Monitoring device, monitoring method, and computer program

1. A monitoring device comprising:

a receiver that receives a frame from a communication network; and

a processor that when executing instructions:

performs a first determination that determines whether the frame is illegal or legal based on a result of message authentication for the frame, the first determination determines that the frame is legal when the message authentication succeeds, and determines that the frame is illegal when the message authentication fails,

performs a second determination that determines whether the frame is illegal or legal based on compliance with at least a predetermined behavior rule for the frame,

delivers, when the first determination and the second determination both indicate that the frame is legal, the frame to a transmitter and causes the transmitter to transmit the frame to the communication network, and

executes, when a combination of a result of the first determination and a result of the second determination indicates that the frame is illegal, at least one of

processing a command countermeasure for the frame,

processing a countermeasure with respect to a transmission source device that transmitted the frame,

changing of notification contents to be transmitted to an external device, and

changing of a priority of notification to be transmitted to the external device

wherein the second determination is different from a determination based on the result of message authentication, and

wherein the first determination is independent of the second determination.

2. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, or when the determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be illegal by the second determination, the processor executes processing of discarding or invalidating the determination target frame.

3. The monitoring device according to claim 1 , wherein

when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, or when the determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be illegal by the second determination,

the processor detects a target device of an illegality countermeasure from among a plurality of transmission source devices, based on presence or absence of an illegality in a plurality of frames transmitted from the plurality of transmission source devices, and executes at least one of

(1) processing of discarding or invalidating a frame to be transmitted from the target device,

(2) processing of updating a computer program in the target device,

(3) processing of updating a key of the message authentication in a transmission source device other than the target device, and

(4) processing of discarding or invalidating a frame received from a bus of the communication network connected with the target device.

4. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, and when the determination target frame is received from a bus in which a frame transmitted from other than a predetermined transmission source device flows, the processor executes processing of updating a key of the message authentication in the predetermined transmission source device.

5. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be legal by the second determination, the processor stores at least log data related to the determination target frame.

6. The monitoring device according to claim 1 , wherein the processor classifies a determination target frame into any of a legal frame, an illegal frame, and a gray frame in accordance with a degree of deviation between a state of the determination target frame and the rule, and when the determination target frame is classified into the gray frame, the processor stores at least log data related to the determination target frame.

7. The monitoring device according to claim 1 , wherein,

the monitoring device is an electronic control unit mounted in a vehicle, and

the processor switches an automatic driving mode of the vehicle to a fail-safe mode, when a frame transmitted via a predetermined gateway device in an in-vehicle network is determined to be illegal by the second determination.

8. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, the processor sets a priority of notification of information related to the determination target frame to a higher priority than another communication.

9. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be illegal by the second determination, the processor sets a priority of notification of information related to the determination target frame to a lower priority than another communication.

10. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be legal by the second determination, the processor sets a priority of notification of information related to the determination target frame to a lower priority than when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, and to a higher priority than when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be illegal by the second determination.

11. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, the processor reports at least information of a command included in the determination target frame and information of a transmission source device of the determination target frame.

12. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be legal by the first determination and the determination target frame is determined to be illegal by the second determination, and when a reception frequency of a frame having a same identification (ID) as the determination target frame exceeds a predetermined value, the processor reports at least information of a command included in the determination target frame.

13. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be illegal by the second determination, the processor reports at least information of a command included in the determination target frame.

14. The monitoring device according to claim 1 , wherein when a determination target frame is determined to be illegal by the first determination and the determination target frame is determined to be legal by the second determination, the processor reports at least information of a command included in the determination target frame and information of another command related to the command.

15. The monitoring device according to claim 1 , wherein when a frame that is excluded from the first determination is determined to be illegal by the second determination, and when a reception frequency of a frame having a same identification (ID) as the frame matches with a predetermined value, the processor reports at least information of a command included in the frame and information of a transmission source device of the frame with a lower priority than another communication.

16. The monitoring device according to claim 1 , wherein when a frame that is excluded from the first determination is determined to be illegal by the second determination, and when a reception frequency of a frame having a same ID as the frame exceeds a predetermined value, the processor reports at least information of a command included in the frame with a lower priority than another communication.

17. The monitoring device according to claim 1 , wherein

the processor

executes, based on a state of a determination target frame and a plurality of predetermined behavioral rules, a plurality of intermediate determinations, and

derives a result of the second determination based on the plurality of intermediate determinations, and

when there exists a result indicating non-conformity with the rules among the results of the plurality of intermediate determinations, the processor notifies an external device of the results of the plurality of intermediate determinations and changes a priority of notification depending on a number of results indicating non-conformity with the rules.

18. A monitoring method executed by a computer, the monitoring method comprising:

receiving a frame from a communication network;

performing a first determination that determines whether the frame is illegal or legal based on a result of message authentication for the frame, the first determination determines that the frame is legal when the message authentication succeeds, and determines that the frame is illegal when the message authentication fails;

performing a second determination that determines whether the frame is illegal or legal based on compliance with at least a predetermined behavior rule for the frame;

delivering, when the first determination and the second determination both indicate that the frame is legal, the frame to a transmitter and causing the transmitter to transmit the frame to the communication network; and

executing, when a combination of a result of the first determination and a result of the second determination indicates that the frame is illegal, at least one of

processing a command countermeasure for the frame,

processing a countermeasure with respect to a transmission source device that transmitted the frame,

changing of notification contents to be transmitted to an external device, and

changing of a priority of notification to be transmitted to the external device,

wherein the second determination is different from a determination based on the result of message authentication, and

wherein the first determination is independent of the second determination.

19. A non-transitory recording medium storing a computer program for causing a computer to execute:

receiving a frame from a communication network;

performing a first determination that determines whether the frame is illegal or legal based on a result of message authentication for the frame, the first determination determines that the frame is legal when the message authentication succeeds, and determines that the frame is illegal when the message authentication fails;

performing a second determination that determines whether the frame is illegal or legal based on compliance with at least a predetermined behavior rule for the frame;

delivering, when the first determination and the second determination both indicate that the frame is legal, the frame to a transmitter and causing the transmitter to transmit the frame to the communication network; and

executing, when a combination of a result of the first determination and a result of the second determination indicates that the frame is illegal, at least one of

processing a command countermeasure for the frame,

processing a countermeasure with respect to a transmission source device that transmitted the frame,

changing of notification contents to be transmitted to an external device, and

changing of a priority of notification to be transmitted to the external device,

wherein the second determination is different from a determination based on the result of message authentication, and

wherein the first determination is independent of the second determination.