CROSS-REFERENCE TO RELATED APPLICATION

This application is based on and claims priority under 35 USC 119 from Japanese Patent Application No. 2019-039702 filed on Mar. 5, 2019, the disclosure of which is incorporated by reference herein.

BACKGROUND

Technical Field

The present disclosure relates to a fraudulent transmission data detection device, a fraudulent transmission data detection method, and a storage medium.

Related Art

Japanese Patent Application Laid-open (JP-A) No. 2018-026663 discloses technology that, each time a message that is to be monitored is received, determines, based on a current reception timing Ti, a reception timing m number of times previously Ti-m, a message transmission cycle F, and a predetermined constant σ, whether or not a fraudulent transmission is present in the received monitored message during a period from the reception timing Ti-m to the reception timing Ti.

The technology described in JP-A No. 2018-026663 determines that data that is received in a shorter time interval than the data (i.e., message) transmission cycle F is fraudulent transmission data. However, in communication that complies with a Standard such as, for example, CAN (Controller Area Network), which is a communication protocol for automobiles and industrial machinery, and the like, fluctuations do occur in the reception time intervals even if the data is normal data, and an incorrect determination may be made due to the effects of these fluctuations in the reception time intervals.

As an example,FIGS. 7A and 7Billustrate cases in which, in normal operations, normal data is received every 100 ms.FIG. 7Aillustrates an example in which the reception of normal data, which conventionally should be received at 0 ms timings, is delayed due to some reason or other to timings of close to 100 ms, and in which the reception of normal data, which conventionally should be received at 300 ms timings, is slightly sped up due to some reason or other. In this case, because data is received four times within a period of 200 ms, which corresponds to two cycles of normal data, it is incorrectly determined that fraudulent transmission data has been received, and there is a possibility that the notation ‘data discarded in spite of the absence of an attack’ will be shown, and that this normal data will be incorrectly discarded.

FIG. 7Billustrates an example in which fraudulent transmission data is received at timings between 200 ms and 300 ms, and in which the reception of normal data, which conventionally should be received at 300 ms timings, is delayed due to some reason or other. In this case, because data is received four times within a period of 200 ms, which corresponds to three cycles of the normal data, there is a possibility that the notation ‘data determined to be normal in spite of the presence of an attack’ will be shown, and that in spite of the fact that fraudulent transmission data has been received, this data will be incorrectly determined to be normal.

SUMMARY

The present disclosure has been conceived in view of the above-described circumstances, and provides a fraudulent transmission data detection device, a fraudulent transmission data detection method, and a storage medium that enable incorrect determinations relating to receptions of fraudulent transmission data that are caused by the effects of fluctuations in the reception time intervals of normal data to be inhibited from occurring.

A first aspect of the present disclosure is a fraudulent transmission data detection device that includes a receiving unit that receives data that is transmitted in cycles; and plural determination units, each of which is configured to, based on whether or not a time from a reference timing until a predetermined number of data items are received by the receiving unit is less than a predetermined time, determine whether or not fraudulent transmission data is contained in the received data, and in which at least the reference timing, or the predetermined number of data items and the predetermined time, are different from those of the other determination units.

In the above-described aspect, plural determination units that determine whether or not fraudulent transmission data is contained in received data are provided, and at least one of the predetermined number of data items and predetermined times in the determination of the fraudulent transmission data, or the reference timings is mutually different from each other in these plural determination units. In this way, by providing plural determination units whose determination criteria for determining fraudulent transmission data are mutually different, even if fluctuations occur in the normal data reception time intervals, because it is likely that a correct determination result will be obtained in at least one of the plural determination units, it is possible to inhibit incorrect determinations about receptions of fraudulent transmission data from occurring.

In the first aspect, the plural determination units may include: a first determination unit that, based on whether or not a time, from a reference timing until a first predetermined number of data items are received by the receiving unit, is less than a first predetermined time, determines whether or not fraudulent transmission data is contained in the received data; and a second determination unit that, based on whether or not a time, from the reference timing until a second predetermined number of data items, which is different from the first predetermined number of data items, are received by the receiving unit, is less than a second predetermined time that is different from the first predetermined time, determines whether or not fraudulent transmission data is contained in the received data.

In the above-described structure the predetermined number of data items and the predetermined timings in the determination as to whether or not fraudulent transmission data is contained in received data are different between the first determination unit and the second determination unit.

When the predetermined time is comparatively short and, in accordance with this, the predetermined number of data items is comparatively fewer, then it is possible to detect the reception of fraudulent transmission data at high speed when fraudulent transmission data is received at a high frequency in a short space of time. In contrast, when the predetermined time is comparatively long and, in accordance with this, the predetermined number of data items is comparatively greater, then it is also possible to detect the reception of fraudulent transmission data when fraudulent transmission data is received at a low frequency over a longer space of time. Accordingly, even if fluctuations do occur in the reception time intervals of normal data, because it is likely that a correct determination result will be obtained in the first determination unit or the second determination unit, it is possible to inhibit incorrect determinations relating to the reception of fraudulent transmission data from occurring.

In the first aspect, the plural determination units may include: a first determination unit that, based on whether or not a time, from a first reference timing until a first predetermined number of data items are received by the receiving unit, is less than a first predetermined time, determines whether or not fraudulent transmission data is contained in the received data; and a third determination unit that, based on whether or not a time, from a second reference timing, which is different from the first reference timing, of the first determination unit until the first predetermined number of data items are received by the receiving unit, is less than the first predetermined time, determines whether or not fraudulent transmission data is contained in the received data.

In the above-described structure the reference timings in the determination as to whether or not fraudulent transmission data is contained in received data are different between the first determination unit and the third determination unit. In this way, by providing plural determination units having mutually different reference timings, even if temporary fluctuations occur in the normal data reception time intervals, because it is likely that at least one of the determination units will be able to make a determination within a period in which the effects of the fluctuations are reduced, it is possible to inhibit incorrect determinations relating to the reception of fraudulent transmission data from occurring.

The first aspect may further include a control unit that, in a case in which it is determined by one of the plural determination units that fraudulent transmission data is contained in the received data, transition to safety control so as to inhibit any effects from the fraudulent transmission data.

In the above-described structure, in a case in which it is determined in one of the plural determination units that fraudulent transmission data is contained in the received data, a control unit transitions to performing safety control. Therefore, it is possible to inhibit any effects from the fraudulent transmission data.

In the first aspect, the plural determination units and the control unit may be provided in a hub ECU to which are connected plural communication buses, and, in a case in which it is determined by one of the plural determination units that fraudulent transmission data is contained in the received data, the safety control may be performed with respect to the communication bus to which the fraudulent transmission data has been transmitted.

In the above-described structure, because the plural determination units and the control unit are provided in a hub ECU, and determinations relating to fraudulent transmission data and the like are performed in the hub ECU, there is no need to alter the structure of any instruments other than the hub ECU when the present disclosure is implemented, so the present disclosure may be applied easily.

In the first aspect, the plural determination units and the control unit may be provided at a terminal ECU to which is connected a single communication bus, and, in a case in which it is determined by one of the plural determination units that fraudulent transmission data is contained in the received data, the safety control is performed with respect to the terminal ECU at which the control unit is itself provided.

In the above-described structure, because the plural determination units and the control unit are provided in a terminal ECU, and determinations relating to fraudulent transmission data and the like are made in the terminal ECU, it is possible to reduce the load on the hub ECU.

In the first aspect, the data that is transmitted in cycles may be transmitted via communication compliant with CAN.

In an environment in which communication that is compliant with CAN is performed, it is easy for fluctuations to consistently occur in normal data reception time intervals. In the above-described structure, in this kind of environment, it is possible to inhibit incorrect determinations relating to the reception of fraudulent transmission data from occurring.

A second aspect of the present disclosure is A fraudulent data transmission method, including: receiving data that is transmitted in cycles; providing plural determination circuits, each of which is configured to determine whether or not fraudulent transmission data is contained in the received data, based on whether or not a time from a reference timing until a predetermined number of data items are received is less than a predetermined time; and causing at least the reference timing, or the predetermined number of data items and the predetermined time, to be different at each of the plural determination circuits.

A third aspect of the present disclosure is a non-transitory storage medium storing a program that causes a computer to execute fraudulent data detection processing, the fraudulent data detection processing including: receiving data that is transmitted in cycles; providing plural determination circuits, each of which is configured to, based on whether or not a time, from a reference timing until a predetermined number of data items are received, is less than a predetermined time, determine whether or not fraudulent transmission data is contained in the received data; and causing at least the reference timing, or the predetermined number of data items and the predetermined time, to be different at each of the plurality of determination circuits.

The present disclosure enables incorrect determinations relating to receptions of fraudulent transmission data that are caused by the effects of fluctuations in the reception time intervals of normal data to be inhibited from occurring.

