	US 12,155,677 B2
	Fraud detection method, fraud detection device, and recording medium
Manabu Maeda, Osaka (JP); Takeshi Kishikawa, Osaka (JP); and Daisuke Kunimune, Osaka (JP)
Assigned to PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA, Torrance, CA (US)
Filed by Panasonic Intellectual Property Corporation of America, Torrance, CA (US)
Filed on Sep. 26, 2019, as Appl. No. 16/583,996.
Application 16/583,996 is a continuation of application No. PCT/JP2018/044568, filed on Dec. 4, 2018.
Claims priority of application No. 2018-064431 (JP), filed on Mar. 29, 2018.
Prior Publication US 2020/0021611 A1, Jan. 16, 2020
Int. Cl. H04L 9/40 (2022.01); H04L 12/40 (2006.01)

CPC H04L 63/1425 (2013.01) [H04L 12/40026 (2013.01); H04L 63/1466 (2013.01); H04L 2012/40215 (2013.01); H04L 2012/40273 (2013.01)]

4 Claims

1. A non-transitory computer-readable recording medium having recorded thereon a computer program for causing a computer to execute a fraud detection method for detecting an anomalous message in an in-vehicle network, the fraud detection method comprising:

receiving a first message transmitted in the in-vehicle network, the first message being scheduled to be received at a scheduled time that is an elapsed time from a reception time of a second message received last before the first message, the second message being with the same data type ID as the first message;

assessing whether a condition 1 is met, the condition 1 being that a reception time of the first message is within a predetermined range, the predetermined range including the scheduled time;

assessing whether a condition 2 is met, the condition 2 being that arbitration occurs when receiving the first message, the arbitration being that one or more consecutive third messages and the first message following the one or more consecutive third messages are received at less than or equal to a time interval set beforehand;

assessing whether a condition 3 is that (a) a start time of the arbitration is earlier than an upper limit of the predetermined range or that (b) the start time of the arbitration is equal to or later than the upper limit of the predetermined range, the start time of the arbitration being a reception time of a message with an earliest reception time among the one or more consecutive third messages;

determining that the first message is a normal message, when the condition 1 is met and the condition 2 is not met;

determining that the first message is a normal message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (a);

determining that the first message is an anomalous message, when the condition 1 is not met, the condition 2 is met and the condition 3 is (b); and

determining that the first message is an anomalous message, when the condition 1 is not met and the condition 2 is not met.