Anomaly detection device, in-vehicle network system, and anomaly detection method

1. An anomaly detection device for detecting anomaly in a frame flowing through an in-vehicle network system in a vehicle, the anomaly detection device comprising:

an obtainer that obtains one or more frames in each of which at least a destination is stored;

a first holder that holds a first rule defining a first anomaly detection rule and a mirroring rule, the first anomaly detection rule indicating that each of the one or more frames that satisfies a first condition is to be determined as being anomalous, the mirroring rule indicating that when a frame included in the one or more frames satisfies a second condition that the destination of the frame is an electronic control unit that performs a predetermined control, the frame is to be transferred or mirrored;

a first frame controller that performs an anomaly detection process on each of the one or more frames in accordance with the first anomaly detection rule, and controls transferring or mirroring of the one or more frames in accordance with the mirroring rule;

a second holder that holds a second rule defining a second anomaly detection rule indicating that a frame satisfying a third condition is to be determined as being anomalous, the third condition being more specific than the first condition; and

a second frame controller that performs, in accordance with the second rule, the anomaly detection process on each of the one or more frames transferred or mirrored by the first frame controller, wherein

when an anomalous frame is detected, the second frame controller provides or stores a detection result indicating the anomalous frame detected,

the obtainer obtains a plurality of frames including the one or more frames,

the first rule defines a rule indicating that among the plurality of frames obtained by the obtainer, frames accounting for a first proportion are to be transferred or mirrored to the second frame controller, and frames accounting for a second proportion are to be transferred or mirrored to another anomaly detection device in the vehicle,

the first frame controller transfers or mirrors the frames accounting for the first proportion to the second frame controller and transfers or mirrors the frames accounting for the second proportion to the other anomaly detection device in accordance with the first rule, and

the second frame controller performs, in accordance with the second rule, the anomaly detection process on each of the frames transferred or mirrored by the first frame controller that account for the first proportion.

2. The anomaly detection device according to claim 1 , wherein

the first frame controller is implemented by hardware, and

the second frame controller is implemented by software.

3. The anomaly detection device according to claim 1 , wherein

when transferring or mirroring the frames accounting for the second proportion to the other anomaly detection device, the first frame controller transmits request information to the other anomaly detection device by adding the request information to the frames accounting for the second proportion, the request information indicating that the first frame controller requests the other anomaly detection device to perform the anomaly detection process on each of the frames accounting for the second proportion.

4. The anomaly detection device according to claim 3 , wherein

a domain of the in-vehicle network system is divided into a plurality of domains,

the anomaly detection device and the other anomaly detection device belong to different domains among the plurality of domains, and

when transferring or mirroring the frames to the other anomaly detection device, the first frame controller adds, to the frames, identification information for identifying a domain to which the other anomaly detection device belongs, or rewrites identification information included in the frames into the identification information for identifying the domain to which the other anomaly detection device belongs, and transfers or mirrors the frames.

5. The anomaly detection device according to claim 1 , further comprising:

a third holder, wherein

the second frame controller generates, for each destination stored in each of the one or more frames obtained by the obtainer, log information about transmission and reception of the frame, and stores, into the third holder, the log information generated.

6. The anomaly detection device according to claim 5 , further comprising:

an integrated log manager that obtains one or more pieces of the log information from one or more other anomaly detection devices in the vehicle, generates integrated log information by integrating the one or more pieces of the log information obtained and the log information stored in the third holder, and stores, into the third holder, the integrated log information generated.

7. An in-vehicle network system, comprising:

a plurality of anomaly detection devices each of which is the anomaly detection device according to claim 5 ; and

an integrated log management device that obtains one or more pieces of the log information from each of the plurality of anomaly detection devices, generates integrated log information by integrating the one or more pieces of the log information respectively obtained from the plurality of anomaly detection devices, and stores the integrated log information generated.

8. An anomaly detection method for detecting anomaly in a frame flowing through an in-vehicle network system in a vehicle, the anomaly detection method comprising:

obtaining one or more frames in each of which at least a destination is stored;

reading a first rule defining a first anomaly detection rule and a mirroring rule, the first anomaly detection rule indicating that each of the one or more frames that satisfies a first condition is to be determined as being anomalous, the mirroring rule indicating that when a frame included in the one or more frames satisfies a second condition that the destination of the frame is an electronic control unit that performs a predetermined control, the frame is to be transferred or mirrored;

performing an anomaly detection process on each of the one or more frames in accordance with the first anomaly detection rule, and transferring or mirroring the one or more frames in accordance with the mirroring rule that has been read;

reading a second rule defining a second anomaly detection rule indicating that a frame satisfying a third condition is to be determined as being anomalous, the third condition being more specific than the first condition;

performing, in accordance with the second rule that has been read, the anomaly detection process on each of the one or more frames transferred or mirrored; and

providing or storing a detection result when an anomalous frame is detected in the anomaly detection process, the detection result indicating the anomalous frame detected,

wherein

in the obtaining, a plurality of frames including the one or more frames are obtained,

the first rule defines a rule indicating that among the plurality of frames obtained, frames accounting for a first proportion are to be transferred or mirrored to a second frame controller included in an anomaly detection device for performing the anomaly detection process, and frames accounting for a second proportion are to be transferred or mirrored to another anomaly detection device in the vehicle,

in the transferring or mirroring, the frames accounting for the first proportion are transferred or mirrored to the second frame controller and the frames accounting for the second proportion are transferred or mirrored to the other anomaly detection device in accordance with the first rule, and

in the performing, in accordance with the second rule, the anomaly detection process is performed on each of the frames transferred or mirrored that account for the first proportion.