Detection device, detection method and detection program
The detection device that detects presence of an unauthorized message in an in-vehicle network, the detection device includes: a state detection unit configured to detect a transition to a state in which a periodic message is transmitted in an in-vehicle network, based on content of a message transmitted in the in-vehicle network; and a processing unit configured to perform detection processing to detect presence of the unauthorized message based on a reception status of a plurality of the periodic messages in the state detected by the state detection unit.
1 . A detection device that detects presence of an unauthorized message in an in-vehicle network, the detection device comprising:
a state detection unit configured to detect a transition to a periodic state, the periodic state being a state in which a periodic message is transmitted in an in-vehicle network, wherein each message transmitted in the in-vehicle network includes a frame having a header and the transition to the periodic state is determined when the header of the message includes specific content that is transmitted immediately before the start of periodic messages between a client and a server; and
a processing unit configured to perform detection processing to detect presence of the unauthorized message based on a reception status of a plurality of the periodic messages in the state detected by the state detection unit, the reception status being one of a reception interval or a reception frequency in which the periodic messages are received.
2 . The detection device according to claim 1 , wherein in the detection processing, the processing unit detects the unauthorized message when the reception interval of the periodic messages is beyond a predetermined threshold.
3 . The detection device according to claim 2 , wherein in the detection processing, the processing unit calculates a difference between the reception interval and a transmission period corresponding to the periodic message for each type of the periodic message, and, in a case where the calculated difference is greater than or equal to a predetermined threshold value, the processing unit determines that the unauthorized message is present.
4 . The detection device according to claim 3 , wherein the threshold value is set based on variation in a transmission period of the periodic messages analyzed based on a measurement result in a vehicle in which the in-vehicle network is provided.
5 . The detection device according to claim 2 ,
wherein the periodic message can be divided and transmitted in a plurality of frames in the in-vehicle network, and
the processing unit detects the unauthorized message based on a reception interval of frames at the same place in a division sequence.
6 . The detection device according to claim 1 , wherein the processing unit performs the detection processing based on the reception frequency of frames that include part or all of the periodic message.
7 . The detection device according to claim 1 , further including:
a relay unit configured to relay a message between a plurality of in-vehicle devices in the in-vehicle network,
wherein the relay unit does not relay the unauthorized message detected by the processing unit.
8 . The detection device according to claim 1 ,
wherein the state detection unit detects the transition to the state, in a case where a specific message was received, and
the specific message is a message compliant with SOME/IP (Scalable service-Oriented MiddlewarE over IP).
9 . The detection device according to claim 1 , further including:
an output unit configured to perform at least one of storing information regarding the unauthorized message and outputting a warning, in a case where presence of the unauthorized message was detected by the processing unit.
10 . A detection method performed in a detection device that detects presence of an unauthorized message in an in-vehicle network, the detection method comprising the steps of:
detecting a transition to a periodic state, the periodic state being a state in which a periodic message is transmitted in an in-vehicle network, wherein each message transmitted in the in-vehicle network includes a frame having a header and the transition to the periodic state is determined when the header of the message includes specific content that is transmitted immediately before the start of periodic messages between a client and a server; and
detecting presence of the unauthorized message based on a reception status of a plurality of the periodic messages in the detected state, the reception status being one of a reception interval or a reception frequency in which the periodic messages are received.
11 . A computer program product for use in a detection device configured to detect unauthorized messages in an in-vehicle network, the computer program product comprising a non-transitory, machine-readable medium storing instructions which, when executed by at least one programmable processor, causes the at least one programmable processor to perform operations comprising:
detecting a transition to a periodic state, the periodic state being a state in which a periodic message is transmitted in an in-vehicle network, wherein each message transmitted in the in-vehicle network includes a frame having a header and the transition to the periodic state is determined when the header of the message includes specific content that is transmitted immediately before the start of periodic messages between a client and a server; and
a processing unit configured to perform detection processing to detect presence of the unauthorized message based on a reception status of a plurality of the periodic messages in the state detected by the state detection unit, the reception status being one of a reception interval or a reception frequency in which the periodic messages are received.