Anomaly detection device, anomaly detection method, and recording medium

1. An anomaly detection device in an in-vehicle network that includes a plurality of electronic control units (ECUs), a network, and the anomaly detection device, the anomaly detection device being located between the network and a first ECU included in the plurality of ECUs, and comprising:

a communication circuit;

a processor; and

at least one memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations including:

receiving a message from the first ECU and transmitting the message to the network, and receiving a message from the network and transmitting the message to the first ECU, using the communication circuit;

holding, in the at least one memory, a received ID list which is a list of IDs of messages from the plurality of ECUs except for the first ECU that the communication circuit has received from the network and transmitted to the first ECU;

in the case where an ID of the message from one of the plurality of ECUs except for the first ECU that is received by the communication circuit from the network is not included in the received ID list, adding the ID to the received ID list; and

in the case where an ID of the message received by the communication circuit from the first ECU is included in the received ID list, causing the communication circuit not to transmit the message to the network.

2. The anomaly detection device according to claim 1 ,

wherein, the operations further include, in the case where the ID of the message received by the communication circuit from the first ECU is included in the received ID list, isolating the first ECU from the network.

3. The anomaly detection device according to claim 1 ,

wherein, the operations further include, in the case where the communication circuit receives, from the network, anomalous ID information transmitted from a second ECU included in the plurality of ECUs and different from the first ECU, erasing the ID indicated by the anomalous ID information from the received ID list, the anomalous ID information indicating an ID that is anomalous.

4. The anomaly detection device according to claim 1 ,

wherein the at least one memory has a region for recording the number of received messages for each of the IDs included in the received ID list, and

the operations further include:

when the communication circuit receives the message from the network, updating the number of received messages for the ID of the message;

when a vehicle including the in-vehicle network shuts down, saving an ID among the IDs included in the received ID list to nonvolatile memory, the ID being an ID for which the number of received messages recorded in the at least one memory or the frequency of received messages based on the number of received messages is less than or equal to a predetermined value; and

when the vehicle starts, adding the ID saved to the nonvolatile memory, to the received ID list.

5. The anomaly detection device according to claim 4 ,

wherein, the operations further include, when the vehicle starts, in the case where firmware information of the first ECU has been changed since the vehicle last started, erasing the ID saved to the nonvolatile memory, without adding the ID to the received ID list.

6. The anomaly detection device according to claim 1 ,

wherein the at least one memory further holds a transmitted ID list which is a list of IDs of messages that the communication circuit has received from the first ECU and transmitted to the network, and

the operations further include:

in the case where the ID of the message received by the communication circuit from the first ECU is not included in the transmitted ID list, adding the ID to the transmitted ID list; and

in the case where the ID of the message received by the communication circuit from the network is included in the transmitted ID list, causing the communication circuit not to transmit the message to the first ECU.

7. The anomaly detection device according to claim 6 ,

wherein the at least one memory has a region for recording the number of transmitted messages for each of the IDs included in the transmitted ID list, and

the operations further include:

when the communication circuit receives the message from the first ECU, updating the number of transmitted messages for the ID of the message;

when a vehicle including the in-vehicle network shuts down, saving an ID among the IDs included in the received ID list to nonvolatile memory, the ID being an ID for which the number of transmitted messages recorded in the at least one memory or the frequency of transmitted messages based on the number of transmitted messages is less than or equal to a predetermined value; and

when the vehicle starts, adding the ID saved to the nonvolatile memory, to the transmitted ID list.

8. The anomaly detection device according to claim 7 ,

wherein, the operations further include, when the vehicle starts, in the case where firmware information of the first ECU has been changed since the vehicle last started, erasing the ID saved to the nonvolatile memory, without adding the ID to the transmitted ID list.

9. An anomaly detection method for use in an anomaly detection device in an in-vehicle network that includes a plurality of electronic control units (ECUs), a network, and the anomaly detection device, the anomaly detection device being located between the network and a first ECU included in the plurality of ECUs, the anomaly detection method comprising:

in the case where an ID of a message from the plurality of ECUs except for the first ECU that is received by a communication circuit from the network is not included in a received ID list, adding the ID to the received ID list, the received ID list being a list of IDs of messages from the plurality of ECUs except for the first ECU that the communication circuit has received from the network and transmitted to the first ECU; and

in the case where an ID of a message received by the communication circuit from the first ECU is included in the received ID list, causing the communication circuit not to transmit the message to the network.

10. A non-transitory computer-readable recording medium that stores a program for causing a computer to execute the anomaly detection method according to claim 9 .