Monitoring device monitoring network

• US 9,571,513 B2
• Filed: 04/23/2015
• Issued: 02/14/2017
• Est. Priority Date: 04/23/2015
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Munetoh, Seiji
• Primary Examiner(s): Waliullah, Mohammed
• Application Number:
  US14/694,361
• Publication Number:
  US 20160315958A1
• Time in Patent Office: 663 Days
• US Class Current: 1/1
• CPC Class Codes: G07C 5/008 communicating information to a remotely located station transmission systems for measured values G08C
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/48 for in-vehicle communication

Abstract

A monitoring device configured to monitor a network to which plural controllers are connected which includes a decoder configured to extract target data belonging to a target data group from data received from the plural controllers, a first comparator configured to determine whether an immutable part of the target data is known or anomalous, a second comparator configured to determine whether a reception interval of the target data group is normal or anomalous, a third comparator configured to determine whether the number of the target data having been received and included in the target data group is normal or anomalous, and determine whether each reception interval between the target data is normal or anomalous, and a warning counter configured to individually count the number of anomalies determined by the first comparator, the number of anomalies determined by the second comparator, and the number of anomalies determined by the third comparator.

Claims

1. A monitoring device configured to monitor a network connected to a plurality of controllers, the monitoring device comprising:

a decoder configured to extract target data belonging to a target data group from data received from the plurality of controllers;

a first comparator configured to determine whether an immutable part of the target data is known or anomalous;

a second comparator configured to determine whether a reception interval of the target data group is normal or anomalous;

a third comparator configured to determine whether a number of the target data received and included in the target data group is normal or anomalous, and determine whether each reception interval between the target data is normal or anomalous;

a warning counter configured to individually count a number of anomalies determined by the first comparator, a number of anomalies determined by the second comparator, and a number of anomalies determined by the third comparator;

a first register configured to set identification information of the target data;

a second register configured to set information of the immutable part of the target data;

a third resister configured to set a normal value of the reception interval of the target data group;

a fourth register configured to set a normal value of each reception interval between the target data of the target data group;

a fifth register configured to set a normal value of the number of the target data of the target data group;

a first counter configured to count the reception interval of the target data group; and

a second counter configured to count each reception interval between the target data of the target data group, wherein;

the decoder is configured to extract the target data belonging to the target data group by comparing the data received from the plurality of controllers and a value of the identification information set in the first register;

the first comparator is configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register;

the second comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and

the third comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the number of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.

3. The monitoring device of claim 1, wherein the monitoring device is installed in each of the plurality of controllers, and the monitoring device is configured to monitor data output from the corresponding one of the plurality of controllers.

2. The monitoring device of 1, wherein:

the monitoring device is installed in a gateway, wherein the gateway is connected to a plurality of network buses, the plurality of network buses connected to the plurality of controllers; and

the monitoring device is configured to monitor data received through a plurality of interfaces of the gateway for the plurality of network buses.

4. A semiconductor integrated circuit, comprising:

a decoder;

a plurality of comparators; and

a warning counter, wherein;

the decoder is configured to extract target data belonging to a target data group from data received from an outside;

a first comparator of the plurality of comparators is configured to determine whether an immutable part of the target data is known or anomalous;

a second comparator of the plurality of comparators is configured to determine whether a reception interval of the target data group is normal or anomalous;

a third comparator of the plurality of comparators is configured to determine whether a number of the target data having been received and included in the target data group is normal or anomalous and each reception interval between the target data is normal or anomalous; and

the warning counter is configured to individually count a number of anomalies determined by the first comparator, a number of anomalies determined by the second comparator, and a number of anomalies determined by the third comparator;

a first register configured to set identification information of the target data;

a second register configured to set information immutable part of the target data;

a third register configured to set a normal value of the reception interval of the target data group;

a fourth register configured to set a normal value of each reception interval between the target data of the target data group;

a fifth register configured to set a normal value of the number of the target data of the target data group;

a first counter configured to count the reception interval of the target data group; and

a second counter configured to count each reception interval between the target data of the target data group, wherein;

the decoder is configured to extract the target data belonging to the target data group by comparing the data received from the outside and a value of the identification information set in the first register;

the first comparator is configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register;

the second comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and

the third comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the number of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.

5. A network device, comprising:

a plurality of controllers; and

a monitoring device configured to monitor data output from each of the plurality of controllers, wherein the monitoring device comprises;

a decoder configured to extract target data belonging to a target data group from data received from the plurality of controllers;

a first comparator configured to determine whether an immutable part of the target data is known or anomalous;

a second comparator configured to determine whether a reception interval of the target data group is normal or anomalous;

a third comparator configured to determine whether a number of the target data having been received and included in the target data group is normal or anomalous, and each reception interval between the target data is normal or anomalous;

a warning counter configured to individually count a number of anomalies determined by the first comparator, a number of anomalies determined by the second comparator, and a number of anomalies determined by the third comparator;

a first register configured to set identification information of the target data;

a second register configured to set information of the immutable part of the target data;

a third register configured to set a normal value of the reception interval of the target data group;

a fourth register configured to set a normal value of each reception interval between the target data of the target data group;

a fifth register configured to set a normal value of the number of the target data of the target data group;

a first counter configured to count the reception interval of the target data group; and

a second counter configured to count each reception interval between the target data of the target data group, wherein;

the decoder is configured to extract the target data belonging to the target data group by comparing the data received from the plurality of controllers and a value of the identification information set in the first register;

the first comparator is configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register;

the second comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and

the third comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the number of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.

6. The network device of claim 5, further comprising:

a plurality of network buses connected to the plurality of controllers; and

a gateway connected to the plurality of network buses, wherein the monitoring device is installed in the gateway, and the monitoring device is configured to monitor data output from the plurality of controllers and received through interfaces of the gateway for the plurality of network buses.

7. The network device of claim 5, wherein the monitoring device is installed in each of the plurality of controllers, and the monitoring device is configured to monitor data output from the corresponding one of the plurality of controllers.

8. The network device of claim 5, further comprising a communication device connected to an external network and configured to send information of a monitoring result of the monitoring device to a server on the external network.