Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: An electronic control unit that is capable of more accurately determining an event that has occurred in a network installed in a mobile body such as a vehicle, the electronic control unit including: a transmitter-receiver that receives first messages transmitted from a first ECU included in an in-vehicle network; and an attack determiner that, when a first message among the first messages received by the transmitter-receiver is determined to have an anomaly, determines whether a cause of the anomaly is an attack on the in-vehicle network.

Abstract: An information processing device includes: a storage that stores determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to a vehicle is normal; and a detector that obtains behavior information indicating the behavior of the application, and detects an anomaly in the behavior of the application, based on (i) state information that indicates a state of the mobility and is obtained via the mobility network and (ii) the behavior information obtained and the determination criterion information stored in the storage.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A security device connected to a plurality of networks in a vehicle is provided. The security device determines, with regard to a frame received from a first network, whether to transmit a determination request for the frame outside the vehicle. The security device transmits the determination request outside the vehicle in a case where it is determined to transmit the determination request outside the vehicle, transmits, before obtaining a determination result from outside the vehicle in accordance with the determination request, the frame to a second network, and then obtains determination results from outside the vehicle in accordance with the determination request. The security device outputs presentation information in accordance with the determination result.

Abstract: An information processing device includes: a storage that stores determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to a vehicle is normal; and a detector that obtains behavior information indicating the behavior of the application, and detects an anomaly in the behavior of the application, based on (i) state information that indicates a state of the mobility and is obtained via the mobility network and (ii) the behavior information obtained and the determination criterion information stored in the storage.

Abstract: An anomaly detection electronic control unit connected to an in-vehicle network includes: a communicator that receives a first communication message indicating speed information of a vehicle including the in-vehicle network and a second communication message indicating peripheral information of the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: (A) determining a first traveling state of the vehicle based on the speed information and a second traveling state of the vehicle based on the peripheral information; (B) determining, by comparing the first traveling state with the second traveling state, that the first communication message is anomalous when the first traveling state is different from the second traveling state; and (C) executing processing to handle an anomaly when the first communication message is determined to be anomalous.

Abstract: An abnormality detection method is provided. The abnormality detection method is for detecting an abnormality that may be transmitted to a bus in an on-board network system. The on-board network system includes a plurality of electronic controllers that transmit and receive messages via the bus in a mobility entity. In the abnormality detection method, for example, a gateway transmits identification information to a server and receives a response determining a unit time. An operation process is performed using feature information based on a number of messages received from the bus per the determined unit time and using a model indicating a criterion in terms of a message occurrence frequency. A judgment is made as to an abnormality according to a result of the operation process.

Abstract: An anomaly detection electronic control unit (ECU) that detects unauthorized messages on a communication path is provided. An ECU that periodically transmits a first-type message including data to be monitored, and an ECU that periodically transmits a second-type message including data for comparison, are connected to the communication path. The anomaly detection ECU includes: a receiver that successively receives first-type and second-type messages; a processor that determines whether a first-type message received is normal or anomalous; and a transmitter that transmits a predetermined message in accordance with results of the determining.

Abstract: An electronic control unit that is capable of more accurately determining an event that has occurred in a network installed in a mobile body such as a vehicle, the electronic control unit including: a transmitter-receiver that receives first messages transmitted from a first ECU included in an in-vehicle network; and an attack determiner that, when a first message among the first messages received by the transmitter-receiver is determined to have an anomaly, determines whether a cause of the anomaly is an attack on the in-vehicle network.

Abstract: An abnormality detection method is provided. The abnormality detection method is for detecting an abnormality that may be transmitted to a bus in an on-board network system. The on-board network system includes a plurality of electronic controllers that transmit and receive messages via the bus in a mobility entity. In the abnormality detection method, for example, a gateway transmits identification information to a server and receives a response determining a unit time. An operation process is performed using feature information based on a number of messages received from the bus per the determined unit time and using a model indicating a criterion in terms of a message occurrence frequency. A judgment is made as to an abnormality according to a result of the operation process.

Abstract: An abnormality detection method is provided. The abnormality detection method is for detecting an abnormality that may be transmitted to a bus in an on-board network system. The on-board network system includes a plurality of electronic controllers that transmit and receive messages via the bus in a vehicle according to a CAN protocol. In the abnormality detection method, for example, a gateway transmits vehicle identification information to a server and receives a response determining a unit time. An operation process is performed using feature information based on a number of messages received from the bus per the determined unit time and using a model indicating a criterion in terms of a message occurrence frequency. A judgment is made as to an abnormality according to a result of the operation process.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: An anomaly detection electronic control unit connected to an in-vehicle network includes: a communicator that receives a first communication message indicating speed information of a vehicle including the in-vehicle network and a second communication message indicating peripheral information of the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: (A) determining a first traveling state of the vehicle based on the speed information and a second traveling state of the vehicle based on the peripheral information; (B) determining, by comparing the first traveling state with the second traveling state, that the first communication message is anomalous when the first traveling state is different from the second traveling state; and (C) executing processing to handle an anomaly when the first communication message is determined to be anomalous.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A security device connected to a plurality of networks in a vehicle is provided. The security device determines, with regard to a frame received from a first network, whether to transmit a determination request for the frame outside the vehicle. The security device transmits the determination request outside the vehicle in a case where it is determined to transmit the determination request outside the vehicle, transmits, before obtaining a determination result from outside the vehicle in accordance with the determination request, the frame to a second network, and then obtains determination results from outside the vehicle in accordance with the determination request. The security device outputs presentation information in accordance with the determination result.

Abstract: A security device connected to at least one bus in a vehicle is provided. The security device determines, with regard to a frame received from the at least one bus, whether predetermined conditions are satisfied to determine whether the frame is a suspect of being an attack frame. The security device transmits, a determination request to an external device outside of the vehicle in a case where the predetermined conditions are satisfied, and obtains determination results from the external device in accordance with the determination request. The security device outputs first presentation information in the case where the predetermined conditions are satisfied, and outputs second presentation information in a case where the determination results are obtained from the external device.

Abstract: An anomaly detection electronic control unit (ECU) that detects unauthorized messages on a communication path is provided. An ECU that periodically transmits a first-type message including data to be monitored, and an ECU that periodically transmits a second-type message including data for comparison, are connected to the communication path. The anomaly detection ECU includes: a receiver that successively receives first-type and second-type messages; a processor that determines whether a first-type message received is normal or anomalous; and a transmitter that transmits a predetermined message in accordance with results of the determining.

Abstract: An abnormality detection method is provided. The abnormality detection method is for detecting an abnormality that may be transmitted to a bus in an on-board network system. The on-board network system includes a plurality of electronic controllers that transmit and receive messages via the bus in a vehicle according to a CAN protocol. In the abnormality detection method, for example, a gateway transmits vehicle identification information to a server and receives a response determining a unit time. An operation process is performed using feature information based on a number of messages received from the bus per the determined unit time and using a model indicating a criterion in terms of a message occurrence frequency. A judgment is made as to an abnormality according to a result of the operation process.