Detection device, vehicle, detection method, and detection program
A detection device includes: a monitoring unit configured to monitor, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network; and a generation unit configured to generate a reference time to be used in a detection process of detecting the unauthorized message; a detection unit configured to perform detection process, based on time difference between a time corresponding to a transmission time of target message based on a monitoring result of the monitoring unit, and the reference time generated by the generation unit. When target message has been determined to be abnormal in the detection process, the generation unit, based on a value obtained by adding a latest statistical value to the reference time, generates a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be abnormal.
1. A detection device configured to detect an unauthorized message in an in-vehicle network, comprising:
a monitoring unit configured to monitor, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network;
a generation unit configured to generate a reference time to be used in a detection process of detecting the unauthorized message;
a detection unit configured to perform the detection process, based on a time difference between a time corresponding to a transmission time of the target message based on a monitoring result of the monitoring unit, and the reference time generated by the generation unit; and
an update unit configured to update a statistical value of the time difference by using the time difference between the reference time and a time corresponding to a transmission time of the target message having been determined to be normal in the detection process, wherein
when the target message has been determined to be abnormal in the detection process, the generation unit, based on a value obtained by adding a latest statistical value to the reference time, generates a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be abnormal.
2. The detection device according to claim 1 , wherein
the detection unit detects an abnormality regarding a first target message, based on a time difference between the reference time and a time corresponding to a transmission time of the first target message that is the target message, and on a time difference between the reference time and a time corresponding to a transmission time of a second target message that is the target message to be transmitted after the first target message.
3. The detection device according to claim 1 , wherein
when the target message has been determined to be normal in the detection process, the generation unit, based on a time corresponding to a transmission time of the target message having been determined to be normal, generates a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be normal.
4. The detection device according to claim 1 , wherein
the generation unit, when generating the reference time, uses a delay time due to an arbitration process performed when the target message is transmitted.
5. A vehicle being provided with the detection device according to claim 1 .
6. A detection method performed in a detection device configured to detect an unauthorized message in an in-vehicle network, the method comprising:
monitoring, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network;
generating a reference time to be used in a detection process of detecting the unauthorized message;
performing the detection process, based on a time difference between a time corresponding to a transmission time of the target message based on a monitoring result of the target message, and the generated reference time; and
updating a statistical value of the time difference by using the time difference between the reference time and a time corresponding to a transmission time of the target message having been determined to be normal in the detection process, wherein
in generating the reference time, when the target message has been determined to be abnormal in the detection process, a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be abnormal, is generated based on a value obtained by adding a latest statistical value to the reference time.
7. A computer-readable non-transitory storage having stored therein a detection program used in a detection device configured to detect an unauthorized message in an in-vehicle network, the program causing a computer to function as:
a monitoring unit configured to monitor, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network;
a generation unit configured to generate a reference time to be used in a detection process of detecting the unauthorized message;
a detection unit configured to perform the detection process, based on a time difference between a time corresponding to a transmission time of the target message based on a monitoring result of the monitoring unit, and the reference time generated by the generation unit; and
an update unit configured to update a statistical value of the time difference by using the time difference between the reference time and a time corresponding to a transmission time of the target message having been determined to be normal in the detection process, wherein
when the target message has been determined to be abnormal in the detection process, the generation unit, based on a value obtained by adding a latest statistical value to the reference time, generates a new reference time to be used in the detection process for a target message to be transmitted after the target message having been determined to be abnormal.