FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003
COMPLETE SPECIFICATION
(See section 10, rule 13)
“INFORMATION PROCESSING DEVICE, MOVING APPARATUS,
METHOD, AND PROGRAM”
SONY CORPORATION, of 1-7-1, Konan, Minato-ku,
Tokyo 108-0075, Japan
The following specification particularly describes the invention and the manner in which it is to
be performed.
2
DESCRIPTION
INFORMATION PROCESSING APPARATUS, MOVING APPARATUS,
METHOD, AND PROGRAM
5 TECHNICAL FIELD
[0001]
The present disclosure relates to an information
processing apparatus, a moving apparatus, a method, and a
program. More specifically, the present disclosure
10 relates to an information processing apparatus, a moving
apparatus, a method, and a program, each of which
performs monitoring of processing executed in an
electronic control unit (ECU) attached to a moving
apparatus such as a vehicle, prevention of occurrence of
15 abnormalities, and the like.
BACKGROUND ART
[0002]
Recent automobiles are equipped with a large number
20 of electronic control units (ECUs) controlled by programs
(software).
For example, an automobile is equipped with various
different electronic control units (ECUs) such as an
electronic control unit (ECU) that performs drive control
25 of the automobile, an electronic control unit (ECU) that
performs control other than control of a drive system,
such as opening and closing of doors, air conditioning
control, and displaying control of a display, and those
electronic control units perform various kinds of
30 processing in accordance with individual programs,
respectively.
3
[0003]
Such a plurality of ECUs is connected to each other
by, for example, a controller area network (CAN)
standardized as an in-vehicle network, and is configured
to transmit and receive CAN messages conforming 5 to a CAN
protocol via the network.
[0004]
However, the ECUs controlled by programs (software)
may be illegally controlled by, for example, a virus or
10 malicious program intruding from outside of the network.
The virus and the like may intrude at various
timings from, for example, an external device, an
external storage medium, or the like connected to the
CAN.
15 [0005]
Therefore, in many cases, a system including the
ECUs is provided with a monitoring apparatus for
performing detection of fraud and restoration processing.
The monitoring apparatus acquires, for example, log
20 information corresponding to various kinds of processing
executed in the ECUs, and performs detection of fraud,
restoration, and the like on the basis of the log
information.
Note that the system is also configured as follows:
25 log information acquired by the monitoring apparatus of
the vehicle is transmitted to an external server, and the
server executes analysis of fraud and transmits an
analysis result to the monitoring apparatus of the
vehicle, and then elimination of the fraud and
30 restoration processing are performed by using the
analysis result received by the monitoring apparatus from
4
the server.
[0006]
In a case where such analysis of fraud based on log
information is performed, it is necessary to collect log
information corresponding to communication 5 messages (CAN
messages) transmitted and received by the ECUs connected
to the network.
However, in the configuration in which the
plurality of ECUs is connected to a single network, i.e.,
10 the CAN, various CAN messages are transmitted and
received via the network (CAN) even in a normal state.
In a case where some special processing is further
performed, more messages are transmitted and received.
[0007]
15 When the monitoring apparatus further attempts to
collect logs from each ECU while a large number of
messages are being transmitted and received as described
above, it is necessary to transmit and receive log
messages from each ECU to the monitoring apparatus by
20 using a limited bandwidth of the network. This reduces
an available bandwidth. As a result, there arises a
problem that transmission and reception of normal control
messages are congested or delayed.
[0008]
25 As a related art, for example, Patent Document 1
(Japanese Patent Application Laid-Open No. 2010-206698)
discloses control performed in a case where a large
amount of log information is generated.
Patent Document 1 discloses a configuration in
30 which priority is set for log messages and, in a case
where a resource load is in a high state, only high5
priority log messages are selectively collected.
However, the configuration described in Patent
Document 1 is a configuration in which collection of log
messages is controlled only on the basis of the state of
5 the resource load.
[0009]
In a case where, in the network to which the
plurality of ECUs is connected, for example, a virus is
detected, it is necessary to rapidly perform processing
10 for removing the virus and eliminating an influence of
the virus.
In the configuration in which log messages are
collected only on the basis of the state of the resource
load described in Patent Document 1, even if a virus is
15 detected, acquisition of log messages is restricted in a
case where it is determined that the resource load is
large. Thus, the configuration may fail in acquiring log
messages required for virus countermeasures.
20 CITATION LIST
PATENT DOCUMENT
[0010]
Patent Document 1: Japanese Patent Application Laid-Open
No. 2010-206698
25
SUMMARY OF THE INVENTION
PROBLEMS TO BE SOLVED BY THE INVENTION
[0011]
The present disclosure has been made in view of,
30 for example, the above problems. It is therefore an
object thereof to provide an information processing
6
apparatus, a moving apparatus, a method, and a program,
each of which is configured so that, in a network to
which a plurality of electronic control units (ECUs) is
connected, logs corresponding to messages transmitted
from and received by the respective ECUs 5 are selectively
acquired in accordance with a status of a network
bandwidth, and can efficiently prevent illegal processing
caused by a virus or the like, without reducing a
bandwidth for normal communication messages via the
10 network.
SOLUTIONS TO PROBLEMS
[0012]
A first aspect of the present disclosure is
15 an information processing apparatus including
a processing monitoring unit configured to execute
processing of monitoring a data communication network, in
which:
the processing monitoring unit includes
20 a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
and
a virus monitoring unit configured to collect log
information corresponding to a communication message in
25 the data communication network and perform virus
detection based on the log information; and
the virus monitoring unit
is configured to change a mode of collecting the
log information in accordance with information regarding
30 the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
7
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance 5 with predetermined
priority information.
[0013]
Further, a second aspect of the present disclosure
is
10 a moving apparatus including:
a data communication network configured to transmit
and receive a communication message for controlling a
component of the moving apparatus; and
a processing monitoring unit configured to execute
15 processing of monitoring the data communication network,
in which:
the processing monitoring unit includes
a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
20 and
a virus monitoring unit configured to collect log
information corresponding to a communication message in
the data communication network and perform virus
detection based on the log information; and
25 the virus monitoring unit
is configured to change a mode of collecting the
log information in accordance with information regarding
the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
30 in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
8
a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.
5 [0014]
Further, a third aspect of the present disclosure
is
an information processing method executed in an
information processing apparatus, the method including
10 causing a processing monitoring unit configured to
execute processing of monitoring a data communication
network to execute
system load monitoring processing of monitoring an
available bandwidth of the data communication network,
15 and
virus monitoring processing of collecting log
information corresponding to a communication message in
the data communication network and performing virus
detection based on the log information, in which
20 in the virus monitoring processing,
the processing monitoring unit executes processing
of changing a mode of collecting the log information in
accordance with information regarding the available
bandwidth of the data communication network acquired by
25 the system load monitoring unit, and
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
a predetermined threshold, the processing monitoring unit
collects only limited log information corresponding to a
30 high-priority communication message in accordance with
predetermined priority information.
9
[0015]
Further, a fourth aspect of the present disclosure
is
a program for causing an information processing
apparatus to execute information 5 processing,
the program causing a processing monitoring unit
configured to execute processing of monitoring a data
communication network to execute
system load monitoring processing of monitoring an
10 available bandwidth of the data communication network,
and
virus monitoring processing of collecting log
information corresponding to a communication message in
the data communication network and performing virus
15 detection based on the log information, in which
in the virus monitoring processing,
the program causes the processing monitoring unit
to
execute processing of changing a mode of collecting
20 the log information in accordance with information
regarding the available bandwidth of the data
communication network acquired by the system load
monitoring unit, and
in a case where the available bandwidth of the data
25 communication network is neither equal to nor larger than
a predetermined threshold, collect only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.
30 [0016]
Note that the program of the present disclosure is,
10
for example, a program that can be provided by a storage
medium or a communication medium in a computer-readable
format for an information processing apparatus or a
computer system capable of executing various program
codes. By providing such a program 5 in a computerreadable
format, processing corresponding to the program
is realized in the information processing apparatus or
computer system.
[0017]
10 Other objects, features, and advantages of the
present disclosure will be apparent from more detailed
description based on embodiments of the present
disclosure described below and the accompanying drawings.
Note that, in this specification, a system is a logical
15 set configuration of a plurality of apparatuses, and is
not limited to a configuration in which apparatuses
having respective configurations are included in the same
housing.
20 EFFECTS OF THE INVENTION
[0018]
According to a configuration of an embodiment of
the present disclosure, efficient virus detection and
removal are realized by changing a mode of collecting
25 logs in accordance with a network usage status.
Specifically, for example, the configuration
includes a processing monitoring unit that executes
processing of monitoring a data communication network,
and the processing monitoring unit includes a system load
30 monitoring unit that monitors an available bandwidth of a
network and a virus monitoring unit that collects log
11
information corresponding to a communication message and
performs virus detection. The virus monitoring unit
changes a mode of collecting log information in
accordance with information regarding the available
bandwidth of the network acquired 5 by the system load
monitoring unit. In a case where a virus is detected and
the available bandwidth is neither equal to nor larger
than a predetermined threshold, only limited log
information corresponding to a high-priority
10 communication message is collected.
With this configuration, efficient virus detection
and removal are realized by changing the mode of
collecting logs in accordance with the network usage
status.
15 Note that the effects described in the present
specification are merely examples, are not limited, and
may have additional effects.
BRIEF DESCRIPTION OF DRAWINGS
20 [0019]
Fig. 1 shows a configuration example of a moving
apparatus.
Fig. 2 shows a network configuration example of a
moving apparatus.
25 Fig. 3 shows a configuration example of an
electronic control unit (ECU).
Fig. 4 is a flowchart showing a processing sequence
executed by a processing monitoring unit.
Fig. 5 shows examples of predetermined log
30 information priority.
Fig. 6 is a flowchart showing a sequence of setting
12
a program executed by a processing monitoring unit,
defining an event, switching processing, and the like.
Fig. 7 shows a plurality of kinds of processing
executed by a processing monitoring unit and specific
examples of an event serving as a trigger 5 for switching
processing.
Fig. 8 is a flowchart showing a processing sequence
executed by a processing monitoring unit.
Fig. 9 shows a configuration example of a moving
10 apparatus serving as a probe car.
Fig. 10 shows a network configuration example of a
moving apparatus that is a probe car.
Fig. 11 is a flowchart showing a processing
sequence executed by a processing monitoring unit of a
15 moving apparatus that is a probe car.
Fig. 12 is a flowchart showing a processing
sequence executed by a processing monitoring unit of a
moving apparatus that is a probe car.
Fig. 13 shows examples of predetermined log
20 information priority.
Fig. 14 shows a configuration example in which a
single ECU is provided in a processing monitoring unit of
a moving apparatus.
Fig. 15 shows a configuration example in which a
25 processing monitoring unit of a moving apparatus is
provided as an information processing apparatus
attachable to and detachable from the moving apparatus.
Fig. 16 shows a hardware configuration example of
an information processing apparatus.
30
MODE FOR CARRYING OUT THE INVENTION
13
[0020]
Hereinafter, details of an information processing
apparatus, a moving apparatus, a method, and a program of
the present disclosure will be described with reference
to the drawings. Note that description 5 will be made in
accordance with the following items.
1. Configuration example of moving apparatus
2. Processing executed by processing monitoring
unit
10 3. Configuration in which three or more kinds of
processing are switched in accordance with available
bandwidth of CAN network
4. Examples of log collection processing in probe
car
15 5. Other embodiments
6. Summary of configurations of present disclosure
[0021]
[1. Configuration example of moving apparatus]
First, a configuration example of a moving
20 apparatus will be described with reference to Figs. 1 and
the like.
Note that, in the following embodiment, an
embodiment in which a moving apparatus 10 is an
automobile (vehicle) will be described as an example of
25 the moving apparatus 10. However, processing of the
present disclosure can be used in various moving
apparatuses other than automobiles.
A configuration of the present disclosure is
applicable not only to automobiles but also to, for
30 example, various moving apparatuses such as (walking and
traveling) robots, flying objects such as drones, and
14
apparatuses that move on or in water such as ships and
submarines.
[0022]
Fig. 1 shows a configuration example of an
automobile (vehicle) that is an example 5 of the moving
apparatus 10.
As shown in Fig. 1, the moving apparatus 10
includes a steering 11, a shift lever 12, a display unit
13, an engine 14, an accelerator 15, a brake 16, a
10 processing monitoring unit 17, an in-vehicle electronic
device group (ECU group) 18, a GPS receiver 19, a storage
unit 20, a communication unit 21, and an input/output IF
22.
Note that those components are merely some main
15 components of the moving apparatus 10, and the moving
apparatus 10 includes many other components in addition
to those components.
[0023]
Among the components shown in Fig. 1, the in20
vehicle electronic device group (ECU group) 18 includes a
plurality of electronic control units (ECUs), and each
ECU controls each configuration unit of the moving
apparatus 10.
The ECU is connected to each component of the
25 moving apparatus 10 by a controller area network (CAN)
standardized as an in-vehicle network, and performs
control by transmitting and receiving a CAN message
conforming to a CAN protocol.
[0024]
30 The ECUs in the in-vehicle electronic device group
(ECU group) 18 execute, for example, various kinds of
15
control such as drive control regarding driving of the
moving apparatus 10 such as the engine 14 and the
steering 11, control of display information on the
display unit 13, control of opening, closing, locking,
and the like of doors, and communication 5 control in the
communication unit 21.
The above control is performed by programs
(software) executed by the ECUs.
[0025]
10 The plurality of electronic control units (ECUs)
included in the in-vehicle electronic device group (ECU
group) 18 can be roughly classified into the following
three groups:
(1) a drive system control ECU that performs drive
15 control regarding driving of the moving apparatus 10 such
as the engine 14, the steering 11, the shift lever 12,
the accelerator 15, and the brake 16;
(2) a body system control ECU that performs control
of a body system other than a drive system of the moving
20 apparatus, such as control of the display unit 13,air
conditioning, and opening, closing, and locking of doors;
and
(3) a communication system control ECU that
performs control regarding the communication unit 21, the
25 input/output IF 22, the GPS receiver 19, and the like
which perform communication or input and output of data
with an external device or external storage device.
[0026]
Those electronic control units (ECUs) perform
30 various kinds of processing in accordance with individual
programs, respectively.
16
[0027]
However, the ECUs controlled by programs (software)
may be illegally controlled by a virus or malicious
program intruding from the outside.
The virus may intrude at various 5 timings from, for
example, various wired or wireless illegal devices that
illegally access the CAN from the outside.
The processing monitoring unit 17 shown in Fig. 1
is a monitoring apparatus for performing detection of
10 such a virus and restoration processing.
[0028]
The processing monitoring unit 17 acquires, for
example, log information corresponding to various kinds
of processing executed in the ECUs, specifically, for
15 example, log information corresponding to communication
messages transmitted and received by the ECUs, and
performs detection of fraud, restoration processing, and
the like on the basis of the acquired log information.
[0029]
20 Further, the processing monitoring unit 17
transmits the acquired log information to an external
server. The server executes analysis based on the log
information, and transmits an analysis result to the
processing monitoring unit 17. The processing monitoring
25 unit 17 removes fraud (virus, program, or the like) and
performs restoration processing by using the analysis
result received from the server.
[0030]
As described above, the plurality of electronic
30 control units (ECUs) included in the in-vehicle
electronic device group (ECU group) 18 controls each
17
component of the moving apparatus 10 shown in Fig. 1.
Control data for this control is transferred via the
controller area network (CAN) standardized as the invehicle
network.
The ECUs and other components connected 5 to the CAN
transmit and receive CAN messages that are communication
messages conforming to the CAN protocol.
[0031]
Fig. 2 shows a network configuration example of the
10 CAN.
A moving apparatus 100 shown in Fig. 2 includes a
plurality of ECUs 102, 103, and 111 to 113 and is
configured so that such a plurality of ECUs is connected
to a CAN network 120 that is an in-vehicle network.
15 The ECUs 102 and 103 are ECUs included in a
processing monitoring unit 101.
The ECUs 111 to 113 correspond to the three kinds
of ECUs described above with reference to Fig. 1, i.e.,
the drive system control ECU, the body system control
20 ECU, and the communication system control ECU.
[0032]
Not only the ECUs but also various components to be
controlled by the ECUs, i.e., an engine, an accelerator,
and the like are connected to the CAN network. Those
25 components are controlled in response to control messages
generated by the ECUs in accordance with programs
(software).
The ECUs perform control by generating a CAN
message conforming to the CAN protocol and transmitting
30 the message to various targets to be controlled.
[0033]
18
The ECUs shown in Fig. 2 are the following five
ECUs:
(1) an ECU-1a (system load monitoring ECU) 102;
(2) an ECU-1b (virus monitoring & log collection
5 ECU) 103;
(3) an ECU-2a (drive system control ECU) 111;
(4) an ECU-2b (body system control ECU) 112; and
(5) an ECU-2c (communication system control ECU)
113.
10 [0034]
“(3) The ECU-2a (drive system control ECU) 111” is
a drive system control ECU that performs drive control
regarding driving of the moving apparatus 100 such as an
engine, a steering, a shift lever, an accelerator, and a
15 brake.
“(4) The ECU-2b (body system control ECU) 112” is a
body system control ECU that performs control of a body
system other than a drive system of the moving apparatus,
such as control of a display unit, air conditioning, and
20 opening, closing, and locking of doors.
“(5) The ECU-2c (communication system control ECU)
113” is a communication system control ECU that performs
control regarding a communication unit, an input/output
IF, a GPS receiver, and the like which perform
25 communication or input and output of data with an
external device or external storage device.
[0035]
Those ECUs 111 to 113 control each component of the
moving apparatus 100 by transmitting a CAN message
30 conforming to the CAN protocol to each component of the
moving apparatus 100 via the controller area network
19
(CAN) 120.
[0036]
“(1) The ECU-1a (system load monitoring ECU) 102”
and “(2) the ECU-1b (virus monitoring & log collection
ECU) 103” are ECUs included in the processing 5 monitoring
unit 101.
Note that those two ECUs can also be configured as
a single ECU.
[0037]
10 “(1) The ECU-1a (system load monitoring ECU) 102”
mainly monitors a communication status of the CAN network
120. Specifically, the ECU monitors a bandwidth usage
status of the network.
The CAN network 120 is a path for packets such as
15 control messages transmitted and received between the
ECUs and other apparatuses connected to the network, and
traffic changes depending on a situation.
For example, when the moving apparatus 100 starts
moving, it is necessary to simultaneously control various
20 devices, and the traffic (communication traffic) of the
network is increased.
In addition, in a case where behavior is greatly
changed or in other cases, such as when the moving
apparatus 100 switches from forward to reverse, the
25 number of control messages is increased, and the
communication traffic is also increased.
[0038]
“(2) The ECU-1b (virus monitoring & log collection
ECU) 103” acquires log information based on a CAN message
30 transmitted and received via the CAN network 120, i.e., a
control message to each configuration unit of the moving
20
apparatus 100, such as the engine and the accelerator,
and executes virus exposing processing or the like based
on the log information.
[0039]
The ECU-1b (virus monitoring & log 5 collection ECU)
103 can access a virus database (DB) 105 storing virus
pattern data.
The ECU-1b (virus monitoring & log collection ECU)
103 verifies whether or not a virus having the same
10 pattern as a virus pattern stored in the virus database
(DB) 105 is included in a control message transmitted and
received in the CAN network 102.
In a case where a virus is detected, antivirus
processing for eliminating the virus, such as
15 invalidating the message, is performed.
[0040]
Further, the ECU-1b (virus monitoring & log
collection ECU) 103 transmits the collected log
information to a log analysis server 200 via a
20 communication unit 104.
The log analysis server 200 executes a more
advanced log analysis to detect a virus, a malicious
program, and the like that cannot be checked only by
processing of matching with virus patterns stored in the
25 virus database 105 of the moving apparatus 100, generates
detection information, countermeasure processing
information, and the like, and transmits the information
to the ECU-1b (virus monitoring & log collection ECU)
103.
30 [0041]
The ECU-1b (virus monitoring & log collection ECU)
21
103 executes countermeasure processing such as virus
removal on the basis of the virus detection information
and the countermeasure processing information received
from the log analysis server 200.
5 [0042]
As described above, the processing monitoring unit
101 performs processing by using the following two ECUs:
(1) the ECU-1a (system load monitoring ECU) 102;
and
10 (2) the ECU-1b (virus monitoring & log collection
ECU) 103.
[0043]
Herein, the processing monitoring unit 101 changes
log information to be collected from the CAN network 120
15 in accordance with an increase or decrease of the traffic
of the CAN network 120.
Specifically, the ECU-1a (system load monitoring
ECU) 102 monitors the communication status of the CAN
network 120, and, in a case where the traffic
20 (communication usage bandwidth) of the CAN network 120 is
equal to or less than a predetermined threshold, the ECU-
1b (virus monitoring & log collection ECU) 103 collects
log information corresponding to all communication
messages from the CAN network 120 and transmits the log
25 information to the log analysis server 200.
[0044]
Note that the log information includes, for
example, contents of a communication message, a message
length, a communication period, communication sequence
30 information, and the like included in the communication
message in the CAN network 120.
22
The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and
analyzes the contents of the communication message, the
message length, the communication 5 period, the
communication sequence, and the like, and then transmits
each piece of the above information to the log analysis
server 200 as log information.
[0045]
10 Meanwhile, in a case where the traffic
(communication usage bandwidth) of the CAN network 120 is
larger than the predetermined threshold, the ECU-1b
(virus monitoring & log collection ECU) 103 sets log
information to be acquired on the basis of communication
15 messages in the CAN network 120 to a log corresponding to
a communication message limited in accordance with
predetermined priority, and transmits only the collected
limited log to the log analysis server 200.
A specific example of this log collection based on
20 the traffic will be described later in detail.
[0046]
The moving apparatus 100 shown in Fig. 2 includes
the plurality of ECUs, and each of those ECUs controls
various targets to be controlled, e.g., targets to be
25 controlled such as the engine and the accelerator, in
accordance with programs (software). Specifically, the
ECUs perform control by generating a CAN message
conforming to the CAN protocol and transmitting the
message to various targets to be controlled.
30 A general configuration example of each ECU will be
described with reference to Fig. 3.
23
[0047]
Fig. 3 shows a basic hardware configuration example
of an ECU 200.
As shown in Fig. 3, the ECU 200 includes a central
processing unit (CPU) 201, a read only 5 memory (ROM) 202,
a random access memory (RAM) 203, a network IF 206, an
input/output unit 207, a storage unit 208, and a
communication unit 209.
Note that the configuration of the ECU 200 shown in
10 Fig. 3 is merely an example, and each ECU is not limited
to the configuration shown in Fig. 3, and may have
various configurations in accordance with a target to be
controlled by each ECU.
[0048]
15 The configuration of the ECU 200 shown in Fig. 3
will be described.
The CPU 201 functions as a data processing unit
that executes various kinds of processing in accordance
with programs stored in the ROM 202 or storage unit 208.
20 The RAM 203 stores programs to be executed by the CPU
201, parameters, and various kinds of data. Further, the
RAM 203 is also used as a work area for the programs to
be executed by the CPU 201.
[0049]
25 The network IF 206 is connected to the CAN network
120 and functions as an interface for receiving and
outputting a message via the CAN network.
The input/output unit 207 is an input/output unit
for allowing a user to input data or output data from the
30 ECU. For example, the input/output unit 207 is used to
change or check a program to be executed in the ECU 200,
24
and set, change, or check parameters.
[0050]
The storage unit 208 stores the programs to be
executed by the CPU 201 of the ECU 200, parameters used
for executing the programs, other data, 5 and the like.
The communication unit 209 is used to communicate
with, for example, an external device such as an external
server.
[0051]
10 [2. Processing executed by processing monitoring
unit]
Next, a sequence of processing executed by the
processing monitoring unit 101 included in the moving
apparatus 100 shown in Fig. 2 will be described with
15 reference to a flowchart shown in Fig. 4.
[0052]
Fig. 4 is a flowchart showing a processing sequence
executed by the processing monitoring unit 101.
A flow shown in Fig. 4 is executed by the ECUs in
20 the processing monitoring unit 101.
Specifically, for example, the CPUs in the ECUs
execute the flow in accordance with programs stored in
the storage units.
Hereinafter, processing in each step of the
25 flowchart shown in Fig. 4 will be sequentially described.
[0053]
(Step S101)
First, in step S101, the processing monitoring unit
executes processing of detecting a virus from a
30 communication packet in the CAN network and processing of
monitoring a bandwidth used by the CAN network.
25
[0054]
For example, in the configuration shown in Fig. 2,
the ECU-1a (system load monitoring ECU) 102 monitors the
communication status of the CAN network 120, i.e.,
executes the processing of monitoring 5 the bandwidth used
by the CAN network.
Further, the ECU-1b (virus monitoring & log
collection ECU) 103 acquires a CAN message transmitted or
received via the CAN network 120 and monitors whether or
10 not a virus is included therein.
[0055]
(Step S102)
Next, in step S102, the processing monitoring unit
determines whether or not a virus is detected.
15 That is, the ECU-1b (virus monitoring & log
collection ECU) 103 determines whether or not a virus is
detected from the CAN message transmitted or received via
the CAN network 120.
[0056]
20 In a case where a virus is detected, the processing
proceeds to step S103.
In a case where no virus is detected, the
processing proceeds to step S105.
[0057]
25 (Step S103)
In a case where the ECU-1b (virus monitoring & log
collection ECU) 103 detects a virus from the CAN message
transmitted or received via the CAN network 120 in step
S102, the processing proceeds to step S103.
30 [0058]
In step S103, the processing monitoring unit checks
26
the traffic of the CAN network.
That is, the processing monitoring unit checks
whether or not there is a margin in the available
bandwidth of the CAN network.
Specifically, the ECU-1a (system 5 load monitoring
ECU) 102 monitors the communication status of the CAN
network 120 and determines whether or not there is a
margin in the available bandwidth of the network, i.e.,
whether or not the available bandwidth is equal to or
10 larger than a predetermined threshold.
[0059]
The predetermined threshold can be variously set
and is set to, for example, 50% of the entire available
bandwidth of the CAN network.
15 In step S103, it is determined whether or not the
available bandwidth of the CAN network is 50% or more of
the entire bandwidth.
[0060]
In a case where it is determined in step S103 that
20 the available bandwidth is equal to or larger than the
predetermined threshold (50% or more) and there is a
margin in the available bandwidth of the network, the
processing proceeds to step S104.
Meanwhile, in a case where it is determined that
25 the available bandwidth is less than the predetermined
threshold (less than 50%) and there is no margin in the
available bandwidth of the network, the processing
proceeds to step S105.
[0061]
30 (Step S104)
In a case where it is determined in the
27
determination processing in step S103 that the available
bandwidth is equal to or larger than the predetermined
threshold (50% or more) and there is a margin in the
available bandwidth of the network, the processing
proceeds 5 to step S104.
In step S104, the processing monitoring unit
collects all log information based on communication
messages (communication packets in the CAN network)
issued by each ECU in the moving apparatus, and transmits
10 the log information to the log analysis server 200.
[0062]
Specifically, the ECU-1b (virus monitoring & log
collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 2 collects all logs corresponding to all
15 communication messages in the CAN network 120, and
transmits the collected logs corresponding to all the
communication messages to the log analysis server 200.
[0063]
(Step S105)
20 Meanwhile, in any of the following cases, the
processing proceeds to step S105:
in a case where no virus is detected in the
determination processing in step S102; and
in a case where a virus is detected in the
25 determination processing in step S102 and it is
determined in the determination processing in step S103
that the available bandwidth is less than the
predetermined threshold (less than 50%) and there is no
margin in the available bandwidth of the network.
30 [0064]
In step S105, the processing monitoring unit
28
collects only log information corresponding to a part of
communication messages (communication packets in the CAN
network) issued by each ECU in the moving apparatus and
transmits the log information to the log analysis server
5 200.
[0065]
Specifically, the ECU-1b (virus monitoring & log
collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 2 sets logs to be collected from
10 communication messages in the CAN network 120 only to
logs corresponding to communication messages that are
limited in accordance with predetermined priority, and
transmits only the collected logs corresponding to the
limited messages to the log analysis server 200.
15 [0066]
Note that, in a case where the processing in step
S105 is executed, the processing monitoring unit 101
needs to limit logs to be collected in accordance with
the predetermined priority. The processing monitoring
20 unit 101 holds, in the ECU, a priority list in which
predetermined priority information is registered, and
performs log acquisition processing in accordance with
the held list.
[0067]
25 An example of setting a log information priority
list held in the processing monitoring unit 101 will be
described with reference to Fig. 5.
As shown in Fig. 5, log information priority is set
in accordance with, for example, a system of the ECU that
30 issues a communication message.
Fig. 5 shows the following three kinds of priority
29
for respective ECU systems:
first priority = a communication message issued by
the communication system control ECU;
second priority = a communication message issued by
the drive system 5 control ECU; and
third priority = a communication message issued by
the body system control ECU.
[0068]
The communication system control ECU to which the
10 first priority is set corresponds to the ECU-2c
(communication system control ECU) 113 shown in Fig. 2.
The ECU-2c (communication system control ECU) 113 is a
communication system control ECU that performs control
regarding a communication unit, an input/output IF, a GPS
15 receiver, and the like which perform communication or
input and output of data with an external device or
external storage device.
The external device, the external storage device,
and the like serving as targets to be controlled by the
20 communication system control ECU are likely to be a path
through which a virus or malicious program intrudes.
[0069]
Therefore, in a case where a virus or malicious
program intrudes from the outside, first, the virus or
25 malicious program is likely to be embedded in a
communication message issued by the communication system
control ECU.
For this reason, a log corresponding to a
communication message issued by the communication system
30 control ECU is set to be a log to be collected and
analyzed with the highest priority (first priority).
30
[0070]
Note that the log information collected by the ECU-
1b (virus monitoring & log collection ECU) 103 of the
processing monitoring unit 101 shown in Fig. 2 and
transmitted to the log analysis server 5 200 may be a
communication message in the CAN network 120, and the log
information corresponding to the communication system
control ECU having the first priority preferably includes
contents of the communication message, the message
10 length, the communication period, and the like.
When the above information is included therein,
virus analysis can be efficiently executed.
[0071]
The ECU-1b (virus monitoring & log collection ECU)
15 103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and
analyzes the contents of the communication message, the
message length, and the communication period, and then
transmits each piece of the above information to the log
20 analysis server 200 as log information.
[0072]
The drive system control ECU to which the second
priority is set corresponds to the ECU-2a (drive system
control ECU) 111 shown in Fig. 2. The ECU-2a (drive
25 system control ECU) 111 is a drive system control ECU
that performs drive control regarding driving of the
moving apparatus 100 such as the engine, the steering,
the shift lever, the accelerator, and the brake.
The drive system control ECU is an ECU that
30 performs control regarding driving of the moving
apparatus 100, and causes a serious problem if erroneous
31
processing is performed due to a virus or the like.
For this reason, a log corresponding to a
communication message issued by the drive system control
ECU is set to be a target to be collected and analyzed
with the 5 second priority.
[0073]
Note that the log information collected by the ECU-
1b (virus monitoring & log collection ECU) 103 of the
processing monitoring unit 101 shown in Fig. 2 and
10 transmitted to the log analysis server 200 may be a
communication message in the CAN network 120, and the log
information corresponding to the drive system control ECU
having the second priority preferably includes
information that can be used for analyzing a control
15 sequence of a target to be controlled, such as, for
example, the contents of the communication message, the
communication sequence information (time information),
and the like.
When the above information is included therein,
20 virus analysis in a drive system control message can be
efficiently executed.
[0074]
For example, in a case where a normal control
sequence of a drive system target to be controlled
25 (engine or the like) is A → B → C, there is a possibility
that an abnormal control sequence is set to, for example,
A → C → D when the drive system target to be controlled
is infected with a certain virus.
In order to detect an abnormality in the control
30 sequence as described above, the log information
corresponding to the drive system control ECU preferably
32
includes information that can be used for analyzing the
control sequence of the target to be controlled, such as,
for example, the contents of the communication message,
the communication sequence information (time
information), 5 and the like.
[0075]
The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and also
10 acquires information that can be used for analyzing a
control sequence of a target to be controlled, and then
transmits information including the communication message
and the sequence information to the log analysis server
200 as log information.
15 [0076]
The body system control ECU to which the third
priority is set corresponds to the ECU-2b (body system
control ECU) 112 shown in Fig. 2. The ECU-2b (body
system control ECU) 112 is a body system control ECU that
20 performs control of a body system other than the drive
system of the moving apparatus, such as control of a
display unit, air conditioning, and opening, closing, and
locking of doors.
The body system control ECU is an ECU that performs
25 control regarding parts other than the parts regarding
driving of the moving apparatus 100, and is unlikely to
affect driving of the moving apparatus 100 even if
erroneous processing is performed due to a virus or the
like.
30 For this reason, a log corresponding to a
communication message issued by the body system control
33
ECU is set to be a target to be collected and analyzed
with the third priority.
[0077]
Note that the log information collected by the ECU-
1b (virus monitoring & log collection 5 ECU) 103 of the
processing monitoring unit 101 shown in Fig. 2 and
transmitted to the log analysis server 200 may be a
communication message in the CAN network 120, and the log
information corresponding to the body system control ECU
10 having the third priority also preferably includes
information that can be used for analyzing a control
sequence of a target to be controlled, such as, for
example, the contents of the communication message, the
communication sequence information (time information),
15 and the like.
When the above information is included therein,
virus analysis in a drive system control message can be
efficiently executed.
[0078]
20 The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and also
acquires information that can be used for analyzing a
control sequence of a target to be controlled, and then
25 transmits information including the communication message
and the sequence information to the log analysis server
200 as log information.
[0079]
Note that the example of setting priority of the
30 log information shown in Fig. 5 is merely an example, and
other various priority settings can be performed.
34
The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 shown in Fig. 2
stores, for example, the list showing the priority of the
log information (acquired-log priority list) shown in
Fig. 5 in the storage 5 unit in the ECU.
Note that specific examples of the priority list
encompass, for example, a list including association data
between priority identifiers and IDs of CAN messages or
IDs indicating transmission sources or transmission
10 destinations of messages, and the like.
[0080]
The ECU-1b (virus monitoring & log collection ECU)
103 acquires bandwidth information of the CAN network 120
acquired by the ECU-1a (system load monitoring ECU) 102
15 in the processing in step S103, and determines whether or
not a log to be acquired is limited to a high-priority
log on the basis of the acquired bandwidth information.
[0081]
Step S105 is processing performed in a case where
20 it is determined in the band determination processing in
step S103 that the available bandwidth is less than the
predetermined threshold and there is a small margin in
the remaining available communication bandwidth. In the
processing, only a log corresponding to a message having
25 high priority is selectively collected and is transmitted
to the log analysis server 200.
Specifically, for example, only logs corresponding
to communication messages generated by the communication
system control ECU having the first priority and the
30 drive system control ECU having the second priority shown
in Fig. 5 are selectively collected, and only the
35
selectively collected logs are transmitted to the log
analysis server 200.
[0082]
Note that setting of a high-priority log to be
selected can be variously 5 performed.
For example, only a log of the communication system
control ECU having the first priority shown in Fig. 5 can
also be set to a target to be selected.
[0083]
10 Further, in the example of setting priority shown
in Fig. 5, targets to be controlled by the ECUs are used
as priority classification information as follows:
the first priority = a communication message issued
by the communication system control ECU;
15 the second priority = a communication message
issued by the drive system control ECU; and
the third priority = a communication message issued
by the body system control ECU.
Further, for example, a communication message
20 generated by the drive system control ECU may be
classified for each target to be controlled (engine,
accelerator, or the like), and priority of the individual
target to be controlled may be set.
[0084]
25 In a case of such a priority setting, it is also
possible to select not only logs of the communication
system control ECU having the first priority shown in
Fig. 5 but also a part of logs of the drive system
control ECU having the second priority, such as, for
30 example, only a log corresponding to a message for
controlling the engine, as a target to be collected,
36
analyzed, and transmitted to the server.
[0085]
Further, the bandwidth usage status is further
subdivided as follows, for example:
(a) a large amount of available 5 bandwidth:
bandwidth load (used bandwidth) = 20% or less;
(b) a medium amount of available bandwidth:
bandwidth load (used bandwidth) = 20% to 40%; and
(c) a small amount of available bandwidth:
10 bandwidth load (used bandwidth) = 40% or more.
As described above, which of the above three kinds
the bandwidth usage status corresponds to may be
determined, and log information to be collected may be
changed in accordance with priority on the basis of the
15 determination result.
A specific processing example of the above case
will be described later.
[0086]
(Step S106)
20 When the processing monitoring unit 101 completes
the processing of collecting all or a part of the log
information (communication packets in the CAN network) of
each ECU in the moving apparatus and transmitting the log
information to the log analysis server 200 in step S104
25 or step S105, then the processing monitoring unit 101
receives log analysis information from the log analysis
server 200 in step S106.
[0087]
The log analysis server 200 executes an advanced
30 log analysis to detect a virus, a malicious program, and
the like that cannot be checked only by processing of
37
matching with virus patterns stored in the virus database
105 of the moving apparatus 100, generates detection
information, countermeasure processing information, and
the like, and transmits the information to the ECU-1b
(virus monitoring & log collection 5 ECU) 103 of the
processing monitoring unit 101.
[0088]
(Step S107)
Next, in step S107, the ECU-1b (virus monitoring &
10 log collection ECU) 103 of the processing monitoring unit
101 executes countermeasure processing such as virus
removal on the basis of the virus detection information
and the countermeasure processing information received
from the log analysis server 200.
15 [0089]
(Step S108)
Next, in step S108, whether to terminate the
processing is determined. In a case where the processing
is not terminated, the processing returns to step S101,
20 and the processing of detecting a virus from a
communication packet in the CAN network and the
processing of monitoring the bandwidth used by the CAN
network are continuously executed.
[0090]
25 Meanwhile, for example, in a case where movement of
the moving apparatus 100 is stopped and a power supply is
turned off, it is determined in step S108 that the
processing is terminated, and the processing is
terminated.
30 [0091]
As can be understood from the processing shown in
38
the flowchart in Fig. 4 described above, the processing
monitoring unit 101 executes the following two kinds of
processing while switching those two kinds of processing
in accordance with a situation.
(First processing (normal processing)) 5 processing
of collecting only a high-priority log and transmitting
the log to the server.
(Second processing (emergency processing))
processing of collecting all logs and transmitting the
10 logs to the server.
The above two different kinds of processing are
executed while being switched in accordance with the
situation.
[0092]
15 A program for performing this switching of
processing, i.e., a program executed by the ECUs 102 and
103 in the processing monitoring unit 101 needs to be a
program that allows the above two different kinds of
processing to be executed while being switched in
20 accordance with the situation.
[0093]
Further, the program executed by the ECUs 102 and
103 in the processing monitoring unit 101, i.e., a
program for monitoring viruses and collecting logs is
25 executed with higher priority than programs (user
programs) executed by the other ECUs.
[0094]
Further, the program for monitoring viruses and
collecting logs, which is executed by the ECUs 102 and
30 103 in the processing monitoring unit 101, can
dynamically change a log acquisition mode between, for
39
example, the (first processing (normal processing)) and
the (second processing (emergency processing)) described
above, in order to monitor an abnormal state and acquire
a necessary log in accordance with the situation.
5 [0095]
In order to dynamically change this log
acquisition, it is necessary to set a program or function
for detecting an observation status of the CAN network,
i.e., an event observable by the program and switching
10 the processing in accordance with the detected event, and
it is also necessary to define an event that triggers
switching of the processing.
[0096]
Such processing of setting a program and processing
15 of defining an event executed in the processing
monitoring unit 101, switching of processing based on
execution of the set program, and an example of a series
of the above processing sequence will be described with
reference to a flowchart shown in Fig. 6.
20 Hereinafter, processing in each step of the
flowchart shown in Fig. 6 will be sequentially described.
[0097]
(Step S151)
Processing in step S151 is processing for defining
25 an event that triggers switching of the processing and
defining processing (program, function, or the like) for
executing different kinds of processing in accordance
with detection of the event.
The above processing can be executed by the user.
30 [0098]
Specifically, the following processing is
40
performed:
(1) defining an event serving as a condition for
changing the processing;
(2) defining the first processing (program or
function) executed in a case where no 5 event is detected;
and
(3) defining the second processing (program or
function) executed in a case where an event is detected.
[0099]
10 This processing in step S101 is performed by, for
example, the user setting and changing a program executed
in the ECUs, i.e.,
the ECU-1a (system load monitoring ECU) 102, and
the ECU-1b (virus monitoring & log collection ECU)
15 103 in the processing monitoring unit 101 of the moving
apparatus 100 shown in Fig. 2 and functions and
parameters used in the program.
[0100]
The user can set and change the program executed in
20 the ECUs and the functions and parameters used in the
program via the input/output units 207 of the ECUs 200
described above with reference to Fig. 3.
The programs and functions defined by the user in
the above (1) to (3) are stored in the storage units of
25 the ECUs in the processing monitoring unit of the moving
apparatus 100 shown in Fig. 2.
[0101]
Specific examples of the processing executed by the
processing monitoring unit and the event that triggers
30 switching of the processing will be described with
reference to Fig. 7.
41
Fig. 7 shows specific examples of the above events
(1) to (3), the first processing (normal processing), and
the second processing (emergency processing).
Fig. 7(A) shows examples of the event serving as
the condition for changing 5 the processing.
The examples in Fig. 7(A) show the following two
types of events:
a first event = a virus is detected; and
a second event = the available bandwidth of the
10 communication network (CAN) is equal to or larger than
the predetermined threshold.
The program executed by the processing monitoring
unit 101 detects the above two events.
[0102]
15 Further, the processing monitoring unit 101
executes one of the following processing defined in Fig.
7(B) depending on whether or not the event is detected:
the first processing (normal processing) =
processing of collecting a high-priority selected log and
20 transmitting the log to the server, which is executed in
a case where no event is detected; and
the second processing (emergency processing) =
processing of collecting all logs and transmitting the
logs to the server, which is executed in a case where an
25 event is detected.
[0103]
In step S151,
(1) the event serving as the condition for changing
the processing,
30 (2) the first processing (program or function) that
is executed in a case where no event is detected, and
42
(3) the second processing (program or function)
that is executed in a case where an event is detected
are defined as described above.
[0104]
Note that, in the example shown 5 in Fig. 7, the
following two events are set as an event that triggers a
change of the log acquisition mode:
the first event = a virus is detected; and
a second event = the available bandwidth of the
10 communication network (CAN) is equal to or larger than
the predetermined threshold.
However, other various events can be set.
[0105]
For example, detection of a system load exceeding
15 the threshold, detection of an error log, detection of a
CAN network attack message, and the like can also be set
as the event.
It is possible to set the change of the log
collection mode by using occurrence of those various
20 events as a trigger. Further, the above setting and
changing of the event can be performed by the user.
Further, processing that is changed in accordance
with detection of the event, i.e., a program, a program
code, and the like can also be set and changed by the
25 user.
[0106]
Referring back to the flow in Fig. 6, processing in
and after step S152 will be described.
(Step S152)
30 The processing in and after step S152 is processing
to which the event and processing (program or function)
43
defined in step S151 are applied.
[0107]
First, in step S152, event detection processing is
executed.
This event detection processing 5 is performed at
fixed time intervals, for example, at 10 msec intervals.
[0108]
The following two events defined in step S151 are
events to be detected:
10 a first event = a virus is detected; and
a second event = the available bandwidth of the
communication network (CAN) is equal to or larger than
the predetermined threshold.
[0109]
15 The first event is detected by the ECU-1b (virus
monitoring & log collection ECU) 103 of the processing
monitoring unit 101 in the configuration shown in Fig. 2.
The ECU-1b (virus monitoring & log collection ECU)
103 detects the first event by executing the processing
20 of detecting a virus from a CAN message transmitted and
received via the CAN network 120.
[0110]
The second event is detected by the ECU-1a (system
load monitoring ECU) 102 of the processing monitoring
25 unit 101 in the configuration shown in Fig. 2.
The ECU-1a (system load monitoring ECU) 102
monitors the communication status of the CAN network 120
and determines whether or not there is a margin in the
available bandwidth of the network, i.e., whether or not
30 the available bandwidth is equal to or larger than the
predetermined threshold.
44
[0111]
In step S152, those two events, i.e.,
the first event = a virus is detected, and
a second event = the available bandwidth of the
communication network (CAN) is equal 5 to or larger than
the predetermined threshold.
are detected.
[0112]
(Step S153)
10 The processing in step S153 is an event detection
result determination step of the event detection
processing in step S152.
[0113]
In a case where only one of the above two events,
15 i.e.,
the first event = a virus is detected, and
a second event = the available bandwidth of the
communication network (CAN) is equal to or larger than
the predetermined threshold.
20 is detected or neither of the two events is
detected, the determination processing in step S153 is
No, and the processing proceeds to step S154.
Meanwhile, in a case where both the above two
events are detected, the determination processing in step
25 S153 is Yes, and the processing proceeds to step S155.
[0114]
(Step S154)
In a case where neither of the above two events is
detected or only one of the two events is detected, the
30 determination processing in step S153 is No, and the
processing proceeds to step S154.
45
In step S154, the first processing (normal
processing) is executed.
That is, the following first processing (normal
processing) described with reference to Fig. 7 is
5 executed:
the first processing (normal processing) =
processing of collecting a high-priority selected log and
transmitting the log to the server, which is executed in
a case where no event is detected; and
10 [0115]
(Step S155)
Meanwhile, in a case where both the above two
events are detected, the determination processing in step
S153 is Yes, and the processing proceeds to step S155.
15 In step S155, the second processing (emergency
processing) is executed.
That is, the following second processing (emergency
processing) described with reference to Fig. 7 is
executed:
20 the second processing (emergency processing) =
processing of collecting all logs and transmitting the
logs to the server, which is executed in a case where an
event is detected.
[0116]
25 As described above, the processing monitoring unit
101 shown in Fig. 2 executes the processing according to
the definition of the event and program shown in Fig. 6.
[0117]
Note that, as described above, the program executed
30 by the ECUs 102 and 103 in the processing monitoring unit
101, i.e., the program for monitoring viruses and
46
collecting logs is executed with higher priority than
programs (user programs) executed by the other ECUs.
[0118]
Note that a configuration for executing the program
for monitoring viruses and collecting 5 logs with higher
priority than other programs can be variously formed.
For example, there is a configuration using a program
having a kernel space monitoring function.
[0119]
10 That is, the program executed by the ECUs 102 and
103 in the processing monitoring unit 101, i.e., the
program for monitoring viruses and collecting logs is set
as a program having a kernel space monitoring function.
A kernel space is an address space used by a
15 program (kernel) having higher priority than the user
program (program executed by the ECUs), and the program
having the kernel space monitoring function is executed
with higher priority than the user program (program
executed by the ECUs) that uses another user space as the
20 address space.
[0120]
By using the program executed by the ECUs 102 and
103 in the processing monitoring unit 101 as the program
having the kernel space monitoring function, a change in
25 processing based on monitoring of the event and
occurrence of the event is performed.
With this setting, the program executed by the ECUs
102 and 103 in the processing monitoring unit 101 can be
set as a program having higher priority than programs
30 executed in the ECUs other than those in the processing
monitoring unit 101.
47
[0121]
Note that the example using the kernel space
monitoring function is merely an example, and other
configurations may be adopted.
It is only necessary to set the program 5 executed by
the ECUs 102 and 103 in the processing monitoring unit
101, i.e., the program for monitoring viruses and
collecting logs so that the program is executed with
higher priority than the programs (user programs)
10 executed by the other ECUs.
[0122]
[3. Configuration in which three or more kinds of
processing are switched in accordance with available
bandwidth of CAN network]
15 Next, a configuration in which three or more kinds
of processing are switched in accordance with the
available bandwidth of the CAN network will be described.
[0123]
In the processing sequence described above with
20 reference to the flowchart shown in Fig. 4, in a case
where a virus is detected from a CAN message transmitted
and received via the CAN network 120, whether or not
there is a margin in the available bandwidth of the CAN
network, i.e., whether or not the available bandwidth is
25 equal to or larger than the predetermined threshold is
checked in step S103, and one of the following two kinds
of processing is performed in accordance with the check
result:
[0124]
30 (the first processing (normal processing)) (step
S105) = processing of collecting only a high-priority log
48
and transmitting the log to the server; and
(the second processing (emergency processing) (step
S104)) = processing of collecting all logs and
transmitting the logs to the server.
5 [0125]
As described above, the processing that is executed
in accordance with the bandwidth usage status is not
limited to the above two kinds, and three or more
different kinds of processing can be performed.
10 A sequence of a case where three different kinds of
processing are performed in accordance with the bandwidth
usage status will be described with reference to a
flowchart shown in Fig. 8.
[0126]
15 The flowchart shown in Fig. 8, as well as the
flowchart described above with reference to Fig. 4, is a
flowchart for describing a sequence of processing
executed by the processing monitoring unit 101 included
in the moving apparatus 100 shown in Fig. 2.
20 [0127]
The flow shown in Fig. 8 is executed by the ECUs in
the processing monitoring unit 101.
Specifically, for example, the CPUs in the ECUs
execute the flow in accordance with programs stored in
25 the storage units.
In the flowchart shown in Fig. 8, the processing in
steps S101, S102, and steps S106 to S108 are similar to
the processing in steps S101, S102, and steps S106 to
S108 shown in the flow of Fig. 4, respectively.
30 Therefore, description thereof is omitted.
[0128]
49
The flowchart shown in Fig. 8 is different from the
flowchart shown in Fig. 4 in processing in steps S110 to
S113 shown in Fig. 8.
The flow shown in Fig. 8 is different from the flow
shown in Fig. 4 in that the processing 5 in steps S103 to
S105 in Fig. 4 are replaced with steps S110 to S113 in
the flow shown in Fig. 8.
[0129]
Details of steps S110 to S113 will be described.
10 (Step S110)
In a case where the ECU-1b (virus monitoring & log
collection ECU) 103 detects a virus from a CAN message
transmitted and received via the CAN network 120 in step
S102, the processing proceeds to step S110.
15 [0130]
In step S110, the processing monitoring unit checks
the traffic of the CAN network.
That is, how much bandwidth the CAN network uses
and how much bandwidth is available are checked.
20 In this embodiment, which of the following three
kinds the bandwidth usage status corresponds to is
determined:
(a) a large amount of available bandwidth:
bandwidth load (used bandwidth) = 20% or less;
25 (b) a medium amount of available bandwidth:
bandwidth load (used bandwidth) = 20% to 40%; and
(c) a small amount of available bandwidth:
bandwidth load (used bandwidth) = 40% or more.
In this embodiment, which of the above three kinds
30 the bandwidth usage status corresponds to is determined,
and log information to be collected is changed in
50
accordance with priority on the basis of the
determination result.
[0131]
In step S110,
in a case where (a) a large amount 5 of available
bandwidth: bandwidth load (used bandwidth) = 20% or less
is determined,
the processing proceeds to step S111.
[0132]
10 Further, in step S110,
in a case where (b) a medium amount of available
bandwidth: bandwidth load (used bandwidth) = 20% to 40%
is determined,
the processing proceeds to step S112.
15 [0133]
Further, in step S110,
in a case where (c) a small amount of available
bandwidth: bandwidth load (used bandwidth) = 40% or more
is determined,
20 the processing proceeds to step S113.
[0134]
(Step S111)
In the determination processing in step S110,
in a case where (a) a large amount of available
25 bandwidth: bandwidth load (used bandwidth) = 20% or less
is determined,
the processing proceeds to step S111.
In step S111, the processing monitoring unit
collects all log information based on communication
30 messages (communication packets in the CAN network)
issued by each ECU in the moving apparatus, and transmits
51
the all log information to the log analysis server 200.
[0135]
Specifically, the ECU-1b (virus monitoring & log
collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 2 collects all logs corresponding 5 to all
communication messages in the CAN network 120, and
transmits the collected logs corresponding to all the
communication messages to the log analysis server 200.
[0136]
10 (Step S112)
Further, in the determination processing of step
S110,
in a case where (b) a medium amount of available
bandwidth: bandwidth load (used bandwidth) = 20% to 40%
15 is determined,
the processing proceeds to step S112.
In step S112, the processing monitoring unit
collects only log information corresponding to a part of
communication messages (communication packets in the CAN
20 network) issued by each ECU in the moving apparatus and
transmits the log information to the log analysis server
200.
[0137]
Specifically, the ECU-1b (virus monitoring & log
25 collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 2 sets logs to be collected from
communication messages in the CAN network 120 only to
logs corresponding to communication messages that are
limited in accordance with predetermined priority, and
30 transmits only the collected logs corresponding to the
limited messages to the log analysis server 200.
52
[0138]
The priority of collecting logs of communication
messages is set as described above with reference to Fig.
5.
That is, the priority is 5 set as follows in
accordance with a system of the ECU that issues a
communication message:
first priority = a communication message issued by
the communication system control ECU;
10 second priority = a communication message issued by
the drive system control ECU; and
third priority = a communication message issued by
the body system control ECU.
[0139]
15 Step S112 is processing performed in a case where
(b) a medium amount of available bandwidth: bandwidth
load (used bandwidth) = 20% to 40% is determined in the
determination processing of step S110.
In this case, only logs corresponding to
20 communication messages having the first and second
priority are collected and transmitted to the log
analysis server 200.
That is, only logs corresponding to the following
communication messages are collected and transmitted to
25 the log analysis server 200:
the first priority = a communication message issued
by the communication system control ECU; and
the second priority = a communication message
issued by drive system control ECU.
30 [0140]
(Step S113)
53
Meanwhile, in a case where no virus is detected in
the determination processing in step S102, or in a case
where a virus is detected in the determination processing
in step S102 and (c) a small amount of available
bandwidth: bandwidth load (used bandwidth) 5 = 40% or more
is determined in the determination processing in step
S110,
the processing proceeds to step S113.
[0141]
10 In step S113, the processing monitoring unit
collects only a part of the log information
(communication packets in the CAN network) of each ECU in
the moving apparatus and transmits the part of the log
information to the log analysis server 200.
15 In step S112, the processing monitoring unit
collects only log information corresponding to a part of
communication messages (communication packets in the CAN
network) issued by each ECU in the moving apparatus and
transmits the log information to the log analysis server
20 200.
[0142]
Specifically, the ECU-1b (virus monitoring & log
collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 2 sets logs to be collected from
25 communication messages in the CAN network 120 only to
logs corresponding to communication messages that are
limited in accordance with predetermined priority, and
transmits only the collected logs corresponding to the
limited messages to the log analysis server 200.
30 [0143]
The priority of collecting logs of communication
54
messages is set as described above with reference to Fig.
5.
That is, the priority is set as follows in
accordance with a system of the ECU that issues a
communication 5 message:
first priority = a communication message issued by
the communication system control ECU;
second priority = a communication message issued by
the drive system control ECU; and
10 third priority = a communication message issued by
the body system control ECU.
[0144]
Step S113 is processing performed in a case where
(c) a small amount of available bandwidth: bandwidth load
15 (used bandwidth) = 40% or more is determined in the
determination processing in step S110.
In this case, only a log corresponding to a
communication message having the first priority is
collected and transmitted to the log analysis server 200.
20 That is,
only a log corresponding to a communication message
having the following first priority is collected and
transmitted to the log analysis server 200:
the first priority = a communication message issued
25 by the communication system control ECU.
[0145]
After any of the processing in steps S111 to S113,
the processing in and after step S106 is executed.
The processing in and after step S106 is similar to
30 the processing described above with reference to Fig. 4.
Thus, description thereof is omitted.
55
[0146]
As described above, in this embodiment, the
processing to be executed is changed by classifying the
bandwidth usage status of the CAN network 120 into the
following three 5 kinds: That is,
which of the following three kinds the bandwidth
usage status corresponds to is determined:
(a) a large amount of available bandwidth:
bandwidth load (used bandwidth) = 20% or less;
10 (b) a medium amount of available bandwidth:
bandwidth load (used bandwidth) = 20% to 40%; and
(c) a small amount of available bandwidth:
bandwidth load (used bandwidth) = 40% or more.
Then, log information to be collected is changed in
15 accordance with priority on the basis of the
determination result.
[0147]
With such a setting, it is possible to efficiently
collect a log required for virus analysis, without
20 delaying normal communication data in the CAN network
120.
[0148]
[4. Examples of log collection processing in probe
car]
25 Next, examples of log collection processing in a
probe car will be described.
The probe car is a vehicle equipped with a camera
for acquiring map information, traffic information,
environmental information such as weather, or the like,
30 and various sensors.
Specifically, examples thereof encompass a vehicle
56
equipped with an omnidirectional camera for map creation
and the like.
[0149]
A configuration example of the probe car will be
described with reference 5 to Fig. 9.
Fig. 9 shows a configuration example of a moving
apparatus (probe car) 10b.
As shown in Fig. 9, the moving apparatus (probe
car) 10b includes not only the steering 11, the shift
10 lever 12, the display unit 13, the engine 14, the
accelerator 15, the brake 16, the processing monitoring
unit 17, the in-vehicle electronic device group (ECU
group) 18, the GPS receiver 19, the storage unit 20, the
communication unit 21, and the input/output IF 22, but
15 also a forward-facing camera 25, a backward-facing camera
26, and an omnidirectional camera 27.
[0150]
Note that those components are merely some main
components of the moving apparatus 10b (probe car), and
20 the moving apparatus 10b (probe car) includes many other
components in addition to those components.
[0151]
Among the components of the moving apparatus (probe
car) 10b shown in Fig. 9, the following components are
25 the same as the components of the moving apparatus 10
described above with reference to Fig. 1: the steering
11, the shift lever 12, the display unit 13, the engine
14, the accelerator 15, the brake 16, the processing
monitoring unit 17, the in-vehicle electronic device
30 group (ECU group) 18, the GPS receiver 19, the storage
unit 20, the communication unit 21, and the input/output
57
IF 22.
[0152]
The moving apparatus (probe car) 10b shown in Fig.
9 includes the forward-facing camera 25, the backwardfacing
camera 26, and the omnidirectional 5 camera 27 in
addition to the components of the moving apparatus 10
described above with reference to Fig. 1.
[0153]
The forward-facing camera 25, the backward-facing
10 camera 26, and the omnidirectional camera 27 are
components of a probe car compatible sensor.
As described above, the probe car is a vehicle
equipped with a camera for acquiring map information,
traffic information, environmental information such as
15 weather, or the like, and various sensors.
Herein, as an embodiment of the probe car, an
exemplary probe car equipped with cameras to create map
information and the like will be described as a
representative example.
20 [0154]
Not only the cameras but also various sensors can
be used as the probe car compatible sensor. For example,
in a case of a probe car that acquires traffic
information, sensors such as a distance sensor and an
25 acceleration sensor are mounted as the probe car
compatible sensor. Further, in a case of a probe car
that acquires weather information, various sensors such
as a temperature sensor, a humidity sensor, and a
barometric pressure sensor are mounted as the probe car
30 compatible sensor.
In the following embodiment, a probe car equipped
58
with cameras as the probe car compatible sensor to create
map information and the like will be described as a
representative example.
[0155]
The in-vehicle electronic device 5 group (ECU group)
18 shown in Fig. 9 includes a plurality of electronic
control units (ECUs), and each ECU controls each
configuration unit of the moving apparatus (probe car)
10b.
10 The ECU is connected to each component of the
moving apparatus 10b (probe car) by the controller area
network (CAN) standardized as the in-vehicle network, and
performs control by transmitting and receiving a CAN
message conforming to the CAN protocol.
15 [0156]
The ECUs in the in-vehicle electronic device group
(ECU group) 18 execute, for example, various kinds of
control such as drive control regarding driving of the
moving apparatus 10b (probe car) such as the engine 14,
20 the steering 11, and the like, control of display
information on the display unit 13, control of opening,
closing, locking, and the like of doors, communication
control in the communication unit 21, and imaging control
of each camera.
25 The above control is performed by programs
(software) executed by the ECUs.
[0157]
The plurality of electronic control units (ECUs)
included in the in-vehicle electronic device group (ECU
30 group) 18 can be roughly classified into the following
four groups:
59
(1) the drive system control ECU that performs
drive control regarding driving of the moving apparatus
(probe car) 10b such as the engine 14, the steering 11,
the shift lever 12, the accelerator 15, and the brake 16;
(2) the body system control 5 ECU that performs
control of the body system other than the drive system of
the moving apparatus, such as control of the display unit
13,air conditioning, and opening, closing, and locking of
doors;
10 (3) the communication system control ECU that
performs control regarding the communication unit 21, the
input/output IF 22, the GPS receiver 19, and the like
which perform communication and input and output of data
with an external device or external storage device; and
15 (4) a probe car compatible sensor (camera or the
like) system control ECU that performs control regarding
the forward-facing camera 25, the backward-facing camera
26, the omnidirectional camera 27, and the like.
Those electronic control units (ECUs) perform
20 various kinds of processing in accordance with individual
programs, respectively.
[0158]
However, such ECUs controlled by programs
(software) may be illegally controlled by a virus or
25 malicious program intruding from the outside.
The virus may intrude at various timings from, for
example, various wired or wireless illegal devices that
illegally access the CAN from the outside.
The processing monitoring unit 17 shown in Fig. 9
30 is a monitoring apparatus for performing detection of
such a virus and restoration processing.
60
[0159]
The processing monitoring unit 17 acquires, for
example, log information corresponding to various kinds
of processing executed in the ECUs, and performs
detection of fraud, restoration, and 5 the like on the
basis of the log information.
Further, the processing monitoring unit 17
transmits the acquired log information to an external
server. The server executes analysis based on the log
10 information, and transmits an analysis result to the
processing monitoring unit 17. The processing monitoring
unit 17 removes fraud (virus, program, or the like) and
performs restoration processing by using the analysis
result received from the server.
15 [0160]
As described above, the plurality of electronic
control units (ECUs) included in the in-vehicle
electronic device group (ECU group) 18 controls each
component of the moving apparatus (probe car) 10b shown
20 in Fig. 9. Control data for this control is transferred
via the controller area network (CAN) standardized as the
in-vehicle network.
The ECUs and other components connected to the CAN
transmit and receive CAN messages conforming to the CAN
25 protocol.
[0161]
Fig. 10 shows a network configuration example of
the CAN.
A moving apparatus (probe car) 100b shown in Fig.
30 10 includes a plurality of ECUs 102, 103, and 111 to 114,
and is configured so that the plurality of ECUs is
61
connected to the CAN network 120 that is an in-vehicle
network.
The ECUs 102 and 103 are ECUs included in a
processing monitoring unit 101.
The ECUs 111 to 114 correspond to 5 the four kinds of
ECUs described above with reference to Fig. 1, i.e., the
drive system control ECU, the body system control ECU,
the communication system control ECU, and the probe car
compatible sensor (camera or the like) system control
10 ECU.
[0162]
Various components to be controlled by the ECUs,
i.e., the engine, the accelerator, the cameras, and the
like are also connected to the CAN network. Those
15 components are controlled in response to control messages
generated by the ECUs in accordance with programs
(software).
The ECUs perform control by generating a CAN
message conforming to the CAN protocol and transmitting
20 the message to various targets to be controlled.
[0163]
The ECUs shown in Fig. 10 are the following six
ECUs:
(1) the ECU-1a (system load monitoring ECU) 102;
25 (2) the ECU-1b (virus monitoring & log collection
ECU) 103;
(3) the ECU-2a (drive system control ECU) 111;
(4) the ECU-2b (body system control ECU) 112;
(5) the ECU-2c (communication system control ECU)
30 113; and
(6) an ECU-3a (probe car compatible sensor (camera
62
or the like) control ECU) 114
[0164]
Among the above ECUs, the ECUs (1) to (5) are
similar to the ECUs described above with reference to
5 Fig. 2.
The moving apparatus (probe car) 100b in this
embodiment includes the (6) ECU-3a (probe car compatible
sensor (camera or the like) control ECU) 114 in addition
to the ECUs (1) to (5).
10 “(6) The ECU-3a (probe car compatible sensor
(camera or the like) control ECU) 114” is a probe car
compatible sensor (camera or the like) system control ECU
that performs control regarding the probe car compatible
sensor (camera or the like) such as the forward-facing
15 camera 25, the backward-facing camera 26, and the
omnidirectional camera 27 shown in Fig. 9.
[0165]
The ECU-3a (probe car compatible sensor (camera or
the like) control ECU) 114 executes imaging instruction
20 control of the forward-facing camera 25, the backwardfacing
camera 26, and the omnidirectional camera 27 by
using a CAN message transmitted via the CAN network 120.
Further, the ECU-3a (probe car compatible sensor (camera
or the like) control ECU) 114 executes processing of
25 acquiring an image captured by each camera via the CAN
network 120 and storing the image in a sensor detection
information DB 115, and other processing.
[0166]
The processing monitoring unit 101 performs
30 processing by using the following two ECUs:
(1) ECU-1a (system load monitoring ECU) 102; and
63
(2) ECU-1b (virus monitoring & log collection ECU)
103.
[0167]
Herein, the processing monitoring unit 101 changes
log information to be collected from the 5 CAN network 120
in accordance with an increase or decrease of the traffic
of the CAN network 120.
Specifically, the ECU-1a (system load monitoring
ECU) 102 monitors the communication status of the CAN
10 network 120, and, in a case where the traffic
(communication usage bandwidth) of the CAN network 120 is
equal to or less than the predetermined threshold, the
ECU-1b (virus monitoring & log collection ECU) 103
collects log information corresponding to all
15 communication messages from the CAN network 120 and
transmits the log information to the log analysis server
200.
[0168]
Note that the log information includes, for
20 example, contents of a communication message, a message
length, a communication period, communication sequence
information, and the like included in the communication
message in the CAN network 120.
The ECU-1b (virus monitoring & log collection ECU)
25 103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and
analyzes the contents of the communication message, the
message length, the communication period, the
communication sequence, and the like, and then transmits
30 each piece of the above information to the log analysis
server 200 as log information.
64
[0169]
Meanwhile, in a case where the traffic
(communication usage bandwidth) of the CAN network 120 is
larger than the predetermined threshold, the ECU-1b
(virus monitoring & log collection 5 ECU) 103 sets log
information to be acquired on the basis of communication
messages in the CAN network 120 only to logs
corresponding to communication messages that are limited
in accordance with the predetermined priority, and
10 transmits only the collected limited logs to the log
analysis server 200.
A sequence of the processing executed by the
processing monitoring unit 101 included in the moving
apparatus (probe car) 100b shown in Fig. 10 will be
15 described with reference to flowcharts shown in Figs. 11
and 12.
[0170]
Figs. 11 and 12 are flowcharts showing a processing
sequence executed by the processing monitoring unit 101
20 of the moving apparatus (probe car) 100b.
The flows shown in Figs. 11 and 12 are executed by
the ECUs in the processing monitoring unit 101.
Specifically, for example, the CPUs in the ECUs
execute the flow in accordance with programs stored in
25 the storage units.
Hereinafter, processing in each step of the
flowcharts shown in Figs. 11 and 12 will be sequentially
described.
[0171]
30 The flow shown in Fig. 11 is the first half of the
processing sequence executed by the processing monitoring
65
unit 101 of the moving apparatus (probe car) 100b, and
the flow shown in Fig. 12 is the second half of the
processing sequence.
[0172]
Processing in steps S201 to S208 5 shown in the first
half of the processing flow shown in Fig. 11 is
substantially similar to the processing in steps S101 to
S108 shown in the normal processing sequence executed by
the processing monitoring unit 101 of the moving
10 apparatus 10 described above with reference to Fig. 4.
However, a processing mode of processing of
selectively collecting a high-priority log in step S205
is different from the normal processing in processing
step S105 executed by the processing monitoring unit 101
15 of the moving apparatus 10 described with reference to
Fig. 4.
This processing will be described.
[0173]
(Step S205)
20 In any of the following cases, the processing in
step S205 is executed:
in a case where no virus is detected in the
determination processing in step S202; and
in a case where a virus is detected in the
25 determination processing in step S202 and it is
determined in the determination processing in step S203
that the available bandwidth is less than the
predetermined threshold (less than 50%) and there is no
margin in the available bandwidth of the network.
30 [0174]
In step S205, the processing monitoring unit
66
collects only log information corresponding to a part of
communication messages (communication packets in the CAN
network) issued by each ECU in the moving apparatus and
transmits the log information to the log analysis server
5 200.
[0175]
Specifically, the ECU-1b (virus monitoring & log
collection ECU) 103 of the processing monitoring unit 101
shown in Fig. 10 sets logs to be collected from
10 communication messages in the CAN network 120 only to
logs corresponding to communication messages that are
limited in accordance with the predetermined priority,
and transmits only the collected logs corresponding to
the limited messages to the log analysis server 200.
15 [0176]
In a case where the processing in step S205 is
executed, the processing monitoring unit 101 limits logs
to be collected in accordance with the predetermined
priority.
20 Fig. 13 shows examples of the predetermined
priority.
[0177]
An example of setting log information priority
shown in Fig. 13 is an example of setting priority
25 according to a system of the ECU that issues a
communication message as described below:
first priority = a communication message issued by
the communication system control ECU;
second priority = a communication message issued by
30 the drive system control ECU; and
the third priority = communication messages issued
67
by the body system control ECU and the probe car
compatible sensor (camera) system control ECU.
[0178]
The example of setting log information priority for
the normal moving apparatus 100 has been 5 described above
with reference to Fig. 5. However, the example of
setting log information priority for the moving apparatus
(probe car) 100b shown in Fig. 13 is different from the
above example in that a communication message issued by
10 the probe car compatible sensor (camera) system control
ECU is added as the third priority.
[0179]
The first priority and the second priority are
similar to as the settings described above with reference
15 to Fig. 5.
That is, the communication system control ECU to
which the first priority is set corresponds to the ECU-2c
(communication system control ECU) 113 shown in Fig. 10.
The ECU-2c (communication system control ECU) 113 is a
20 communication system control ECU that performs control
regarding a communication unit, an input/output IF, a GPS
receiver, and the like which perform communication or
input and output of data with an external device or
external storage device.
25 The external device, the external storage device,
and the like serving as targets to be controlled by the
communication system control ECU are likely to be a path
through which a virus or malicious program intrudes.
[0180]
30 Further, the drive system control ECU to which the
second priority is set corresponds to the ECU-2a (drive
68
system control ECU) 111 shown in Fig. 2. The ECU-2a
(drive system control ECU) 111 is a drive system control
ECU that performs drive control regarding driving of the
moving apparatus (probe car) 100b such as the engine, the
steering, the shift lever, the accelerator, 5 and the
brake.
The drive system control ECU is an ECU that
performs control regarding driving of the moving
apparatus (probe car) 100b, and causes a serious problem
10 if erroneous processing is performed due to a virus or
the like.
For this reason, a log corresponding to a
communication message issued by the drive system control
ECU is set to be a target to be collected and analyzed
15 with the second priority.
[0181]
Logs corresponding to messages set to have the
third priority in this embodiment are logs corresponding
to communication messages issued by the body system
20 control ECU described above with reference to Fig. 5 and
the probe car compatible sensor (camera) system control
ECU.
[0182]
The body system control ECU corresponds to the ECU-
25 2b (body system control ECU) 112 shown in Fig. 10. The
ECU-2b (body system control ECU) 112 is a body system
control ECU that performs control of a body system other
than the drive system of the moving apparatus, such as
control of a display unit, air conditioning, and opening,
30 closing, and locking of doors.
Further, the probe car compatible sensor (camera)
69
system control ECU corresponds to the ECU-3a (probe car
compatible sensor (camera) system control ECU) 114 shown
in Fig. 10. The ECU-3a (probe car compatible sensor
(camera) system control ECU) 114 is an ECU that controls
cameras mounted on the moving apparatus 5 (probe car).
[0183]
The body system control ECU and the probe car
compatible sensor (camera) system control ECU are ECUs
that performs control regarding parts other than the
10 parts regarding driving of the moving apparatus (probe
car) 100b, and is unlikely to affect driving of the
moving apparatus (probe car) 100b even if erroneous
processing is performed due to a virus or the like.
For this reason, logs corresponding to
15 communication messages issued by the body system control
ECU and the probe car compatible sensor (camera) system
control ECU are collected and analyzed with the third
priority.
[0184]
20 Note that the log information collected by the ECU-
1b (virus monitoring & log collection ECU) 103 of the
processing monitoring unit 101 shown in Fig. 10 and
transmitted to the log analysis server 200 may be a
communication message in the CAN network 120, and the log
25 information corresponding to the body system control ECU
and the probe car compatible sensor (camera) system
control ECU having the third priority preferably includes
information that can be used for analyzing a control
sequence of a target to be controlled, such as, for
30 example, the contents of the communication message, the
communication sequence information (time information),
70
and the like.
When the above information is included therein,
virus analysis in a drive system control message can be
efficiently executed.
5 [0185]
The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 acquires a
communication message in the CAN network 120, and also
acquires information that can be used for analyzing a
10 control sequence of a target to be controlled, and then
transmits information including the communication message
and the sequence information to the log analysis server
200 as log information.
[0186]
15 Note that the example of setting log information
priority shown in Fig. 13 is merely an example, and other
various priority settings can be performed.
The ECU-1b (virus monitoring & log collection ECU)
103 of the processing monitoring unit 101 shown in Fig.
20 10 stores, for example, a priority list corresponding to
log information priority setting information shown in
Fig. 13 in the storage unit in the ECU.
[0187]
The ECU-1b (virus monitoring & log collection ECU)
25 103 acquires bandwidth information of the CAN network 120
acquired by the ECU-1a (system load monitoring ECU) 102
in the processing in step S203, and determines whether or
not a log to be acquired is limited to a high-priority
log on the basis of the acquired bandwidth information.
30 [0188]
Step S205 is processing performed in a case where
71
it is determined in the band determination processing in
step S203 that the available bandwidth is less than the
predetermined threshold and there is a small margin in
the remaining available communication bandwidth. In the
processing, only a log corresponding to 5 a message having
high priority is selectively collected and is transmitted
to the log analysis server 200.
Specifically, for example, only logs corresponding
to communication messages generated by the communication
10 system control ECU having the first priority and the
drive system control ECU having the second priority shown
in Fig. 13 are selectively collected, and only the
selectively collected logs are transmitted to the log
analysis server 200.
15 [0189]
Note that setting of a high-priority log to be
selected can be variously performed.
For example, only a log of the communication system
control ECU having the first priority shown in Fig. 13
20 can also be set to a target to be selected.
[0190]
Further, in the example of setting priority shown
in Fig. 13, targets to be controlled by the ECUs are set
as priority classification information as follows:
25 the first priority = a communication message issued
by the communication system control ECU;
the second priority = a communication message
issued by the drive system control ECU; and
the third priority = communication messages issued
30 by the body system control ECU and the probe car
compatible sensor (camera) system control ECU.
72
Further, the communication message generated by
each ECU may be classified for each target to be
controlled (engine, accelerator, camera, or the like),
and priority of the individual target to be controlled
5 may be set.
[0191]
Furthermore, as described above with reference to
the flowchart shown in Fig. 8, the bandwidth usage status
is further subdivided as follows, for example:
10 (a) a large amount of available bandwidth:
bandwidth load (used bandwidth) = 20% or less;
(b) a medium amount of available bandwidth:
bandwidth load (used bandwidth) = 20% to 40%; and
(c) a small amount of available bandwidth:
15 bandwidth load (used bandwidth) = 40% or more.
As described above, which of the above three kinds
the bandwidth usage status corresponds to may be
determined, and log information to be collected may be
changed in accordance with priority on the basis of the
20 determination result.
[0192]
The processing in steps S206 and S207 is similar to
the processing in steps S106 and S107 described above
with reference to the flow in Fig. 5.
25 In this embodiment, i.e., in a case where the probe
car is used, the processing in and after step S208 shown
in Fig. 12 is further performed after step S207.
The processing in and after step S208 will be
described.
30 [0193]
(Step S208)
73
In step S208, the processing monitoring unit 101
determines whether or not a communicable bandwidth of the
sensor detection information (image captured by the
camera or the like) of the probe car compatible sensor
(camera or the like) in the CAN network 5 120 is equal to
or less than a predetermined threshold.
[0194]
The predetermined threshold is a threshold
corresponding to a predetermined probe car compatible
10 sensor (camera or the like), and is, for example, 30% of
the entire communication bandwidth in the CAN network 120
as an example.
In step S208,
in a case where the communicable bandwidth of the
15 sensor detection information (image captured by the
camera or the like) of the probe car compatible sensor
(camera or the like) in the CAN network 120 is equal to
or less than the threshold (30% of the previous
communication bandwidth), the processing proceeds to step
20 S209.
Meanwhile, in a case where the communicable
bandwidth thereof is neither equal to nor less than the
threshold (30% of the entire communication bandwidth),
the processing proceeds to step S210.
25 [0195]
(Step S209)
In step S208,
in a case where it is determined that the
communicable bandwidth of the sensor detection
30 information (image captured by the camera or the like) of
the probe car compatible sensor (camera or the like) in
74
the CAN network 120 is equal to or less than the
threshold (30% of the previous communication bandwidth),
the processing proceeds to step S209.
[0196]
In step S209, sensor detection 5 frequency of the
sensor detection information (image captured by the
camera or the like) of the probe car compatible sensor
(camera or the like) (frequency of outputting the
detection information to the CAN network) is set to low
10 frequency, and control processing of reducing an output
data amount of the sensor detection information to the
CAN network is executed.
[0197]
Specifically, the ECU-1a (system load monitoring
15 ECU) 102 of the processing monitoring unit 101 in the
moving apparatus (probe car) 100b shown in Fig. 10
transmits a message (command) to the ECU-3a (probe car
compatible sensor (camera or the like) control ECU) 114
so as to reduce frequency of acquiring images captured by
20 the cameras.
In response to the message (command) received from
the ECU-1a (system load monitoring ECU) 102, the ECU-3a
(probe car compatible sensor (camera or the like) control
ECU) 114 performs control so as to reduce the frequency
25 of outputting images captured by each camera which is a
target to be controlled to the CAN network 120.
With this processing, it is possible to reduce
congestion of the CAN network 120, and prevent a delay
and the like of communication of other important
30 communication messages.
[0198]
75
(Step S210)
Meanwhile, in step S208, in a case where it is
determined that the communicable bandwidth of the sensor
detection information (image captured by the camera or
the like) of the probe car compatible 5 sensor (camera or
the like) in the CAN network 120 is neither equal to nor
less than the predetermined threshold (30% of the
previous communication bandwidth), the processing
proceeds to step S210.
10 [0199]
In step S210, the sensor detection frequency of the
sensor detection information (image captured by the
camera or the like) of the probe car compatible sensor
(camera or the like) (frequency of outputting the
15 detection information to the CAN network) is set to high
frequency, and control processing of not reducing an
output data amount of the sensor detection information to
the CAN network is executed.
[0200]
20 Specifically, the ECU-1a (system load monitoring
ECU) 102 of the processing monitoring unit 101 in the
moving apparatus (probe car) 100b shown in Fig. 10
transmits a message (command) to the ECU-3a (probe car
compatible sensor (camera or the like) control ECU) 114
25 so as not to reduce the frequency of acquiring images
captured by the cameras.
In response to the message (command) received from
the ECU-1a (system load monitoring ECU) 102, the ECU-3a
(probe car compatible sensor (camera or the like) control
30 ECU) 114 performs control so as not to reduce the
frequency of outputting images captured by each camera
76
which is a target to be controlled to the CAN network
120.
[0201]
With this processing, it is possible to maintain
the sensor detection information of 5 the cameras or the
like with high density.
Also in this state, the congestion of the CAN
network 120 does not become extremely high, and thus
control can be performed without causing a delay and the
10 like of communication of other important communication
messages.
[0202]
(Step S211)
When either step S209 or step S210 is completed,
15 the processing proceeds to step S211.
Next, in step S211, whether to terminate the
processing is determined. In a case where the processing
is not terminated, the processing returns to step S201,
and the processing of detecting a virus from a
20 communication packet in the CAN network and the
processing of monitoring the bandwidth used by the CAN
network are continuously executed.
[0203]
Meanwhile, for example, in a case where movement of
25 the moving apparatus (probe car) 100b is stopped and a
power supply is turned off, it is determined in step S211
that the processing is terminated, and the processing is
terminated.
[0204]
30 [5. Other embodiments]
Next, other embodiments will be described.
77
The following two embodiments will be described:
(a) an embodiment in which the number of ECUs
included in the processing monitoring unit 101 is one;
and
(b) an embodiment in which 5 the processing
monitoring unit 101 is provided as an information
processing apparatus detachable from the moving apparatus
100.
[0205]
10 First,
(a) the embodiment in which the number of ECUs
included in the processing monitoring unit 101 is one
will be described with reference to Fig. 14.
[0206]
15 The moving apparatus 100 shown in Fig. 14 is a
modification example of the moving apparatus 100
described above with reference to Fig. 2.
In the moving apparatus 100 described above with
reference to Fig. 2, the processing monitoring unit 101
20 includes the following two ECUs:
(1) the ECU-1a (system load monitoring ECU) 102”;
and
(2) the ECU-1b (virus monitoring & log collection
ECU) 103”.
25 [0207]
Meanwhile, in the moving apparatus 100 shown in
Fig. 14, the processing monitoring unit 101 includes the
following only one ECU:
(1) an ECU-1c (system load monitoring & virus
30 monitoring & log collection ECU) 106.
[0208]
78
The ECU-1c (system load monitoring & virus
monitoring & log collection ECU) 106
executes all the processing executed by the ECU-1a
(system load monitoring ECU) 102 and the ECU-1b (virus
monitoring & log collection ECU) 103 described 5 above with
reference to Fig. 2.
That is, the ECU-1c (system load monitoring & virus
monitoring & log collection ECU) 106 monitors the
bandwidth usage status of the CAN network 120, acquires
10 log information based on a CAN message transmitted and
received via the CAN network 120, and executes virus
detection processing and the like based on the acquired
log information.
Further, the ECU-1c (system load monitoring & virus
15 monitoring & log collection ECU) 106 executes
transmission and reception processing with the log
analysis server 200 via the communication unit 104, and
also executes processing of transmitting the acquired log
information to the log analysis server 200, processing of
20 receiving analysis information from the log analysis
server 200, and antivirus processing such as elimination
of viruses based on received information.
[0209]
As described above, the processing monitoring unit
25 101 can include a single ECU, and can also include
individual ECUs for respective processing units.
[0210]
Next,
(b) the embodiment in which the processing
30 monitoring unit 101 is provided as an information
processing apparatus attachable to and detachable from
79
the moving apparatus 100
will be described with reference to Fig. 15.
[0211]
In the moving apparatus 100 shown in Fig. 15, as
well as in the configuration described 5 with reference to
Fig. 14, the processing monitoring unit 101 includes the
following only one ECU:
(1) the ECU-1c (system load monitoring & virus
monitoring & log collection ECU) 106.
10 The embodiment shown in Fig. 15 is an example in
which the processing monitoring unit 101 is provided as
an independent information processing apparatus 300
attachable to and detachable from the moving apparatus
100.
15 The information processing apparatus 300 is
connected to the CAN network 120 of the moving apparatus
100 via a network interface (IF), and can output a
message to the CAN network 120 and can acquire a message
from the CAN network 120.
20 [0212]
The information processing apparatus 300 can be
attached to the moving apparatus 100 as necessary and be
detached from the moving apparatus 100 when not used.
Fig. 16 shows a hardware configuration example of
25 the information processing apparatus 300.
[0213]
The hardware configuration example of the
information processing apparatus 300 will be described
with reference to Fig. 16.
30 A central processing unit (CPU) 301 functions as a
data processing unit that executes various kinds of
80
processing in accordance with programs stored in a read
only memory (ROM) 302 or storage unit 308. For example,
the processing according to the sequences described in
the above embodiment is executed. A random access memory
(RAM) 303 stores programs executed 5 by the CPU 301,
parameters, and various kinds of data, and is also used
as a work area for executing the programs. The CPU 301,
the ROM 302, and the RAM 303 are connected to each other
by a bus 304.
10 [0214]
The CPU 301 is connected to an input/output
interface 305 via the bus 304. The input/output
interface 305 is connected to an input unit 306 including
a data acquisition unit and the like, such as various
15 switches, a keyboard, a touchscreen, a mouse, and a
microphone and is also connected to an output unit 307
including a display, a speaker, and the like.
[0215]
Further, the information processing apparatus 300
20 is connected to the CAN network 120 via a network IF 321
and outputs a message to the CAN network 120 and receives
a message from the CAN network 120.
[0216]
The CPU 301 executes processing such as generation
25 of log information and virus analysis based on a message
input from the CAN network 120. Further, the CPU 301
executes processing based on a command or the like input
from the input unit 306, and outputs a processing result
to, for example, the output unit 307.
30 The storage unit 308 connected to the input/output
interface 305 includes, for example, a hard disk and the
81
like, and stores the programs executed by the CPU 301 and
various kinds of data. A communication unit 309
functions as a transmission/reception unit for data
communication via a network such as the Internet or a
local area network, and communicates 5 with an external
device.
[0217]
A drive 130 connected to the input/output interface
305 drives a removable medium 311, such as a magnetic
10 disk, an optical disk, a magneto-optical disk, or a
semiconductor memory such as a memory card, to record or
read data.
[0218]
Because the information processing apparatus 300
15 having the configuration shown in Fig. 16 is attached to
the moving apparatus 100 shown in Fig. 15, it is possible
to perform monitoring of communication messages
transmitted and received via the CAN network 120 in the
moving apparatus 100, acquisition of logs, and virus
20 elimination processing.
[0219]
[6. Summary of configurations of present
disclosure]
Hereinabove, the embodiments of the present
25 disclosure have been described in detail by referring to
specific embodiments. However, it is obvious that those
skilled in the art can make modifications and
substitutions of the embodiments, without departing from
the scope of the present disclosure. That is, the
30 present invention has been described in the form of
illustration, and should not be interpreted in a limited
82
manner. The claims should be taken into consideration in
order to determine the gist of the present disclosure.
[0220]
Note that the technology disclosed in this
specification can be configured 5 as follows.
(1) An information processing apparatus including
a processing monitoring unit configured to execute
processing of monitoring a data communication network, in
which:
10 the processing monitoring unit includes
a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
and
a virus monitoring unit configured to collect log
15 information corresponding to a communication message in
the data communication network and perform virus
detection based on the log information; and
the virus monitoring unit
is configured to change a mode of collecting the
20 log information in accordance with information regarding
the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
25 a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.
[0221]
30 (2) The information processing apparatus according
to (1), in which
83
in a case where the available bandwidth of the data
communication network is equal to or larger than the
predetermined threshold,
the virus monitoring unit collects not only the log
information corresponding to 5 the high-priority
communication message but also log information
corresponding to a low-priority communication message.
[0222]
(3) The information processing apparatus according
10 to (1) or (2), in which
in a case where a virus is detected from the data
communication network and the available bandwidth of the
data communication network is equal to or larger than the
predetermined threshold,
15 the virus monitoring unit collects not only the
limited log information corresponding to the highpriority
communication message but also log information
corresponding to a low-priority communication message.
[0223]
20 (4) The information processing apparatus according
to any one of (1) to (3), in which
the virus monitoring unit
transmits the collected log information to a log
analysis server.
25 [0224]
(5) The information processing apparatus according
to any one of (1) to (4), in which
in a case where a virus is detected from the data
communication network and the available bandwidth of the
30 data communication network is neither equal to nor larger
than the predetermined threshold,
84
the virus monitoring unit collects at least log
information corresponding to a communication message
issued by a communication system control electronic
control unit (ECU).
5 [0225]
(6) The information processing apparatus according
to any one of (1) to (5), in which
the virus monitoring unit
is configured to store priority information
10 regarding log collection in a storage unit, and
in a case where a virus is detected from the data
communication network and the available bandwidth of the
data communication network is neither equal to nor larger
than the predetermined threshold, determines log
15 information to be collected in accordance with order of
priority obtained from the information stored in the
storage unit.
[0226]
(7) The information processing apparatus according
20 to any one of (1) to (6), in which the data communication
network is a controller area network (CAN) configured to
transmit and receive a communication message for
controlling a component of the moving apparatus.
[0227]
25 (8) The information processing apparatus according
to any one of (1) to (7), in which the priority
information applied by the virus monitoring unit to
determine log information to be collected is priority
information set for each electronic control unit (ECU)
30 connected to the data communication network.
[0228]
85
(9) The information processing apparatus according
to any one of (1) to (8), in which
the priority information is priority information
set as follows:
log information corresponding 5 to a communication
message issued by the communication system control
electronic control unit (ECU) having first priority;
log information corresponding to a communication
message issued by a drive system control electronic
10 control unit (ECU) having second priority; and
log information corresponding to a communication
message issued by a body system control electronic
control unit (ECU) having third priority.
[0229]
15 (10) The information processing apparatus according
to (9), in which
the virus monitoring unit
collects only the log information corresponding to
the communication message issued by the communication
20 system control electronic control unit (ECU) in a case
where the available bandwidth of the data communication
network is less than a predetermined first threshold,
collects the log information corresponding to the
communication messages issued by the communication system
25 control electronic control unit (ECU) and the drive
system control electronic control unit (ECU) in a case
where the available bandwidth of the data communication
network is equal to or larger than the predetermined
first threshold but is less than a second threshold, and
30 collects the log information corresponding to the
communication messages issued by the communication system
86
control electronic control unit (ECU), the drive system
control electronic control unit (ECU), and the body
system control electronic control unit (ECU) in a case
where the available bandwidth of the data communication
network is equal to or larger than the 5 second threshold.
[0230]
(11) The information processing apparatus according
to (9) or (10), in which the log information having the
third priority in the priority information further
10 includes log information corresponding to a communication
message issued by a probe car compatible sensor system
control electronic control unit (ECU).
[0231]
(12) The information processing apparatus according
15 to any one of (1) to (11), in which:
the data communication network is a data
communication network configured to transmit and receive
a communication message for controlling a component of a
probe car including an information acquisition sensor;
20 and
in a case where the available bandwidth of the data
communication network is equal to or less than a
predetermined sensor compatible threshold, the processing
monitoring unit performs control so as to reduce
25 frequency of outputting sensor detection information from
the information acquisition sensor to the data
communication network.
[0232]
(13) A moving apparatus including:
30 a data communication network configured to transmit
and receive a communication message for controlling a
87
component of the moving apparatus; and
a processing monitoring unit configured to execute
processing of monitoring the data communication network,
in which:
the processing monitoring 5 unit includes
a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
and
a virus monitoring unit configured to collect log
10 information corresponding to a communication message in
the data communication network and perform virus
detection based on the log information; and
the virus monitoring unit
is configured to change a mode of collecting the
15 log information in accordance with information regarding
the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
20 a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.
[0233]
25 (14) The moving apparatus according to (13), in
which
in a case where the available bandwidth of the data
communication network is equal to or larger than the
predetermined threshold,
30 the virus monitoring unit collects not only the log
information corresponding to the high-priority
88
communication message but also log information
corresponding to a low-priority communication message.
[0234]
(15) The moving apparatus according to (13) or
5 (14), in which
in a case where a virus is detected from the data
communication network and the available bandwidth of the
data communication network is neither equal to nor larger
than the predetermined threshold,
10 the virus monitoring unit collects at least log
information corresponding to a communication message
issued by a communication system control electronic
control unit (ECU).
[0235]
15 (16) The moving apparatus according to any one of
(13) to (15), in which:
the data communication network is a controller area
network (CAN) configured to transmit and receive a
communication message for controlling a component of the
20 moving apparatus; and
the priority information applied by the virus
monitoring unit to determine log information to be
collected is priority information set for each electronic
control unit (ECU) connected to the CAN.
25 [0236]
(17) The moving apparatus according to any one of
(13) to (16), in which
the priority information is priority information
set as follows:
30 log information corresponding to a communication
message issued by the communication system control
89
electronic control unit (ECU) having first priority;
log information corresponding to a communication
message issued by a drive system control electronic
control unit (ECU) having second priority; and
log information corresponding 5 to a communication
message issued by a body system control electronic
control unit (ECU) having third priority.
[0237]
(18) The moving apparatus according to (17), in
10 which the log information having the third priority in
the priority information further includes log information
corresponding to a communication message issued by a
probe car compatible sensor system control electronic
control unit (ECU).
15 [0238]
(19) An information processing method executed in
an information processing apparatus, the method including
causing a processing monitoring unit configured to
execute processing of monitoring a data communication
20 network to execute
system load monitoring processing of monitoring an
available bandwidth of the data communication network,
and
virus monitoring processing of collecting log
25 information corresponding to a communication message in
the data communication network and performing virus
detection based on the log information, in which
in the virus monitoring processing,
the processing monitoring unit executes processing
30 of changing a mode of collecting the log information in
accordance with information regarding the available
90
bandwidth of the data communication network acquired by
the system load monitoring unit, and
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
a predetermined threshold, the processing 5 monitoring unit
collects only limited log information corresponding to a
high-priority communication message in accordance with
predetermined priority information.
[0239]
10 (20) A program for causing an information
processing apparatus to execute information processing,
the program causing a processing monitoring unit
configured to execute processing of monitoring a data
communication network to execute
15 system load monitoring processing of monitoring an
available bandwidth of the data communication network,
and
virus monitoring processing of collecting log
information corresponding to a communication message in
20 the data communication network and performing virus
detection based on the log information, in which
in the virus monitoring processing,
the program causes the processing monitoring unit
to
25 execute processing of changing a mode of collecting
the log information in accordance with information
regarding the available bandwidth of the data
communication network acquired by the system load
monitoring unit, and
30 in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
91
a predetermined threshold, collect only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.
5 [0240]
Further, the series of processing described in the
specification can be executed by hardware, software, or a
combined configuration of both. In a case where the
processing is executed by software, the processing can be
10 executed by installing a program in which the processing
sequence is recorded in a memory inside a computer
incorporated into dedicated hardware and executing the
program, or by installing a program in a general purpose
computer that can execute various kinds of processing and
15 executing the program. For example, the program can be
recorded on a recording medium in advance. The program
can be installed in the computer from the recording
medium, or can also be received via a network such as a
local area network (LAN) or the Internet and be installed
20 in a recording medium such as a built-in hard disk.
[0241]
Note that the various kinds of processing described
in the specification not only are executed in time series
in accordance with the description, but also are executed
25 in parallel or individually depending on a processing
capacity of an apparatus that executes the processing or
as necessary. Further, in this specification, a system
is a logical set configuration of a plurality of
apparatuses, and is not limited to a configuration in
30 which apparatuses having respective configurations are
included in the same housing.
92
INDUSTRIAL APPLICABILITY
[0242]
Hereinabove, as described above, according to a
configuration of an embodiment of the present 5 disclosure,
efficient virus detection and removal are realized by
changing a mode of collecting logs in accordance with a
network usage status.
Specifically, for example, the configuration
10 includes a processing monitoring unit that executes
processing of monitoring a data communication network,
and the processing monitoring unit includes a system load
monitoring unit that monitors an available bandwidth of a
network and a virus monitoring unit that collects log
15 information corresponding to a communication message and
performs virus detection. The virus monitoring unit
changes a mode of collecting log information in
accordance with information regarding the available
bandwidth of the network acquired by the system load
20 monitoring unit. In a case where a virus is detected and
the available bandwidth is neither equal to nor larger
than a predetermined threshold, only limited log
information corresponding to a high-priority
communication message is collected.
25 With this configuration, efficient virus detection
and removal are realized by changing the mode of
collecting logs in accordance with the network usage
status.
30 REFERENCE SIGNS LIST
[0243]
93
10 Moving apparatus
11 Steering
12 Shift lever
13 Display unit
5 14 Engine
15 Accelerator
16 Brake
17 Processing monitoring unit
18 In-vehicle electronic device group (ECU)
10 19 GPS receiver
20 Storage unit
21 Communication unit
22 Input/output IF
25 Forward-facing camera
15 26 Backward-facing camera
27 Omnidirectional camera
30 GPS satellite
100 Moving apparatus
101 Processing monitoring unit
20 102, 103, 106 ECU
104 Communication unit
105 Virus DB
111 to 114 ECU
115 Sensor detection information DB
25 120 CAN network
200 ECU
201 CPU
202 ROM
203 RAM
30 206 Network IF
207 Input/output unit
94
208 Storage unit
209 Communication unit
300 Information processing apparatus
301 CPU
5 302 ROM
303 RAM
304 Bus
305 Input/output interface
306 Input unit
10 307 Output unit
308 Storage unit
309 Communication unit
310 Drive
311 Removable medium
15 321 Network IF
95
CLAIMS
1. An information processing apparatus comprising
a processing monitoring unit configured to execute
processing of monitoring a data communication 5 network,
wherein:
the processing monitoring unit includes
a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
10 and
a virus monitoring unit configured to collect log
information corresponding to a communication message in
the data communication network and perform virus
detection based on the log information; and
15 the virus monitoring unit
is configured to change a mode of collecting the
log information in accordance with information regarding
the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
20 in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
25 priority information.
2. The information processing apparatus according to
claim 1, wherein
in a case where the available bandwidth of the data
30 communication network is equal to or larger than the
predetermined threshold,
96
the virus monitoring unit collects not only the log
information corresponding to the high-priority
communication message but also log information
corresponding to a low-priority communication message.
5
3. The information processing apparatus according to
claim 1, wherein
in a case where a virus is detected from the data
communication network and the available bandwidth of the
10 data communication network is equal to or larger than the
predetermined threshold,
the virus monitoring unit collects not only the
limited log information corresponding to the highpriority
communication message but also log information
15 corresponding to a low-priority communication message.
4. The information processing apparatus according to
claim 1, wherein
the virus monitoring unit
20 transmits the collected log information to a log
analysis server.
5. The information processing apparatus according to
claim 1, wherein
25 in a case where a virus is detected from the data
communication network and the available bandwidth of the
data communication network is neither equal to nor larger
than the predetermined threshold,
the virus monitoring unit collects at least log
30 information corresponding to a communication message
issued by a communication system control electronic
97
control unit (ECU).
6. The information processing apparatus according to
claim 1, wherein
the virus 5 monitoring unit
is configured to store priority information
regarding log collection in a storage unit, and
in a case where a virus is detected from the data
communication network and the available bandwidth of the
10 data communication network is neither equal to nor larger
than the predetermined threshold, determines log
information to be collected in accordance with order of
priority obtained from the information stored in the
storage unit.
15
7. The information processing apparatus according to
claim 1, wherein the data communication network is a
controller area network (CAN) configured to transmit and
receive a communication message for controlling a
20 component of the moving apparatus.
8. The information processing apparatus according to
claim 1, wherein the priority information applied by the
virus monitoring unit to determine log information to be
25 collected is priority information set for each electronic
control unit (ECU) connected to the data communication
network.
9. The information processing apparatus according to
30 claim 1, wherein
the priority information is priority information
98
set as follows:
log information corresponding to a communication
message issued by the communication system control
electronic control unit (ECU) having first priority;
log information corresponding 5 to a communication
message issued by a drive system control electronic
control unit (ECU) having second priority; and
log information corresponding to a communication
message issued by a body system control electronic
10 control unit (ECU) having third priority.
10. The information processing apparatus according to
claim 9, wherein
the virus monitoring unit
15 collects only the log information corresponding to
the communication message issued by the communication
system control electronic control unit (ECU) in a case
where the available bandwidth of the data communication
network is less than a predetermined first threshold,
20 collects the log information corresponding to the
communication messages issued by the communication system
control electronic control unit (ECU) and the drive
system control electronic control unit (ECU) in a case
where the available bandwidth of the data communication
25 network is equal to or larger than the predetermined
first threshold but is less than a second threshold, and
collects the log information corresponding to the
communication messages issued by the communication system
control electronic control unit (ECU), the drive system
30 control electronic control unit (ECU), and the body
system control electronic control unit (ECU) in a case
99
where the available bandwidth of the data communication
network is equal to or larger than the second threshold.
11. The information processing apparatus according to
claim 9, wherein the log information 5 having the third
priority in the priority information further includes log
information corresponding to a communication message
issued by a probe car compatible sensor system control
electronic control unit (ECU).
10
12. The information processing apparatus according to
claim 1, wherein:
the data communication network is a data
communication network configured to transmit and receive
15 a communication message for controlling a component of a
probe car including an information acquisition sensor;
and
in a case where the available bandwidth of the data
communication network is equal to or less than a
20 predetermined sensor compatible threshold, the processing
monitoring unit performs control so as to reduce
frequency of outputting sensor detection information from
the information acquisition sensor to the data
communication network.
25
13. A moving apparatus comprising:
a data communication network configured to transmit
and receive a communication message for controlling a
component of the moving apparatus; and
30 a processing monitoring unit configured to execute
processing of monitoring the data communication network,
100
wherein:
the processing monitoring unit includes
a system load monitoring unit configured to monitor
an available bandwidth of the data communication network,
5 and
a virus monitoring unit configured to collect log
information corresponding to a communication message in
the data communication network and perform virus
detection based on the log information; and
10 the virus monitoring unit
is configured to change a mode of collecting the
log information in accordance with information regarding
the available bandwidth of the data communication network
acquired by the system load monitoring unit, and
15 in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
a predetermined threshold, collects only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
20 priority information.
14. The moving apparatus according to claim 13, wherein
in a case where the available bandwidth of the data
communication network is equal to or larger than the
25 predetermined threshold,
the virus monitoring unit collects not only the log
information corresponding to the high-priority
communication message but also log information
corresponding to a low-priority communication message.
30
15. The moving apparatus according to claim 13, wherein
101
in a case where a virus is detected from the data
communication network and the available bandwidth of the
data communication network is neither equal to nor larger
than the predetermined threshold,
the virus monitoring unit collects 5 at least log
information corresponding to a communication message
issued by a communication system control electronic
control unit (ECU).
10 16. The moving apparatus according to claim 13,
wherein:
the data communication network is a controller area
network (CAN) configured to transmit and receive a
communication message for controlling a component of the
15 moving apparatus; and
the priority information applied by the virus
monitoring unit to determine log information to be
collected is priority information set for each electronic
control unit (ECU) connected to the CAN.
20
17. The moving apparatus according to claim 13, wherein
the priority information is priority information
set as follows:
log information corresponding to a communication
25 message issued by a communication system control
electronic control unit (ECU) having first priority;
log information corresponding to a communication
message issued by a drive system control electronic
control unit (ECU) having second priority; and
30 log information corresponding to a communication
message issued by a body system control electronic
102
control unit (ECU) having third priority.
18. The moving apparatus according to claim 17, wherein
the log information having the third priority in the
priority information further includes 5 log information
corresponding to a communication message issued by a
probe car compatible sensor system control electronic
control unit (ECU).
10 19. An information processing method executed in an
information processing apparatus, the method comprising
causing a processing monitoring unit configured to
execute processing of monitoring a data communication
network to execute
15 system load monitoring processing of monitoring an
available bandwidth of the data communication network,
and
virus monitoring processing of collecting log
information corresponding to a communication message in
20 the data communication network and performing virus
detection based on the log information, wherein
in the virus monitoring processing,
the processing monitoring unit executes processing
of changing a mode of collecting the log information in
25 accordance with information regarding the available
bandwidth of the data communication network acquired by
the system load monitoring unit, and
in a case where the available bandwidth of the data
communication network is neither equal to nor larger than
30 a predetermined threshold, the processing monitoring unit
collects only limited log information corresponding to a
103
high-priority communication message in accordance with
predetermined priority information.
20. A program for causing an information processing
apparatus to execute information 5 processing,
the program causing a processing monitoring unit
configured to execute processing of monitoring a data
communication network to execute
system load monitoring processing of monitoring an
10 available bandwidth of the data communication network,
and
virus monitoring processing of collecting log
information corresponding to a communication message in
the data communication network and performing virus
15 detection based on the log information, wherein
in the virus monitoring processing,
the program causes the processing monitoring unit
to
execute processing of changing a mode of collecting
20 the log information in accordance with information
regarding the available bandwidth of the data
communication network acquired by the system load
monitoring unit, and
in a case where the available bandwidth of the data
25 communication network is neither equal to nor larger than
a predetermined threshold, collect only limited log
information corresponding to a high-priority
communication message in accordance with predetermined
priority information.