Back to results
US 12,659,335 B2Granted
Fraud detection method, fraud detection device, and recording medium
AssigneePanasonic Intellectual Property Corporation of America
InventorsManabu Maeda, Takeshi Kishikawa, Daisuke Kunimune
Life of this patent
Estimating the term…
Abstract
A fraud detection method includes: determining whether a period of a message repeatedly transmitted in an in-vehicle network is anomalous; detecting whether arbitration occurs when the message is transmitted in the in-vehicle network; and determining that the message is an anomalous message, in the case where the period of the message is anomalous and no arbitration occurs when the message is transmitted in the in-vehicle network.
Claims21
A non-transitory computer-readable recording medium having recorded thereon a computer program for causing a computer to execute a fraud detection method for detecting an anomalous message in an in-vehicle network, executed by a computer, the fraud detection method comprising:
- receiving a first message transmitted in the in-vehicle network, the first message being scheduled to be received at a scheduled time that is an elapsed time from a reception time of a second message received last before the first message, the second message being with a same data type as the first message;
- assessing whether a condition 1 is met, the condition 1 being that a reception time of the first message is within a predetermined range, the predetermined range including the scheduled time;
- assessing whether a condition 2 is met, the condition 2 being that arbitration occurs when receiving the first message, the arbitration being that one or more consecutive third messages and the first message following the one or more consecutive third messages are received at less than or equal to a time interval set beforehand;
- assessing whether a condition 3 is that (a) a start time of the arbitration is earlier than an upper limit of the predetermined range or that (b) the start time of the arbitration is equal to or later than the upper limit of the predetermined range, the start time of the arbitration being a reception time of a message with an earliest reception time among the one or more consecutive third messages;
- determining that the first message is a normal message, when the condition 1 is met and the condition 2 is not met;
- determining that the first message is a normal message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (a);
- determining that the first message is an anomalous message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (b);
- and
- determining that the first message is an anomalous message, when the condition 1 is not met and the condition 2 is not met,
- wherein the fraud detection method further comprises:
- deciding a start point for calculating a scheduled time of a fourth message received immediately after the first message in accordance with information about the first message, the fourth message being with the same data type as the first message;
- and
- determining whether a reception time of the fourth message is within a second predetermined range including the scheduled time of the fourth message that is an elapsed time from the start point.
10 more elements
A fraud detection device that detects an anomalous message in an in-vehicle network, the fraud detection device comprising:
- one or more hardware processors;
- and
- a non-transitory storage,
- wherein the one or more processors, using the storage:
- receive a first message transmitted in the in-vehicle network, the first message being scheduled to be received at a scheduled time that is an elapsed time from a reception time of a second message received last before the first message, the second message being with a same data type as the first message;
- assess whether a condition 1 is met, the condition 1 being that a reception time of the first message is within a predetermined range, the predetermined range including the scheduled time;
- assess whether a condition 2 is met, the condition 2 being that arbitration occurs when receiving the first message, the arbitration being that one or more consecutive third messages and the first message following the one or more consecutive third messages are received at less than or equal to a time interval set beforehand;
- assess whether a condition 3 is that (a) a start time of the arbitration is earlier than an upper limit of the predetermined range or that (b) the start time of the arbitration is equal to or later than the upper limit of the predetermined range, the start time of the arbitration being a reception time of a message with an earliest reception time among the one or more consecutive third messages;
- determine that the first message is a normal message, when the condition 1 is met and the condition 2 is not met;
- determine that the first message is a normal message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (a);
- determine that the first message is an anomalous message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (b);
- and
- determine that the first message is an anomalous message, when the condition 1 is not met and the condition 2 is not met,
- wherein the one or more hardware processors further:
- decide a start point for calculating a scheduled time of a fourth message received immediately after the first message in accordance with information about the first message, the fourth message being with the same data type as the first message;
- and
- determine whether a reception time of the fourth message is within a second predetermined range including the scheduled time of the fourth message that is an elapsed time from the start point.
14 more elements
Dependencies are inferred from the claim text.