In-vehicle information processing for unauthorized data

A control system for processing a data frame flowing in a network, the network including at least one electronic control unit, the control system comprising:

• a processor;
• and
• a storage device,
• wherein the processor sequentially receives a plurality of data frames flowing in the network,
• wherein the processor records, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information,
• wherein the processor acquires, from the reception interval information, a first distribution of the reception intervals between the plurality of data frames,
• wherein the processor determines a presence or an absence of an unauthorized data frame among the plurality of data frames,
• wherein a normal model indicating a second distribution of normal data frames is stored in the storage device, and
• in determining the presence or the absence of the unauthorized data frame by the processor, a difference between the normal model and the first distribution of the reception intervals between the plurality of data frames is calculated, and the presence or the absence of the unauthorized data frame is determined in accordance with the difference,
• wherein the normal model indicates an amount of statistics of reception intervals between the normal data frames as the second distribution,
• wherein the first distribution is an amount of statistics of the reception intervals between the plurality of data frames, and
• wherein in the determining the presence or the absence of the unauthorized data frame, a difference between the amount of statistics of the reception intervals between the normal data frames and the amount of statistics of the reception intervals between the plurality of data frames is calculated, and whether the unauthorized data frame is present among the plurality of data frames is determined based on a magnitude of the difference.

A method, performed by a control system including a storage device, for processing a data frame flowing in a network, the method comprising:

• sequentially receiving a plurality of data frames flowing in the network;
• recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information;
• acquiring, from the reception interval information, a first distribution of the reception intervals between the plurality of data frames;
• and
• determining a presence or an absence of an unauthorized data frame among the plurality of data frames,
• wherein a normal model indicating a second distribution of normal data frames is stored in the storage device,
• wherein in the determining of the presence or the absence of the unauthorized data frame, a difference between the normal model and the first distribution of the reception intervals between the plurality of data frames is calculated, and the presence or the absence of the unauthorized data frame is determined in accordance with the difference,
• wherein the normal model indicates reception intervals between the normal data frames as the second distribution,
• wherein the first distribution is an anomaly score of the reception intervals between the plurality of data frames, and the anomaly score is calculated by using a probability distribution between the reception intervals between the plurality of data frames and the reception intervals between the normal data frames indicated by the normal model, and
• wherein in the determining the presence or the absence of the unauthorized data frame, whether the unauthorized data frame is present among the plurality of data frames is determined based on the anomaly score.

A method, performed by a control system including a storage device, for processing a data frame flowing in a network, the method comprising:

• sequentially receiving a plurality of data frames flowing in the network;
• recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information;
• acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames;
• and
• determining a presence or an absence of an unauthorized data frame among the plurality of data frames,
• wherein a normal model indicating a property of a normal data frame is further stored in the storage device,
• wherein the normal model indicates reception intervals between normal data frames as the property,
• wherein the acquired feature is an anomaly score of the reception intervals between the plurality of data frames, and the anomaly score is calculated by using a probability distribution between the reception intervals between the plurality of data frames and the reception intervals between the normal data frames indicated by the normal model, and
• wherein in the determining the presence or the absence of the unauthorized data frame, the presence or the absence of the unauthorized data frame among the plurality of data frames is determined by using the feature acquired by using the reception interval information, the normal model, and the anomaly score.