JP7268562B2 - METHOD AND INFORMATION PROCESSING APPARATUS FOR ESTIMATING MESSAGE FEATURES - Google Patents

Description

The present invention relates to a method and information processing apparatus for estimating characteristics of messages transmitted within a network.

A network technology called CAN (Controller Area Network) may be used in an in-vehicle network of an automobile. In a network using CAN, each node is equipped with an ECU (electronic control unit).

Identification information (ID) is attached to the message transmitted from the ECU. This message is broadcast to the ECUs in the network. Here, each ECU recognizes the ID of the message it should acquire. Each ECU then acquires the necessary message by checking the ID of the received message.

In the CAN system configured as described above, an ECU may be hijacked by a malicious third party, and an attack may occur in which a malicious message is output from the ECU. For example, an ID used in CAN systems is given to malicious messages. Then, the ECU receiving the message may perform unintended processing. Therefore, methods for detecting attacks or unauthorized access to networks are being studied.

In addition, a security device has been proposed that can detect attack frames by adapting to various and changing attacks (for example, Patent Document 1). In a network in which a plurality of electronic control units (ECUs) communicate, an information processing apparatus has been proposed that determines whether or not a frame received from the network is invalid (for example, Patent Document 2). An information processing method for processing data frames flowing through an in-vehicle network has been proposed (for example, Patent Document 3).

JP 2017-085663 A JP 2019-008618 A WO2018/105330

In the CAN system, the transmission type (or transmission pattern) may differ for each identifier assigned to the message. For example, the following three transmission types are assumed.
(1) Periodic message (2) Aperiodic message (3) Periodic message with event transmission Note that a periodic message is transmitted at a constant period by an ECU. Periodic messages with event transmission are normally transmitted at regular intervals, but when a certain event occurs, they are transmitted due to the occurrence of that event. Aperiodic messages are messages other than periodic messages or periodic messages with event transmission.

In attack detection, it is preferable to know the message transmission type for each identifier. In addition, in attack detection, it is preferable to be able to recognize what format (or attribute) data is written in which area in the received frame.

However, conventional techniques cannot efficiently determine the type of transmission and the format of each piece of data within a frame. As an example, two determination processes are executed independently. In addition, the conventional technology does not detect attacks by recognizing periodic messages with event transmission. Therefore, the attack detection methods of the prior art have room for improvement.

It is an object according to one aspect of the present invention to provide a method for accurately estimating characteristics of messages transmitted within a network.

An estimation method of one aspect of the present invention estimates characteristics of messages transmitted within a network. This estimation method refers to the communication log that records the reception time of each message and the data stored in each message. By calculating the reception interval that represents the difference from the time and detecting the values stored in each of the multiple different partial areas specified by the combination of the position and length in the data area of each message, each partial area , the number of patterns representing the number of detected different values is counted, and a first variable representing whether or not the message reception interval provided for each partial region corresponds to a predetermined transmission cycle and a second variable representing whether or not the message reception interval corresponds to the transmission period during a period other than when a predetermined event occurs, based on the reception interval and the value stored in the partial area. respectively, and based on said first variable, said second variable and said number of patterns, the transmission type of the message and the format of the data stored in the data area of the message.

According to the above aspect, it is possible to accurately estimate the characteristics of the message transmitted within the network.

1 illustrates an example of a network in which an estimator is used; FIG. FIG. 10 is a diagram illustrating a periodic message with event transmission; FIG. 3 is a diagram showing an example of a format of a frame that transmits a message; It is a figure which shows an example of the hardware constitutions of ECU by which an estimation apparatus is mounted. FIG. 4 is a diagram showing an example of the format of each data stored in a message; It is a figure which shows an example of the estimation apparatus concerning embodiment of this invention. It is a figure which shows an example of a communication log. FIG. 10 is a diagram showing an example of a partial area; 6 is a flowchart showing an example of estimation processing according to the embodiment of the present invention; It is a figure which shows an example of a variable management table. 6 is a flowchart showing an example of preprocessing; 6 is a flowchart showing an example of estimation processing; 9 is a flow chart showing pre-processing of the second embodiment; It is a flow chart which shows estimation processing of a 2nd embodiment. FIG. 4 is a diagram showing an example of a communication log referred to in Examples 1 and 2; FIG. FIG. 11 is a diagram (part 1) showing an update result in the first embodiment; FIG. 12 is a diagram (part 2) showing an update result in the first embodiment; FIG. 13 is a diagram (part 3) showing an update result in the first embodiment; FIG. 10 is a diagram (part 4) showing an update result in the first embodiment; FIG. 11 is a diagram (part 1) showing an update result in the second embodiment; FIG. 12 is a diagram (part 2) showing an update result in the second embodiment; FIG. 13 is a diagram (part 3) showing an update result in the second embodiment;

FIG. 1 shows an example of a network in which an estimator according to an embodiment of the invention is used. A network 100 shown in FIG. 1 includes a plurality of ECUs (ECU0 to ECUk). A plurality of ECUs are connected to each other via a bus. In this embodiment, a plurality of ECUs constitute a CAN (Controller Area Network) system.

Each ECU can send messages over the bus. This message is broadcast to all ECUs in network 100 . At this time, the message also arrives at the source node. Each message is assigned an identifier (ID). Here, each ECU recognizes the ID of the message it should acquire. Each ECU then acquires the necessary message by checking the ID of the received message. Each ECU is an example of a "communication device".

In the network 100 described above, an estimating device is implemented in one of a plurality of ECUs. In the embodiment shown in FIG. 1, the estimation device is mounted in the ECU0. In this case, the ECU in which the estimation device is mounted is an example of an "information processing device." Also, the estimation device may be implemented in an information processing device such as a computer instead of being implemented in any ECU. Furthermore, a computer outside the vehicle may use the technology to estimate features, and using the estimated features, an ECU or computer inside the vehicle, or a computer outside the vehicle may perform attack detection.

The estimator estimates the transmission type of messages transmitted within network 100 and the format (or attributes) of the data contained in the messages. Note that the estimation device may be used together with the attack detection device. In this case, the attack detection device uses the estimation result of the estimation device to determine whether the received message is an attack message. Also, the estimation device and the attack detection device may be implemented within the same ECU.

ECU1-ECUk transmit a message containing the specified identifier. In the example shown in FIG. 1, ECU1 transmits a message including identification information ID_A, ECU2 transmits a message including identification information ID_B, and ECU3 transmits a message including identification information ID_C. Here, each message is broadcast within network 100 . Therefore, the ECU in which the estimating device is installed (here, ECU0) can receive all messages. The timing chart of FIG. 1 shows how messages transmitted from ECU1 to ECU3 arrive at ECU0.

Messages transmitted in the network 100 are classified into one of the following for each identifier.
(1) Cyclic message (2) Aperiodic message (3) Cyclic message with event transmission

A periodic message is sent by a given ECU at regular intervals. For example, messages with ID=0x123 are sent at 10 ms intervals, and messages with ID=0x456 are sent at 20 ms intervals.

Periodic messages with event transmission are normally transmitted at regular intervals, but when a certain event occurs, they are transmitted due to the occurrence of that event. In the example shown in FIG. 2, messages are normally sent with a period T1. Specifically, the messages M1 to M4 are transmitted with a period T1. However, when a predetermined event (eg, user's instruction or detection of an alarm) occurs, the message is transmitted due to the occurrence of the event. In FIG. 2, message M5 is sent due to the occurrence of an event. At this time, the difference T2 between the transmission timing of the message M4 and the transmission timing of the message M5 is shorter than the period T1. After this, messages M6-M7 are sent. At this time, the message transmission interval returns to T1.

A specific value is set in a predetermined area of the message transmitted due to the occurrence of the event. For example, in case 1 shown in FIG. 2, "1" is set in predetermined areas of messages M1-M4 and M6-M7, but "3" is set in the same area of message M5. Alternatively, the value of a predetermined area of the message changes due to the occurrence of an event. For example, in case 2, "1" is set in a predetermined area of messages M1 to M4, and "7" is set in the same area after message M5.

In an in-vehicle network, multiple ECUs are used to control the vehicle. For example, a message containing ID=0x123 transmits data representing the accelerator opening. Also, a message including ID=0x456 transmits data representing the brake depression angle.

FIG. 3 shows an example format of a frame for transmitting messages. A standard frame includes a Start of Frame (SOF), an arbitration field, a control field, a data field, a CRC field, an ACK field, and an End of Frame (EOF). The arbitration field includes ID and RTR (Remote Transmission Request). ID represents identification information for identifying a message. The control field includes IDE (Identifier Extension), reserved bits, and DLC (Data Length Code). The CRC field contains a CRC sequence and a CRC delimiter. The ACK field contains the ACK slot and ACK delimiter. The value shown for each information element in FIG. 3 represents the bit length. For example, the length of the ID is 11 bits and the length of the data field is variable from 0 to 64 bits.

Similar to the standard specification frame, the frame used in the extension specification also contains SOF, arbitration field, control field, data field, CRC field, ACK field, EOF. However, in the extended specification, identification information is represented by a larger number of bits.

In the following description, it is assumed that messages are transmitted using standardized frames. However, the estimation method according to the embodiment of the present invention is also applicable to the case where messages are transmitted using extended specification frames. Also, the estimation method according to the embodiment of the present invention is compatible with a standard called CAN-FD.

FIG. 4 shows an example of the hardware configuration of an ECU in which the estimating device is mounted. ECU 200 includes a CAN transceiver 201, a CAN controller 202, and a processing circuit 203 in this example. Processing circuitry 203 includes processor 204 and memory 205 .

CAN transceiver 201 has the capability to transmit and receive the frames shown in FIG. The CAN controller 202 extracts data from the frame received by the CAN transceiver 201 and measures the reception time of the frame. It should be noted that CAN controller 202 may perform a CRC check on the received frame. CAN controller 202 can also store data in the transmission frame. The processor 204 executes programs stored in the memory 205 to achieve the estimation of the transmission type of the message and the format of the data contained in the message. In this case, this program describes the procedure of the flow chart described later.

An estimation device according to an embodiment of the present invention generates information used by an attack detection device that detects attacks on a network. That is, the estimating device estimates the transmission type of the message for each identifier, and also estimates the format of the data contained in the message for each identifier.

Here, attack detection shall be performed under the following preconditions.
(1) Perform detection for each identifier.
(2) It is unclear whether the message containing the identifier to be detected is a periodic message, a periodic message with event transmission, or an aperiodic message.
(3) However, the transmission cycle of the periodic message or the periodic message with event transmission is known or detectable.
(4) It is unknown what type of data is stored in the data area (for example, "a fixed value is stored in the area for 8 bits from the 5th bit").

Under these preconditions, the attack detection device (or detector) makes the following advance preparations before attack detection.
Preparatory process 1: Based on the communication log acquired in advance, the transmission type of the message is estimated for each identifier.
Preparatory process 2: A detection method corresponding to the transmission type obtained in preparatory procedure 1 is prepared.

As a detection method, a method has been proposed in which a message transmission cycle is used and a message that arrives outside the transmission cycle is determined to be an attack message. Methods have also been proposed to detect attack messages based on the behavior of data in the messages. For aperiodic messages or periodic messages with event transmission, methods based on the behavior of data in the messages are effective.

In the detection method based on data behavior, for example, if the first 8 bits of the data area of a message containing a specific identifier have a fixed value, when the value of the first 8 bits of the received message differs from the fixed value, , the message is determined to be an attack message. Alternatively, if the value of a predetermined field in sequentially transmitted messages changes according to a predetermined rule (eg, incremented by 1), then if the received message does not follow that rule, the message is considered an attack message. be judged. There are many other rules, and an incoming message is determined to be an attack message when it deviates from the respective rules.

Therefore, when executing a detection method based on data behavior, it is necessary to know in advance what type of data is stored between bits in the data area for each identifier. need to leave Specifically, before attack detection, it is necessary to investigate what type of data is stored in messages based on network communication logs. That is, the detector performs the following two processes before attack detection.
Process A: Based on the network communication log, the transmission type of the message is estimated for each identifier.
Process B: Based on the communication log of the network, for each identifier, the type of data contained in the data area of the message is estimated.

FIG. 5 shows an example of the format of each data stored in the message. In this example, the first 16-bit data format is a continuous value, the next 8-bit data format is a fixed value, and the last 8-bit data format is a checksum. Here, "continuous value" represents data in which the difference between the value stored in a certain received message and the value stored in the next received message is smaller than a predetermined threshold. For example, it is conceivable that the amount of change in the steering wheel angle detected at predetermined time intervals (eg, 10 ms) will not exceed a predetermined value. Therefore, when the difference between the value detected from a certain received message and the value detected from the next received message is greater than a threshold, it is determined that an attack has occurred. Alternatively, when another value is detected in the area where the "fixed value" is stored, it is determined that an attack has occurred.

Here, process B (that is, estimation of what type of data is stored at which position in the data area of the message) is described in document X or document Y, for example.
Document X: Field Classification, Modeling and Anomaly Detection in Unknown CAN Bus Networks (Markovitz, Wool) (International Conference escar 2015)
Literature Y: WO2018/105330

The method described in Document X exploits the uniqueness of the data to identify three types (fixed value, multi-value, continuous/sensor value). In addition, in the method described in Document Y, five formats (fixed value, counter, continuous value, checksum, status (multi-value)) is identified.

However, with the method described in Document X or Document Y, it is difficult to detect an event region from a periodic message with event transmission. In this specification, an "event area" is an area in which a specific value is set when an event occurs in a periodic message with event transmission, or an area in which a fixed value is normally set in a periodic message with event transmission but when an event occurs. Sometimes it means a region whose value changes. Further, in the method described in Document X or Document Y, it is difficult to perform the above-described process A simultaneously with or in parallel with the above-described process B. For this reason, the time required to prepare for attack detection becomes long. Therefore, the estimation method according to the embodiment of the present invention has functions to solve these problems.

<First embodiment>
FIG. 6 shows an example of an estimation device according to an embodiment of the invention. The estimation device 10 according to the embodiment of the present invention includes a communication log database 11, a control unit 12, a pattern number counter 13, a reception interval determination unit 14, a variable update unit 15, a format estimation unit 16, an intermediate result storage unit 17, and a final A result estimation unit 18 is provided. Note that the estimating device 10 may include other circuits or functions not shown in FIG.

The estimating device 10 is connected to a communication network including multiple ECUs. Then, the estimating device 10 receives frames transmitted from each ECU. Each frame stores a message. That is, the estimating device 10 receives messages transmitted from each ECU. In the example shown in FIG. 1 , the ECU 0 may operate as the estimation device 10 . In this case, the estimation device 10 receives messages transmitted from ECU1 to ECUk. Alternatively, the estimating device 10 is a computer program implemented in an external computing device that analyzes communication logs obtained from a communication network including multiple ECUs. In this case, a frame log is acquired one by one from the communication log transmitted from each ECU and processed.

The estimating device 10 has the capability to identify the transmission type of the message. That is, the estimating device 10 has a function of identifying a periodic message, an aperiodic message, or a periodic message with event transmission. As described with reference to FIG. 2, the periodic message with event transmission is normally transmitted at regular intervals, but when a predetermined event occurs, it is transmitted due to the occurrence of that event. . Therefore, the periodic message with event transmission is normally transmitted at a constant period, but when an event occurs, it is transmitted at shorter time intervals than the period. In the periodic message with event transmission detected in the first embodiment, when an event occurs, a specific value is set in a predetermined area in the message, as in case 1 shown in FIG. .

The communication log database 11 stores communication logs related to messages received by the estimation device 10 . As shown in FIG. 7, the communication log records the message reception time, the identifier included in the message, and the data stored in the data area of the message. In this embodiment, the data area is 64 bits, as shown in FIG. Therefore, the maximum length of data stored in each message is 64 bits.

The estimation device 10 uses communication logs stored in the communication log database 11 to estimate the transmission type of the message and the characteristics of the data stored in the message for each identifier. In addition, in the following description, unless otherwise specified, processing for an identifier to be estimated will be described.

The control unit 12 designates a predetermined monitor period. Then, the control unit 12 acquires information representing the reception time of each message and the data stored in the data area from the communication log corresponding to the monitoring period. In the following description, the reception time of the i-th message arriving at the estimating device 10 may be denoted as "t(i)", and the data stored in the message may be denoted as "Data(i)". .

Here, the estimating device 10 generates information for implementing attack detection based on the behavior of data stored in each message. Therefore, the estimating device 10 analyzes the data area of each message. However, it is unknown to the estimating device 10 what length of data is stored at what position in the data area. Therefore, the estimation device 10 analyzes data values for all stored patterns.

In the following description, when one or more pieces of individual data are stored in a 64-bit data area, the area in which each piece of individual data is stored may be called a "partial area." For example, in the embodiment shown in FIG. 5, the data area comprises a 16-bit partial area for storing steering wheel angle data, an 8-bit partial area for storing fixed data, and an 8-bit partial area for storing checksum data. contains.

Estimation device 10 analyzes the data stored in each partial area. Here, the start position and length of the partial area storing individual data are unknown. Therefore, the estimation device 10 analyzes data values for all stored patterns. For example, if the length of a partial area is 1 bit, there may be a partial area starting from the 1st bit, a partial area starting from the 2nd bit, ... a partial area starting from the 64th bit. . That is, if the length of the partial area is 1 bit, there can be 64 types of partial areas. Also, if the length of the partial area is 2 bits, there may be partial areas starting from the 1st bit, partial areas starting from the 1st bit, . . . partial areas starting from the 63rd bit. . That is, if the length of the partial area is 2 bits, there can be 63 types of partial areas. Likewise, if the length of a partial area is k bits, there can be "64+1−k" kinds of partial areas. Therefore, there are a total of 2080 patterns of partial areas.

Thus, each partial area is identified by a combination of starting position and length within the data area. Therefore, in the following description, the partial area identified by the starting position P and the length L or the value stored in the partial area may be referred to as "Data (P, L)". For example, in FIG. 8, the steering wheel angle data is stored from the first bit in the data area and its length is 16 bits. Therefore, the partial area storing the steering wheel angle data is represented by "Data (1, 16)". Also, the fixed data is stored from the 17th bit in the data area, and its length is 8 bits. Therefore, the partial area storing the fixed data is represented by "Data (17, 8)".

The pattern number counter 13 counts the number of patterns for each partial area. That is, the number of patterns is counted for each of 2080 partial areas. The number of patterns represents the number of different values that appear in messages arriving at the estimator 10 within the monitoring period. For example, when the same value is stored in all received messages, the pattern number is "1". Further, when the value X is stored in 5 of the 10 received messages and the value Y is stored in the remaining 5 messages, the number of patterns is "2". Furthermore, out of the 10 received messages, if 5 messages store the value X, 3 messages store the value Y, and the remaining 2 messages store the value Z, the pattern The number is "3". In the following description, the number of patterns in partial area Data (P, L) may be expressed as "DP (P, L)".

The reception interval determining unit 14 calculates, for each received message, a reception interval representing the difference between the reception time of the message and the reception time of the message immediately preceding the message. That is, for the i-th message, the reception interval dt(i) is calculated by calculating the difference between the reception time t(i) and the reception time t(i-1). Further, the reception interval determination unit 14 compares the transmission period and the reception interval dt(i) for each received message, and notifies the control unit 12 of the comparison result.

The variable updating unit 15 manages the following three variables for each partial area. That is, each variable is managed for each of 2080 partial regions. It should be noted that the transmission interval described below represents the transmission interval of the message including the identifier to be estimated.
(1) Variable s_f representing whether or not the message reception interval is shorter than the transmission cycle
(2) Variable p_f representing whether or not the message reception interval matches the transmission cycle
(3) Variable f_f representing whether or not the message reception interval coincides with the transmission cycle during a period other than when a predetermined event occurs
Note that the variable f_f indicates whether or not the message reception interval coincides with the transmission cycle during a period other than when a predetermined event occurs. or That is, the variable f_f indicates whether or not the message reception interval coincides with the transmission cycle during a period other than when a predetermined event occurs. It may indicate whether the value should be stored at times other than when an event occurs. Then, the variable update unit 15 updates these messages based on the message reception interval. At this time, a variable associated with a certain sub-area may be updated based on the message reception interval and the value of that sub-area. The initial values of these variables are each "1". Also, once these variables are updated to "0", they never return to "1". In the following description, the variables related to the partial area identified by the starting position P and length L will be referred to as "s_f(P,L)", "p_f(P,L)", and "f_f(P,L)", respectively. may be indicated.

The format estimation unit 16 estimates the format (or attribute) of data stored in each partial area. At this time, the format estimating unit 16 determines the values of the stored data, the number of patterns DP obtained by the pattern number counter 13, and the variables updated by the variable updating unit 15. Infer the format of the data.

The intermediate result storage unit 17 temporarily stores the processing results of the pattern number counter 13 , the reception interval determination unit 14 , the variable update unit 15 and the format estimation unit 16 .

When the processing for all communication logs within the monitoring period is completed, the control unit 12 generates an end notification and gives it to the final result estimation unit 18 . Then, the final result estimation unit 18 uses the processing results stored in the intermediate result storage unit 17 to estimate the transmission type of the message and the format of the data stored in the message for each identifier. At this time, the final result estimation unit 18 estimates the transmission type of the message and the format of the data stored in the message based on the estimation result for each partial area.

FIG. 9 is a flow chart showing an example of estimation processing according to the embodiment of the present invention. The processing of this flow chart is performed for the designated monitoring period and the designated identifier.

In S1, the estimation device 10 initializes variables used in estimation processing. Specifically, the number of patterns DP(P, L) is initialized to "zero" for all partial regions. Also, variables s_f, p_f, and f_f are initialized to "1" for all the partial areas.

Each variable is managed by the variable management table shown in FIG. In FIG. 10, the two numbers identifying the partial area represent the starting position P and length L within the data area. Formats 1 to 8 will be explained later. This variable management table is stored in, for example, the interim progress storage unit 17 . Note that the variable management table may manage other variables not shown in FIG. 10 in addition to the variables shown in FIG.

In S2, the estimation device 10 performs preprocessing. Pre-processing is performed for each received message and for each subregion within each received message. That is, the estimating apparatus 10 performs preprocessing on each of the 2080 partial areas each time one record of data is extracted from the communication log.

In S3, the estimation device 10 executes estimation processing. The estimation processing includes processing for estimating the format of data stored in each partial area, and processing for estimating the transmission type of the message based on the data format of each partial area.

In S4, the estimating device 10 executes a duplication elimination process. Duplication elimination processing includes processing for determining the format of data stored in the partial area.

FIG. 11 is a flowchart illustrating an example of preprocessing. This preprocessing corresponds to S2 shown in FIG. Therefore, this preprocessing is performed for each partial area. In the description below, the partial area on which preprocessing is performed may be referred to as a "target partial area".

In S11, the format determination unit 16 estimates the format of the data stored in the target partial area. In this example, data may be in any one of the following ten formats.
Format 1: Fixed value Format 2: Checksum (calculation formula)
Format 3: Counter format 4: Monotonically increasing format 5: Unsigned continuous value format 6: Signed continuous value format 7: Checksum (uniform)
Format 8: Multi-value Format 9: Event (Specific value: A specific value is set when an event occurs)
Format 10: Event (change: value changes when event occurs)
Format 10 is detected in a second embodiment, which will be described later. Then, in S11, the format determination unit 16 determines whether or not there is a possibility that the format of the data stored in the target partial area corresponds to one of the formats 1 to 4 described above. Then, when the format of the data stored in the target partial area can correspond to a certain format, the format determining unit 16 sets the flag corresponding to the format to "1";"0" is set to the flag corresponding to .

At this time, the following information is referred to in estimating the data format.
(1) Number of appearance patterns of data (2) Variance value of data variation when data is regarded as unsigned data (3) Variance value of data variation when data is regarded as signed data (4 ) Checksum calculation formula (information indicating how to calculate based on which part value)
(5) Uniform distribution of data (6) Differential value from previous message value In S11, the following processing is executed.
(1) When the number of appearance patterns of data is 2 or more, the fixed value possibility flag corresponding to format 1 is set to "0".
(2) When the result of the checksum calculation does not match the value stored in the target partial area, the checksum (calculation formula) possibility flag corresponding to format 2 is set to "0". Since the checksum is normally executed for n-byte data (n is an integer), if the data length does not meet this condition, the checksum (calculation formula) possibility flag is immediately displayed. "0" may be set.
(3) When the difference value from the previous message value changes in both positive and negative directions, set the counter possibility flag corresponding to format 3 to "0" and support format 4. The monotonically increasing possibility flag is also set to "0".
(4) The difference value from the value of the immediately preceding message is either positive or negative for all messages, but if the magnitude of the difference is greater than a certain value, monotone corresponding to format 4 The increase possibility flag is set to "0".
(5) When the difference value from the previous message value is not a constant value other than zero, set "0" to the counter possibility flag corresponding to format 3. (6) Difference from the previous message value. When the value difference value is a constant value other than zero, the monotonically increasing possibility flag corresponding to Format 4 is set to "0".

The state in which the possibility flag is "0" indicates that the data stored in the target partial area does not correspond to the corresponding format. In other words, the state in which the possibility flag is "1" indicates that the data stored in the target partial area can correspond to the corresponding format. Thus, in S11, it is determined whether or not the data stored in the target partial area can correspond to formats 1-4.

In S12 and S13, the pattern number counter 13 updates the pattern number DP of the target partial area as necessary. Specifically, when the value of the target partial area of the new received message does not match any of the values stored in the corresponding partial area of the previous received message, the number of patterns DP is incremented by 1, and The new value is saved. Note that when the number of patterns DP is 3 or more, the new value may not be saved in order to save the memory area.

In S14, the reception interval determination unit 14 calculates the message reception interval dt. That is, the difference between the reception time of the message to be processed and the reception time of the immediately preceding message is calculated. Since the reception interval is the same for all partial areas, the reception interval determining unit 14 does not need to calculate the reception interval for each partial area.

In S<b>15 , the reception interval determination unit 14 determines whether or not the reception interval dt is smaller than the transmission cycle T. In the determination of S15, the transmission cycle T means a value (T-th1) that is smaller than the transmission cycle T by a predetermined amount th1. Then, when the reception interval dt is smaller than the transmission cycle T, in S16, the variable update unit 15 updates the variable p_f to "0".

In S17, the variable updating unit 15 matches the value (Data (P, L)) stored in the target partial area with the value (d(1)) stored in the target partial area of the first received message. Determine whether or not Here, the process of S17 is executed when the determination of S15 is "Yes". That is, the reception interval dt is smaller than the transmission period T, and the value (Data (P, L)) stored in the target partial area is the value (d(1 )), the determination in S17 is “Yes”. This situation does not satisfy the condition that "although it is normally transmitted at regular intervals, when a certain event occurs, a specific value is set due to the occurrence of that event". Therefore, when the determination in S17 is "Yes", the variable update unit 15 updates the variable f_f to "0" in S18.

For example, in case 1 shown in FIG. 2, if the data of message M5 matches the data of message M1, the determination in S17 is "Yes" and the variable f_f is updated to "0" in S18. On the other hand, when the data of the message M5 is different from the data of the message M1, the determination in S17 is "No" and the variable f_f is not updated.

In S<b>19 , the reception interval determination unit 14 determines whether or not the reception interval dt is greater than the transmission cycle T. In the determination of S19, the transmission cycle T means a value (T-th2) that is larger than the transmission cycle T by a predetermined amount th2. Then, when the reception interval dt is greater than the transmission period T, in S20, the variable update unit 15 updates the variables s_f, p_f, and f_f to "0".

When the reception interval dt matches or substantially matches the transmission interval T (T−th1<dt<T+th2), in S21, the variable update unit 15 updates the value stored in the target partial area to the value of the first received message. It is determined whether or not it matches the value stored in the target partial area. Here, the processing of S21 is substantially the same as that of S17. Then, when the reception interval dt matches or substantially matches the transmission interval T and the value stored in the target partial area is different from the value stored in the target partial area of the first received message, the variable updating unit 15 updates the variable f_f to "0" in S22. On the other hand, when the value stored in the target partial area in S21 matches the value stored in the target partial area of the first received message, the variables s_f, p_f and f_f are held.

Thus, when the reception interval dt is smaller than the transmission period T and the value stored in the target partial area matches the value stored in the target partial area of the first received message, the variable f_f becomes " 0”. Also, when the reception interval dt matches or substantially matches the transmission interval T and the value stored in the target partial area differs from the value stored in the target partial area of the first received message, the variable f_f It may be updated to "0".

A state in which the variable corresponding to a certain partial area is "0" indicates that the transmission type of the message including that partial area does not correspond to the transmission type corresponding to that variable. In other words, when the preprocessing is completed for all received messages during the monitoring period, the state in which the variable corresponding to a certain partial area is "1" indicates that the message including that partial area corresponds to that variable. It is presumed that it may have been sent with a transmission type that

FIG. 12 is a flowchart illustrating an example of estimation processing. This estimation process corresponds to S3 shown in FIG. Note that the estimation process is executed after the pre-processing shown in FIG. 11 is completed. Therefore, when the estimation process is executed, the update of the number of patterns DP and variables s_f, p_f, f_f is finished for each partial area.

The format estimation unit 16 executes the processes of S31 to S36 for each partial area. Therefore, the partial area on which the estimation process is executed is sometimes called a “target partial area”.

In S31, the format estimation unit 16 determines whether or not the pattern number DP and the variables s_f, p_f, and f_f provided for the target partial region satisfy the following three conditions.
(1) The number of patterns DP is "2" (2) The variable s_f is "1" (3) The variable f_f is "1" Indicates that two types of values appear in the target partial area. Condition (2) indicates that a message has arrived at least once within the monitoring period at a reception interval shorter than the transmission period. Condition (3) indicates that the received message may be a periodic message with event transmission.

When the above three conditions are satisfied, the format estimation unit 16 estimates in S32 that the transmission type of the message including the target partial area is "periodic message with event transmission (specific value)". On the other hand, when the above three conditions are not satisfied, the processing of the format estimation unit 16 proceeds to S33.

In S33, the format estimation unit 16 determines whether or not the variable p_f provided for the target partial area is "1". The state in which the variable p_f is "1" is obtained when the reception intervals of all received messages match or substantially match the transmission cycle T. FIG. Then, when the variable p_f is "1", the format estimation unit 16 estimates in S34 that the transmission type of the message including the target partial area is "periodic message". On the other hand, when the variable p_f is not "1", the format estimation unit 16 estimates in S35 that the transmission type of the message including the target partial area is "aperiodic message".

In S36, the format estimating unit 16 determines whether the format of the data stored in the target partial area can correspond to any one of formats 5 to 8 described above. Specifically, the following processing is executed.
(1) When the data stored in the target partial area is regarded as "unsigned data" and the variance value of the amount of change in the data exceeds a certain value, unsigned continuous values corresponding to Format 5 are possible. "0" is set to the nature flag.
(2) When the data stored in the target partial area is regarded as "signed data" and the variance value of the amount of change in the data exceeds a certain value, signed continuous values corresponding to format 6 are possible. "0" is set to the nature flag.
(3) When the data stored in the target partial area are not uniformly distributed, set the checksum (uniform) possibility flag corresponding to format 7 to “0”.
(4) Set the multi-value possibility flag corresponding to format 8 to "1". Alternatively, form estimator 16 may not use the multi-value probability flag.

The state in which the possibility flag is "0" indicates that the data stored in the target partial area does not correspond to the corresponding format. In other words, the state in which the possibility flag is "1" indicates that the data stored in the target partial area can correspond to the corresponding format. Thus, in S36, it is determined whether or not the data stored in the target partial area can correspond to formats 5-8.

Thus, in S31-S36, the data format and transmission type are estimated for each partial area. After that, the format estimation unit 16 estimates the transmission type of the message in S37. As an example, when the determination in S31 is "Yes" for one or more partial areas, the format estimation unit 16 estimates that the transmission type of the message is "periodic message with event transmission". Further, when there is no partial area determined as "Yes" in S31 and the determination in S33 is "Yes" for one or more partial areas, the format estimation unit 16 determines the transmission type of the message. is a "periodic message". When the above two cases do not apply, the format estimation unit 16 estimates that the transmission type of the message is "aperiodic message".

Through the preprocessing and estimation processing described above, for each partial area, a possibility flag is obtained that indicates the result of eliminating impossible data format candidates. However, a plurality of candidates may remain for one partial area. Also, a certain partial area may be included in another partial area. Therefore, the duplication elimination process shown in FIG. 9 is executed. Note that "continuous value" does not make sense for data shorter than a predetermined length. For example, when the length of the partial area is shorter than 4 bits, the continuous value possibility flag is set to "0". may The same applies to "checksum".

The duplication elimination process shown in FIG. 9 includes, for example, the following processes. Note that the duplicate elimination process is executed by the final result estimation unit 18, for example.

(1) While incrementing the data length of the partial area from 1 bit to 64 bits, or decrementing the data length of the partial area from 64 bits to 1 bit by 1, the fixed value possibility flag is set to "1". Determines the data format of the partial area that is specified as "fixed value".

(2) Prepare a variable i representing the starting position of the partial area and a variable j representing the data length of the partial area. The variable i sequentially designates from the first bit to the data length bit. The variable j is decremented to 1 with the length from the i-th bit to the bit whose data format is not determined as an initial value. However, when the value of i+j is a multiple of 8, priority is given to the partial area corresponding to that value. Then, while changing the variable i and the variable j, the following duplication elimination process is executed. In the description below, (i, j) represents a partial area whose start position is the i-th bit and whose length is j bits.
(2a) When the checksum (calculation formula) possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is "checksum (calculation formula) ” is decided.
(2b) When the event (specific value) possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is set to "event (specific value)". decide.
(2c) When the event (change) possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is determined as "event (change)". . The "event (change)" will be described later in the second embodiment.
(2d) When the counter possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is determined as the "counter".
(2e) When the monotonically increasing possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is determined to be "monotonically increasing".
(2f) When the unsigned continuous value possibility flag of (i, j) is "1" and the signed continuous value possibility flag is also "1", an area of j bits from the i-th bit , into the form with the smaller variance.
(2g) When the unsigned continuous value possibility flag of (i, j) is "1" and the signed continuous value possibility flag is "0", an area of j bits from the i-th bit determines the data stored in to be "unsigned continuous values".
(2h) When the unsigned continuous value possibility flag of (i, j) is "0" and the signed continuous value possibility flag is "1", an area of j bits from the i-th bit determines the data stored in to be "signed continuous values".
(2i) When the checksum (uniform) possibility flag of (i, j) is "1", the data stored in the j-bit area from the i-th bit is "checksum (uniform) ” is decided.
(2j) One bit from the i-th bit is determined as a "multi-value".
(2k) If a format other than "multi-value" is determined, add j to i and continue the loop. If it is determined to be "multi-value", add "1" to i and continue the loop.

When the value of i+j is a multiple of 8, the partial area corresponding to that value is preferentially processed. Because there are many things. Also, in the above procedure, the processing is performed from the beginning of the data area, but the processing may be performed from the end of the data area. Furthermore, the above 2b and 2c may be exchanged with each other. The above 2f, 2g and 2h may be interchanged with each other. The above 2a and the above 2b and 2c may be exchanged with each other.

Note that in the first embodiment, the estimation device 10 may execute the process of S11 after S13, or may execute the process of S11 after S14. Also, the estimating apparatus 10 may execute the process of S36 immediately after the preprocessing, or may execute the process of S36 immediately before the overlapping process. Furthermore, the estimating apparatus 10 may perform overlapping processing at any timing after the preprocessing is completed.

Although three variables s_f, p_f, and f_f are used in the examples shown in FIGS. 9 to 12, the estimation device 10 may use two variables to perform the estimation process. For example, the estimating device 10 uses the message possibility flag with event transmission and the periodic message possibility flag. In this case, the processes shown in FIGS. 11 and 12 are executed as follows. That is, when the reception interval dt is shorter than the transmission cycle in S15, the periodic message possibility flag is updated to "0". In S17, when the value of the target partial area matches the value stored in the target partial area of the first received message, the message possibility flag with event transmission is updated to "0". When the reception interval dt is longer than the transmission cycle in S19, the message possibility flag with event transmission and the periodic message possibility flag are updated to "0". Then, in S31, if the number of patterns DP is "2" and the message possibility flag with event transmission is "1", the transmission type is estimated to be "event (specific value)". Note that the message possibility flag with event transmission and the periodic message possibility flag correspond to variable f_f and variable p_f, respectively.

Also, in the example shown in FIG. 12, the transmission type of the message including the target partial area is estimated in S31 based on three conditions, but the first embodiment is not limited to this method. For example, when the pattern number DP is "2", the variable s_f is "1", the variable f_f is "1", and the variable p_f is "0", the target partial region may be presumed to be an "event (specific value)".

Furthermore, in the example shown in FIG. 12, it is determined in S31 whether or not the pattern number DP of the target partial area is "2". Here, the state in which the number of patterns DP is "2" corresponds to message transmission in which a predetermined fixed value is normally set and a specific value different from the fixed value is set when an event occurs. For example, in case 1 shown in FIG. 2, "1 (fixed value)" is normally set, and "3 (specific value)" is set in the message M5 that is sent due to the occurrence of an event. However, the "event (specific value)" of the first embodiment is not limited to this case. That is, the "event (specific value)" may be a message in which an arbitrary value is normally set and a specific value is set when an event occurs. In this case, in S31, it is determined whether or not the number of patterns DP of the target partial area is "2 or more".

<Second embodiment>
In the first embodiment, a periodic message with event transmission includes a partial area in which a specific value is set when an event occurs. In contrast, in the second embodiment, a periodic message with event transmission includes a partial area whose value changes when an event occurs. For example, in case 2 shown in FIG. 2, the data of messages M1 to M4 is "1", but the data after message M5 generated due to the occurrence of the event is changed to "7".

The configuration of the estimating device 10 is substantially the same in the first embodiment and the second embodiment, as shown in FIG. Also, the procedure of the estimation method is substantially the same in the first embodiment and the second embodiment, as shown in the flow chart of FIG. However, preprocessing and estimation processing according to the second embodiment include processing different from that of the first embodiment.

FIG. 13 is a flowchart illustrating an example of preprocessing performed in the second embodiment. Note that S11, S14-16, and S19-S20 are substantially the same in the first embodiment and the second embodiment. Also, in the second embodiment, it is not necessary to execute S12 to S13 shown in FIG. Therefore, although S12 to S13 are omitted in FIG. 13, S12 to S13 may be executed in the second embodiment.

In the second embodiment, the process of S41 is executed instead of S17 shown in FIG. In S41, the variable update unit 15 converts the value (Data(i)) stored in the target partial area to the value (Data(i-1)) stored in the target partial area of the previous received message. Determine whether or not they match. Here, the processing of S41 is executed when the determination of S15 is "Yes". That is, when the reception interval dt is smaller than the transmission cycle T and the value stored in the target partial area matches the value stored in the target partial area of the immediately preceding received message, the determination in S41 is " Yes”. This situation does not satisfy the condition that "the value of the target partial area changes when a predetermined event occurs". Therefore, when the determination in S41 is "Yes", the variable update unit 15 updates the variable f_f to "0" in S18.

For example, in case 2 shown in FIG. 2, if the data of message M5 matches the data of message M4, the determination in S41 is "Yes" and the variable f_f is updated to "0" in S18. On the other hand, when the data of the message M5 is different from the data of the message M4, the determination in S41 is "No" and the variable f_f is not updated.

When the reception interval dt matches or substantially matches the transmission interval T (T−th1<dt<T+th2), in S42, the variable update unit 15 updates the value stored in the target partial area to the value of the previous received message. It is determined whether or not it matches the value stored in the target partial area. Here, the processing of S42 is substantially the same as that of S41. When the reception interval dt matches or substantially matches the transmission interval T and the value stored in the target partial area is different from the value stored in the target partial area of the previous received message, the variable updating unit 15 updates the variable f_f to "0" in S43. On the other hand, when the value stored in the target partial area in S42 matches the value stored in the target partial area of the first received message, the variables s_f, p_f and f_f are held.

Thus, in the preprocessing of the second embodiment, the reception interval dt is smaller than the transmission period T, and the value stored in the target partial area is the value stored in the target partial area of the immediately preceding received message. , the variable f_f is updated to '0'. Also, when the reception interval dt matches or substantially matches the transmission interval T, and the value stored in the target partial area differs from the value stored in the target partial area of the previous received message, the variable f_f is It may be updated to "0".

FIG. 14 is a flowchart illustrating an example of estimation processing performed in the second embodiment. Note that S33 to S37 are substantially the same in the first embodiment and the second embodiment.

In the second embodiment, the processing of S44-S45 is executed instead of S31-S32 shown in FIG. In S44, the format estimation unit 16 determines whether the variables s_f, p_f, and f_f satisfy the following two conditions.
(1) The variable s_f is "1" (2) The variable f_f is "1" Condition (1) indicates that a message has arrived at least once within the monitoring period at a reception interval shorter than the transmission period. show. Condition (2) indicates that the received message may be a periodic message with event transmission.

When the above two conditions are satisfied, the format estimation unit 16 estimates in S45 that the transmission type of the message including the target partial area is "periodic message with event transmission (change)". On the other hand, when the above two conditions are not satisfied, the processing of the format estimation unit 16 proceeds to S33.

Note that in the second embodiment, the estimation device 10 may perform the process of S11 after S14. Also, the estimating apparatus 10 may execute the process of S36 immediately after the preprocessing, or may execute the process of S36 immediately before the overlapping process. Furthermore, the estimating apparatus 10 may perform overlapping processing at any timing after the preprocessing is completed.

Although three variables s_f, p_f, and f_f are used in the examples shown in FIGS. 13 and 14, the estimation process may be performed using two variables. For example, the estimating device 10 uses the message possibility flag with event transmission and the periodic message possibility flag. In this case, the processes shown in FIGS. 13 and 14 are executed as follows. That is, when the reception interval dt is shorter than the transmission cycle in S15, the periodic message possibility flag is updated to "0". In S41, when the value of the target partial area matches the value of the target partial area of the previous received message, the message possibility flag with event transmission is updated to "0". In S19, when the reception interval dt is longer than the transmission cycle, the message possibility flag with event transmission and the periodic message possibility flag are updated to "0". If the message possibility flag with event transmission is "1" in S44, it is estimated that the transmission type is "event (change)". Note that the message possibility flag with event transmission and the periodic message possibility flag correspond to variable f_f and variable p_f, respectively.

Also, the estimation device 10 may perform both the estimation of the first embodiment and the estimation of the second embodiment. In this case, a variable (f_f) representing whether or not the message reception interval matches the transmission cycle during a period other than when a predetermined event occurs is set to a specific value when an event occurs. It is preferable to individually manage the variable f_f1 and the variable f_f2 for detecting a message whose value changes when an event occurs.

<Example 1>
In this example, the communication log shown in FIG. 15 is obtained. To simplify the explanation, the reception time (timestamp) is represented by two digits below the decimal point, and the length of the data area of each message is 4 bits. In an actual CAN, data is formed in units of bytes, but for the sake of simplicity, an example in which the data length is 4 bits is shown. In the checksum calculation, the addition result of the 1st to 3rd bits in the data area is written to the 4th bit. The transmission cycle of the message containing ID=100 and the basic transmission cycle of the message containing ID=200 are both 1 second.

The estimating device 10 estimates the features of the message containing ID=100. Here, in this embodiment, since the length of the data area of each message is 4 bits, there are 10 types of partial areas (that is, combinations of starting positions and lengths) below.
(1) start position = 1, length = 1
(2) start position = 1, length = 2
(3) start position = 1, length = 3
(4) start position = 1, length = 4
(5) start position = 2, length = 1
(6) start position = 2, length = 2
(7) start position = 2, length = 3
(8) start position = 3, length = 1
(9) start position = 3, length = 2
(10) start position = 4, length = 1

Then, the estimating apparatus 10 acquires data in order from the first record of the communication log shown in FIG. 15 and executes the processing of the flowchart shown in FIG. 9 (FIGS. 11 and 12 or FIGS. 13 and 14). Note that the initial value of the number of patterns DP in each partial area is zero. The initial values of variables s_f, p_f, and f_f are one. At S15 and S19, the margins (ie th1 and th2) are 0.2 seconds each.

(1) Acquiring the data of the first record The data recorded in the first record of the communication log is "reception time = 1.00, ID = 100, value = 0001". Here, this message contains "ID=100". Therefore, the estimation device 10 executes estimation processing. The results of execution by the estimating device 10 are as follows.

(1a) Partial Area with Start Position=1, Length=1 The value stored in this partial area is "0". That is, d(1,1)(1) is "0". Also, the number of patterns DP(1,1) is updated to "1". Furthermore, since the length of the partial area is not 4, it cannot be checksum (calculation formula) data. Therefore, the checksum (calculation formula) possibility flag (1, 1) is updated to "0".

(1b) Partial area with start position=1, length=2 The value stored in this partial area is "00". That is, d(1,2)(1) is "00". Also, the number of patterns DP(1,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flags (1, 2) are updated to "0".

(1c) Partial Area with Start Position=1, Length=3 The value stored in this partial area is "000". That is, d(1,3)(1) is "000". Also, the number of patterns DP(1,3) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flags (1, 3) are updated to "0".

(1d) Partial Area with Start Position=1, Length=4 The value stored in this partial area is "0001". That is, d(1,4)(1) is "0001". Also, the number of patterns DP(1,4) is updated to "1". Here, the length of the partial area is four. However, the sum of the 1st to 3rd bits does not match the value of the 4th bit. Therefore, the checksum (calculation formula) possibility flag (1, 4) is updated to "0".

(1e) Partial area with start position=2, length=1 The value stored in this partial area is "0". That is, d(2,1)(1) is "0". Also, the number of patterns DP(2, 1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (2, 1) is updated to "0".

(1f) Partial area with start position=2, length=2 The value stored in this partial area is "00". That is, d(2,2)(1) is "00". Also, the number of patterns DP(2,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (2, 2) is updated to "0".

(1g) Partial area with start position=2, length=3 The value stored in this partial area is "001". That is, d(2,3)(1) is "001". Also, the number of patterns DP(2, 3) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flags (2, 3) are updated to "0".

(1h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(1) is "0". Also, the number of patterns DP(3, 1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (3, 1) is updated to "0".

(1i) Partial area with start position=3, length=2 The value stored in this partial area is "01". That is, d(3,2)(1) is "01". Also, the number of patterns DP(3,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (3, 2) is updated to "0".

(1j) Partial area with start position=1, length=1 The value stored in this partial area is "1". That is, d(4,1)(1) is "1". Also, the number of patterns DP(4,1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (4, 1) is updated to "0".

FIG. 16 shows the processing results of the above 1a to 1j. Format 2 shown in FIG. 16 represents a checksum (calculation formula). In other words, the possibility that any data stored in each partial area is a checksum (calculation formula) is denied. In addition, the estimating apparatus 10 records the reception time of the message as "previous reception time=1.00" for processing subsequent messages.

(2) Acquiring the data of the second record The data recorded in the second record of the communication log is "reception time = 1.50, ID = 200, value = 0000". Here, since this message does not contain "ID=100", the acquired data is discarded.

(3) Acquiring the data of the third record The data recorded in the third record of the communication log is "reception time = 2.00, ID = 100, value = 0110". Here, since this message includes "ID=100", the estimating device 10 executes the estimating process.

The estimating apparatus 10 calculates the difference between the reception time of the message and the reception time of the previous received message containing the same identifier, and obtains "reception interval dt=1.00". Here, the reception interval dt is equal to or greater than "transmission cycle -th1" and equal to or less than "transmission cycle +th2". Therefore, the estimating device 10 does not update the variables s_f and p_f. However, when the value stored in the partial area is different from the value of the same partial area in message M1, estimating device 10 updates the variable f_f of that partial area to "0".

Note that once the variables s_f, p_f, f_f and the flags corresponding to data formats 1 to 8 are updated to "0", they never return to "1". Therefore, for variables or flags that have already been updated to "0", description thereof will be omitted even if an event occurs to update "1" to "0".

(3a) Partial area with start position=1, length=1 The value stored in this partial area is "0". That is, d(1,1)(2) is "0", and the value stored in the partial area is the value (d(1,1)( 1)) is the same. Therefore, the number of patterns DP(1,1) is kept as "1". Also, the counter possibility flag (1, 1) and the monotonically increasing possibility flag (1, 1) are updated to "0".

(3b) Partial area with start position=1, length=2 The value stored in this partial area is "01". That is, d(1,2)(2) is "01", and the value stored in the partial area is the value (d(1,2)( 1)) is different. As a result, the pattern number DP (1, 2) is updated to "2", the fixed value possibility flag (1, 2) is updated to "0", and the variable f_f (1, 2) is updated to "0". be done.

(3c) Partial area with start position=1, length=3 The value stored in this partial area is "011". That is, d(1,3)(2) is "011", and the value stored in the partial area is the value (d(1,3)( 1)) is different. As a result, the pattern number DP (1, 3) is updated to "2", the fixed value possibility flag (1, 3) is updated to "0", and the variable f_f (1, 3) is updated to "0". be done.

(3d) Partial area with start position=1, length=4 The value stored in this partial area is "0110". That is, d(1,4)(2) is "0110", and the value stored in the partial area is the value (d(1,4)( 1)) is different. Therefore, the pattern number DP(1,4) is updated to "2", the fixed value possibility flag (1,4) is updated to "0", and the variable f_f(1,4) is updated to "0". be. Furthermore, since the difference between the value stored in the partial area and the value (d(1,4)(1)) stored in the same partial area of the previous message is 5, which is greater than the threshold, The monotonically increasing possibility flag (1, 4) is updated to "0". Note that the threshold is assumed to be 5 in this embodiment.

(3e) Partial area with start position=2, length=1 The value stored in this partial area is "1". That is, d(2,1)(2) is "1", and the value stored in the partial area is the value (d(2,1)( 1)) is different. As a result, the pattern number DP (2, 1) is updated to "2", the fixed value possibility flag (2, 1) is updated to "0", and the variable f_f (2, 1) is updated to "0". be done.

(3f) Partial area with start position=2, length=2 The value stored in this partial area is "11". That is, d(2,2)(2) is "11", and the value stored in the partial area is the value (d(2,2)( 1)) is different. As a result, the pattern number DP (2, 2) is updated to "2", the fixed value possibility flag (2, 2) is updated to "0", and the variable f_f (2, 2) is updated to "0". be done.

(3g) Subregion with start position=2, length=3 The value stored in this subregion is "110". That is, d(2,3)(2) is "110", and the value stored in the partial area is the value (d(2,3)( 1)) is different. As a result, the pattern number DP (2, 3) is updated to "2", the fixed value possibility flag (2, 3) is updated to "0", and the variable f_f (2, 3) is updated to "0". be done. Furthermore, since the difference between the value stored in the partial area and the value (d(2,3)(1)) stored in the same partial area of the previous message is 5, which is greater than the threshold, The monotonically increasing possibility flag (2, 3) is updated to "0".

(3h) Partial area with start position=3, length=1 The value stored in this partial area is "1". That is, d(3,1)(2) is "1", and the value stored in the partial area is the value (d(3,1)( 1)) is different. Therefore, the pattern number DP(3,1) is updated to "2", the fixed value possibility flag (3,1) is updated to "0", and the variable f_f(3,1) is updated to "0". be.

(3i) Subregion with start position=3, length=2 The value stored in this subregion is "10". That is, d(3,2)(2) is "10", and the value stored in the partial area is the value (d(3,2)( 1)) is different. As a result, the pattern number DP (3, 2) is updated to "2", the fixed value possibility flag (3, 2) is updated to "0", and the variable f_f (3, 2) is updated to "0". be done.

(3j) Partial area with start position=4, length=1 The value stored in this partial area is "0". That is, d(4,1)(2) is "0", and the value stored in the partial area is the value (d(4,1)( 1)) is different. As a result, the pattern number DP (4, 1) is updated to "2", the fixed value possibility flag (4, 1) is updated to "0", and the variable f_f (4, 1) is updated to "0". be done.

FIG. 17 shows the results of the processes 3a to 3j. Note that format 1 represents a fixed value. Format 3 represents a counter. Form 4 represents monotonically increasing. In addition, the estimating apparatus 10 records the reception time of the message as "previous reception time=2.00" for processing subsequent messages.

(4) Acquiring the data of the fourth record The data recorded in the fourth record of the communication log is "reception time = 2.50, ID = 200, value = 0000". Here, since this message does not contain "ID=100", the acquired data is discarded.

(5) Acquiring the data of the 5th record The data recorded in the 5th record of the communication log is "reception time = 3.00, ID = 100, value = 1001". Here, since this message includes "ID=100", the estimating device 10 executes the estimating process.

The estimating apparatus 10 calculates the difference between the reception time of the message and the reception time of the previous received message containing the same identifier, and obtains "reception interval dt=1.00". Here, the reception interval dt is equal to or greater than "transmission cycle -th1" and equal to or less than "transmission cycle +th2". Therefore, the estimating device 10 does not update the variables s_f and p_f. However, if the value stored in a partial area is different from the value in the same partial area of message M1, or if the value stored in the partial area is different from the value in the same partial area of message M3, the estimation device 10 updates the variable f_f of that partial area to "0".

(5a) Partial area with start position=1, length=1 The value stored in this partial area is "1". That is, d(1,1)(3) is "1". And this value is different from any value stored in the same partial area of the previous received message. Therefore, the number of patterns DP(1,1) is updated to "2". Also, the fixed value possibility flag (1, 1) is updated to "0". Furthermore, the variable f_f(1,1) is updated to "0".

(5b) Partial area with start position=1, length=2 The value stored in this partial area is "10". That is, d(1,2)(3) is "10". And this value is different from any value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(1,2) is updated to "3".

(5c) Partial area with start position=1, length=3 The value stored in this partial area is "100". That is, d(1,3)(3) is "100". And this value is different from any value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(1,3) is updated to "3". Also, the amount of change in the value stored in the partial area is not a constant value other than zero. Specifically, the difference between d(1,2)(1) and d(1,2)(2) is "3", and d(1,2)(2) and d(1,2) The difference from (3) is "4". Therefore, the counter possibility flag (1,4) is updated to "0".

(5d) Partial area with start position=1, length=4 The value stored in this partial area is "1001". That is, d(1,4)(3) is "1001". And this value is different from any value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(1,4) is updated to "3". Also, the amount of change in the value stored in the partial area is not a constant value other than zero. Therefore, the counter possibility flag (1,4) is updated to "0".

(5e) Partial area with start position=2, length=1 The value stored in this partial area is "0". That is, d(2,1)(3) is "0". Then, the value stored in the partial area may increase or decrease. Specifically, the difference between d(2,1)(1) and d(2,1)(2) is "+1", and d(2,1)(2) and d(2,1) The difference from (3) is "-1". Therefore, the counter possibility flag (2,1) is updated to "0" and the monotonically increasing possibility flag (2,1) is updated to "0".

(5f) Partial area with start position=2, length=2 The value stored in this partial area is "00". That is, d(2,2)(3) is "00". Then, the value stored in the partial area may increase or decrease. Therefore, the counter possibility flag (2, 2) is updated to "0", and the monotonically increasing possibility flag (2, 2) is updated to "0".

(5g) Partial area with start position=2, length=3 The value stored in this partial area is "001". That is, d(2,3)(3) is "001". The amount of change in the value stored in the partial area is not a constant value other than zero. Therefore, the counterability flags (2,3) are updated to "0".

(5h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(3) is "0". Then, the value stored in the partial area may increase or decrease. Therefore, the counter possibility flag (3,1) is updated to "0" and the monotonically increasing possibility flag (3,1) is updated to "0".

(5i) Partial area with start position=3, length=2 The value stored in this partial area is "01". That is, d(3,2)(3) is "01". Then, the value stored in the partial area may increase or decrease. Therefore, the counter possibility flag (3, 2) is updated to "0", and the monotonically increasing possibility flag (3, 2) is updated to "0".

(5j) Partial area with start position=4, length=1 The value stored in this partial area is "1". That is, d(4,1)(3) is "1". Then, the value stored in the partial area may increase or decrease. Therefore, the counter possibility flag (4,1) is updated to "0" and the monotonically increasing possibility flag (4,1) is updated to "0".

FIG. 18 shows the results of the processes 5a to 5j. Note that the estimating device 10 records the reception time of the message as "previous reception time=3.00" for subsequent message processing.

(6) Acquiring the data of the sixth record The data recorded in the sixth record of the communication log is "reception time = 3.25, ID = 200, value = 0100". Here, since this message does not contain "ID=100", the acquired data is discarded.

(7) Acquiring the data of the 7th record The data recorded in the 7th record of the communication log is "reception time = 4.00, ID = 100, value = 0111". Here, since this message includes "ID=100", the estimating device 10 executes the estimating process.

The estimating apparatus 10 calculates the difference between the reception time of the message and the reception time of the previous received message containing the same identifier, and obtains "reception interval dt=1.00". Here, the reception interval dt is equal to or greater than "transmission cycle -th1" and equal to or less than "transmission cycle +th2". Therefore, the estimating device 10 does not update the variables s_f, p_f, f_f.

(7a) Partial area with start position=1, length=1 The value stored in this partial area is "1". That is, d(1,1)(4) is "1".

(7b) Partial area with start position=1, length=2 The value stored in this partial area is "01". That is, d(1,2)(4) is "01". Then, the value stored in the partial area may increase or decrease. Therefore, the counter possibility flag (1, 2) is updated to "0", and the monotonically increasing possibility flag (1, 2) is updated to "0".

(7c) Partial area with start position=1, length=3 The value stored in this partial area is "011". That is, d(1,3)(4) is "011". Then, the value stored in the partial area may increase or decrease. Therefore, the monotonically increasing possibility flag (1, 3) is updated to "0".

(7d) Partial area with start position=1, length=4 The value stored in this partial area is "0111". That is, d(1,4)(4) is "0111". This value is different from any value stored in the same sub-area of previously received messages. Therefore, the number of patterns DP(1,4) is updated to "4".

(7e) Partial area with start position=2, length=1 The value stored in this partial area is "1". That is, d(2,1)(4) is "1".

(7f) Partial area with start position=2, length=2 The value stored in this partial area is "11". That is, d(2,2)(4) is "11".

(7g) Subregion with start position=2, length=3 The value stored in this subregion is "111". That is, d(2,3)(4) is "111". This value is different from any value stored in the same sub-area of previously received messages. Therefore, the number of patterns DP(2,3) is updated to "3".

(7h) Partial area with start position=3, length=1 The value stored in this partial area is "1". That is, d(3,1)(4) is "1".

(7i) Subregion with start position=3, length=2 The value stored in this subregion is "11". That is, d(3,2)(4) is "11". This value is different from any value stored in the same sub-area of previously received messages. Therefore, the number of patterns DP(3,2) is updated to "3".

(7j) Partial area with start position=4, length=1 The value stored in this partial area is "1". That is, d(4,1)(4) is "1".

FIG. 19 shows the results of the processes 7a-7j. The message transmission type (event, periodic, aperiodic) will be described later. Also, the estimating apparatus 10 records the reception time of the message as "previous reception time=4.00" for the processing of subsequent messages.

(8) Acquiring the data of the 8th record The data recorded in the 8th record of the communication log is "reception time = 4.25, ID = 200, value = 0000". Here, since this message does not contain "ID=100", the acquired data is discarded.

(9) Transmission Type Estimation The estimation device 10 executes S31 to S35 in FIG. 12 (or S33 to S35, S44 and S45 in FIG. 14) for each partial area. Here, in this example, the variables s_f, p_f, and f_f are all "1" and have not been updated. As a result, as shown in FIG. 19, the variable p_f is "1" in all partial areas. That is, "transmission type=periodic message" is obtained for all partial areas through S33 and S34. Therefore, estimation apparatus 10 estimates that the message including ID=100 is a "periodic message".

(10) Estimation of formats 5 to 8 Assuming that the value stored in the data area is "signed data", the value changes from "1" → "6" → "-7" → "7", The variance is large. Therefore, the signed continuous value possibility flag (1, 4) is updated to "0". On the other hand, if the values stored in the data area are assumed to be "unsigned data", the values change from "1"→"6"→"9"→"7", and the variance is small. Therefore, the unsigned consecutive value possibility flag (1, 4) is kept at "1".

The values stored in each partial area are not evenly distributed. Therefore, the checksum (uniform) possibility flag is updated to "0" for all partial areas.

(11) Duplication Elimination Processing Fixed value possibility flags (format 1 in FIG. 19) are updated to “0” for all partial areas. Therefore, it is presumed that a message containing ID=100 does not store fixed value data. Also, there is no partial area where the sum of the start position (i) and the data length (j) is a multiple of eight. Therefore, the estimating apparatus 10 starts the duplicate elimination process from the partial area with the longer data length (that is, the partial area (1, 4)).
(11a) Since the checksum (calculation formula) possibility flag (format 2 in FIG. 19) of partial area (1, 4) is updated to "0", the data format is not determined.
(11b) Since the event possibility flag of partial area (1, 4) has been updated to "0", the data format is not determined.
(11c) Since the counterability flag (format 3 in FIG. 19) of partial area (1, 4) is updated to "0", the data format is not determined.
(11d) Since the monotonically increasing possibility flag (format 4 in FIG. 19) of partial area (1, 4) is updated to "0", the data format is not fixed.
(11e) The unsigned continuous value possibility flag of partial area (1, 4) is kept at "1" as described above. Therefore, estimation apparatus 10 estimates that the format of the data stored in the data area is "unsigned continuous value".

<Example 2>
As in the first embodiment, also in the second embodiment, message features are estimated based on the communication log shown in FIG. However, in the second embodiment, the estimating device 10 estimates the characteristics of messages including ID=200. In addition, in the second embodiment, estimation (that is, detection of a message with event transmission including a partial area in which a specific value is set when an event occurs) according to the first embodiment is performed.

(1) Acquiring the data of the first record The data recorded in the first record of the communication log is "reception time = 1.00, ID = 100, value = 0001". Here, since this message does not contain "ID=200", the acquired data is discarded.

(2) Acquiring the data of the second record The data recorded in the second record of the communication log is "reception time = 1.50, ID = 200, value = 0000". Here, since this message includes "ID=200", the estimating device 10 executes estimation processing. The results of execution by the estimating device 10 are as follows.

(2a) Partial area with start position=1, length=1 The value stored in this partial area is "0". That is, d(1,1)(1) is "0". Also, the number of patterns DP(1,1) is updated to "1". Furthermore, since the length of the partial area is not 4, it cannot be checksum (calculation formula) data. Therefore, the checksum (calculation formula) possibility flag (1, 1) is updated to "0".

(2b) Partial Area with Start Position=1, Length=2 The value stored in this partial area is "00". That is, d(1,2)(1) is "00". Also, the number of patterns DP(1,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (1, 2) is updated to "0".

(2c) Partial area with start position=1, length=3 The value stored in this partial area is "000". That is, d(1,3)(1) is "000". Also, the number of patterns DP(1,3) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flags (1, 3) are updated to "0".

(2d) Partial area with start position=1, length=4 The value stored in this partial area is "0000". That is, d(1,4)(1) is "0000". Also, the number of patterns DP(1,4) is updated to "1". The length of the partial area is 4, and the sum of the first to third bits matches the value of the fourth bit, so the checksum (calculation formula) possibility flag (1, 4) is " 1” is retained.

(2e) Partial area with start position=2, length=1 The value stored in this partial area is "0". That is, d(2,1)(1) is "0". Also, the number of patterns DP(2, 1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (2, 1) is updated to "0".

(2f) Partial area with start position=2, length=2 The value stored in this partial area is "00". That is, d(2,2)(1) is "00". Also, the number of patterns DP(2,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (2, 2) is updated to "0".

(2g) Partial area with start position=2, length=3 The value stored in this partial area is "000". That is, d(2,3)(1) is "000". Also, the number of patterns DP(2, 3) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flags (2, 3) are updated to "0".

(2h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(1) is "0". Also, the number of patterns DP(3, 1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (3, 1) is updated to "0".

(2i) Partial area with start position=3, length=2 The value stored in this partial area is "00". That is, d(3,2)(1) is "00". Also, the number of patterns DP(3,2) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (3, 2) is updated to "0".

(2j) Partial area with start position=4, length=1 The value stored in this partial area is "0". That is, d(4,1)(1) is "0". Also, the number of patterns DP(4,1) is updated to "1". Furthermore, since the length of the partial area is not 4, the checksum (calculation formula) possibility flag (4, 1) is updated to "0".

FIG. 20 shows the processing results of the above 2a to 2j. Format 2 shown in FIG. 20 represents a checksum (calculation formula). In addition, the estimating apparatus 10 records the reception time of the message as "previous reception time=1.50" for processing subsequent messages.

(3) Acquiring the data of the third record The data recorded in the third record of the communication log is "reception time = 2.00, ID = 100, value = 0110". Here, since this message does not contain "ID=200", the acquired data is discarded.

(4) Acquiring the data of the fourth record The data recorded in the fourth record of the communication log is "reception time = 2.50, ID = 200, value = 0000". Here, since this message includes "ID=200", the estimating device 10 executes estimation processing.

The estimating device 10 calculates the difference between the reception time of the message and the reception time of the immediately preceding received message containing the same identifier, and obtains "reception interval dt=1.00". Here, the reception interval dt is equal to or greater than "transmission cycle -th1" and equal to or less than "transmission cycle +th2". Therefore, the estimation device 10 does not update the variables s_f and p_f. However, if the value stored in a sub-region is different from the value of the same sub-region in the first message containing "ID=200" (i.e., message M2), then the estimator 10 stores variable f_f to "0".

(4a) Partial Area with Start Position=1, Length=1 The value stored in this partial area is "0". That is, d(1,1)(2) is "0". The value stored in the partial area is the same as the value (d(1,1)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(1,1) is kept as "1". Also, the counter possibility flag (1, 1) and the monotonically increasing possibility flag (1, 1) are updated to "0". Although the reception interval dt matches the transmission period, the value of the partial area (ie, "0") is the same partial area of the first message (ie, of message M2) containing "ID=200". (ie, '0'), the variable f_f(1,1) is not updated. The same applies to other partial areas.

(4b) Partial area with start position=1, length=2 The value stored in this partial area is "00". That is, d(1,2)(2) is "00". The value stored in the partial area is the same as the value (d(1,2)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(1,2) is kept at "1". Also, the counter possibility flag (1, 2) and the monotonically increasing possibility flag (1, 2) are each updated to "0".

(4c) Partial area with start position=1, length=3 The value stored in this partial area is "000". That is, d(1,3)(2) is "000". The value stored in the partial area is the same as the value (d(1,3)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(1,3) is kept as "1". Also, the counter possibility flag (1, 3) and the monotonically increasing possibility flag (1, 3) are updated to "0".

(4d) Partial area with start position=1, length=4 The value stored in this partial area is "0000". That is, d(1,4)(2) is "0000". The value stored in the partial area is the same as the value (d(1,4)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(1,4) is kept at "1". Also, the counter possibility flag (1, 4) and the monotonically increasing possibility flag (1, 4) are each updated to "0".

(4e) Partial area with start position=2, length=1 The value stored in this partial area is "0". That is, d(2,1)(2) is "0". The value stored in the partial area is the same as the value (d(2,1)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(2,1) is kept as "1". Also, the counter possibility flag (2, 1) and the monotonically increasing possibility flag (2, 1) are updated to "0".

(4f) Partial area with start position=2, length=2 The value stored in this partial area is "00". That is, d(2,2)(2) is "00". The value stored in the partial area is the same as the value (d(2,2)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(2,2) is kept as "1". Also, the counter possibility flag (2, 2) and the monotonically increasing possibility flag (2, 2) are updated to "0".

(4g) Partial area with start position=2, length=3 The value stored in this partial area is "000". That is, d(2,3)(2) is "000". The value stored in the partial area is the same as the value (d(2,3)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(2, 3) is kept as "1". Also, the counter possibility flag (2, 3) and the monotonically increasing possibility flag (2, 3) are updated to "0".

(4h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(2) is "0". The value stored in the partial area is the same as the value (d(3,1)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(3,1) is kept at "1". Also, the counter possibility flag (3, 1) and the monotonically increasing possibility flag (3, 1) are updated to "0".

(4i) Partial area with start position=3, length=2 The value stored in this partial area is "00". That is, d(3,2)(2) is "00". The value stored in the partial area is the same as the value (d(3,2)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(3,2) is kept as "1". Also, the counter possibility flag (3, 2) and the monotonically increasing possibility flag (3, 2) are updated to "0".

(4j) Partial area with start position=4, length=1 The value stored in this partial area is "0". That is, d(4,1)(2) is "0". The value stored in the partial area is the same as the value (d(4,1)(1)) stored in the same partial area of the previous message. Therefore, the number of patterns DP(4,1) is kept at "1". Also, the counter possibility flag (4, 1) and the monotonically increasing possibility flag (4, 1) are updated to "0".

FIG. 21 shows the results of the processes 4a to 4j. Note that format 3 represents a counter. Form 4 represents monotonically increasing. In addition, the estimating apparatus 10 records the reception time of the message as "previous reception time=2.50" for processing subsequent messages.

(5) Acquiring the data of the 5th record The data recorded in the 5th record of the communication log is "reception time = 3.00, ID = 100, value = 1001". Here, since this message does not contain "ID=200", the acquired data is discarded.

(6) Acquiring the data of the sixth record The data recorded in the sixth record of the communication log is "reception time = 3.25, ID = 200, value = 0100". Here, since this message includes "ID=200", the estimating device 10 executes estimation processing.

Note that the estimating apparatus 10 calculates the difference between the reception time of the message and the reception time of the immediately preceding received message containing the same identifier, and obtains "reception interval dt=0.75". Here, the reception interval dt is equal to or less than "transmission cycle-th1". Therefore, the estimation device 10 updates the variable p_f of each partial region to "0", as shown in FIG. Note that this process corresponds to S15 to S16 shown in FIG. 11 or FIG.

(6a) Partial area with start position=1, length=1 The value stored in this partial area is "0". That is, d(1,1)(3) is "0". Here, the value stored in the partial area is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(1,1) is kept as "1". In addition, in a situation where the reception interval dt is equal to or less than "transmission period - th1", the value stored in the partial area is the value (d(1,1)( 1)) is the same. Therefore, the variable f_f(1,1) is updated to "0". This process corresponds to S17-S18 shown in FIG.

(6b) Partial area with start position=1, length=2 The value stored in this partial area is "01". That is, d(1,2)(3) is "01". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,2) is updated to "2" and the fixed value possibility flag (1,2) is updated to "0".

(6c) Partial area with start position=1, length=3 The value stored in this partial area is "010". That is, d(1,3)(3) is "010". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,3) is updated to "2" and the fixed value possibility flag (1,3) is updated to "0".

(6d) Partial area with start position=1, length=4 The value stored in this partial area is "0100". That is, d(1,4)(3) is "0100". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,4) is updated to "2" and the fixed value possibility flag (1,4) is updated to "0". Also, since the sum of the 1st to 3rd bits of the partial area does not match the value of the 4th bit, the checksum (calculation formula) possibility flag (1, 4) is updated to "0".

(6e) Partial area with start position=2, length=1 The value stored in this partial area is "1". That is, d(2,1)(3) is "1". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP (2, 1) is updated to "2" and the fixed value possibility flag (2, 1) is updated to "0".

(6f) Subregion with start position=2, length=2 The value stored in this subregion is "10". That is, d(2,2)(3) is "10". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP(2,2) is updated to "2" and the fixed value possibility flag (2,2) is updated to "0".

(6g) Subregion with start position=2, length=3 The value stored in this subregion is "100". That is, d(2,3)(3) is "100". Here, this value is different from any value stored in the same partial area of the previously received message. Therefore, the pattern number DP (2, 3) is updated to "2" and the fixed value possibility flag (2, 3) is updated to "0".

(6h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(3) is "0". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(3,1) is kept at "1". In addition, in a situation where the reception interval dt is equal to or less than "transmission period - th1", the value stored in the partial area is the value (d(3, 1) ( 1)) is the same. Therefore, the variable f_f(3,2) is updated to "0".

(6i) Partial area with start position=3, length=2 The value stored in this partial area is "00". That is, d(3,2)(3) is "00". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(3,2) is kept at "1". In addition, in a situation where the reception interval dt is equal to or less than "transmission period - th1", the value stored in the partial area is the value (d(3,2)( 1)) is the same. Therefore, the variable f_f(3,2) is updated to "0".

(6j) Partial area with start position=4, length=1 The value stored in this partial area is "0". That is, d(4,1)(3) is "0". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the number of patterns DP(4,1) is kept at "1". In addition, in a situation where the reception interval dt is equal to or less than "transmission period - th1", the value stored in the partial area is the value (d(4, 1) ( 1)) is the same. Therefore, the variable f_f(4,1) is updated to "0".

FIG. 22 shows the results of the processes 6a to 6j. Note that, as described above, the variable p_f of each partial area has been updated to "0". In addition, the estimating apparatus 10 records the reception time of the message as "previous reception time=3.25" for processing subsequent messages.

(7) Acquiring the data of the 7th record The data recorded in the 7th record of the communication log is "reception time = 4.00, ID = 100, value = 0111". Here, since this message does not contain "ID=200", the acquired data is discarded.

(8) Acquiring the data of the 8th record The data recorded in the 8th record of the communication log is "reception time = 4.25, ID = 200, value = 0000". Here, since this message includes "ID=200", the estimating device 10 executes estimation processing.

The estimating device 10 calculates the difference between the reception time of the message and the reception time of the immediately preceding received message containing the same identifier, and obtains "reception interval dt=1.00". Here, the reception interval dt is equal to or greater than "transmission cycle -th1" and equal to or less than "transmission cycle +th2". Therefore, the estimation device 10 does not update the variables s_f and p_f. However, if the value stored in a sub-region is different from the value of the same sub-region in the first message containing "ID=200" (i.e., message M2), then the estimator 10 stores variable f_f to "0".

(8a) Partial area with start position=1, length=1 The value stored in this partial area is "0". That is, d(1,1)(4) is "0". Here, the value stored in the partial area is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,1) is not updated.

(8b) Partial area with start position=1, length=2 The value stored in this partial area is "00". That is, d(1,2)(4) is "00". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,2) is not updated.

(8c) Partial area with start position=1, length=3 The value stored in this partial area is "000". That is, d(1,3)(4) is "000". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,3) is not updated.

(8d) Partial area with start position=1, length=4 The value stored in this partial area is "0000". That is, d(1,4)(4) is "0000". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(1,4) is not updated.

(8e) Partial area with start position=2, length=1 The value stored in this partial area is "0". That is, d(2,1)(4) is "0". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(2,1) is not updated.

(8f) Partial area with start position=2, length=2 The value stored in this partial area is "00". That is, d(2,2)(4) is "00". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(2,2) is not updated.

(8g) Partial area with start position=2, length=3 The value stored in this partial area is "000". That is, d(2,3)(4) is "000". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(2,3) is not updated.

(8h) Partial area with start position=3, length=1 The value stored in this partial area is "0". That is, d(3,1)(4) is "0". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(3,1) is not updated.

(8i) Partial area with start position=3, length=2 The value stored in this partial area is "00". That is, d(3,2)(4) is "00". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(3,2) is not updated.

(8j) Partial area with start position=4, length=1 The value stored in this partial area is "0". That is, d(4,1)(4) is "0". Here, this value is not a new value with respect to the value stored in the same partial area of the previously received message. Therefore, the pattern number DP(4,1) is not updated.

(9) Transmission Type Estimation The estimation device 10 executes S31 to S35 in FIG. 12 for each partial area. Here, when the above processing is completed, the variable p_f and the variable f_f provided for the partial areas (1,1), (3,1), (3,2), and (4,1) are set to "0". ” has been updated. Therefore, the transmission types corresponding to these partial areas are determined as "aperiodic" as shown in FIG. Since the other partial areas satisfy the condition of S31 in FIG. 12, their transmission types are determined to be "event (specific value)".

Furthermore, when the transmission type corresponding to one or more partial areas is determined to be "event (specific value)", estimating apparatus 10 estimates that the message transmission type is "event (specific value)". Therefore, estimating apparatus 10 estimates that the message including ID=200 is the "periodic message with event transmission".

(10) Estimation of Formats 5 to 8 Assuming that the value stored in the data area is "signed data", the value changes from "0" → "4" → "0" → "0". Variance is small. Therefore, the signed continuous value possibility flag (1, 4) is kept at "1". Even if the values stored in the data area are assumed to be "unsigned data", the transition of the values is the same. be.

The values stored in each partial area are not evenly distributed. Therefore, the checksum (uniform) possibility flag is updated to "0" for all partial areas.

(11) Duplication Elimination Processing As shown in FIG. 22, the fixed value possibility flags provided for the partial areas (1,1), (3,1), and (4,1) are "1". That is, the fixed value possibility flags of the 1st, 3rd and 4th bits in the data area are each "1". Therefore, these bits are determined to be "fixed values" respectively. Therefore, an estimation of the data type is made for the second bit. Here, there is no partial area in which the sum of the starting position (i) and the data length (j) is a multiple of eight. Therefore, the estimating apparatus 10 starts the overlap elimination process from the partial area with the longer data length (that is, the partial area (2, 1)).
(11a) Since the checksum (calculation formula) possibility flag (format 2 in FIG. 22) of the partial area (2, 1) is updated to "0", the data format is not determined.
(11b) Since the event possibility flag of the partial area (2, 1) remains "1", the data format is determined as "event (specific value)". Therefore, the estimating apparatus 10 estimates the data of the 1st bit, the 3rd bit, and the 4th bit as "fixed values" and the data of the 2nd bit as an "event (specific value)".

Thus, the estimation method according to the embodiment of the present invention can estimate the transmission type of the message while estimating the format of the data based on the behavior of the data within the data area. Therefore, the time for analyzing the communication log is reduced in the preparatory process for attack detection. In addition, it is possible to identify messages that are normally transmitted periodically and that are transmitted asynchronously with respect to the transmission cycle when an event occurs (periodic messages with event transmission in the above example). Therefore, using the estimation result obtained by the estimation method according to the embodiment of the present invention improves the accuracy of attack detection.

The following notes are further disclosed with respect to embodiments, including the above examples.
(Appendix 1)
An estimation method for estimating characteristics of a message sent in a network, comprising:
Refer to communication logs that record the time each message was received and the data stored in each message,
calculating, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received prior to the reception of the message;
A pattern representing the number of different values found for each sub-area by finding the values stored in each of a number of different sub-areas specified by a combination of position and length within the data area of each message count each number,
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs updating a second variable representing whether or not it corresponds to the transmission period based on the reception interval and the value stored in the partial area;
An estimation method, comprising: estimating a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns.
(Appendix 2)
The second variable is whether or not the message reception interval corresponds to the transmission cycle during a period other than the occurrence of a predetermined event, and the value stored in the partial area during the period other than the occurrence of the event. The estimation method according to appendix 1, characterized by representing whether or not is a value that should be stored at times other than when an event occurs.
(Appendix 3)
initial states of the first variable and the second variable are each a first state;
When the reception interval between the received message to be processed and the immediately preceding received message having the same identifier is shorter than the transmission period, the first variable provided for each partial area is changed to the second variable. update to the state of
When the reception interval is shorter than the transmission period and the value of the first partial area in the received message to be processed matches the value of the first partial area in the first received message, the first updating a second variable provided for a partial area of to a second state;
updating a first variable and a second variable provided for each partial area to a second state when the reception interval is longer than the transmission period;
when a second variable provided for at least one partial area among the plurality of partial areas represents a first state, and the number of patterns in the at least one partial area is two or more; ,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
The estimation method according to appendix 1, wherein the received message is estimated to include a partial area to which a specific value is set when the predetermined event occurs.
(Appendix 4)
A second variable provided for at least one partial area of the plurality of partial areas represents a first state, and the number of patterns in the at least one partial area is two or more, and , when a first variable provided for said at least one subregion represents a second state,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
The estimation method according to Supplementary Note 3, wherein the received message is estimated to include a partial area to which a specific value is set when the predetermined event occurs.
(Appendix 5)
managing a third variable indicating whether or not the message reception interval is shorter than a predetermined transmission period, provided for each partial area;
the initial state of the third variable is the first state;
updating the third variable provided for each partial area to a second state when the reception interval is equal to or greater than the transmission period;
A second variable provided for at least one partial area of the plurality of partial areas represents a first state, and the number of patterns in the at least one partial area is two or more, and , when a third variable provided for said at least one subregion represents a first state,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
The estimation method according to Supplementary Note 3, wherein the received message is estimated to include a partial area to which a specific value is set when the predetermined event occurs.
(Appendix 6)
initial states of the first variable and the second variable are each a first state;
When the reception interval between the received message to be processed and the immediately preceding received message having the same identifier is shorter than the transmission period, the first variable provided for each partial area is changed to the second variable. update to the state of
When the reception interval is shorter than the transmission period and the value of the first partial area in the received message to be processed matches the value of the first partial area in the immediately preceding received message, the first updating a second variable provided for one partial area to a second state;
updating a first variable and a second variable provided for each partial area to a second state when the reception interval is longer than the transmission period;
when a second variable provided for at least one partial area of the plurality of partial areas represents a first state,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
The estimation method according to appendix 1, wherein the received message is estimated to include a partial area whose value changes when the predetermined event occurs.
(Appendix 7)
managing a third variable indicating whether or not the message reception interval is shorter than a predetermined transmission period, provided for each partial area;
the initial state of the third variable is the first state;
updating the third variable provided for each partial area to a second state when the reception interval is equal to or greater than the transmission period;
A second variable provided for at least one partial area of the plurality of partial areas represents a first state, and a third variable provided for the at least one partial area When the variable represents the first state,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
The estimation method according to appendix 6, wherein the received message is estimated to include a partial area whose value changes when the predetermined event occurs.
(Appendix 8)
The second variable is whether or not the message reception interval corresponds to the transmission cycle during a period other than the occurrence of a predetermined event, and the value stored in the partial area during the period other than the occurrence of the event. indicates whether or not is a value that should be stored except when an event occurs,
When the reception interval corresponds to the transmission period and the value of the second partial area in the received message to be processed is different from the value to be stored except when an event occurs, the second partial area The estimation method according to appendix 3 or 6, characterized in that a second variable provided for is updated to a second state.
(Appendix 9)
The format of the data stored in the data area of the message is data set to a specific value when an event occurs, data whose value changes when an event occurs, fixed value, unsigned continuous value, sign Any one of Appendices 1 to 8, characterized in that it determines whether it corresponds to a continuous value with a formula, a checksum by a calculation formula, a checksum that shows uniformity, a counter, a monotonically increasing value, or a multi-value estimation method.
(Appendix 10)
Refer to communication logs that record the time each message was received and the data stored in each message,
calculating, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received prior to the reception of the message;
A pattern representing the number of different values found for each sub-area by finding the values stored in each of a number of different sub-areas specified by a combination of position and length within the data area of each message count each number,
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs updating a second variable representing whether or not it corresponds to the transmission period based on the reception interval and the value stored in the partial area;
A program that causes a computer to execute a process of estimating a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns.
(Appendix 11)
An information processing device for estimating characteristics of a message transmitted within a network,
a storage unit that stores a communication log in which the reception time of each message and the data stored in each message are recorded;
a reception interval calculation unit that refers to the communication log and calculates, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received before the reception of the message;
By referring to the communication log and detecting the values stored in each of a plurality of different partial areas specified by the combination of the position and length in the data area of each message, each partial area detected a counter each counting the number of patterns representing the number of different values in
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs an updating unit that updates a second variable representing whether or not it corresponds to the transmission cycle based on the reception interval and the value stored in the partial area;
an estimation unit that estimates a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns;
Information processing device.

10 estimation device 11 communication log database 12 control unit 13 pattern number counter 14 reception interval determination unit 15 variable update unit 16 format estimation unit 18 final result estimation unit 200 ECU
204 processor

Claims (7)

An estimation method for estimating characteristics of a message sent in a network, comprising:
Refer to communication logs that record the time each message was received and the data stored in each message,
calculating, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received prior to the reception of the message;
A pattern representing the number of different values found for each sub-area by finding the values stored in each of a number of different sub-areas specified by a combination of position and length within the data area of each message count each number,
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs updating a second variable representing whether or not it corresponds to the transmission period based on the reception interval and the value stored in the partial area;
An estimation method, comprising: estimating a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns. The second variable is whether or not the message reception interval corresponds to the transmission cycle during a period other than the occurrence of a predetermined event, and the value stored in the partial area during the period other than the occurrence of the event. The estimating method according to claim 1, characterized by representing whether or not is a value that should be stored except when an event occurs. initial states of the first variable and the second variable are each a first state;
When the reception interval between the received message to be processed and the immediately preceding received message having the same identifier is shorter than the transmission period, the first variable provided for each partial area is changed to the second variable. update to the state of
When the reception interval is shorter than the transmission period and the value of the first partial area in the received message to be processed matches the value of the first partial area in the first received message, the first updating a second variable provided for a partial area of to a second state;
updating a first variable and a second variable provided for each partial area to a second state when the reception interval is longer than the transmission period;
when a second variable provided for at least one partial area among the plurality of partial areas represents a first state, and the number of patterns in the at least one partial area is two or more; ,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
2. The estimation method according to claim 1, wherein said received message is estimated to include a partial area to which a specific value is set when said predetermined event occurs. initial states of the first variable and the second variable are each a first state;
When the reception interval between the received message to be processed and the immediately preceding received message having the same identifier is shorter than the transmission period, the first variable provided for each partial area is changed to the second variable. update to the state of
When the reception interval is shorter than the transmission period and the value of the first partial area in the received message to be processed matches the value of the first partial area in the immediately preceding received message, the first updating a second variable provided for one partial area to a second state;
updating a first variable and a second variable provided for each partial area to a second state when the reception interval is longer than the transmission period;
when a second variable provided for at least one partial area of the plurality of partial areas represents a first state,
The received message is transmitted at the transmission cycle during a period in which the predetermined event does not occur, and
2. The estimation method according to claim 1, wherein the received message includes a partial area whose value changes when the predetermined event occurs. The second variable is whether or not the message reception interval corresponds to the transmission cycle during a period other than the occurrence of a predetermined event, and the value stored in the partial area during the period other than the occurrence of the event. indicates whether or not is a value that should be stored except when an event occurs,
When the reception interval corresponds to the transmission period and the value of the second partial area in the received message to be processed is different from the value to be stored except when an event occurs, the second partial area 5. An estimation method according to claim 3 or 4, characterized in that a second variable provided for is updated to a second state. Refer to communication logs that record the time each message was received and the data stored in each message,
calculating, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received prior to the reception of the message;
A pattern representing the number of different values found for each sub-area by finding the values stored in each of a number of different sub-areas specified by a combination of position and length within the data area of each message count each number,
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs updating a second variable representing whether or not it corresponds to the transmission period based on the reception interval and the value stored in the partial area;
A program that causes a computer to execute a process of estimating a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns. An information processing device for estimating characteristics of a message transmitted within a network,
a storage unit that stores a communication log in which the reception time of each message and the data stored in each message are recorded;
a reception interval calculation unit that refers to the communication log and calculates, for each message, a reception interval representing the difference between the reception time of the message and the reception time of the message received before the reception of the message;
By referring to the communication log and detecting the values stored in each of a plurality of different partial areas specified by the combination of the position and length in the data area of each message, each partial area detected a counter each counting the number of patterns representing the number of different values in
A first variable provided for each partial area that indicates whether the message reception interval corresponds to a predetermined transmission cycle, and a message reception interval during a period other than when a predetermined event occurs an updating unit that updates a second variable representing whether or not it corresponds to the transmission cycle based on the reception interval and the value stored in the partial area;
an estimation unit that estimates a transmission type of a message and a format of data stored in a data area of the message based on the first variable, the second variable, and the number of patterns;
Information processing device.

Images