Anomaly detection method, anomaly detection device, and recording medium

1 . An anomaly detection method for detecting an anomaly in a network inside a vehicle, the network being included in an in-vehicle network system including a plurality of electronic control units that transmit and receive messages via the network, the anomaly detection method comprising:

obtaining, from a message sequence received from the network, a plurality of messages included in a sliding window that is divided into past, present, and future period sub-windows;

generating, from the obtained plurality of messages, image data of a reception interval between the plurality of messages or image data of a transition of a sensor value of the plurality of messages;

generating, by processing the generated image data through a plurality of convolutional layers and a plurality of pooling layers of a trained convolutional neural network (CNN), an output representing a feature of the generated image data;

classifying the generated image data using a trained bidirectional long-short term memory (BLSTM) based on the generated output according to whether an attack message has been inserted in the plurality of messages included in the sliding window; and

when the attack message has been inserted in the plurality of messages included in the sliding window, outputting a detection result indicating that an insertion attack has been made in the plurality of messages included in the sliding window,

wherein the output representing the feature of the generated image data is a feature vector, and the trained BLSTM classifies a time series of feature vectors corresponding to a plurality of sliding windows to determine whether the attack message has been inserted into the plurality of messages in the sliding window.

2 . The anomaly detection method according to claim 1 , further comprising:

obtaining the plurality of messages, by dividing, using the a sliding window, the message sequence received from the network; and

generating, from the obtained plurality of messages, the image data representing the reception interval between the plurality of messages or an image representing the transition of the sensor value of the plurality of messages, to generate the image data of the reception interval between the plurality of messages or the image data of the transition of the sensor value of the plurality of messages.

3 . The anomaly detection method according to claim 1 , further comprising:

determining, when the attack message has been inserted into the plurality of messages in the sliding window, from the sensor value included in each of the plurality of messages, whether the message is the attack message, based on a predetermined rule, the plurality of messages being included in the message sequence.

4 . The anomaly detection method according to claim 1 , further comprising, when the attack message has been inserted into the plurality of messages in the sliding window:

calculating difference values between sensor values of all combinations of two messages that are sequential in reception time among the plurality of messages included in the message sequence in the sliding window;

combining the plurality of messages into groups according to the calculated difference values;

determining whether all of the difference values included in each of the groups are zero;

outputting, when not all of the difference values are zero, a detection result indicating that the insertion attack has been made in the plurality of messages in the sliding window, the insertion attack being the insertion of the attack message; and

outputting, when all of the difference values are zero, the detection result indicating that in the plurality of messages in the sliding window, a message in a group where the difference values are zero is not the attack message.

5 . The anomaly detection method according to claim 1 , further comprising, when the attack message has been inserted in the plurality of messages in the sliding window:

detecting, from the plurality of messages included in the message sequence in the sliding window-predetermined period, using another trained CNN different from the trained CNN, a message that is the attack message among the plurality of messages and a sensor that has been attacked.

6 . The anomaly detection method according to claim 1 , further comprising, when the attack message has been inserted in the plurality of messages in the sliding window: detecting, from each of the plurality of messages included in the message sequence in the sliding window, using the trained BLSTM, whether the message is the attack message.

7 . The anomaly detection method according to claim 1 , further comprising, when the attack message has been inserted in the plurality of messages in the sliding window:

obtaining a determination result obtained by determining, from the sensor value included in each of the plurality of messages, whether the message is the attack message, based on a predetermined rule, the plurality of messages being included in the message sequence in the sliding window;

obtaining a first detection result indicating a result of detecting, from the plurality of messages included in the message sequence in the sliding window, using another trained CNN different from the trained CNN, a message that is the attack message among the plurality of messages and a sensor that has been attacked;

obtaining a second detection result indicating a result of detecting, from each of the plurality of messages included in the message sequence in the sliding window, using the trained BLSTM, whether the message is the attack message; and

performing an ensemble process on the obtained determination result, the obtained first detection result, and the obtained second detection result, and outputting a result of the ensemble process, wherein

in the ensemble process,

(i) the determination result, the first detection result, or the second detection result is selected, or

(ii) the obtained determination result, the obtained first detection result, and the obtained second detection result are integrated by calculation of a weighted average of the obtained determination result, the obtained first detection result, and the obtained second detection result.

8 . An anomaly detection device for detecting an anomaly in a network inside a vehicle, the network being included in an in-vehicle network system including a plurality of electronic control units that transmit and receive messages via the network, the anomaly detection device comprising:

a processor; and

a memory, wherein the processor is configured to

obtain, from a message sequence received from the network, a plurality of messages included in a sliding window that is divided into past, present, and future period sub-windows;

generate, from the obtained plurality of messages, image data of a reception interval between the plurality of messages or image data of a transition of a sensor value of the plurality of messages;

generate, by processing the generated image data through a plurality of convolutional layers and a plurality of pooling layers of a trained convolutional neural network (CNN), an output representing a feature of the generated image data;

classify the generated image data using a trained bidirectional long-short term memory (BLSTM) based on the generated output according to whether an attack message has been inserted in the plurality of messages included in the sliding window; and

output, when the attack message has been inserted in the plurality of messages included in the sliding window a detection result indicating that an insertion attack has been made in the plurality of messages included in the sliding window, the insertion attack being an insertion of the attack message,

wherein the output representing the feature of the generated image data is a feature vector, and the trained BLSTM classifies a time series of feature vectors corresponding to a plurality of sliding windows to determine whether the attack message has been inserted into the plurality of messages in the sliding window.

9 . A non-transitory computer-readable recording medium having recorded thereon a program for causing a computer to execute an anomaly detection method for detecting an anomaly in a network inside a vehicle, the network being included in an in-vehicle network system including a plurality of electronic control units that transmit and receive messages via the network, the program causing the computer to execute the operations of:

obtaining, from a message sequence received from the network, a plurality of messages included in a sliding window that is divided into past, present, and future period sub-windows;

generating, from the obtained plurality of messages, image data of a reception interval between the plurality of messages or image data of a transition of a sensor value of the plurality of messages;

generating, by processing the generated image data through a plurality of convolutional layers and a plurality of pooling layers of a trained convolutional neural network (CNN), an output representing a feature of the generated image data;

classifying the generated image data using a trained bidirectional long-short term memory (BLSTM) based on the generated output according to whether an attack message has been inserted in the plurality of messages included in the sliding window; and

outputting, when the attack message has been inserted in the plurality of messages included in the sliding window, a detection result indicating that an insertion attack has been made in the plurality of messages included in the sliding window, the insertion attack being an insertion of the attack message,

wherein the output representing the feature of the generated image data is a feature vector, and the trained BLSTM classifies a time series of feature vectors corresponding to a plurality of sliding windows to determine whether the attack message has been inserted into the plurality of messages in the sliding window.

10 . The anomaly detection method according to claim 1 , further comprising:

generating past, present, and future period sub-windows of the message sequence received by the network inside the vehicle; and

using the sub-windows to divide the message sequence to obtain a plurality of messages in a selected sub-window and to generate the image data of the reception interval between the plurality of messages included in the selected sub-window in a predetermined period from the message sequence received from the network or from the image data of the transition of the sensor value of the plurality of messages.

11 . The anomaly detection method according to claim 10 , further comprising determining a size of each of the sub-windows generated by the sliding window.

12 . The anomaly detection method according to claim 11 , further comprising:

using the sliding window to generate the past, present, and future period sub-windows of the message sequence received by the network inside the vehicle, wherein the past sub-window is larger than the present and future sub-windows.

13 . The anomaly detection method according to claim 12 , wherein the present and future sub-windows have the same duration.

14 . The anomaly detection method according to claim 13 , wherein the size of the past sub-window is set to 200 ms, the size of the present sub-window is set to 100 ms, and the size of the future sub-window is set to 100 ms.

15 . The anomaly detection method according to claim 1 , further comprising:

determining whether each message in the message sequence in a selected sub-window is normal or anomalous in response to the classifying operation determining that an attack message has been inserted into a plurality of messages in the selected sub-window of the past, present and future period sub-windows; and

outputting a determination result of receipt of an anomalous message when a message is determined to be anomalous.