Abstract: In a vehicle abnormality detection device, when a transmission and reception unit receives abnormality information of a first control device on an in-vehicle network configured by a plurality of layers via a firewall, an abnormality cause candidate acquisition unit acquires a candidate for a second control device that may cause the abnormality of the first control device. An abnormality information management unit manages the first control device and the second control device as abnormality cause control devices when the second control device in which an abnormality occurs before a time when the abnormality of the first control device is detected is detected from the candidate acquired by the abnormality cause candidate acquisition unit.

Abstract: A monitoring apparatus includes: an acquisition unit sequentially receiving messages on a network; a first calculation unit calculating a difference between data values of two continuous messages; a second calculation unit calculating a difference between reception time points of two continuous messages; a first determination unit determining whether a received message is an abnormal message based on the difference calculated by the first calculation unit or the second calculation unit; a second determination unit determining whether a received message is a suspicious message based on the difference calculated by the first calculation unit or the second calculation unit; and a recording unit recording, when the second determination unit determines that the received message is the suspicious message, as a history, data values and reception time points of the suspicious message and a predetermined number of messages received before and after reception of the suspicious message.

Abstract: A processor is configured to determine whether or not target data, this being data that a first application is attempting to access, is permitted data based on a correspondence relationship list, and to permit the first application to access the target data in cases in which the processor has determined the target data to be the permitted data, and not to permit the first application to access the target data in cases in which the processor has determined the target data not to be the permitted data.

Abstract: In a vehicle abnormality detection device, when a transmission and reception unit receives abnormality information of a first control device on an in-vehicle network configured by a plurality of layers via a firewall, an abnormality cause candidate acquisition unit acquires a candidate for a second control device that may cause the abnormality of the first control device. An abnormality information management unit manages the first control device and the second control device as abnormality cause control devices when the second control device in which an abnormality occurs before a time when the abnormality of the first control device is detected is detected from the candidate acquired by the abnormality cause candidate acquisition unit.

Abstract: A monitoring apparatus includes: an acquisition unit sequentially receiving messages on a network; a first calculation unit calculating a difference between data values of two continuous messages; a second calculation unit calculating a difference between reception time points of two continuous messages; a first determination unit determining whether a received message is an abnormal message based on the difference calculated by the first calculation unit or the second calculation unit; a second determination unit determining whether a received message is a suspicious message based on the difference calculated by the first calculation unit or the second calculation unit; and a recording unit recording, when the second determination unit determines that the received message is the suspicious message, as a history, data values and reception time points of the suspicious message and a predetermined number of messages received before and after reception of the suspicious message.

Abstract: A monitoring apparatus includes: an acquisition unit sequentially receiving messages on a network; a first calculation unit calculating a difference between data values of two continuous messages; a second calculation unit calculating a difference between reception time points of two continuous messages; a first determination unit determining whether a received message is an abnormal message based on the difference calculated by the first calculation unit or the second calculation unit; a second determination unit determining whether a received message is a suspicious message based on the difference calculated by the first calculation unit or the second calculation unit; and a recording unit recording, when the second determination unit determines that the received message is the suspicious message, as a history, data values and reception time points of the suspicious message and a predetermined number of messages received before and after reception of the suspicious message.

Abstract: An in-vehicle network system includes a relay apparatus and a first processor connected with the relay apparatus to be able to perform communication with the relay apparatus. The relay apparatus includes a first port for retrofitting a second processor and a second port for connecting a third processor that performs a communication setting process for the second processor connected at the first port.

Abstract: A monitoring apparatus includes: an acquisition unit sequentially receiving messages on a network; a first calculation unit calculating a difference between data values of two continuous messages; a second calculation unit calculating a difference between reception time points of two continuous messages; a first determination unit determining whether a received message is an abnormal message based on the difference calculated by the first calculation unit or the second calculation unit; a second determination unit determining whether a received message is a suspicious message based on the difference calculated by the first calculation unit or the second calculation unit; and a recording unit recording, when the second determination unit determines that the received message is the suspicious message, as a history, data values and reception time points of the suspicious message and a predetermined number of messages received before and after reception of the suspicious message.

Abstract: Disclosed is a system for detecting an attack, which includes a server and a plurality of vehicles capable of wirelessly communicating with each other. Each of the vehicles has a sensor, a sensor information acquisition unit, a traffic information reception unit, and a transmission unit that transmits the sensor information and the traffic information to the server. The server has a reception unit that receives the sensor information and the traffic information from the vehicles, a verification unit that verifies whether the sensor information and the traffic information are inconsistent with each other, and a notification unit that notifies, when the sensor information and the traffic information are inconsistent with each other, the vehicles of the inconsistency.

Abstract: Disclosed is a system for detecting an attack, which includes a server and a plurality of vehicles capable of wirelessly communicating with each other. Each of the vehicles has a sensor, a sensor information acquisition unit, a traffic information reception unit, and a transmission unit that transmits the sensor information and the traffic information to the server. The server has a reception unit that receives the sensor information and the traffic information from the vehicles, a verification unit that verifies whether the sensor information and the traffic information are inconsistent with each other, and a notification unit that notifies, when the sensor information and the traffic information are inconsistent with each other, the vehicles of the inconsistency.

Abstract: An in-vehicle network system includes a relay apparatus and a first processor connected with the relay apparatus to be able to perform communication with the relay apparatus. The relay apparatus includes a first port for retrofitting a second processor and a second port for connecting a third processor that performs a communication setting process for the second processor connected at the first port.

Abstract: A network monitoring device according to an embodiment monitors a message that is periodically transmitted in a network in which a message identified by an identifier is transmitted and received, and includes a reception time recording unit and an unauthorized-transmission determination unit. The reception time recording unit records a reception time in association with the identifier, every time a message to be monitored is received. The unauthorized-transmission determination unit determines presence of an unauthorized transmission on the received message to be to be monitored, based on a latest reception time Ti, an m previous reception time Ti-m, a message transmission period F, and a constant ? determined in advance, in a period from the reception time Ti-m to the reception time Ti, every time the message to be monitored is received.

Abstract: A network monitoring device according to an embodiment monitors a message that is periodically transmitted in a network in which a message identified by an identifier is transmitted and received, and includes a reception time recording unit and an unauthorized-transmission determination unit. The reception time recording unit records a reception time in association with the identifier, every time a message to be monitored is received. The unauthorized-transmission determination unit determines presence of an unauthorized transmission on the received message to be to be monitored, based on a latest reception time Ti, an m previous reception time Ti-m, a message transmission period F, and a constant ? determined in advance, in a period from the reception time Ti-m to the reception time Ti, every time the message to be monitored is received.

Abstract: An information processing device is connected to a plurality of networks and performs information processing. The networks include a control network connected to a control device in a mobile object, an information network connected to an information device in the mobile object, and an external network connected to an external device outside of the mobile object. The information processing device includes firewalls each connected to one of the networks, and a processor connected to each network via the corresponding firewall. The information processing device isolates at least the control network from the other networks.

Abstract: Disclosed is a system for detecting an attack, which includes a server and a plurality of vehicles capable of wirelessly communicating with each other. Each of the vehicles has a sensor, a sensor information acquisition unit, a traffic information reception unit, and a transmission unit that transmits the sensor information and the traffic information to the server. The server has a reception unit that receives the sensor information and the traffic information from the vehicles, a verification unit that verifies whether the sensor information and the traffic information are inconsistent with each other, and a notification unit that notifies, when the sensor information and the traffic information are inconsistent with each other, the vehicles of the inconsistency.

Abstract: An information processing device is connected to a plurality of networks and performs information processing. The networks include a control network connected to a control device in a mobile object, an information network connected to an information device in the mobile object, and an external network connected to an external device outside of the mobile object. The information processing device includes firewalls each connected to one of the networks, and a processor connected to each network via the corresponding firewall. The information processing device isolates at least the control network from the other networks.

Abstract: A CAN controller, which is connected to a communication bus constituting a network mounted on a vehicle, transmits and receives communication messages to and from the network. The CAN controller comprises a bus load measurement unit that calculates a bus load rate of the network on the basis of receiving communication messages flowing through the network for a measurement time period established for a bus load rate calculation. Further, the bus load measurement unit determines, on the basis of the calculated bus load rate, whether the load of the network is heavy or light. The CAN controller also comprises a CAN protocol engine that voluntarily restricts the transmission of communication messages on the basis of a result of the determination by the bus load measurement unit to the effect that the load is heavy.