Abstract: A priority determination system incudes a processor, a terminal, and a memory. The processor obtains anomaly data items, each indicating an anomaly in a corresponding one of moving bodies, and obtains state data items, each indicating a state of a corresponding one of the moving bodies. The processor calculates, for each anomaly data item, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies, determines a priority of a task for dealing with the anomaly indicated by each anomaly data item based on the risk value, and provides an output to the terminal to execute the task. The terminal displays an alert related to at least one of the priority of the task, the risk value, or an estimated dealing time required for completing the task.

Abstract: An on-vehicle device according to the present disclosure is capable of communicating with a server and mounted on a vehicle. The on-vehicle device includes a memory, and a hardware processor coupled to the memory. The hardware processor is configured to: receive, from the server, a log acquisition requirement including an anomaly detected point portion that designates one or more anomaly detected points and a log acquisition target portion that indicates one or more logs to be acquired when an anomaly is detected at the one or more anomaly detected points designated by the anomaly detected point portion; store the log acquisition requirement; detect an anomaly of the vehicle; acquire, when detecting an anomaly, a log based on a part where an anomaly is detected and the log acquisition requirement; and transmit the acquired log to the server.

Abstract: An attack path generation method according to the present disclosure is an attack path generation method executed by acquiring logs in devices connected to a network including at least one of a branch and a merge where each device has an attack detection function. The method includes: generating a primary-attack path without the branch and merge based on the acquired logs; generating a secondary-attack path branching from the primary-attack path or merging with the primary-attack path based on the logs; and outputting the generated primary-attack path and secondary-attack path to a device that performs attack-determination. The secondary-attack path is an attack path including an upstream or downstream device in which an event assumed to be an attack occurs within a certain period of time from an event assumed to be an attack on a device included in the primary-attack path and connected to the network merging/branching point.

Abstract: A priority determination system includes: an anomaly obtainer that obtains anomaly data items each indicating anomaly in a corresponding one of moving bodies; a state obtainer that obtains state data items each indicating a state of a corresponding one of the moving bodies; a risk value calculator that calculates, for each of the anomaly data items, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies; a priority determiner that determines a priority of a task for dealing with the anomaly indicated by each of the anomaly data items, based on the risk value of the anomaly data item; and an outputter that provides output based on a result of the determination.

Abstract: A priority determination system includes: an anomaly obtainer that obtains anomaly data items each indicating anomaly in a corresponding one of moving bodies; a state obtainer that obtains state data items each indicating a state of a corresponding one of the moving bodies; a risk value calculator that calculates, for each of the anomaly data items, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies; a priority determiner that determines a priority of a task for dealing with the anomaly indicated by each of the anomaly data items, based on the risk value of the anomaly data item; and an outputter that provides output based on a result of the determination.