Abstract: A malware detection method for a home network system including one or more home appliances that are connected to a home network includes: obtaining a plurality of setting values including at least information indicating a device type and an operating state of a target device subject to malware detection; selecting one detection model out of a plurality of detection models according to the plurality of setting values obtained; obtaining power consumption or current consumption of the target device; and detecting whether the target device is infected with malware, based on stable power or stable current obtained in the obtaining of the power consumption or the current consumption using the one detection model selected in the selecting, when the power consumption indicates stable power that varies within a predetermined range or the current consumption indicates stable current that varies within a predetermined range.

Abstract: A malware detection method for a home network system including one or more home appliances that are connected to a home network includes: obtaining a plurality of setting values including at least information indicating a device type and an operating state of a target device subject to malware detection; selecting one detection model out of a plurality of detection models according to the plurality of setting values obtained; obtaining power consumption or current consumption of the target device; and detecting whether the target device is infected with malware, using the one detection model selected in the selecting and based on the power consumption or the current consumption obtained.

Abstract: An information management method collects log information of one or more home electrical apparatuses corresponding to service providers. Display screen data is generated which indicates a status of the log information. The display screen data includes groups of information which each contain information on an apparatus, a service provider corresponding to the apparatus, and log information output from the apparatus. Provision of the log information of each group is individually selectable. The display screen data is provided via a network to a display terminal that performs access to a server device. Information is received from the display terminal, which indicates that selection on whether or not provision of the log information is performed. Provision of the log information is not performed on the selected group when a determination is made that refusal of provision of the log information on the selected group is performed.

Abstract: A device monitoring method includes: receiving a message transmitted from a first device to a second device and addressed to the second device; determining whether the message contains a device control command for controlling the second device; if the message contains the device control command, further determining whether to transmit the message to the second device based on a predetermined condition; and when the message is determined to be transmitted to the second device, transmitting the message to the second device. The predetermined condition includes a first condition that the first device is registered as a device having a predetermined function in a device list containing information about whether each of the devices is a device having the predetermined function. The message is determined to be transmitted to the second device when the predetermined condition is satisfied.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A sidewalk information generation device includes a thinning unit configured to perform thinning processing for extracting, from image data indicating an area of a sidewalk, a centerline in a width direction of the area of the sidewalk, a segmentation unit configured to perform segmentation processing for dividing the centerline extracted by the thinning unit in a longitudinal direction to generate a plurality of lines, and a vectorization unit configured to convert each of the plurality of lines generated by the segmentation unit to vector data indicating a coordinate sequence of a plurality of line segments.

Abstract: A sidewalk network information generation device in an embodiment includes a sidewalk centerline data storage device configured to store sidewalk centerline data indicating a plurality of sidewalk centerlines, a detection unit configured to detect an end point and a corner point of each of the plurality of sidewalk centerlines from the sidewalk centerline data stored in the sidewalk centerline data storage unit, and a link information generation unit configured to select, from among the end points and the corner points of the plurality of sidewalk centerlines detected by the detection unit, first coordinates indicating an end point or a corner point of a first sidewalk centerline and second coordinates indicating an end point or a corner point of a second sidewalk centerline within a certain distance from the first coordinates, and generate link information for linking the plurality of sidewalk centerlines on the basis of the selected first and second coordinates.

Abstract: A gateway that notifies a fraud detection server located outside a vehicle of information about an in-vehicle network system including an in-vehicle network includes: a priority determiner that determines a priority using at least one of: a state of the vehicle including the in-vehicle network system; an identifier of a message communicated on the in-vehicle network; and a result of fraud detection performed on the message; a frame transmitter-receiver that transmits and receives the message communicated on the in-vehicle network; a frame interpreter that extracts information about the in-vehicle network based on the message received by the frame transmitter-receiver; and a frame uploader that notifies the fraud detection server of notification information including the priority and the information about the in-vehicle network.

Abstract: A gateway device is connected to a plurality of electronic controllers on-board a vehicle. The gateway device acquires firmware update information, which includes at least a part of updated firmware to be applied to a first electronic controller, patch data, and information indicating where to apply the patch data. When the gateway device determines that the first electronic controller does not include a firmware cache for performing a pre-update firmware cache operation, the gateway device executes a proxy process. In this regard, the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, merges the patch data and existing firmware to create updated boot ROM data with updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM data and resets the first electronic controller with the updated firmware.

Abstract: A fraud detecting method for use in an in-vehicle network system including a plurality of electronic control units that communicate with each other via a network includes detecting whether a state of a vehicle satisfies a first condition or a second condition, and switching, upon detecting that the state of the vehicle satisfies the first condition or the second condition, an operation mode of a second electronic control unit connected to the network. A first mode in which a first type of detecting process for detecting a fraudulent message in the network is performed is switched to a second mode in which the first type of detecting process is not performed upon detecting that the state of the vehicle satisfies the first condition. Moreover, the second mode is switched to the first mode upon detecting that the state of the vehicle satisfies the second condition.

Abstract: In an anomaly determination method for determining an anomaly in a received message, a plurality of messages which include messages that are periodic and each of which includes a first field having a fixed value and a second field having a variable value are each received as the received message, and one of a plurality of combinations to be used for determination each of which includes at least one of a plurality of anomaly determinations including an anomaly determination utilizing a reception timing based on the periodicity or the number of received messages, an anomaly determination utilizing the first field, and an anomaly determination utilizing the second field, is selected according to one or more criteria among available execution time of the anomaly determination method, a load amount, a data amount, and the number of messages.

Abstract: A gateway device is connected via network(s) to electronic controllers on-board a vehicle, where at least one of the electronic controllers is implemented in a virtual machine. The gateway device includes one or more memories, and circuitry that acquires firmware update information. The circuitry determines whether a first electronic controller satisfies a second condition based on second information, which is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation. The circuitry also causes, when the second condition is not satisfied, the gateway device to execute a proxy process, where the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.

Abstract: In an anomaly determination method for determining an anomaly in a received message, a plurality of messages which include messages that are periodic and each of which includes a first field having a fixed value and a second field having a variable value are each received as the received message, and one of a plurality of combinations to be used for determination each of which includes at least one of a plurality of anomaly determinations including an anomaly determination utilizing a reception timing based on the periodicity or the number of received messages, an anomaly determination utilizing the first field, and an anomaly determination utilizing the second field, is selected according to one or more criteria among available execution time of the anomaly determination method, a load amount, a data amount, and the number of messages.

Abstract: A log generation method for generating a log of communication on an in-vehicle network includes: performing a plurality of determination processes for determining, by using different methods, whether or not a message sent to the in-vehicle network is anomalous; generating a log in accordance with results of the plurality of determination processes; and transmitting the generated log. In the generating, information items to be included in the log are determined in accordance with a combination of the results of the plurality of determination processes so that the log does not include identical information items.

Abstract: A gateway that notifies a fraud detection server located outside a vehicle of information about an in-vehicle network system including an in-vehicle network includes: a priority determiner that determines a priority using at least one of: a state of the vehicle including the in-vehicle network system; an identifier of a message communicated on the in-vehicle network; and a result of fraud detection performed on the message; a frame transmitter-receiver that transmits and receives the message communicated on the in-vehicle network; a frame interpreter that extracts information about the in-vehicle network based on the message received by the frame transmitter-receiver; and a frame uploader that notifies the fraud detection server of notification information including the priority and the information about the in-vehicle network.

Abstract: A reference message determining method is used in unauthorized communication detection in an onboard network system that is executed by an information processing system including at least one memory. The onboard network system including a network and one or more electronic control units connected to the network. The method includes executing unauthorized activity detection for determining whether or not a message received from the network is an attack message. A message that could not be determined to be unauthorized is regarded as a gray message. The method also includes determining whether or not the gray message is unauthorized again at a predetermined timing. In a case where the gray message is determined to be an attack message in the unauthorized-activity-detection executing operation, a communication pattern is identified based on information relating to the gray message and information relating to the plurality of the received messages previously determined as unauthorized.

Abstract: A statistical information generation device that generates statistical information from Ethernet frames on a mobility network includes: a transceiver that transmits and receives the Ethernet frames; and a statistical information generator that collects a plurality of Ethernet frames transmitted or received by the transceiver within a predetermined time period, and classifies, out of the plurality of Ethernet frames collected, Ethernet frames containing the same destination IP address, source IP address, destination port number, source port number, and protocol, and containing, in payloads, same identification information related to mobility control, into the same group, generates the statistical information for each group from the Ethernet frames classified into groups, and transmits the generated statistical information from the transceiver.

Abstract: A fraud detecting method for use in an in-vehicle network system including a plurality of electronic control units that communicate with each other via a network includes detecting whether a state of a vehicle satisfies a first condition or a second condition, and switching, upon detecting that the state of the vehicle satisfies the first condition or the second condition, an operation mode of a fraud-sensing electronic control unit connected to the network between a first mode in which a first type of detecting process for detecting a fraudulent message in the network is performed and a second mode in which the first type of detecting process is not performed. Moreover, in the second mode, a second type of detecting process having a different degree to which a fraudulent message is detectible than the first type of detecting process is performed.

Abstract: An electric lock control method includes: performing a first determination of whether a person is present in a predetermined region surrounding an electric lock, based on first information generated by an electronic device; when it is determined that a first person is present in the predetermined region in the performing of the first determination, performing a second determination of whether the first person is a person who is permitted to unlock the electric lock, based on second information related to movement of the first person; and controlling a state of the electric lock based on a result of the second determination, the state being a locked state or an unlocked state.

Abstract: An unauthorized activity detection method in an onboard network system. The detection method includes determining whether or not a message sent out onto the network is an attack message, saving information relating to the attack message in at least one memory in a case where the message is an attack message, identifying a communication pattern from information relating to the attack message, and determining whether or not the message matches a communication pattern. The determination of whether an attack message and determination of whether matching a communication pattern are executed on each of a plurality of messages received from the network. In the determining of whether an attack message executed on a message received after executing of determining of whether matching a communication pattern, results of the determination of whether an attack message that has already be executed are used.