Abstract: In a security method according to one aspect of the present disclosure, when a fraudulent command is detected in an in-vehicle communication network, an electronic control unit (ECU) which can transmit a fraudulent command is specified, the specified ECU is caused to execute update of the software used by the specified ECU, and execution of update of the software by the specified ECU is prohibited after the update of the software is executed.

Abstract: An anomaly detection device is a device for detecting an anomaly in a mobile body and includes: a type determiner that determines a type of an anomaly detected; a type change determiner that determines whether or not a change has occurred between a type of an anomaly detected last time and a type of an anomaly detected this time; and an anomaly detection log transmitter that transmits an anomaly detection log related to the anomaly detected this time when the change has occurred, and does not transmit the anomaly detection log related to the anomaly detected this time when the change has not occurred.

Abstract: An attack path generation method according to the present disclosure is an attack path generation method executed by acquiring logs in devices connected to a network including at least one of a branch and a merge where each device has an attack detection function. The method includes: generating a primary-attack path without the branch and merge based on the acquired logs; generating a secondary-attack path branching from the primary-attack path or merging with the primary-attack path based on the logs; and outputting the generated primary-attack path and secondary-attack path to a device that performs attack-determination. The secondary-attack path is an attack path including an upstream or downstream device in which an event assumed to be an attack occurs within a certain period of time from an event assumed to be an attack on a device included in the primary-attack path and connected to the network merging/branching point.

Abstract: An information processing device includes: an obtainer that obtains, from an anomaly detection sensor that detects an anomaly in a network, a detection log related to the anomaly in the network and the detection time of the anomaly indicated in the detection log; an occurrence time determiner that determines the occurrence time of an attack on the network based on the obtained detection time, and records the determined occurrence time; and an end time determiner that determines the expected end time of the attack on the network based on the obtained detection log, and records the determined expected end time.

Abstract: An integrated monitoring apparatus is mounted on a vehicle. An evidence log collection unit that of the integrated monitoring apparatus starts collecting a log from an ECU mounted on the vehicle when a predetermined log collection start condition is met. A determination unit of the integrated monitoring apparatus determines whether the ECU is operating normally based on the log of the ECU collected. When the ECU is determined to be operating normally, the log collection unit of the integrated monitoring apparatus stops collecting the log from the ECU.

Abstract: An information processing device includes: an obtainer that obtains, from an anomaly detection sensor that detects an anomaly in a network, a detection log related to the anomaly in the network and the detection time of the anomaly indicated in the detection log; an occurrence time determiner that determines the occurrence time of an attack on the network based on the obtained detection time, and records the determined occurrence time; and an end time determiner that determines the expected end time of the attack on the network based on the obtained detection log, and records the determined expected end time.

Abstract: A log management module includes: an anomaly detection information receiver that receives anomaly detection information; a detection history information storage that stores detection history information; an attack route information storage that stores attack route information indicating a candidate for an attack route in the CAN bus; an attack route estimator that estimates an attack route including the specific device, based on the attack route information; and a collection target determiner that, upon receipt of the anomaly detection information by the anomaly detection information receiver, determines, as collection targets whose log information for analysis which is for analyzing presence or absence of an undetected anomaly in the CAN bus is to be collected, one or more candidate devices which have been narrowed down from the devices, are present on the attack route estimated by the attack route estimator, and have no history of anomaly detection.

Abstract: An anomaly detection device is a device for detecting an anomaly in a mobile body and includes: a type determiner that determines a type of an anomaly detected; a type change determiner that determines whether or not a change has occurred between a type of an anomaly detected last time and a type of an anomaly detected this time; and an anomaly detection log transmitter that transmits an anomaly detection log related to the anomaly detected this time when the change has occurred, and does not transmit the anomaly detection log related to the anomaly detected this time when the change has not occurred.

Abstract: An information processing device that detects an anomaly in an in-vehicle network provided in a vehicle includes: a local rule storage in which at least an individual rule which is a rule generated for the vehicle is stored; a global rule storage in which an integrated rule which is a rule generated for a plurality of vehicles including the vehicle is stored; and a processing unit that performs, using a rule stored in at least one of the local rule storage or the global rule storage, an anomaly detection process on a frame transmitted on the in-vehicle network.

Abstract: An electronic control device includes: an acquisition unit that acquires state information indicating at least one of a state of a movable body and a state of an external environment in which the movable body is moving, and a control instruction indicating at least one of a steering control instruction for steering the movable body and an acceleration control instruction for adjusting acceleration of the movable body; and a determining unit that determines whether the control instruction is a false control instruction based on the at least one state indicated by the state information acquired and control indicated by the control instruction acquired.

Abstract: An information processing device that detects an anomaly in an in-vehicle network provided in a vehicle includes: a local rule storage in which at least an individual rule which is a rule generated for the vehicle is stored; a global rule storage in which an integrated rule which is a rule generated for a plurality of vehicles including the vehicle is stored; and a processing unit that performs, using a rule stored in at least one of the local rule storage or the global rule storage, an anomaly detection process on a frame transmitted on the in-vehicle network.

Abstract: An electronic control apparatus includes: an obtaining unit configured to obtain data transmitted via a network in a system; and a judging unit configured to judge presence or absence of an anomaly in the data obtained by the obtaining unit, based on a transmission state of the data. The judging unit is configured to judge that an anomaly is present in the data, when the transmission state of the data is a transmission stopped state.

Abstract: A server includes: an obtainer that obtains items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles; and a generator that generates an integrated rule that is suitable for the items of information obtained by the obtainer and is for anomaly detection processing in the in-vehicle network of one of the vehicles; and a provider that outputs the integrated rule generated by the generator. For example, the obtainer obtains condition information indicating a condition pertaining to each of the plurality of vehicles at a time when the communication frame is transmitted on the in-vehicle network, and the generator generates the integrated rule using the items of frame information associated with the condition information.

Abstract: An information transmission device is provided in an object that including one or more devices and a monitoring sensor monitoring each device. The information transmission device includes: an obtainer that obtains, from the monitoring sensor, first detection information indicating that an anomaly is detected in any device; and a transmitter that transmits, to an external device, monitoring information including the first detection information and relevance information. The relevance information indicates relevance between the first detection information and second detection information which is obtained from the monitoring sensor and transmitted from the transmitter to the external device prior to the transmission of the first detection information. The second detection information indicating that an anomaly is detected in any device, and relating to the first detection information.

Abstract: An electronic control unit includes: a first determination unit which determines whether a message received is an address claim message; a second determination unit which determines, when it is determined that the message received is an address claim message, whether a device name included in the address claim message received is a predetermined device name; and a third determination unit which performs a predefined determination process, when it is determined that the device name included in the address claim message received is the predetermined device name, and determine whether the address claim message received is an unauthorized message according to a result of the predefined determination process.

Abstract: An electronic control device is connected to at least one bus of a mobile object, and includes: a controller that controls behavior of the mobile object; an anomaly detector that performs detection to detect an anomaly in communication data which flows through the at least one bus and which includes identification information for identifying control details related to the behavior of the mobile object; and an obtainer that obtains at least one piece of identification information corresponding to a result of the detection.

Abstract: A master control device is communicatively coupled to a first slave control device and a second slave control device via a first network and a second network, respectively. The master control device provides output data to the first slave control device based on input data received from the second slave control device. A monitoring apparatus which monitors an operation of the master control device stores determination data indicating a correspondence relationship between the input data and the output data, obtains the input data provided to the second network by the second slave control device and the output data provided to the first slave control device via the first network, and determines a presence or an absence of an anomaly in the operation of the master control device by determining whether the input data and the output data correspond to the determination data.

Abstract: An information processing device includes: a first communication unit which transmits and receives communication data through a network connected to a first GW, a second GW, and at least one electronic control unit; a monitoring unit which determines whether the communication data is normal; and a notification unit which transmits, at least to the second GW, a notification that brings the network to a state in which one of a transfer function of the first GW and a transfer function of the second GW gateway is active and the other one of the transfer functions is inactive, when the monitoring unit does not determine that the communication data is normal.

Abstract: An information processing device is provided. A first communication unit transmits and receives communication data through a network. The network is connected to a first gateway, a second gateway, and at least one electronic control unit. A monitoring unit determines whether the communication data is normal. A notification unit transmits, at least to the second gateway, a notification that brings the network to a state in which one of a transfer function of the first gateway and a transfer function of the second gateway is active and the other one of the transfer functions is inactive, when the monitoring unit determines that the communication data is not normal.

Abstract: An electronic control unit includes: a first determination unit which determines whether a message received is an address claim message; a second determination unit which determines, when it is determined that the message received is an address claim message, whether a device name included in the address claim message received is a predetermined device name; and a third determination unit which performs a predefined determination process, when it is determined that the device name included in the address claim message received is the predetermined device name, and determine whether the address claim message received is an unauthorized message according to a result of the predefined determination process.