Abstract: A gateway apparatus is connected to a plurality of buses. A data frame is received by using one of the plurality of buses as a reception bus. Whether the received data frame is a monitoring target data frame is determined based on monitoring target information. The monitoring target information is stored in a storage to associate the monitoring target data frame with a monitoring target transmission source bus connected to a transmission source electronic control unit. Whether the reception bus matches the monitoring target transmission source bus is determined based on the monitoring target information in response to determining that the received data frame is a monitoring target data frame. An abnormality detection on the received data frame is performed in response to determining that the reception bus matches the monitoring target transmission source bus.

Abstract: A security management device includes a management unit, a determination unit, and an output unit. The management unit is configured to manage an anomaly location of an anomaly in a system in which a plurality of electronic controllers are connected through a network, and an anomaly amount in the anomaly location. The determination unit is configured to determine whether or not to implement countermeasures against the anomaly based on the anomaly location and the anomaly amount. The output unit is configured to output an instruction based on a determination result by the determination unit.

Abstract: An unauthorized intrusion prevention device is provided that, in response to detection of abnormality in an electronic control device mounted in a movable body, gives an instruction for executing measures for the movable body. The unauthorized intrusion prevention device acquires first information related to a protection function of the electronic control device and second information related to a function of the electronic control device other than the protection function. The unauthorized intrusion prevention device, using the first information, performs a first determination of whether the protection function is normal. The unauthorized intrusion prevention device, using the second information, performs a second determination of whether the function other than the protection function is normal or abnormal. The unauthorized intrusion prevention device, using results of first and second determination, determines as the measures a blocking method of blocking unauthorized information in the movable object.

Abstract: A log management device includes a log collection unit configured to receive a log generated by a security sensor, a storage unit configured to store the log, a statistical analysis unit configured to obtain a statistical calculation result by performing statistical analysis on a plurality of the logs, a control unit configured to determine which of the log and the statistical calculation result is to be sent according to a predetermined condition, and a transmission unit configured to transmit at least one of the log or the statistical calculation result according to the predetermined condition.

Abstract: A control device comprising a processor, wherein the processor is configured to: acquire a warning level indicating a warning measure related to an abnormality that has occurred in a vehicle, from a device installed externally to the vehicle; detect an abnormality that has occurred in the vehicle, from equipment mounted to the vehicle; perform thinning control on a detection result of the abnormality detected according to the warning level; and transmit the detection result resulting from thinning to the device.

Abstract: An information processing device, comprising a processor, wherein the processor is configured to: acquire security event information for a vehicle from another information processing device installed in the vehicle; and in cases in which wireless communication with a security center cannot be performed, notify a destination inside the vehicle of at least one of a response instruction, which is predetermined according to the security event information, or the security event information.

Abstract: In an electronic control unit, it is determine whether a data frame received from a different electronic control unit via a communication network is abnormal. A prediction data, which is predicted to be a normal data supposed to be included in the data frame determined to be abnormal, is generated by using a past data that is a data included in stored data frames, based on a stored prediction generation method. A prediction data frame including the prediction data is transmitted via the communication network.

Abstract: An electronic control unit includes a receiver that receives a data frame transmitted at given transmission periods from a transmission source electronic control unit connected via a communication network, a buffer capable of storing the data frame, a writer that writes the data frame received by the receiver into the buffer, and an abnormality determiner that determines that the data frame is abnormal when the number of data frames written into the buffer exceeds a given threshold or when the data frame is written in excess of a capacity of the buffer.

Abstract: A center device is provided that receives a log from vehicle-mounted equipment transmitting the log based on an external transmission rule and analyzes the log to detect a cyber attack. Based on a result of the detecting, the center device determines update of the external transmission rule. The center devices transmits an external transmission rule update instruction. As attack depth of the cyber attack is deeper, the center device sets an external transmission target to the log that is generated in a deeper layer among layers in which constituent elements of the vehicle-mounted equipment are defined.

Abstract: An unauthorized intrusion prevention device is provided that, in response to detection of abnormality in an electronic control device mounted in a movable body, gives an instruction for executing measures for the movable body. The unauthorized intrusion prevention device acquires first information related to a protection function of the electronic control device and second information related to a function of the electronic control device other than the protection function. The unauthorized intrusion prevention device, using the first information, performs a first determination of whether the protection function is normal. The unauthorized intrusion prevention device, using the second information, performs a second determination of whether the function other than the protection function is normal or abnormal. The unauthorized intrusion prevention device, using results of first and second determination, determines as the measures a blocking method of blocking unauthorized information in the movable object.

Abstract: In an anomaly detection by an electronic control unit connected to an other electronic control unit via a communication network, a data frame is received from the other electronic control unit, and a reception interval is calculated between a first data frame and a second data frame received immediately before the first data frame. A determination value for determining whether the data frame is anomalous is updated by adding a predetermined value to the determination value when the reception interval is equal to or less than a threshold value, and the data frame is determined to be anomalous when the determination value exceeds a limit value.

Abstract: A security management device includes a management unit, a determination unit, and an output unit. The management unit is configured to manage an anomaly location of an anomaly in a system in which a plurality of electronic controllers are connected through a network, and an anomaly amount in the anomaly location. The determination unit is configured to determine whether or not to implement countermeasures against the anomaly based on the anomaly location and the anomaly amount. The output unit is configured to output an instruction based on a determination result by the determination unit.

Abstract: An abnormality detection device includes: a receiver, a reception predictor, frame information storage, and an abnormality determiner. The receiver receives a communication frame via a communication network. The frame information storage stores information regarding the communication frame. The reception predictor calculates and sets a predicted time range including a scheduled reception time of the communication frame of a target frame type from among a plurality of frame types received by the receiver by referencing the frame information storage and the reception time of the communication frame when the communication frame is received. The abnormality determiner determines the target communication frame is an abnormal frame when the target communication frame is received at a time outside the predicted reception range.

Abstract: In an electronic control unit, it is determine whether a data frame received from a different electronic control unit via a communication network is abnormal. A prediction data, which is predicted to be a normal data supposed to be included in the data frame determined to be abnormal, is generated by using a past data that is a data included in stored data frames, based on a stored prediction generation method. A prediction data frame including the prediction data is transmitted via the communication network.

Abstract: An electronic control unit includes a receiver that receives a data frame transmitted at given transmission periods from a transmission source electronic control unit connected via a communication network, a buffer capable of storing the data frame, a writer that writes the data frame received by the receiver into the buffer, and an abnormality determiner that determines that the data frame is abnormal when the number of data frames written into the buffer exceeds a given threshold or when the data frame is written in excess of a capacity of the buffer.

Abstract: A gateway apparatus is connected to a plurality of buses. A data frame is received by using one of the plurality of buses as a reception bus. Whether the received data frame is a monitoring target data frame is determined based on monitoring target information. The monitoring target information is stored in a storage to associate the monitoring target data frame with a monitoring target transmission source bus connected to a transmission source electronic control unit. Whether the reception bus matches the monitoring target transmission source bus is determined based on the monitoring target information in response to determining that the received data frame is a monitoring target data frame. An abnormality detection on the received data frame is performed in response to determining that the reception bus matches the monitoring target transmission source bus.

Abstract: In an anomaly detection by an electronic control unit connected to an other electronic control unit via a communication network, a data frame is received from the other electronic control unit, and a reception interval is calculated between a first data frame and a second data frame received immediately before the first data frame. A determination value for determining whether the data frame is anomalous is updated by adding a predetermined value to the determination value when the reception interval is equal to or less than a threshold value, and the data frame is determined to be anomalous when the determination value exceeds a limit value.

Abstract: A vehicle communication system includes an onboard apparatus, a mobile device, and a key issuing apparatus provided outside the vehicle for issuing a key for cryptographic communication between the mobile device and the onboard apparatus. The mobile device and the onboard apparatus store the key, and perform the cryptographic communication using the key. The key issuing apparatus issues, to the onboard apparatus, the key and validity information indicating validity of the key. The onboard apparatus includes a determination section determining whether a validity ends, and an update request section transmitting a key update request to request the issuance of a new key. When the key update request has been received, the key issuing apparatus issues a new key to the mobile device, and issues a new key and validity information on the new key to the onboard apparatus.

Abstract: A communication system includes multiple nodes connected with each other. Each of the multiple nodes generates a message authentication code using a count value of a counter. The multiple nodes include a transmission node and a reception node. The count value of the counter is includes a high-order count value and a low-order count value. In the transmission node, a normal message generation portion generates a normal message to include a transmission data, the low-order count value, and the message authentication code, and a synchronization message generation portion generates a synchronization message. In the reception node, a message verification portion verifies the received normal message, a resynchronization request portion transmits a resynchronization request of the counter to the transmission node, and a count value update portion updates the high-order count value stored in the reception count value storage portion when the synchronization message is received.

Abstract: In a communication system, a management node includes: a high-order count value holding unit holding a high-order count value; and a high-order count value distribution unit updating the high-order count value under a high-order update condition and distributing the updated high-order count value to normal nodes. In the communication system, a normal node includes: a count value holding unit holding a count value; a low-order update unit updating a low-order count value held in the count value holding unit under a low-order update condition; and a high-order update unit updating a high-order count value held in the count value holding unit to the high-order count value distributed from the management node together with a reset of the low-order count value.