# US 12,003,521 B2 · Anomaly detection method and anomaly detection device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,521 B2 - Document ID: US12003521B2 - Status: Granted - Kind: B2 - Application number: 17/082,431 - Filed: 2020-10-28 - Published: 2021-02-11 - Granted: 2024-06-04 - Earliest claimed: 2018-07-27 - Assignees: Panasonic Intellectual Property Corporation of America - Applicants: Panasonic Intellectual Property Corporation of America - Inventors: Takeshi Kishikawa; Yoshihiro Ujiie; Ryo Hirano; Tohru Wakabayashi - Web page: https://patentgrep.com/patent/US12003521B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/554: {involving event detection and direct action} - H04L 12/40: Bus networks - H04L 12/40013: {Details regarding a bus controller} - H04L 12/4035: {in which slots of a TDMA packet structure are assigned based on a contention resolution carried out at a master unit (TDM/TDMA multiplex systems per se H04J3/1694; hybrid switching systems H04L12/64)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2012/40208: {characterized by the use of a particular bus standard} - H04L 2012/40241: {Flexray} - H04L 2012/40273: {the transportation system being a vehicle} - H04W 4/48: for in-vehicle communication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An anomaly detection device included in a communication network adopting a time-triggered protocol based on a time slot includes: a frame transceiver that receives frames; and an anomaly detector that detects an occurrence of an anomalous frame in accordance with a time slot among a plurality of time slots included in a cycle and the number of repeated cycles of the cycle for each frame. The anomaly detector detects an occurrence of an anomalous frame by verifying a statistic on the frames received while the cycle is repeated a predetermined number of times, which is at least once, against a rule indicating a reference range of the statistic. ## Claims ### Claim 1 An anomaly detection device included in a communication network adopting a time-triggered protocol based on a time slot, the communication network including a plurality of communication devices that connect to each other, each of the plurality of communication devices transmitting or receiving one or more frames for each predetermined time slot in a predetermined cycle, the predetermined time slot being one time slot of a plurality of time slots, the predetermined cycle being one cycle of repeated cycles, the anomaly detection device comprising: a frame receiver that receives the one or more frames; and an anomaly detector that detects an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received by the frame receiver, wherein the anomaly detector performs the detection by verifying a statistic on the one or more frames against a rule indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle, each frame of the one or more frames is classified according to a first type, the first type being a type according to meta information included in each frame of the one or more frames, the statistic includes a first statistic on a total number of each type of frames classified according to the first type, in the predetermined cycle, the rule includes a first rule indicating a reference range of the first statistic, and the anomaly detector detects an occurrence of an anomalous frame from among the one or more frames by verifying the first statistic against the first rule. ### Claim 2 (depends on 1) The anomaly detection device according to claim 1, wherein each frame of the one or more frames is classified according to a second type, the second type being a type according to content of a payload of each frame of the one or more frames, the statistic includes a second statistic on at least one of: a total number of each type of frames classified according to the second type, in two or more cycles that include the predetermined cycle; and a total number of each type of frames classified according to the first type and the second type, in two or more cycles that include the predetermined cycle, the rule includes a second rule indicating a reference range of the second statistic, and the anomaly detector detects an occurrence of an anomalous frame by verifying the second statistic against the second rule. ### Claim 3 (depends on 2) The anomaly detection device according to claim 2, wherein when detecting an occurrence of an anomalous frame using one of the first rule and the second rule, the anomaly detector further determines, using an other of the first rule and the second rule, whether the anomalous frame has occurred. ### Claim 4 (depends on 1) The anomaly detection device according to claim 1, wherein when detecting an occurrence of an anomalous frame, the anomaly detector further determines whether each frame of the one or more frames is anomalous. ### Claim 5 (depends on 4) The anomaly detection device according to claim 4, wherein the anomaly detector determines that a frame from among the one or more frames is anomalous when (i) the time slot in which the frame is received is the each predetermined time slot in the predetermined cycle and (ii) a relationship, in which a remainder is 0 if a value obtained by subtracting a predetermined offset value from a value of the number of repeated cycles of the predetermined cycle in which the frame is transmitted is divided by a predetermined cycle reception, is not satisfied. ### Claim 6 (depends on 1) The anomaly detection device according to claim 1, wherein the plurality of time slots included in the plurality of cycles include a dynamic time slot in which a frame is transmitted or received as needed for each of the plurality of cycles, and the anomaly detector determines whether a dynamic frame received in the dynamic time slot is anomalous, in accordance with: a vehicle status determined from a frame received before the dynamic frame is received; and information included in the dynamic frame. ### Claim 7 (depends on 6) The anomaly detection device according to claim 6, wherein if the vehicle status is not a predetermined status when the dynamic frame including a number of repeated cycles satisfying a predetermined relationship with a slot identification (ID) of the dynamic frame is received, the anomaly detector determines that the dynamic frame is anomalous. ### Claim 8 (depends on 1) The anomaly detection device according to claim 1, wherein the time-triggered protocol is a predetermined communication protocol, the number of repeated cycles refers to a cycle count defined in the predetermined communication protocol, and the first statistic includes at least one of: a total number of the one or more frames received; a total number of one or more null frames received; a total number of one or more sync frames received; a total number of one or more startup frames received; a total number of one or more frames each having a payload preamble indicator indicating 1; and a total number of one or more frames received each having an error. ### Claim 9 An anomaly detection method executed in a communication network adopting a time-triggered protocol based on a time slot, the communication network including a plurality of communication devices that connect to each other, each of the plurality of communication devices transmitting or receiving one or more frames for each predetermined time slot in a predetermined cycle, the predetermined time slot being one time slot of a plurality of time slots, the predetermined cycle being one cycle of repeated cycles, the anomaly detection method comprising: receiving the one or more frames; and detecting an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received in the receiving, wherein the detecting is performed by verifying a statistic on the one or more frames against a rule indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle, each frame of the one or more frames is classified according to a first type, the first type being a type according to meta information included in each frame of the one or more frames, the statistic includes a first statistic on a total number of each type of frames classified according to the first type, in the predetermined cycle, the rule including a first rule indicating a reference range of the first statistic, and the detecting includes detecting an occurrence of an anomalous frame from among the one or more frames by verifying the first statistic against the first rule.