monitoring system) is placed on the V2X network. The abnormality monitoring system is created or updated by machine learning using a log of sensor data or control data collected from a vehicle traveling in a normal state, for example (in the following, creating and updating are not distinguished, The anomaly detection model such as the normal model, and the content or transmission pattern of data flowing through the network are compared, and an anomaly is detected based on the difference. The accuracy of the determination regarding the abnormality of the data here depends on the accuracy of the abnormality detection model. For example, a normal model is created using data collected from a vehicle traveling in a situation where no abnormality has occurred. Here, the distinction as to whether or not the data is data when an abnormality has occurred in the vehicle can be made, for example, by an ECU (Electronic Control Unit) having an abnormality determination function connected to the in-vehicle network. It is possible based on the determination. Therefore, it is also possible to determine whether the data is used to create a normal model or the like.

However, sensor data or control data of a vehicle for which control or sensing is performed using data received from surrounding nodes by V2X communication is data generated by the vehicle when no abnormality is detected. If an abnormality occurs at the time of generation of the data, the peripheral nodes may be affected by the abnormality. In some cases, in spite of the state that should normally be judged as abnormal, it may also be judged as normal due to the influence of the information on the peripheral nodes where the abnormality has occurred. Therefore, there is a problem that as the vehicle corresponding to the V2X communication spreads, the accuracy of the abnormality determination may be reduced even with the normal model created based on the data from the vehicle in which the abnormality is not detected.

In view of such problems, the present inventors have conceived of a mechanism for selecting learning data suitable for creating a target abnormality detection model from data collected by the V2X network.

Thus, log information used as learning data to be provided for creation of an abnormality detection model used by the abnormality monitoring system may be accompanied by information indicating the presence or absence of an adverse effect from a peripheral node that is a peripheral communication counterpart. it can. Here, the term “periphery” refers to a distance range in which V2V communication or V2I communication is possible, and the upper limit thereof is, for example, a range of several tens of meters to several hundreds of meters.

Also, for example, the second node information includes the result of the determination performed on the second node based on at least one of sensor data or control data of the second node, which is performed on the second node, The second abnormality determination may be performed by acquiring the result included in the second node information. Alternatively, the second node information includes at least one of sensor data or control data of the second node, and the second abnormality determination is based on at least one of the sensor data or control data included in the second node information. It may be performed.

Thus, the information indicating whether there is a possibility that there is an adverse effect from the peripheral node is provided by the node transmitting the log information or by the peripheral node thereof. Further, for example, when the second node information includes the result of the determination that an abnormality has occurred in the second node, the second node information may further include the result of the determination regarding the type of the abnormality that has occurred in the second node. Alternatively, the second abnormality determination may include determination as to the type of the generated abnormality, and the abnormality information may further indicate the type of the generated abnormality.

This makes it possible to properly use learning data log information according to the method of machine learning for creating an abnormality detection model.

Also, for example, the first node may be a vehicle provided with an in-vehicle network system capable of communicating with other nodes constituting the V2X network. As a result, in the node where the data to be transmitted as the log information has occurred, the information on the presence or absence of the occurrence of the abnormality in the peripheral node of the node is acquired. The information acquired in this manner is more accurate than the determination of the presence or absence of an abnormality occurring after the factual information in a learning data generation server or the like. Also, the load on the learning data generation server that collects a large amount of data can be reduced.

Also, for example, the log information transmitted in the log information transmission step may be transmitted to a node that creates an abnormality detection model used for abnormality detection in a monitoring system in the V2X network using the log information.

This makes it possible to create an anomaly detection model using, as learning data, log information that can be used selectively based on the presence or absence of an anomaly occurrence in peripheral nodes of each node.

As a result, it is possible to create an abnormality detection model by executing machine learning using, as learning data, log information including information indicating the presence or absence of the possibility of an adverse effect of an abnormality at a peripheral node.

Further, in the information selection step, state information associated with the first abnormality information indicating no abnormality and the second abnormality information indicating no abnormality is selected as the predetermined information, and the model is selected. In the creating step, a normal model may be created as the abnormality detection model using the selected predetermined information as learning data. Alternatively, in the information selection step, state information associated with at least one of the first abnormality information indicating that there is an abnormality and the second abnormality information that indicates that there is an abnormality is selected as the predetermined information. The anomaly detection model may be created using the selected predetermined information as supervised learning data in the model creation step.

Thus, the method of machine learning can be properly used according to the presence or absence of an abnormality that is added to the log information, and an abnormality detection model that can execute abnormality detection with higher accuracy can be obtained.

Further, a program according to an aspect of the present invention is a program executed by a processor included in an abnormality determination apparatus included in a first node to be monitored in a V2X network, and the program executes the abnormality by being executed by the processor. A log information acquisition step of acquiring log information including the time and state information of the first node at the time indicated by the time and at least one of sensor data or control data on the first node; A first abnormality determination step of executing a first abnormality determination on occurrence of an abnormality on the first node in the second node, and another node to be monitored in the V2X network, the second node being around the first node Based on second node information on the abnormality of the second node acquired from the node, A second abnormality determination step of executing a second abnormality determination on the occurrence of an abnormality on the second node, and the log information if the result of the second abnormality determination indicates the occurrence of an abnormality on the second node An anomaly information addition step of appending anomaly information indicating occurrence of an anomaly on the second node, and transmitting the log information to which the anomaly information is attached to at least a part of nodes constituting the V2X network And a log information transmission step.

Thus, it is possible to add to the log information used as learning data to be provided for creating the abnormality detection model used by the abnormality monitoring system, information indicating the presence or absence of the possibility that the peripheral node may have an adverse effect.

Further, a program according to an aspect of the present invention is a program executed by a processing unit included in a server, and is executed by the processing unit to cause the server to monitor the first node to be monitored in the V2X network. The V2X network uses the log information acquisition step of acquiring the generated log information, the information selection step of selecting predetermined information from the acquired log information, and the selected predetermined information as learning data. A monitoring node that monitors one node, and performing a model creation step of executing machine learning for creating an anomaly detection model used for anomaly detection, the log information including time, and sensor data on the first node Or state information of the first node at the time indicated by at least one of the control data First abnormality information indicating the presence or absence of an abnormality on the first node at the time, and the presence or absence of an abnormality on a second node in the vicinity of the first node at the time and communicating with the first node (2) information associated with abnormality information is included, and in the information selection step, the predetermined information is selected based on the first abnormality information and the second abnormality information.

The embodiment described below shows one specific example of the present invention. Numerical values, shapes, components, steps, order of steps, and the like described in the following embodiments are merely examples, and are not intended to limit the present invention. Moreover, among the components in the following embodiments, components not described in the independent claims are described as optional components. Further, the contents of each of the embodiment and the modification can be combined as long as no contradiction occurs, and is included in the technical scope of the present invention.

Embodiment
[1. V2X Network Overview]
First, an overview of a V2X network to which the technology according to the present invention can be applied will be described. FIG. 1 is a diagram for describing an overview of a V2X network.

The nodes constituting the V2X network 1 include

vehicles

10A, 10B and 10C, a traffic light 30A, a vehicle speed measuring device 30B, a base station 40, and an abnormality monitoring server 50. In the following, the

vehicles

10A, 10B and 10C may be collectively referred to as the vehicle 10, collectively or referring to any one or more without distinction. In addition, the traffic signal 30A and the vehicle speed measuring device 30B may be collectively referred to as the roadside device 30 collectively or referring to one without distinction.

The vehicle 10 performs V2V communication between the vehicles 10 and V2I communication with the roadside device 30, and transmits and receives data using a predetermined message set such as BSM (Basic Safety Message). Further, the vehicle 10 is connected to a communication network 20 such as the Internet through the base station 40, and performs V2N communication with the abnormality monitoring server 50. From the vehicle 10 to the abnormality monitoring server 50, a log including communication data on the in-vehicle network system 100 included in the vehicle 10, for example, sensor data or contents indicated by control data is transmitted.

From the abnormality monitoring server 50 to the vehicle 10, data usable for abnormality detection in the in-vehicle network system 100, for example, an abnormality detection model used for abnormality detection executed on the vehicle is transmitted. In addition, this abnormality detection model is created by machine learning which used the log transmitted from each vehicle 10 as learning data. Also, in this example, data may be exchanged between the roadside device 30 and the abnormality monitoring server 50 as well. For example, from the roadside machine 30 to the abnormality monitoring server 50, communication data on the system of the roadside machine 30 is transmitted, and from the abnormality monitoring server 50 to the roadside machine 30, an abnormality detection model usable for abnormality detection by the roadside machine 30 is transmitted. Ru.

In the V2X network 1, the vehicle 10 is a target of monitoring by the abnormality monitoring server 50. More specifically, the abnormality monitoring server 50 executes abnormality detection due to a cyber attack or a failure on the data flowing through the V2X network 1 by the vehicle 10 and determines whether or not an abnormality has occurred in the vehicle 10. There is. The roadside device 30 is also a target of monitoring by the abnormality monitoring server 50, but has a function of monitoring other nodes in addition to its original function, that is, the function as a traffic light or a vehicle speed measuring device. Are targeted for monitoring. In the V2X network 1, it can be said that an abnormality monitoring system is constructed by a plurality of nodes having different roles in this manner.

[2. Node configuration]
Next, among the various nodes constituting the V2X network 1, the configurations of the vehicle 10, the roadside device 30, and the abnormality monitoring server 50 will be described.

[2-1. vehicle]
Each vehicle 10 includes an on-vehicle network system capable of V2X communication with other nodes as described above. FIG. 2 is a block diagram showing a configuration of an in-vehicle network system 100 provided in the vehicle 10A, which is an example of the in-vehicle network system provided in the vehicle 10.

The in-vehicle network system 100 is, for example, a system in which at least a part thereof is constructed and operated in accordance with a CAN (Controller Area Network) standard, and the external communication device 110 intervenes between the inside and the outside of the vehicle 10 and networks for each functional system. , And an information system network 130 and a control system network 140, which are networks for each of these functional systems. The information system network 130 and the control system network 140 are examples of functional system networks that may be included in the in-vehicle network system 100, and the present invention is not limited to these. Further, the technology according to the present invention is also applicable to a network system that has not been differentiated by functional line. The present invention is also applicable to a system on a network conforming to a standard other than CAN such as Ethernet (registered trademark) or a network system in which parts conforming to different standards such as CAN and Ethernet coexist.

The external communication device 110 is an interface that communicates with the

vehicles

10B and 10C, which are nodes other than the vehicle 10A in the V2X network 1, the roadside device 30 (not shown in FIG. 2) and the base station 40, and is used for V2X communication It is realized by a communication module corresponding to various communication standards.

The gateway 120 is realized by an ECU in which the above-described data relay function is implemented. Also, the gateway 120 functionally includes an abnormality determination device 125 described later that can be realized on this ECU.

The information system network 130 includes a bus line indicated by a double line and a plurality of

ECUs

131, 132 and 133 connected to the bus line, and the control system network 140 includes a bus line and a plurality of the bus lines connected to the bus line. The

ECUs

141, 142 and 143 of FIG. In each ECU, an apparatus (not shown) such as a sensor or an actuator is connected to an interface different from the interface connected to the bus line. Sensor data obtained by measurement with a sensor is used inside the ECU or output to a bus line for use in another ECU. The ECU to which the actuator is connected controls the actuator according to information indicated by such sensor data or according to control data acquired from another ECU via a bus line. Further, in the in-vehicle network system 100, such sensor data or control data is also received by the gateway 120, and becomes a target of abnormality determination by the abnormality determination device 125 included in the gateway 120. FIG. 3 is a block diagram showing a functional configuration example of the abnormality determination device 125. As shown in FIG.

The abnormality determination device 125 determines whether or not an abnormality has occurred in the in-vehicle network system 100 (abnormal determination). For the process of this abnormality determination, for example, a method based on either or both of a transmission pattern of data frame and data contents, a method using message authentication technology such as MAC (Message Authentication Code), the above-mentioned abnormality detection model Various methods such as the method to be used, or a combination of these may be used. A configuration example of the abnormality determination device 125 is shown in the block diagram of FIG.

The abnormality determination device 125 includes a data reception unit 1251, a log information acquisition unit 1252, a data transmission unit 1253, an accumulation unit 1254, and an abnormality determination unit 1255.

The data receiving unit 1251 receives sensor data or control data transmitted on the in-vehicle network system 100.

The log information acquisition unit 1252 associates the content of the data received by the data reception unit 1251 with the information of the reception time of the data acquired from the timer (not shown), and stores it in the storage unit 1254 as log information. An example of the data configuration of the log information accumulated in the accumulation unit 1254 in this way is shown in FIG. In the example shown in FIG. 4, in each row, the time acquired from the timer is associated with each other in the "time" column, and the content of the data received by the data receiving unit 1251 in the "in-vehicle status information" column. It is stored. The contents of data stored as log information include, for example, velocity and acceleration as shown in FIG. 4, but the present invention is not limited to these. For example, measured values measured by sensors included in the vehicle 10, such as yaw rate, shift position, steering angle, engine speed, accelerator opening degree, etc., determination value of determination performed based on the measured values, issued control instruction Various types of information may be stored as log information in chronological order. Further, in this example, positional information of the vehicle 10A at this time is further stored. Such position information may be provided from a reception module of a positioning system provided in, for example, a car navigation system or a smartphone connected to the in-vehicle network system 100.

The abnormality determination unit 1255 performs determination as to whether or not an abnormality has occurred on the in-vehicle network system 100 at the time indicated by the log information stored in the storage unit 1254. This abnormality determination may be performed by the various methods described above, using, for example, the contents of sensor data or control data included in the log information or other information on the in-vehicle network system 100. The abnormality determination unit 1255 adds the result of the abnormality determination to the corresponding log information. An example of data configuration of log information to which the result of such abnormality determination is added is shown in FIG. In the example shown in FIG. 5, the result of the abnormality determination in the vehicle 10A at the time included in the log information stored in each row is stored in the "in-vehicle abnormality determination" column. Further, in this example, when an abnormality has occurred as a result of the abnormality determination (refer to the line in which the value of the "in-vehicle abnormality determination" column is "abnormal"), the type of the abnormality occurrence location is the type of abnormality Are stored as the information of (refer to the column of "in-vehicle abnormality type"). Thus, the abnormality determination unit 1255 may acquire further detailed information on the generated abnormality and add it to the log information.

Further, the abnormality determination unit 1255 performs an abnormality determination based on the information acquired from the peripheral node by the V2V communication or the V2I communication, and further adds the result of the abnormality determination to the log information. An example of the data configuration of the log information to which the result of the abnormality determination of another node is added in this way is shown in FIG. In the example illustrated in FIG. 6, the result of the abnormality determination at the peripheral node of the vehicle 10A at the time included in the log information stored in each row is the column of “peripheral node abnormality determination” and each information of the same line. It is stored in association with it. Further, in this example, when an abnormality is generated as a result of the abnormality determination (refer to a line in which the value in the column of “peripheral node abnormality determination” is “abnormal”), the node in which the abnormality occurs or further Information indicating the location of occurrence of an abnormality in the node is further stored in association with the information of the type of the abnormality (refer to the column of “Peripheral node abnormality type”). However, the abnormality in the other nodes where the information is associated with the time here may be any as long as it occurs or is detected within a predetermined time (for example, within a few seconds to 1 minute) close to that time. Synchronization is not required. Further, as long as the temporal condition is satisfied, a plurality of pieces of information related to the abnormality determination of the peripheral node may be associated with the in-vehicle abnormality at one time. Abnormality determination of peripheral nodes will be described later.

In this specification, for convenience of explanation, not only the information on the in-vehicle state at a certain time as shown in FIG. 4 but also the self node or peripheral node added by the abnormality determination unit 1255 as in FIG. The log information including the information on the abnormality of the data may be referred to as the log. Further, in the V2X network, each vehicle 10 monitored by the abnormality monitoring server 50 is an example of the first node in the present embodiment, and a peripheral node communicating with the first node is the second node in the present embodiment An example of The second node may also be a monitoring target of the abnormality monitoring server 50.

Further, in FIG. 4 to FIG. 6, a group of information stored and associated in one line is hereinafter also referred to as a record. For example, in each record of the log shown in FIG. 6, the position of a certain node (for example, the vehicle 10A), the state of the relevant node derived from sensor data or control data, presence or absence of abnormality in the relevant node at a certain time If there is an abnormality, the type, and if there is an abnormality in the peripheral nodes of the node, the type is included.

The storage unit 1254 is a storage place of the data of the above log information.

The data transmission unit 1253 transmits the result of the abnormality determination on the in-vehicle network system 100 executed by the abnormality determination unit 1255 to the peripheral node by V2V communication or V2I communication via the external communication device 110, for example. The transmission of the result of the abnormality determination by the data transmission unit 1253 may be performed each time the determination is performed, or may be performed periodically. Also, only the result of the determination when an abnormality is detected may be transmitted. The information transmitted to the peripheral node includes at least the presence or absence of occurrence of abnormality, and may further include the type of abnormality, corresponding time, or an ID uniquely identifying the vehicle 10A. Further, the data transmission unit 1253 transmits the data of the log information accumulated in the accumulation unit 1254 to the abnormality monitoring server 50 by V2N communication via the external communication device 110. Thus, the log information provided from the vehicle 10 to the abnormality monitoring server 50 is used as machine learning learning data for creating an abnormality detection model used for abnormality determination in the abnormality monitoring server 50.

In such an abnormality determination device 125, in the example of the present embodiment, a predetermined program is executed by the processor of the microcontroller of the ECU realizing the gateway 120, data is read and written in the memory, and time information is acquired from the timer. This is realized by transmitting and receiving data from the input / output unit. In addition, the aspect of implementation of the abnormality determination apparatus 125 is not limited to this example, For example, you may be implement | achieved by one part other than the gateway connected to the vehicle-mounted network system 100, or part or whole of other apparatuses. Further, for example, the functions of the respective constituent elements of the above-described abnormality determination device 125 may be realized in a shared manner by a combination of a plurality of ECUs, a storage device, and the like on the in-vehicle network system 100.

Note that components (not shown) related to traveling as an automobile, such as a drive system that is a target of control by control system network 140, included in vehicle 10A have high relevance to the technology of abnormality monitoring according to the present embodiment. Description is omitted because there is no.

Further, the abnormality determination of the vehicle 10 which is the peripheral node will be further described.

Vehicles

10B and 10C can also each have an onboard network system capable of communication in V2X network 1 similarly to vehicle 10A. Then, for example, if the vehicle 10B includes the abnormality determination device 125 like the vehicle 10A, the vehicle 10A receives the result of the abnormality determination performed by the vehicle 10B, and the occurrence of the abnormality in the peripheral node based on the result. It can be determined whether it has been. Further, if the information received from the vehicle 10B further includes information related to the type of the generated abnormality, the vehicle 10A can make a determination regarding the type of the abnormality generated in the peripheral node based on this information. In any case, basically, it may be determined as the result shown in the received information.

However, the in-vehicle network systems of all the vehicles 10 connected to the V2X network 1 do not always function in the same manner as the in-vehicle network system 100 described above. For example, when the abnormality determination device 125 provided in the vehicle 10B as the vehicle 10A is broken, it is assumed that the in-vehicle network system of the vehicle 10C lacks the same function as the abnormality determination device 125. That is, the vehicle 10A can not receive the result of the abnormality determination from the vehicle 10B and the vehicle 10C. Information indicating the in-vehicle state not including the result of abnormality determination, such as information shown in each row of the list in FIG. 4 may be transmitted from the vehicle 10B and the vehicle 10C to peripheral nodes. In the vehicle 10A, which is a peripheral node having received this information, in the same manner as the abnormality determination unit 1255 determines the abnormality in the in-vehicle network system 100, the abnormality is determined based on the received information indicating the state of the vehicle 10B or the vehicle 10C. Determine if there is an occurrence. Further, the determination on the type of abnormality occurring in the peripheral node may be further performed.

In addition to the above, there is also a route for acquiring information related to an abnormality of the vehicle 10 which is a peripheral node from the roadside device 30, which will be described later.

In any of the patterns, in the in-vehicle network system having a function equivalent to the abnormality determination device 125, the abnormality determination unit 1255 acquires information on the state of the vehicle and determines the presence or absence of an abnormality, and the presence or absence of an abnormality in peripheral nodes. For example, the determination of is periodically performed periodically to generate data of log information having a configuration as shown in FIG. Further, this data is transmitted by the data transmission unit 1253 to the abnormality monitoring server 50.

[2-2. Roadside machine]
As described above, each roadside device 30 naturally has a function as a vehicle speed measuring device or the like as the traffic light 30A of the roadside device 30 and the vehicle speed measuring device 30B in the example of FIG. However, the roadside device 30 in the present embodiment further has a function as a monitoring node that monitors other nodes, and targets the vehicle 10 for monitoring. The configuration of the roadside device 30 for implementing the function of monitoring other nodes will be described below.

FIG. 7 is a block diagram showing a configuration example of the roadside device 30 in the V2X network 1. The roadside device 30 includes a data reception unit 31, a data transmission unit 33, an accumulation unit 34, and an abnormality determination unit 35.

The data receiving unit 31 and the data transmitting unit 33 are interfaces for communicating with the vehicle 10 and the abnormality monitoring server 50 which are nodes other than the roadside device 30 in the V2X network 1, and are used for various types of V2X communication. It is realized by a communication module corresponding to the communication standard. The storage unit 34 is a storage device of the information processing system included in the roadside device 30, and the abnormality determination unit 35 is realized by the processor of the information processing apparatus executing a predetermined program.

The data receiving unit 31 acquires, for example, an abnormality detection model used for abnormality detection from the abnormality monitoring server 50 via the communication network 20. Further, the data receiving unit 31 receives data of log information from the vehicle 10. Here, the data of the log information transmitted from the vehicle 10 can have the data configuration shown in any of FIGS. 4 to 6 depending on the situation of the vehicle 10.

The abnormality determination unit 35 uses this abnormality detection model to perform abnormality determination of the vehicle 10 based on the log information. This abnormality determination by the abnormality determination unit 35 corresponds to the abnormality determination of the other node by the abnormality determination unit 1255 of the abnormality determination device 125 in the vehicle 10. The abnormality determination unit 35 also executes an abnormality determination corresponding to the abnormality determination of the own node by the abnormality determination unit 1255, that is, performs an abnormality determination of the system in the roadside machine 30.

The data of the abnormality detection model and the log information received by the data receiving unit 31 and the log information to which the information about abnormality determination of the own node or another node is added by the abnormality determining unit 35 are accumulated in the accumulation unit 34.

Further, the information related to the abnormality determination is transmitted to the vehicle 10 by the data transmission unit 33. Here, the vehicle 10 that acquires information on abnormality determination from the roadside device 30 is not limited to the vehicle 10 that is a transmission source of the above log information, for example, and the vehicle 10 that is a peripheral node thereof is also received You may get it.

That is, the determination of the presence or absence of the occurrence of the abnormality based on the information indicating the state of each vehicle 10 may be performed by the other vehicle 10 or the roadside device 30 which is the own node or a peripheral node. In addition, each vehicle 10 is a roadside device 30 that is a third-party peripheral node, based on the determination result or the state information acquired from the peripheral node, as a result of the abnormality determination on another vehicle 10 that is a peripheral node. It acquires based on the judgment result acquired from.

In the V2X network 1, a model for abnormality detection is created by machine learning using log information indicating in chronological order the state of each vehicle collected from the vehicles 10 that are nodes to be monitored. Here, the result of the state of the vehicle 10 or the abnormality determination at each point in time, which is included in each record of the log, may be influenced by the information on the peripheral node in which the abnormality has occurred. Then, by using the record under the influence and the record under the influence separately as learning data, it is possible to obtain an abnormality detection model that enables abnormality determination with higher accuracy. In log information assumed conventionally, the presence or absence of an abnormality at a peripheral node is determined based on the time and position indicated by the log information collected from each node at the time of selection of learning data to be used. However, with such a method, the processing load of the information processing apparatus that selects learning data from a large amount of collected logs is large, and the accuracy of the determination of the occurrence of an abnormality at peripheral nodes is also uncertain. Then, by making the vehicle 10 acquire the determination result of the presence or absence of abnormality of the peripheral node through various routes by the actual place and time when the log information is acquired by the vehicle 10 as described above, and append it to the log information With regard to the abnormality of the peripheral node, more accurate information can be associated with the log information than the judgment by the abnormality monitoring server 50, and the load of the process of selecting learning data from the collected log can be suppressed.

Note that, ideally, if all the logs collected from the vehicle 10 are data in a format as shown in FIG. 6, the load on the information processing apparatus that selects learning data is greatly reduced. However, it is a transitional phase in which the vehicle 10 providing a log to which information on the presence or absence of abnormality of the own node or further the peripheral node is added is in the process of being spread by the method as described above. Even when the format log is mixed, the type of log shown in FIG. 6 becomes a clue and the load of selecting learning data in the information processing apparatus can be reduced.

Thus, although the information processing apparatus for selecting learning data may be dedicated to this selection processing, in the example of the present embodiment, from the collection of logs, the abnormality monitoring server 50 selects learning data and creates an abnormality detection model. , And monitoring by abnormality determination using an abnormality detection model. Next, the configuration of the abnormality monitoring server 50 will be described.

[2-3. Abnormality monitoring server]
FIG. 8 is a block diagram showing a configuration example of the abnormality monitoring server 50 in the V2X network 1.

The abnormality monitoring server 50 includes a data reception unit 51, a learning data selection unit 52, a learning unit 53, an accumulation unit 54, and an abnormality determination unit 55.

The data receiving unit 51 receives data from each node to be monitored via the V2X network 1.

The learning data selection unit 52 selects one to be used as learning data from the received log. For example, only records in which both the inside of the vehicle and peripheral nodes are determined to be "normal" are selected as learning data for creating a normal model.

The learning unit 53 executes learning using the learning data selected by the learning data selection unit 52 to create an abnormality detection model.

The accumulation unit 54 stores the log received by the data reception unit 51 and the abnormality detection model created by the learning unit 53.

The abnormality determination unit 55 reads out the abnormality detection model stored in the storage unit 54, and performs abnormality detection / determination (also referred to simply as abnormality determination in this specification) using the abnormality detection model. There are two types of abnormality determination in accordance with the purpose. First, when a log not including the result of abnormality determination as shown in FIG. 4 is received from a node to be monitored, a determination that can be used to select learning data for creating an abnormality detection model for this log The purpose is to obtain the result of The other one is abnormality determination executed for the purpose of monitoring the V2X network 1 with respect to various data transmitted from the monitoring target node.

Although omitted in FIG. 8, the abnormality monitoring server 50 further includes a transmitting unit, and the generated abnormality detection model is transmitted from the transmitting unit to each node that performs abnormality determination on the own node or the peripheral node as described above. May be

Such an abnormality monitoring server 50 is realized by one or more computers including a communication module, a storage device, and a processing unit (processor) that executes a predetermined program. When realized by a plurality of computers, they may cooperate in one place, or may be remote from each other and exchange data via communication networks such as the Internet to cooperate. Good.

The procedure of the process executed in the abnormality monitoring server 50 will be described later.

[3. Processing at Monitoring Target Node and Data Flow in V2X Network]
Next, the processing procedure and data flow in the node to be monitored of the V2X network 1 will be described with reference to the conventional case.

3-1. When the vehicle does not handle the judgment about abnormality of other nodes]
FIG. 9 is a sequence diagram showing an example of a procedure concerning uploading of data from the vehicle 10A which is a monitoring target node to the abnormality monitoring server 50. As shown in FIG. In this example, it is assumed that the vehicle 10A does not execute the abnormality determination on the peripheral nodes because there is no functional reason or a communicable peripheral node.

In the vehicle 10A, the log information acquisition unit 1252 receives data that each ECU sends to the bus in the in-vehicle network system 100, and acquires log information indicating the in-vehicle state (S111). The log information indicating the in-vehicle state of the vehicle 10A acquired here is hereinafter referred to as first log information in order to distinguish it from other log information. The log information in the data configuration example shown in FIG. 4 can be said to be log information at this stage.

Next, the abnormality determination unit 1255 performs abnormality determination on the in-vehicle state of the vehicle 10A (S113). The determination result is added to the first log information. The log information in the data configuration example shown in FIG. 5 can be said to be log information at this stage. In this example, when an abnormality is detected and it is determined that an abnormality has occurred in the vehicle, the abnormality determination unit 1255 further specifies the occurrence place as the type of the abnormality, and adds the result to the first log information. Hereinafter, the result of this determination regarding the abnormality in the vehicle 10A will be referred to as a first determination result in order to distinguish it from the results of other determinations. However, the first determination result may include at least the determination result regarding the presence or absence of occurrence of an abnormality, and the information regarding the type of the abnormality is not essential. Thus, the data (log) uploaded to the abnormality monitoring server 50 of the content in which the first determination result is added to the first log information is generated by the abnormality determination unit 1255 (S115). The data generated in step S115 is transmitted by the data transmission unit 1253 to the abnormality monitoring server 50 (S119).

In the abnormality monitoring server 50 that has received the data of the log information generated in this way in the vehicle 10A which is a node to be monitored, the learning data selection unit 52 determines the time and position of the vehicle 10A included in each record of the data. Based on the above information, a large number of logs received from other nodes are searched for nodes in which an abnormality that may have affected the state of the vehicle 10A has occurred. The learning data selection unit 52 distinguishes the record when it is affected by the abnormality of the peripheral node for each record of the log by this search and the record when it is not so, and selects according to the application (S511). In addition, the load of the process in the abnormality monitoring server 50 from such a search to selection is large. And in the conventional abnormality monitoring server 50 which collected only the data which does not contain the information of the peripheral node as shown in FIG. 4, it may happen that this process is executed for all the records of the received log.

[3-2. When Each Vehicle Collects Judgment Results on Abnormalities at Surrounding Nodes]
FIG. 10 is a sequence diagram showing an example of a procedure regarding uploading of data from the vehicle 10A which is a monitoring target node to the abnormality monitoring server 50. As shown in FIG. In this example, it is assumed that the vehicle 10B, which is a peripheral node of the vehicle 10A, includes an abnormality determination device corresponding to the abnormality determination device 125 shown in FIG. 3 in the in-vehicle network system. And the point from which the vehicle 10A acquires the determination result of the abnormality in the vehicle 10B from the vehicle 10B differs from the example shown in FIG.

In the vehicle 10A, log information acquisition and (S111A) and abnormality determination (S113A) executed by the log information acquisition unit 1252 correspond to steps S111 and S113 of the processing procedure shown in FIG. 9, respectively. At the stage up to this point, the storage unit 1254 stores the first log information of the configuration to which the determination result (first determination result) is added as shown in FIG.

In the vehicle 10B, acquisition (S111B) of log information corresponding to step S111A in the vehicle 10A is performed. The log information indicating the acquired in-vehicle state of the vehicle 10B is hereinafter referred to as second log information in distinction from the above-described first log information. The data configuration example shown in FIG. 4 is also a data configuration example of the second log information.

Next, in the vehicle 10B, in-vehicle abnormality determination (S113B) corresponding to step S113A in the vehicle 10A is executed. The result of this determination regarding the abnormality in the vehicle 10B is distinguished from the first determination result and is hereinafter referred to as a second determination result. Similarly to the first determination result, the second determination result may include at least the determination result regarding the presence or absence of occurrence of abnormality, and may further include information regarding the type of abnormality.

Next, the second determination result is transmitted from the vehicle 10B to the vehicle 10A (S119B). In the vehicle 10A in which the data reception unit 1251 receives the second determination result, the abnormality determination unit 1255 adds a second determination result to the first log information, and the first log information includes the first determination result and the second determination result. Data (log) to be uploaded to the abnormality monitoring server 50 of the added content is generated (S115A). This data is data of the configuration as shown in FIG. That is, the in-vehicle state information and the result of the in-vehicle abnormality determination of the vehicle 10A which is the own node, and the result of the abnormality determination of the vehicle 10B which is the peripheral node are data that are mutually associated and included. The data generated in step S115A is transmitted by the data transmission unit 1253 to the abnormality monitoring server 50 (S119A).

FIG. 11 is a flow chart showing an example of the procedure of processing by the abnormality determination device 125 of the vehicle 10A described in this example. In the abnormality determination device 125, the data reception unit 1251 acquires log information (first log information in FIG. 10) from the data flowing through the in-vehicle network system 100 (S11). When the log information is acquired, the abnormality determination unit 1255 executes the abnormality determination based on the abnormality detection in the vehicle 10A at the time when the log information is acquired (S12). The result of the abnormality determination (the first determination result in FIG. 10) is added to the log information so as to correspond to the log information, and is stored, for example, in the same record (S13). Next, the abnormality determination unit 1255 determines whether the result of the abnormality determination (second determination result in FIG. 10) is received from the peripheral node within a predetermined time (S14). If received (YES at S14), data to which the abnormality determination unit 1255 further adds the second determination result (S18), and if not received (NO at S14), the second determination result is added The data transmission unit 1253 uploads the not-yet-logged first log information to the abnormality monitoring server 50 (S19). In the vehicle 10A, a series of procedures shown in FIG. 11 are repeatedly executed, for example, in a fixed cycle.

Referring again to FIG. 10, in the abnormality monitoring server 50 that has received the data of the log information generated in this way in the vehicle 10A which is the node to be monitored, the learning data selection unit 52 is included in each record of the data. Based on the information of the result of the abnormality determination of the peripheral node of the vehicle 10A, the record when it is affected by the abnormality of the peripheral node and the record when it is not so are distinguished and selected according to the application (S511). As a result, in the abnormality monitoring server 50, selection of learning data is performed with a small processing load as compared with the example shown in FIG. 9, and more accurate information regarding the presence or absence of an abnormality in peripheral nodes can be obtained.

In the example of FIG. 10, although the result of the abnormality determination is transmitted from the vehicle 10B to the vehicle 10A and the log is uploaded from the vehicle 10A to the abnormality monitoring server 50, the abnormality in the vehicle 10A from the vehicle 10A to the vehicle 10B The result of the determination may be transmitted, and a log having a configuration as shown in FIG. 6 may also be uploaded from the vehicle 10B to the abnormality monitoring server 50. As described above, logs are collected from many vehicles connected to the V2X network 1 in the abnormality monitoring server 50, and learning data selected from the logs is used to create an abnormality detection model by the abnormality monitoring server 50. . The processing procedure of creation of the anomaly detection model will be described later.

Further, in the example of FIG. 10, the vehicle 10A receives the result of the abnormality determination only from the vehicle 10B, but in fact, the result of the abnormality determination is collected from the vehicles which are a plurality of peripheral nodes capable of V2V communication. obtain. Further, among the results of the abnormality determination received from the plurality of peripheral nodes, one to be added to the first log information may be selected by, for example, the abnormality determination unit 1255.

[3-3. When abnormality determination in other nodes is executed in the vehicle]
FIG. 12 is a sequence diagram showing another example of the procedure related to uploading of data from the vehicle 10A which is a monitoring target node to the abnormality monitoring server 50. As shown in FIG. In this example, in the vehicle 10B which is a peripheral node of the vehicle 10A, there are some in-vehicle network systems corresponding to the data reception unit 1251 and the log information acquisition unit 1252 of the abnormality determination device 125, and the information indicating the in-vehicle state is Although it is acquired, it is assumed that the abnormality determination is not performed because the abnormality determination unit 1255 is missing or malfunctioning. And what vehicle 10A acquires from vehicle 10B differs in the point which acquires the information which shows not the determination result of abnormality in vehicle 10B but the in-vehicle state of vehicle 10B from the example shown in FIG.

In the vehicle 10A, log information acquisition and (S111A) and abnormality determination (S113A) executed by the log information acquisition unit 1252 are processing procedures common to those shown in FIG. At the stage up to this point, the storage unit 1254 stores the first log information of the configuration to which the determination result (first determination result) is added as shown in FIG.

Also, acquisition of log information (S111B) performed by the vehicle 10B is processing common to that shown in the example of FIG. The acquired log information indicating the in-vehicle state of the vehicle 10B is hereinafter referred to as second log information as in the example of FIG.

Next, second log information is transmitted from the vehicle 10B to the vehicle 10A (S117B). In the vehicle 10A that has received the second log information, the abnormality determination unit 1255 executes an abnormality determination in the vehicle of the vehicle 10B based on the second log information (S113B). The result of this determination regarding the abnormality in the vehicle 10B is hereinafter referred to as a second determination result as in the example of FIG.

Next, in the vehicle 10A, the abnormality determination unit 1255 generates data (log) to be uploaded to the abnormality monitoring server 50 in the content in which the first determination result and the second determination result are added to the first log information ( S115A). In the example of FIG. 10, this data is the same as the log generated in step S115A, including the in-vehicle state information and the result of the in-vehicle abnormality determination of the vehicle 10A as the own node, and the result of the abnormality determination of the vehicle 10B as the peripheral node. , And are data associated with each other. The data generated in step S115A is transmitted by the data transmission unit 1253 to the abnormality monitoring server 50 (S119A).

FIG. 13 is a flow chart showing an example of the procedure of processing by the abnormality determination device 125 of the vehicle 10A described in this example. The procedure shown in the flowchart of FIG. 11 is the determination (step S15) as to whether or not the in-vehicle state information is received from the vehicle 10B, which is performed when the determination result is not received from the peripheral node (NO in S14). When the in-vehicle state information is received (YES in step S15), the present embodiment is different from the first embodiment in that it includes the determination (step S16) regarding the presence or absence of an abnormality in the vehicle 10B. In the vehicle 10A, a series of procedures shown in FIG. 13 are repeatedly executed, for example, in a fixed cycle.

Referring again to FIG. 12, in the abnormality monitoring server 50 that has received data from the vehicle 10A, selection of learning data by the learning data selection unit 52 (S511) is executed. As a result, in the abnormality monitoring server 50, selection of learning data is performed with a small processing load as compared with the example shown in FIG. 9, and more accurate information regarding the presence or absence of an abnormality in peripheral nodes can be obtained. In addition, it is possible to cope with the case where there is a vehicle which can not perform the abnormality determination based on the state information on the own node.

In the example of FIG. 10 or FIG. 12, although the peripheral node to which the vehicle 10A adds the result of abnormality determination to the first log information is the vehicle 10B, the peripheral node is not limited to the vehicle 10. It may be the result of the abnormality judgment of In the example of FIG. 10, the vehicle 10A may be provided with the result of the abnormality determination performed by the roadside device 30 as performed by the vehicle 10B, and may add the result of the determination to the first log information. Further, in the example of FIG. 12, the vehicle 10A receives the information indicating the internal state of the roadside device 30 as the information indicating the internal state of the vehicle 10B is received from the vehicle 10B, and the roadside executed based on this information. The result of the determination of the presence or absence of an abnormality of the machine 30 may be added to the first log information. FIG. 14 is a sequence diagram showing another example of the procedure relating to the uploading of data from the vehicle 10A to the abnormality monitoring server 50 in the latter case. In the example shown in FIG. 14, the roadside machine state information corresponding to the second log information of the vehicle 10B is transmitted from the roadside machine 30 to the vehicle 10A (S137), and the vehicle 10A is based on the roadside machine state information. (S133), the data transmitted to the abnormality monitoring server 50 is the first judgment result in the first log information and the second judgment result on the vehicle 10B. The third embodiment differs from the second embodiment in that the third determination result relating to the roadside device 30 is added.

[3-4. When an anomaly judgment result performed between peripheral nodes is collected]
FIG. 15 is a sequence diagram showing still another example of the procedure related to uploading of data from the vehicle 10A which is a monitoring target node to the abnormality monitoring server 50. As shown in FIG. In this example, in the same manner as the example shown in FIG. 12, it is assumed that no abnormality determination is performed in the vehicle 10B which is a peripheral node of the vehicle 10A, because the abnormality determination unit 1255 is missing or broken. There is. However, it is not the vehicle 10A but the roadside device 30 that performs the abnormality determination based on the state information of the vehicle 10B, and the example shown in FIG. 12 shows that the result of the determination is provided from the roadside device 30 to the vehicle 10A. It is different.

Also, acquisition of log information (S111B) performed by the vehicle 10B is processing common to that shown in the examples of FIGS. 10 and 12. The acquired log information indicating the in-vehicle state of the vehicle 10B is hereinafter referred to as second log information as in the above example.

Next, second log information is transmitted from the vehicle 10B to the roadside device 30 (S117B). The roadside device 30 in this example has a function corresponding to the abnormality determination unit 1255 of the vehicle 10A, and when receiving the second log information, based on the second log information corresponding to step S113B in the vehicle 10A shown in the example of FIG. The abnormality determination in the vehicle of the vehicle 10B is executed (S133B). The result of this determination regarding the abnormality in the vehicle 10B is hereinafter referred to as a second determination result as in the examples of FIGS. 10 and 12.

Next, the second determination result is transmitted from the roadside device 30 to the vehicle 10A (S139B). In the vehicle 10A in which the data reception unit 1251 receives the second determination result, the abnormality determination unit 1255 adds a second determination result to the first log information as in the example of FIG. Data (log) to be uploaded to the abnormality monitoring server 50 is generated in the content to which the determination result and the second determination result are added (S115A). This data is the example of FIG. 10 and FIG. 12, same as the log generated in step S115A, the in-vehicle state information and the result of the in-vehicle abnormality determination of the vehicle 10A as the own node, and the abnormality determination of the vehicle 10B as the peripheral node The result of is data included in association with each other. The data generated in step S115A is transmitted by the data transmission unit 1253 to the abnormality monitoring server 50 (S119A).

A procedure example of processing by the abnormality determination device 125 of the vehicle 10A in this example is shown by the flow chart of FIG. 11 or FIG. 13 although the transmission source of the second determination result is different.

Referring again to FIG. 15, in the abnormality monitoring server 50 that has received data from the vehicle 10A, selection of learning data by the learning data selection unit 52 (S511) is executed. As a result, in the abnormality monitoring server 50, selection of learning data is performed with a small processing load as compared with the example shown in FIG. 9, and more accurate information regarding the presence or absence of an abnormality in peripheral nodes can be obtained. In addition, it is possible to cope with the case where there is a vehicle which can not perform the abnormality determination based on the state information on the own node.

In addition, in the example of FIG. 15, although the transmission destination of the result of the abnormality determination about the vehicle 10B from the roadside machine 30 is shown only to the vehicle 10A, it is not limited to this. For example, the vehicle 10B may be included in the transmission destination from the roadside device 30. For example, the roadside device 30 may transmit the result of the abnormality determination for the vehicle 10B to all the vehicles in the range in which communication can be performed by V2I communication.

[3-5. Remarks]
In the above 3-2 to 3-4, the vehicle 10A, which is a node to be monitored, has information indicating the state in the car at a certain time, and the type and surroundings when abnormality is detected as a result of the in-car abnormality determination. If the result of the node abnormality judgment and the abnormality are detected, the type of information is further acquired, and variations of the processing procedure and data exchange between the nodes until the data associated with these are transmitted to the abnormality monitoring server 50 Indicated. However, these variations are only examples and are not limitative, and the contents and routes of data that can be exchanged in the V2X network 1, and variations including various processing procedures that can be executed in each node are also the present invention. The technical scope of

For example, as described above, the roadside device 30 may function as a monitoring node monitoring each vehicle 10, and the roadside device 30 serving as the monitoring node may obtain information about the in-vehicle condition information or the in-vehicle abnormality determination from each vehicle 10 within the communication range. May be collected and the collected information may be transmitted to each vehicle 10 within the communication range. That is, the information about the abnormality in each vehicle may be acquired from the vehicle 10 in the communication area by the V2I communication, and the information may be shared by each vehicle. Under the present circumstances, when in-vehicle state information is received, the roadside machine 30 may perform abnormality determination based on this in-vehicle state information, and when the result and abnormality are detected, the type information may be transmitted. . In addition, the monitoring node may provide the acquired information to the abnormality monitoring server 50 via the communication network 20.

Not only the presence or absence of an abnormality of a certain vehicle may be transmitted to another vehicle via the roadside device 30, but the presence or absence of an abnormality of a certain roadside device 30 may be shared by communication between vehicles.

Also, various data may be transmitted from the roadside device 30 via the communication network 20.

Further, in the description of 3-2 to 3-4 above, it can be interpreted that transmission of data between nodes such as the vehicle 10B to the vehicle 10A is executed by specifying one partner. It is not limited to such a communication form. Transmission and reception of data between nodes can be performed in various communication modes that can be performed in V2V communication or V2I communication. For example, the transmission destination may be all nodes existing in the communicable area, and a particular group among those nodes, for example, a manufacturer of a vehicle, a type of in-vehicle network system (eg, a manufacturer, a compliant standard) Limited based on version etc.), type of node (eg: vehicle or roadside machine), etc., or conditions different between groups (eg, vehicle manufacturer, all roadside machines) may be applied .

[4. Processing on Abnormality Monitoring Server]
Next, a processing procedure in the abnormality monitoring server 50 that monitors the occurrence of an abnormality in the vehicle 10 or further the roadside device 30 in the V2X network 1 will be described. As described above, the abnormality monitoring server 50 performs collection of logs, selection of learning data, creation of an abnormality detection model, and abnormality monitoring using an abnormality detection model. However, since collection of logs is to receive the log transmitted in the process of the above-mentioned monitoring target node, the description thereof is omitted, and hereinafter, other processes will be described.

[4-1. Abnormality judgment]
First, the processing procedure of the abnormality determination using the abnormality detection model will be described. FIG. 16 is a flow chart showing an example of the procedure of the abnormality determination aiming at acquiring the result of the determination usable for the selection of the learning data among the two types of abnormality determinations by the above-mentioned abnormality monitoring server 50. .

In the abnormality monitoring server 50 connected to the V2X network 1, the data receiving unit 51 receives the log transmitted from each node to be monitored (S21).

Next, the abnormality determination unit 55 reads the abnormality detection model from the storage unit 54 (S22), and uses the abnormality detection model for each record in the log having the configuration as shown in FIG. 4 received. Perform anomaly detection. If an abnormality is detected, the abnormality determination unit 55 determines that an abnormality has occurred in the node that is the transmission source of this log. If no abnormality is detected, the abnormality determination unit 55 determines that no abnormality has occurred in the node that is the transmission source of this data. The result of the determination regarding the presence or absence of occurrence of abnormality is output from the abnormality determination unit 55 (S24). More specifically, the output of the result is, for example, data obtained by adding the determination result to the log of FIG. 4, that is, storage in the storage unit 34 as a log of the state shown in FIG. Also, as the output of the result, the determination result may be transmitted to the node that is the transmission source of the determined data.

Note that the determination of abnormality in step S23 may be only determination regarding the presence or absence of occurrence of abnormality, and when an abnormality is detected, more detailed determination regarding the abnormality such as the type according to the occurrence place is included. It is also good. When an abnormality is detected, the determination result output in step S24 may also include a more detailed determination result regarding the abnormality.

FIG. 17 is a flow chart showing an example of the procedure of the abnormality determination as the object of monitoring of the V2X network 1 among the two types of abnormality determinations by the abnormality monitoring server 50 described above.

In the abnormality monitoring server 50 connected to the V2X network 1, the data receiving unit 51 receives data transmitted from each node to be monitored (S31).

Next, the abnormality determination unit 55 reads an abnormality detection model from the storage unit 54 (S32), and performs abnormality detection on the received data using the abnormality detection model. If an abnormality is detected, the abnormality determination unit 55 determines that an abnormality has occurred in the node that is the transmission source of the log (YES in step S34), and further notifies the V2X network 1 of the generation of the abnormality. The target of notification may be all the nodes in the V2X network 1 or may be selected and sent a node having a predetermined relationship with the node that has generated abnormal data. The predetermined relevance means, for example, the type of node (e.g. vehicle or roadside machine), the manufacturer of the vehicle or roadside machine, the type of control system of the in-vehicle network system or roadside machine (e.g. manufacturer, version of compliant standard etc.) Relevance based on etc. Such relevancy may be acquired based on, for example, information contained in a log collected from each node to be monitored, or may be separately collected and shown in data available to the abnormality monitoring server 50. It may be.

If there is no detected abnormality, the abnormality determination unit 55 determines that no abnormality has occurred in the node that is the transmission source of this log (NO in step S34), and ends the abnormality determination process.

Also in the case of the abnormality determination which is the object of monitoring of the V2X network 1, the result of the abnormality determination may be stored in the storage unit 54 of the abnormality monitoring server 50.

The process shown in the flowchart of FIG. 17 is not limited to the abnormality monitoring server 50, and if there is a roadside machine 30 or vehicle 10 further functioning as a monitoring node in the V2X network 1, the abnormality determination unit 35 or abnormality of these nodes It may also be executed by the determination unit 1255.

[4-2. Selection of learning data and creation of anomaly detection model]
Next, a procedure of processing of creating an abnormality detection model including selection of learning data will be described. FIG. 18 is a flow chart showing an example of a procedure of processing of creating an anomaly detection model in the anomaly monitoring server 50. As shown in FIG.

First, the learning data selection unit 52 reads the log stored in the storage unit 54 (S41).

Next, the learning data selection unit 52 selects a record after having the abnormality determination unit 55 execute a predetermined process on the read log as necessary (S42). The contents of the process differ depending on the state and application of the read log, and the details will be described later.

Next, the learning unit 53 executes learning using the learning data selected by the learning data selection unit 52 (S43), and stores the abnormality detection model created as a result in the storage unit 54 (S44). The anomaly detection model created (including the case of update) in this manner is used for anomaly determination in the anomaly monitoring server 50 as described above, and transmitted to each node on the V2X network 1 that performs anomaly determination. Be done.

Here, the details of step S42 by the learning data selection unit 52 will be described.

FIG. 19 is a flow chart showing an example of the procedure for selecting learning data in the abnormality monitoring server 50. In this example, the data received by the abnormality monitoring server 50 is configured as shown in FIG. 4 and includes information indicating time, position, and in-vehicle state, but does not include any information related to the abnormality, and information on peripheral nodes Not included. When the log read from the storage unit 54 has such a configuration, the learning data selection unit 52 causes the abnormality determination unit 55 to perform abnormality determination based on the information on the in-vehicle state included in the record (S51). If there is an abnormality (YES in S52), the learning data selection unit 52 selects this record as data to be used for supervised learning in the next learning by the learning unit 53 (S57). The supervised learning will be described later.

If there is no abnormality (NO in S52), the learning data selection unit 52 uses the time information and the position information included in this record and exists around the node that is the transmission source of this log when this record is generated. The records of other nodes which have been searched are searched from the data of the acquired peripheral nodes (S53). Next, the learning data selection unit 52 acquires the result of the abnormality determination based on the information by a method according to the information included in the record of the peripheral node acquired as the search result. That is, when the information of the peripheral node includes the result of the abnormality determination, the result is acquired, and when not included, the abnormality determination unit 55 is made to execute the abnormality determination and the result is acquired (S54).

Next, when there is an abnormality in the peripheral node acquired as the search result (YES in S55), the learning data selection unit 52 selects this record as data to be used for supervised learning in the next learning by the learning unit 53. (S57). If there is no abnormality (NO in S55), this record is selected as data to be used for creating a normal model in the next learning by the learning unit 53 (S56).

FIG. 20 is a flowchart showing another example of the procedure of the process of selecting learning data in the abnormality monitoring server 50. In this example, the data received by the abnormality monitoring server 50 is configured as shown in FIG. 5 and includes information indicating time, position, and in-vehicle state, and information on in-vehicle abnormality, but information on peripheral nodes is Not included. When the log read from the storage unit 54 has such a configuration, the learning data selection unit 52 reads the result of the in-vehicle abnormality determination included in the record (S61). If there is an abnormality (YES in S62), the learning data selection unit 52 selects this record as data to be used for supervised learning in the next learning by the learning unit 53 (S67).

The process when there is no abnormality is the same as the procedure from step S52 to step S56 or S57 shown in FIG. That is, when there is no abnormality (NO in S62), the learning data selection unit 52 searches the records of other nodes from the data of the acquired peripheral nodes using the time information and the position information included in this record ( S63). Next, the learning data selection unit 52 acquires the result of the abnormality determination based on the information by a method according to the information included in the record of the peripheral node acquired as the search result (S64).

Next, when there is an abnormality in the peripheral node acquired as a search result (YES in S65), the learning data selection unit 52 selects this record as data used for supervised learning in the next learning by the learning unit 53 ( S67). If there is no abnormality (NO in S65), this record is selected as data used for creating a normal model in the next learning by the learning unit 53 (S66).

FIG. 21 is a flowchart showing still another example of the procedure of the process of selecting learning data in the abnormality monitoring server 50. In this example, the data received by the abnormality monitoring server 50 has the configuration shown in FIG. 6 and includes information indicating time, position, and in-vehicle state, information on an abnormality in the vehicle, and information on an abnormality of peripheral nodes. When the log read from the storage unit 54 has such a configuration, the learning data selection unit 52 reads out the result of the in-vehicle abnormality determination included in the record (S71). If there is an abnormality (YES in S72), the learning data selection unit 52 selects this record as data used for supervised learning in the next learning by the learning unit 53 (S76).

If there is no abnormality (NO in S72), the learning data selection unit 52 reads out the result of the abnormality determination on the peripheral nodes included in the record (S73). If there is an abnormality (YES in S74), the learning data selection unit 52 selects this record as data to be used for supervised learning in the next learning by the learning unit 53 (S76). If there is no abnormality (NO in S74), this record is selected as data used for creating a normal model in the next learning by the learning unit 53 (S75).

Here, supervised learning in the present embodiment will be described. In supervised learning, a large amount of data (record) known to be in the vehicle state when an abnormality occurs in the vehicle or in the peripheral nodes is given to the learning unit 53. The learning unit 53 extracts features from this data, and based on the features, classifies when an abnormality occurs and when it is normal, that is, creates a model for abnormality detection. In addition, if the abnormality can be classified into, for example, types according to the type of node that has occurred, the type of the node, or the like, learning data for supervised learning can be acquired for one category that is the result of classification. By making the learning unit 53 learn using this learning data, an anomaly detection model is created to identify whether the information of the state of a certain type of node or a certain place of a certain kind of node is abnormal. Be done. A more specific example of using learning data according to the abnormality detection model to be created will be described. FIG. 22, FIG. 23A and FIG. 23B are flowcharts showing an example of a procedure of selection processing of supervised learning data in the abnormality monitoring server 50.

Referring to FIG. 22, first, in the learning data selection unit 52, whether the abnormality of the record having the collected log is an abnormality that occurred in the vehicle 10 which is the transmission source of the log, a peripheral node of the vehicle 10, here the roadside machine It is determined whether there are 30 abnormalities (S81). If there is an abnormality in the roadside device 30 (YES from S81 to S82), the learning data selection unit 52 further selects data as supervised learning according to the type of the abnormality in the roadside device 30 (S91A). In the example of FIG. 23A, the type of anomaly of the roadside device 30 is either ETC gate anomaly (S92A), traffic signal anomaly (S93A), or road beacon anomaly (S94A), depending on each anomaly. It is selected as supervised learning data. If the vehicle 10 is abnormal (NO in S81 to S83), the learning data selection unit 52 further selects data as supervised learning according to the type of abnormality in the vehicle 10 (S91A). In the example of FIG. 23B, the type of abnormality of the vehicle 10 is abnormality in the Ethernet portion of the in-vehicle network system 100 (S92B), abnormality in CAN (S93B), or abnormality in the IVI (In-Vehicle Infotainment system) portion. According to which of (S94B), supervised learning data corresponding to each abnormality is selected. Such selection is performed with reference to the information on the abnormality type of the peripheral node included in the log. In addition, the classification of the abnormality mentioned above is an example, It is not limited to these. For example, as the type of abnormality of the peripheral node, it may be very easily shown whether it is a peripheral vehicle or a roadside machine.

[5. Effect etc]
Thus, in the present embodiment, when a log of information indicating the state of the own vehicle is generated in vehicle 10, an abnormality occurs in vehicle 10 or further in its peripheral nodes (vehicle or roadside machine) at that time. It is determined at a time and place (node in) where the information is as close as possible to the situation acquired by the vehicle 10, and the determination result is added to the information indicating the state of the vehicle 10. The time and place as close as possible are the modes closest to the judgment about the abnormality of each vehicle 10 being executed by the abnormality judgment device of the vehicle 10 when the state information is acquired in each vehicle 10. Although the determination about the abnormality of the peripheral node is the closest aspect to be executed by each peripheral node, the aspect in which the vehicle 10 whose state information is acquired is then determined based on the state information received from the peripheral node is is there. Alternatively, as a mode that is the next closest, the vehicle 10 that has acquired information indicating the state of the host vehicle acquires a determination about an abnormality that another peripheral node has performed for a certain peripheral node. In any of these modes, it is more likely or more likely to be accurate than when a log is collected by the abnormality monitoring server 50 and then an abnormality determination is performed on each record, and the load on the abnormality monitoring server 50 is high. Can be reduced.

By adding the determination result regarding such an abnormality, when selecting learning data for the purpose of creating a normal model as an abnormality detection model from a log record of information indicating the state of the vehicle 10, Records can be eliminated. By using such learning data, a higher quality normal model can be obtained, which leads to an improvement in the accuracy of abnormality detection.

Further, depending on the operation mode of the monitoring service, for example, the abnormality monitoring server 50 may collect logs of only some vehicles, such as a specific manufacturer, a specific vehicle type, or a vehicle of a specific in-vehicle network system. In addition, there may be a case where the information is not exchanged between the abnormality monitoring server 50 and the roadside apparatus for some reason. Even in these cases, if the communication standard and the data format are matched in accordance with the standard used in V2X, each vehicle 10 communicates with the peripheral nodes while it is traveling, and it relates to an abnormality. By exchanging information, the abnormality monitoring server 50 can collect logs that can be selected as described above.

Further, supervised learning may be further performed using a record when an abnormality has occurred in the own node or a peripheral node. By using the anomaly detection model created in combination with supervised learning, there is a possibility that anomaly determination can be performed with higher accuracy, or the speed of improvement of the accuracy of the anomaly determination can be increased.

That is, in the creation of an anomaly detection model for anomaly monitoring of a V2X network, it is possible to use higher learning data by using information on each node and dynamically selecting information taking into account information on anomalies of surrounding nodes. An anomaly detection model is obtained that enables anomaly detection with accuracy. As a result, the safety of the V2X network is enhanced, and the safety and convenience of the car society can be improved.

(Modification etc.)
As mentioned above, although the abnormality determination apparatus with which the in-vehicle network system according to the present invention is provided, the server for generating the abnormality detection model, and the like have been described as described above based on the embodiment, the present invention is limited to this description. is not. The above embodiment is an exemplification of the technology according to the present invention, and the present invention is not limited to the above contents, and is also applicable to an embodiment in which changes, replacements, additions, omissions and the like are appropriately made. For example, the following modifications are also included in one embodiment of the present invention.

(1) The number of various nodes constituting the V2X network 1 shown in FIG. 1, the connection form and the like are merely examples for the description of the present embodiment and do not limit the present invention. Further, as described above, the present invention is not realized for the first time when all of the vehicles 10 and the roadside devices 30 which constitute the V2X network 1 have the configuration as shown in FIG. 3 or FIG. 7 respectively. The mutual abnormality determination between the own node or the nodes takes time to spread. In the above embodiments, some examples of the execution of the abnormality judgment of each node in the transitional situation and the use or provision of information of the judgment result have been given as examples, but it is easily conceived from these examples. Other embodiments that can be obtained are also included in the technical scope of the present invention.

(2) The order of execution of the procedures of the various processes (for example, the procedures shown by using FIG. 9 to FIG. 23B) described in the above embodiment is not necessarily limited to the order as described above. The order of execution can be changed, a plurality of procedures can be performed in parallel, or part of the procedures can be omitted without departing from the scope of the present invention.

(3) Further, the data configuration of the log (see FIGS. 4 to 6) shown in the above embodiment is not strictly limited to the illustrated example. For example, the information items in each record of the log shown in each of these figures may be associated in any manner, and need not be included in one table or list. Also, the data included in the log is not limited to those shown in these figures. In an apparatus or system that collects and uses this log in the technology according to the present invention, such as the abnormality monitoring server 50 or a server for creating learning data, for example, an ID for identifying each node and each node into the above groups Information for the purpose may be included. In addition, data transmitted from each node may also include such information.

(4) In the log exemplified in the above embodiment (see FIGS. 4 to 6), although the result of the determination regarding the abnormality of the in-vehicle or the peripheral node is indicated by two values of abnormality and normal, it is not limited thereto. For example, a value indicating the possibility of occurrence of an abnormality in more steps, or a value indicating the degree of severity in more steps if there is an abnormality may be used.

(5) A part or all of the components constituting each device in the above embodiment may be configured from one system LSI (Large Scale Integration: large scale integrated circuit). The system LSI is a super-multifunctional LSI manufactured by integrating a plurality of components on one chip, and more specifically, is a computer system including a microprocessor, a ROM, a RAM and the like. . A computer program is recorded in this ROM. The system LSI achieves its functions by the microprocessor operating according to the computer program. Moreover, each part of the component which comprises each said apparatus may be integrated into 1 chip separately, and 1 chip may be integrated so that one part or all may be included. Further, although a system LSI is used here, it may be called an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. After the LSI is manufactured, a field programmable gate array (FPGA) that can be programmed or a reconfigurable processor that can reconfigure connection and setting of circuit cells in the LSI may be used. Furthermore, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Application of biotechnology etc. may be possible.

(6) Some or all of the components constituting each of the above-described devices may be configured from an IC card or a single module that can be detached from each device. The IC card or module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or module may include the above-described ultra-multifunctional LSI. The IC card or module achieves its functions by the microprocessor operating according to the computer program. This IC card or this module may be tamper resistant.

(7) One aspect of the present invention may be, for example, a method including all or part of the processing procedures included in FIGS. 9 to 23B and the descriptions related thereto in the present specification.

For example, as a method of abnormality determination, it is a method executed by a processor included in the node to be monitored in the V2X network 1 that is included in the node to be monitored, the time, and sensor data or control data Performing a log information acquisition step (for example, step S11) of acquiring log information including at least one state information of the node at this time, and performing a first abnormality determination on occurrence of an abnormality on the node at this time A peripheral node related to an abnormality of a peripheral node acquired from a peripheral node which is a node to be monitored in the first abnormality determination step (for example, step S12) and the V2X network 1 and which is a peripheral node of the above node Information on the peripheral nodes at the above time A second abnormality determination step (for example, step S14) for executing a second abnormality determination related to the occurrence of the peripheral node, and when the result of the second abnormality determination indicates the occurrence of an abnormality on the peripheral node, the peripheral node An abnormal information addition step (for example, step S18) for adding abnormal information indicating the occurrence of an abnormality above and a log for transmitting the log information to which the abnormal information is added to at least a part of nodes constituting the V2X network 1 And an information transmitting step (for example, step S19).

Also, for example, as a method of creating an abnormality detection model, it is a method executed by a processing unit included in the server, and a log information acquisition step (e.g., step S21) of acquiring log information generated by a monitoring target node in the V2X network 1 And an information selection step of selecting predetermined information from the log information, and using the selected predetermined information as learning data, the abnormality used in abnormality detection in the monitoring node monitoring the above monitoring target node in the V2X network 1 And a model creation step (for example, step S44) for performing machine learning for creation of a detection model. Here, in the method of creating an abnormality detection model, the log information described above is state information of the monitoring target node at this time indicated by the time and at least one of sensor data or control data on the monitoring target node; First abnormality information indicating the presence or absence of abnormality on the monitoring target node at time, and second abnormality information indicating the presence or absence of abnormality on the second node communicating with the monitoring target node in the vicinity of the monitoring target node at this time And the corresponding. In the above information selection step, predetermined information is selected based on the first abnormality information and the second abnormality information. The predetermined information here is, for example, information used for learning data which is a normal model, or, for example, information used for learning data for supervised learning.

(8) Further, according to an aspect of the present invention, a computer program that causes a computer to execute the processing according to each of the above methods may be used, or a digital signal made of this computer program may be used.

(9) Further, according to one aspect of the present invention, a computer readable recording medium capable of reading the computer program or digital signal, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD, a DVD-ROM, a DVD-RAM. , BD (Blu-ray (registered trademark) Disc), semiconductor memory, or the like. In addition, digital signals may be recorded on these recording media. In one embodiment of the present invention, a computer program or a digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network represented by the Internet, data broadcasting, or the like.

(10) Further, according to an aspect of the present invention, there is provided a computer system comprising a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor may operate according to the computer program. . In addition, it may be implemented by another independent computer system by recording and transferring a program or digital signal on a recording medium, or transferring a program or digital signal via a network or the like.

(11) An embodiment realized by arbitrarily combining each component and function shown in the above embodiment and the above modification is also included in the scope of the present invention.

INDUSTRIAL APPLICABILITY The present invention is applicable to collection and selection of learning data for machine learning creation of an anomaly detection model used for anomaly detection.

DESCRIPTION OF SYMBOLS 1

V2X network

10, 10A, 10B, 10C Vehicle 20 communication network 30 roadside machine 30A traffic light 30B vehicle speed measuring device 31

data reception unit

33, 1253

data transmission unit

34, 1254

storage unit

35, 1255 abnormality determination unit 50

abnormality monitoring server

51, 1251 data reception unit 52 learning data selection unit 53 learning unit 54 storage unit 55 abnormality determination unit 100 in-vehicle network system 110 external communication device 120 gateway 125 abnormality determination device 130

information network

131, 132, 133, 141, 142, 143 ECU
140 Control Network 1252 Log Information Acquisition Unit

Claims

An abnormality determination apparatus including a processor, which is included in a first node to be monitored in a V2X network, comprising:
The processor is
A log information acquisition step of acquiring log information including time and at least one of sensor data or control data on the first node, including state information of the first node at the time;
A first abnormality determination step of executing a first abnormality determination on occurrence of an abnormality on the first node at the time;
The second node at the time based on second node information related to an abnormality of the second node acquired from a second node that is a monitoring target in the V2X network, the second node being a periphery of the first node A second abnormality determination step of executing a second abnormality determination on occurrence of an abnormality on the node;
An anomaly information addition step of appending anomaly information indicating occurrence of an anomaly on the second node to the log information when the result of the second anomaly determination indicates occurrence of an anomaly on the second node;
Performing a log information transmission step of transmitting the log information to which the abnormality information is added to at least a part of nodes constituting the V2X network.
The second node information includes a result of the determination performed on the second node based on at least one of sensor data or control data of the second node, which is performed on the second node,
The abnormality determination device according to claim 1, wherein the second abnormality determination is executed by acquiring the result included in the second node information.
The abnormality determination device according to claim 2, wherein, when the second node information includes the result of the determination that an abnormality has occurred in the second node, the second node information further includes the result of the determination regarding the type of the abnormality that has occurred in the second node.
The second node information includes at least one of sensor data or control data of the second node,
The abnormality determination apparatus according to claim 1, wherein the second abnormality determination is performed based on at least one of the sensor data or control data included in the second node information.
The abnormality determination apparatus according to claim 4, wherein the second abnormality determination includes determination regarding a type of the generated abnormality, and the abnormality information further indicates the type of the generated abnormality.
The abnormality determination device according to any one of claims 1 to 5, wherein the first node is a vehicle including an in-vehicle network system capable of communicating with other nodes forming the V2X network.
The second node is a vehicle including a roadside device including an information processing system capable of communicating with other nodes configuring the V2X network or an in-vehicle network system capable of communicating with other nodes configuring the V2X network. The abnormality determination device according to any one of 1 to 6.
The log information transmitted in the log information transmission step is transmitted to a node that creates an abnormality detection model used for abnormality detection in a monitoring system in the V2X network, using the log information. The abnormality determination device according to any one of the preceding claims.
A program executed by a processor included in an abnormality determination device included in a first node to be monitored in a V2X network, the abnormality determination device being executed by the processor.
A log information acquisition step of acquiring log information including time and at least one of sensor data or control data on the first node, including state information of the first node at the time;
A first abnormality determination step of executing a first abnormality determination on occurrence of an abnormality on the first node at the time;
The second node at the time based on second node information related to an abnormality of the second node acquired from a second node that is a monitoring target in the V2X network, the second node being a periphery of the first node A second abnormality determination step of executing a second abnormality determination on occurrence of an abnormality on the node;
An anomaly information addition step of appending anomaly information indicating occurrence of an anomaly on the second node to the log information when the result of the second anomaly determination indicates occurrence of an anomaly on the second node;
A program for executing the log information transmission step of transmitting the log information to which the abnormality information is added to at least a part of nodes constituting the V2X network.
A server comprising a processing unit,
The processing unit is
A log information acquisition step of acquiring log information generated by the first node to be monitored in the V2X network;
An information selection step of selecting predetermined information from the acquired log information;
A model creation step of executing machine learning for creation of an anomaly detection model used for anomaly detection by the monitoring node monitoring the first node in the V2X network using the selected predetermined information as learning data; Run
The log information is
Time and
State information of the first node at the time indicated by at least one of sensor data or control data on the first node;
First anomaly information indicating presence or absence of an anomaly on the first node at the time;
Second abnormality information that is present in the vicinity of the first node at the time and that indicates the presence or absence of an abnormality on a second node that communicates with the first node is associated and included;
An abnormality detection model creation server which selects the predetermined information based on the first abnormality information and the second abnormality information in the information selection step.
In the information selection step, state information associated with the first abnormality information indicating no abnormality and the second abnormality information indicating no abnormality is selected as the predetermined information.
The abnormality detection model creation server according to claim 10, wherein in the model creation step, a normal model is created as the abnormality detection model using the selected predetermined information as learning data.
In the information selection step, state information associated with at least one of the first abnormality information indicating that there is an abnormality and the second abnormality information that indicates that there is an abnormality is selected as the predetermined information.
The anomaly detection model creation server according to claim 10, wherein the anomaly detection model is created using the selected predetermined information as supervised learning data in the model creation step.
The first abnormality information further indicates the type of abnormality when there is an abnormality on the first node,
The abnormality detection model according to claim 12, wherein in the information selection step, state information associated with the first abnormality information indicating the type of abnormality on the same first node is collected and selected as the predetermined information. Creation server.
The second anomaly information further indicates the type of anomaly on the second node when there is an anomaly on the second node;
The abnormality according to claim 12 or 13, wherein in the information selection step, state information associated with the second abnormality information indicating the type of the abnormality on the same second node is collected and selected as the predetermined information. Detection model creation server.
The processing unit further executes an abnormality detection step of performing abnormality detection on data transmitted from a monitoring target in the V2X network using the generated abnormality detection model. Description of anomaly detection model creation server.
The anomaly detection model creating server according to any one of claims 10 to 15, wherein the first node is a vehicle provided with an in-vehicle network system capable of communicating with other nodes constituting the V2X network.
The second node is a vehicle including a roadside device including an information processing system capable of communicating with other nodes configuring the V2X network or an in-vehicle network system capable of communicating with other nodes configuring the V2X network. The anomaly detection model creation server according to any one of 10 to 16.
A program executed by a processing unit included in a server, wherein the server executes the program by being executed by the processing unit.
A log information acquisition step of acquiring log information generated by the first node to be monitored in the V2X network;
An information selection step of selecting predetermined information from the acquired log information;
A model creation step of executing machine learning for creation of an anomaly detection model used for anomaly detection by the monitoring node monitoring the first node in the V2X network using the selected predetermined information as learning data; Let it run
The log information is
Time and
State information of the first node at the time indicated by at least one of sensor data or control data on the first node;
First anomaly information indicating presence or absence of an anomaly on the first node at the time;
Second abnormality information that is present in the vicinity of the first node at the time and that indicates the presence or absence of an abnormality on a second node that communicates with the first node is associated and included;
A program for selecting the predetermined information based on the first abnormality information and the second abnormality information in the information selection step.