Abstract: An electronic control unit (ECU) is provided. The ECU is connected to a first network in an onboard network system. The onboard network system includes the first network and a second network. In the first network, first-type frames are transmitted following a first communication protocol. In the second network, second-type frames are transmitted following a second communication protocol. The first-type frame includes first information serving as a base for the second-type frame to be transmitted to the second network, and second information indicating that the first-type frame includes information that is to be transmitted to the second network. The ECU includes a generator that generates the first-type frame following the first communication protocol, and a transmitter that transmits, to the first network, the first-type frame generated by the generator.

Abstract: A vehicle anomaly detection server includes: a communicator that communicates with a vehicle to receive a log of an in-vehicle network in the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: selecting, when information indicating that an anomaly is occurring to a first vehicle among vehicles is obtained by the processor, an anomaly-related vehicle from among the vehicles based on the anomaly, the first vehicle being the vehicle that communicates with the communicator; transmitting, to the anomaly-related vehicle via the communicator, a first request to transmit a log of an in-vehicle network in the anomaly-related vehicle; and determining whether an anomaly is occurring to the anomaly-related vehicle, based on information indicated by the log transmitted from the anomaly-related vehicle and received by the communicator.

Abstract: An IDS ECU includes: an anomalous frame detector that detects an anomalous frame; a connector communicator that transmits an anomaly-related request frame to a connector that is a transmitter of the anomalous frame, to request a response from the connector, and receives, from the connector, an anomaly-related response frame generated by the connector based on the anomaly-related request frame and indicating the transmitter; a network anomaly determiner that calculates, from the anomaly-related response frame, the number of anomalous connectors indicating the number of connectors that transmitted the anomaly-related response frame, and determines that an in-vehicle network system is: in a first anomalous state when the number is 0; and in a second anomalous state when the number is not 0; and a network anomaly handler that handles the first or second anomalous state determined by the network anomaly determiner.

Abstract: An anomaly detection electronic control unit connected to an in-vehicle network includes: a communicator that receives a first communication message indicating speed information of a vehicle including the in-vehicle network and a second communication message indicating peripheral information of the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: (A) determining a first traveling state of the vehicle based on the speed information and a second traveling state of the vehicle based on the peripheral information; (B) determining, by comparing the first traveling state with the second traveling state, that the first communication message is anomalous when the first traveling state is different from the second traveling state; and (C) executing processing to handle an anomaly when the first communication message is determined to be anomalous.

Abstract: A data analysis apparatus includes: a vehicle data communicator that obtains vehicle data indicating a vehicle status of a first vehicle; a external data communicator that obtains external data indicating external circumstances of the first vehicle from at least one of a second vehicle, which is in an area where the first vehicle is running and is different from the first vehicle, and a traffic infrastructure system; a processor; and a memory including at least one set of instructions. By executing the at least one set of instructions, the processor performs: a first determination as to whether there is an inconsistency between the vehicle status of the first vehicle indicated and the external circumstances, and outputs a result of the first determination regarding the first vehicle.

Abstract: A network system includes a first network through which a frame of a first type is transmitted in accordance with a first communication protocol and includes a second network in which a frame of a second type is transmitted in accordance with a second communication protocol. A gateway device is connected to the first network and the second network. The gateway device sequentially receives frames of the first type from the first network and determines whether to transmit data regarding the received frames of the first type to the second network. The gateway device transmits, to the second network, a frame of the second type including data regarding a plurality of the frames of the first type determined to be transmitted to the second network when a condition relating to a number of frames of the first type received by the gateway device is satisfied.

Abstract: A vehicle anomaly detection server includes: a communicator that communicates with a vehicle to receive a log of an in-vehicle network in the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: selecting, when information indicating that an anomaly is occurring to a first vehicle among vehicles is obtained by the processor, an anomaly-related vehicle from among the vehicles based on the anomaly, the first vehicle being the vehicle that communicates with the communicator; transmitting, to the anomaly-related vehicle via the communicator, a first request to transmit a log of an in-vehicle network in the anomaly-related vehicle; and determining whether an anomaly is occurring to the anomaly-related vehicle, based on information indicated by the log transmitted from the anomaly-related vehicle and received by the communicator.

Abstract: An anomaly detection device includes: an obtainer that obtains vehicle information related to the status of a vehicle and including location data indicating the location of the vehicle; a model storage that stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating the vehicle information of the vehicle located at the cell; and a determiner that calculates, based on the vehicle information and evaluation models each being the evaluation model and corresponding to evaluation cells including a first cell including the location of the vehicle indicated in the location data and one or more second cells each having a predetermined positional relationship with the first cell, an anomaly level indicating a degree of anomaly of the vehicle information, determines, based on the anomaly level, whether the vehicle information is anomalous, and outputs a determination result.

Abstract: A network hub is provided for an onboard network system. The onboard network system includes first and second networks for transmission of first-type and second-type frames following first and second communication protocols. The network hub includes a receiver that receives a first-type frame. A processor determines whether or not the first-type frame received by the receiver includes first information that is a base for a second-type frame to be transmitted to the second network, to obtain a determination result, and selects a port to send a frame based on the first-type frame based on the determination result. A transmitter sends the frame based on the first-type frame to a wired transmission path connected to the port selected by the processor based on the first-type frame received by the receiver.

Abstract: A vehicle monitoring apparatus includes: a first communicator that receives specifying information for specifying a target vehicle from a server; and an acquirer that acquires driving information from the target vehicle, the driving information being information regarding driving of the target vehicle specified by the specifying information received by the first communicator. The first communicator transmits the driving information acquired by the acquirer to the server. For example, the acquirer may acquire the driving information obtained from the target vehicle through communication.

Abstract: A vehicle monitoring apparatus includes: a first communicator that receives specifying information for specifying a target vehicle from a server; and an acquirer that acquires driving information from the target vehicle, the driving information being information regarding driving of the target vehicle specified by the specifying information received by the first communicator. The first communicator transmits the driving information acquired by the acquirer to the server. For example, the acquirer may acquire the driving information obtained from the target vehicle through communication.

Abstract: A gateway that notifies a fraud detection server located outside a vehicle of information about an in-vehicle network system including an in-vehicle network includes: a priority determiner that determines a priority using at least one of: a state of the vehicle including the in-vehicle network system; an identifier of a message communicated on the in-vehicle network; and a result of fraud detection performed on the message; a frame transmitter-receiver that transmits and receives the message communicated on the in-vehicle network; a frame interpreter that extracts information about the in-vehicle network based on the message received by the frame transmitter-receiver; and a frame uploader that notifies the fraud detection server of notification information including the priority and the information about the in-vehicle network.

Abstract: An anomaly detection electronic control unit (ECU) that detects unauthorized messages on a communication path is provided. An ECU that periodically transmits a first-type message including data to be monitored, and an ECU that periodically transmits a second-type message including data for comparison, are connected to the communication path. The anomaly detection ECU includes: a receiver that successively receives first-type and second-type messages; a processor that determines whether a first-type message received is normal or anomalous; and a transmitter that transmits a predetermined message in accordance with results of the determining.

Abstract: A server as an information processing device includes: a communicator that communicates with mobile a body; a monitoring data storage that stores past monitoring data of the mobile body received by the communicator; and an alive monitor that determines whether a current state of the mobile body is anomalous, based on the past monitoring data stored in the monitoring data storage.

Abstract: A data analysis apparatus includes: a processor; and a memory including a set of instructions that, when executed by the processor causes the processor to perform operations including: obtaining anomaly analysis results each including information identifying anomaly data of first and second vehicles provided with an in-vehicle network including one or more networks; identifying, for each of the first and second vehicles, a primary ECU having higher relevance to the anomaly data among ECUs connected to the in-vehicle network; identifying, for each of the first and second vehicles, ECUs connected to a network in the one or more networks to which the primary ECU is connected as a secondary ECU set; and identifying an ECU included in both of the secondary ECU set identified for the first vehicle and the secondary ECU set identified for the second vehicle and satisfying a predetermined condition as an anomaly-relevant ECU.

Abstract: An electronic control unit that is capable of more accurately determining an event that has occurred in a network installed in a mobile body such as a vehicle, the electronic control unit including: a transmitter-receiver that receives first messages transmitted from a first ECU included in an in-vehicle network; and an attack determiner that, when a first message among the first messages received by the transmitter-receiver is determined to have an anomaly, determines whether a cause of the anomaly is an attack on the in-vehicle network.

Abstract: A gateway that notifies a fraud detection server located outside a vehicle of information about an in-vehicle network system including an in-vehicle network includes: a priority determiner that determines a priority using at least one of: a state of the vehicle including the in-vehicle network system; an identifier of a message communicated on the in-vehicle network; and a result of fraud detection performed on the message; a frame transmitter-receiver that transmits and receives the message communicated on the in-vehicle network; a frame interpreter that extracts information about the in-vehicle network based on the message received by the frame transmitter-receiver; and a frame uploader that notifies the fraud detection server of notification information including the priority and the information about the in-vehicle network.

Abstract: In an anomaly detection method that determines whether each frame in observation data constituted by a collection of frames sent and received over a communication network system is anomalous, a difference between a data distribution of a feature amount extracted from the frame in the observation data and a data distribution for a collection of frames sent and received over the communication network system, obtained at a different timing from the observation data, is calculated. A frame having a feature amount for which the difference is predetermined value or higher is determined to be an anomalous frame. An anomaly contribution level of feature amounts extracted from the frame determined to be an anomalous frame is calculated, and an anomalous payload part, which is at least one part of the payload corresponding to the feature amount for which the anomaly contribution level is at least the predetermined value, is output.

Abstract: An information processing device comprising: a processor; and a memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations. The operations include: obtaining incident information about an incident of a cyberattack that occurred in a vehicle; obtaining second vehicle information about a state of a second vehicle via communication with the second vehicle; determining a risk level of a vehicle function of the second vehicle based on a degree of matching between the incident information and the second vehicle information; generating a function restriction command for restricting a vehicle function of a first vehicle corresponding to the vehicle function of the second vehicle, when the risk level is higher than a first criterion, the vehicle function of the first vehicle being one among one or more vehicle functions of the first vehicle; and outputting the function restriction command.

Abstract: An electronic control unit (ECU) is provided. The ECU is connected to a first network in an onboard network system. The onboard network system includes the first network and a second network. In the first network, first-type frames are transmitted following a first communication protocol. In the second network, second-type frames are transmitted following a second communication protocol. The first-type frame includes first information serving as a base for the second-type frame to be transmitted to the second network, and second information indicating that the first-type frame includes information that is to be transmitted to the second network. The ECU includes a generator that generates the first-type frame following the first communication protocol, and a transmitter that transmits, to the first network, the first-type frame generated by the generator.