Abstract: An unauthorized connection detection apparatus includes: a connected device count determination unit that determines the number of devices connected to a bus line on the basis of a measured waveform that is a voltage fluctuation waveform representing a change over time in a voltage value of the bus line or an impedance fluctuation waveform representing a change over time in an impedance value of the bus line; and an unauthorized connection determination unit that determines whether or not an unauthorized device is connected to the bus line on the basis of: a result of the determination of the number of devices by the connected device count determination unit; and information indicating the number of valid devices connected to the bus line.

Abstract: An inspection control unit (210) checks a communication status of a communication network (101, 102) to which one or more nodes are connected and determines, based on the communication status, whether inspection of the communication network is possible. When it is determined that inspection of the communication network is possible, the inspection control unit outputs a basic signal, which is a pulse signal for inspecting the communication network, to the communication network. An inspecting unit (220) accepts an inspection signal, which is a basic signal with a waveform changed by flowing through the communication network, and determines, based on the waveform of the inspection signal, whether a new node connected to the communication network is present.

Abstract: A relationship building unit (120), based on a plurality of pieces of software operation data, each of which includes an operation type of software operation and operation object information that indicates a plurality of software objects used in the software operation, generates object relationship data that indicates a relationship between the plurality of software objects. A polluted range locating unit (130), based on the object relationship data and alert data that notifies occurrence of a cyberattack, generates polluted range data that indicates a polluted range affected by the cyberattack.

Abstract: An attack detection device (501) includes a group generation unit (30), a log management unit (40), an authenticator generation unit (90) and a graph management unit (60). The group generation unit (30) generates an authenticator graph (D36) including a plurality of pieces of correspondence information wherein a plurality of logs and an identifier to identify an authenticator generated by using the plurality of logs are associated. The log management unit (40) manages the plurality of logs used for generation of an authenticator identified by the identifier in the authenticator graph (D36). The authenticator generation unit (90) generates the authenticator identified by the identifier for each identifier in the authenticator graph (D36) from the plurality of logs. The graph management unit (60) manages the authenticator graph (D36) and the authenticator generated.

Abstract: A comparison unit (22) compares a measurement value, which is one of changes over time in a voltage value of a bus line (11), distance transition of the voltage value, changes over time in an impedance value of the bus line (11), and distance transition of the impedance value that have been measured, with a normal value, which is one of changes over time in a voltage value of the bus line (11), distance transition of the voltage value, changes over time in an impedance value of the bus line (11), and distance transition of the impedance value in a normal state, and extracts a difference between the measurement value and the normal value. An unauthorized connection determination unit (24) evaluates the difference between the measurement value and the normal value extracted by the comparison unit (22), so as to determine whether an unauthorized device is connected to the bus line (11).

Abstract: In a transfer control apparatus (100), each function unit (110) specifies a transfer time and a device ID, and makes a transfer request of device data. A first control unit (111), in response to the transfer request from a request source being any of a plurality of function units (110), transfers the device data between a first area (121) corresponding to the request source, and a second area (122) corresponding to a combination of the transfer time and the device ID specified by the request source. A second control unit (112) transfers, when a second area (122) corresponding to a transfer time being same as a time notified by a timer (113) exists, the device data between that second area (122), and a third area (123) corresponding to the same device ID as that second area (122).

Abstract: A execution monitoring device (20) includes a time-series data storage unit (225) to store time-series data and a real-time specification determining unit (204). The real-time specification determining unit (204) updates a determination result, which is a result of determining whether the time-series data stored in the time-series data storage unit (225) satisfies a real-time specification, which is part of constraints included in a monitoring specification for electronic device runtime monitoring, is stored in a memory area reserved before execution of the real-time specification determining unit (204), and is a constraint using a real time.

Abstract: An execution control unit (110) confirms a transmission state of an external network (202). The execution control unit determines, as a request destination of attack judgment, either an attack judgment device (210) or an attack judgment unit (120), based on the transmission state of the external network. The execution control unit requests attack judgment to the request destination determined. Each of the attack judgment device and the attack judgment unit judges whether an attack against an in-vehicle system (100) exists, in response to a request of attack judgment.

Abstract: An inspection control unit (210) checks a communication status of a communication network (101, 102) to which one or more nodes are connected and determines, based on the communication status, whether inspection of the communication network is possible. When it is determined that inspection of the communication network is possible, the inspection control unit outputs a basic signal, which is a pulse signal for inspecting the communication network, to the communication network. An inspecting unit (220) accepts an inspection signal, which is a basic signal with a waveform changed by flowing through the communication network, and determines, based on the waveform of the inspection signal, whether a new node connected to the communication network is present.

Abstract: A waveform analysis unit (102) analyzes a measured waveform which is a waveform obtained by measuring one of a voltage value and an impedance value of a bus line (300). A device authentication unit (104) determines whether or not a new device is connected to the bus line (300), the new device being a device not included in configuration information (1070) which includes one or more devices known to be connected to the bus line (300), performs authentication for each of the devices connected to the bus line (300), and when the new device is connected to the bus line (300), acquires authentication information used for the authentication for the new device, and performs the authentication for the new device. An illegitimate operation determination unit (105) determines whether or not illegitimate operation is performed on the bus line (300), by using the configuration information, an analysis result from the waveform analysis unit (102), and an authentication result from the device authentication unit (104).

Abstract: An unauthorized connection detection apparatus includes: a connected device count determination unit that determines the number of devices connected to a bus line on the basis of a measured waveform that is a voltage fluctuation waveform representing a change over time in a voltage value of the bus line or an impedance fluctuation waveform representing a change over time in an impedance value of the bus line; and an unauthorized connection determination unit that determines whether or not an unauthorized device is connected to the bus line on the basis of: a result of the determination of the number of devices by the connected device count determination unit; and information indicating the number of valid devices connected to the bus line.

Abstract: A comparison unit (22) compares a measurement value, which is one of changes over time in a voltage value of a bus line (11), distance transition of the voltage value, changes over time in an impedance value of the bus line (11), and distance transition of the impedance value that have been measured, with a normal value, which is one of changes over time in a voltage value of the bus line (11), distance transition of the voltage value, changes over time in an impedance value of the bus line (11), and distance transition of the impedance value in a normal state, and extracts a difference between the measurement value and the normal value. An unauthorized connection determination unit (24) evaluates the difference between the measurement value and the normal value extracted by the comparison unit (22), so as to determine whether an unauthorized device is connected to the bus line (11).

Abstract: When data output is requested by an application whose default output setting is set ineffective among a plurality of applications, an output setting updating part (120) updates an output setting of the requesting application from ineffective to effective and updates an output setting of another application which outputs data to the same output destination as the output destination of the requesting application and whose default output setting is set effective, from effective to ineffective. An output control part (160) outputs data of an application whose output setting is effective.

Abstract: A communication unit receives, from a terminal device, installed application information indicating an input/output schedule of input of input information to be used for computation by an installed application program installed in the terminal device and output of a result of computation by the installed application program. A determination unit analyzes the input/output schedule of the installed application program indicated by the installed application information and an input/output schedule of input of input information to be used for computation by a non-installed application program not yet installed in the terminal device and output of a result of computation by the non-installed application program, and determines whether or not the installed application program and the non-installed application program can be executed by the terminal device.

Abstract: A communication unit receives, from a terminal device, installed application information indicating an input/output schedule of input of input information to be used for computation by an installed application program installed in the terminal device and output of a result of computation by the installed application program. A determination unit analyzes the input/output schedule of the installed application program indicated by the installed application information and an input/output schedule of input of input information to be used for computation by a non-installed application program not yet installed in the terminal device and output of a result of computation by the non-installed application program, and determines whether or not the installed application program and the non-installed application program can be executed by the terminal device.

Abstract: When data output is requested by an application whose default output setting is set ineffective among a plurality of applications, an output setting updating part (120) updates an output setting of the requesting application from ineffective to effective and updates an output setting of another application which outputs data to the same output destination as the output destination of the requesting application and whose default output setting is set effective, from effective to ineffective. An output control part (160) outputs data of an application whose output setting is effective.

Abstract: In a transfer control apparatus (100), each function unit (110) specifies a transfer time and a device ID, and makes a transfer request of device data. A first control unit (111), in response to the transfer request from a request source being any of a plurality of function units (110), transfers the device data between a first area (121) corresponding to the request source, and a second area (122) corresponding to a combination of the transfer time and the device ID specified by the request source. A second control unit (112) transfers, when a second area (122) corresponding to a transfer time being same as a time notified by a timer (113) exists, the device data between that second area (122), and a third area (123) corresponding to the same device ID as that second area (122).