Abstract: A module for a vehicle includes: a first communication module that transmits and receives first data to and from a first in-vehicle module; a second communication module that transmits and receives second data to and from a second in-vehicle module; and a control module that controls relay of third data among the first communication module and the second communication module. In a case where reception data received by the control module from the first or second communication module is unauthorized, the control module stops relaying the third data in accordance with a traveling state of the vehicle satisfying a predetermined condition, The traveling state includes: the vehicle being stopped; a vehicle speed being at or below a predetermined speed; brakes being applied; a hazard indicator being on; a driver being in a state capable of driving; and/or self-driving functions being in an off state.

Abstract: A vehicle monitoring apparatus includes: a first communicator that receives specifying information for specifying a target vehicle from a server; and an acquirer that acquires driving information from the target vehicle, the driving information being information regarding driving of the target vehicle specified by the specifying information received by the first communicator. The first communicator transmits the driving information acquired by the acquirer to the server. For example, the acquirer may acquire the driving information obtained from the target vehicle through communication.

Abstract: An in-vehicle relay device for a vehicle is provided. The in-vehicle relay device includes a first communication circuit that transmits and receives first data to and from a first in-vehicle equipment in the vehicle. A second communication circuit transmits and receives second data to and from a second in-vehicle equipment in the vehicle. A control circuit controls relay of third data among the first communication circuit and the second communication circuit. In a case where reception data received by the control circuit from the first communication circuit or the second communication circuit is unauthorized, the control circuit stops relaying the third data in accordance with a traveling state of the vehicle.

Abstract: A statistical information generation device that generates statistical information from Ethernet frames on a mobility network includes: a transceiver that transmits and receives the Ethernet frames; and a statistical information generator that collects a plurality of Ethernet frames transmitted or received by the transceiver within a predetermined time period, and classifies, out of the plurality of Ethernet frames collected, Ethernet frames containing the same destination IP address, source IP address, destination port number, source port number, and protocol, and containing, in payloads, same identification information related to mobility control, into the same group, generates the statistical information for each group from the Ethernet frames classified into groups, and transmits the generated statistical information from the transceiver.

Abstract: A priority determination system incudes a processor, a terminal, and a memory. The processor obtains anomaly data items, each indicating an anomaly in a corresponding one of moving bodies, and obtains state data items, each indicating a state of a corresponding one of the moving bodies. The processor calculates, for each anomaly data item, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies, determines a priority of a task for dealing with the anomaly indicated by each anomaly data item based on the risk value, and provides an output to the terminal to execute the task. The terminal displays an alert related to at least one of the priority of the task, the risk value, or an estimated dealing time required for completing the task.

Abstract: An on-vehicle device according to the present disclosure is capable of communicating with a server and mounted on a vehicle. The on-vehicle device includes a memory, and a hardware processor coupled to the memory. The hardware processor is configured to: receive, from the server, a log acquisition requirement including an anomaly detected point portion that designates one or more anomaly detected points and a log acquisition target portion that indicates one or more logs to be acquired when an anomaly is detected at the one or more anomaly detected points designated by the anomaly detected point portion; store the log acquisition requirement; detect an anomaly of the vehicle; acquire, when detecting an anomaly, a log based on a part where an anomaly is detected and the log acquisition requirement; and transmit the acquired log to the server.

Abstract: An information processing device includes: an obtainer that obtains, from an anomaly detection sensor that detects an anomaly in a network, a detection log related to the anomaly in the network and the detection time of the anomaly indicated in the detection log; an occurrence time determiner that determines the occurrence time of an attack on the network based on the obtained detection time, and records the determined occurrence time; and an end time determiner that determines the expected end time of the attack on the network based on the obtained detection log, and records the determined expected end time.

Abstract: A server as an information processing device includes: a communicator that communicates with mobile a body; a monitoring data storage that stores past monitoring data of the mobile body received by the communicator; and an alive monitor that determines whether a current state of the mobile body is anomalous, based on the past monitoring data stored in the monitoring data storage.

Abstract: A priority determination system includes: an anomaly obtainer that obtains anomaly data items each indicating anomaly in a corresponding one of moving bodies; a state obtainer that obtains state data items each indicating a state of a corresponding one of the moving bodies; a risk value calculator that calculates, for each of the anomaly data items, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies; a priority determiner that determines a priority of a task for dealing with the anomaly indicated by each of the anomaly data items, based on the risk value of the anomaly data item; and an outputter that provides output based on a result of the determination.

Abstract: A management device includes: an obtainer that obtains, from a processing device, a log of operation performed by the processing device and verification data for certifying that the log is valid information; a verifier that performs verification of whether the log is valid information, based on the verification data obtained by the obtainer; and a controller that performs storage control for storing the log as an analysis log for analyzing an anomaly into a storage device, in accordance with a result of the verification performed by the verifier.

Abstract: An information processing device includes: an obtainer that obtains, from an anomaly detection sensor that detects an anomaly in a network, a detection log related to the anomaly in the network and the detection time of the anomaly indicated in the detection log; an occurrence time determiner that determines the occurrence time of an attack on the network based on the obtained detection time, and records the determined occurrence time; and an end time determiner that determines the expected end time of the attack on the network based on the obtained detection log, and records the determined expected end time.

Abstract: A log management module includes: an anomaly detection information receiver that receives anomaly detection information; a detection history information storage that stores detection history information; an attack route information storage that stores attack route information indicating a candidate for an attack route in the CAN bus; an attack route estimator that estimates an attack route including the specific device, based on the attack route information; and a collection target determiner that, upon receipt of the anomaly detection information by the anomaly detection information receiver, determines, as collection targets whose log information for analysis which is for analyzing presence or absence of an undetected anomaly in the CAN bus is to be collected, one or more candidate devices which have been narrowed down from the devices, are present on the attack route estimated by the attack route estimator, and have no history of anomaly detection.

Abstract: An information processing device that detects an anomaly in an in-vehicle network provided in a vehicle includes: a local rule storage in which at least an individual rule which is a rule generated for the vehicle is stored; a global rule storage in which an integrated rule which is a rule generated for a plurality of vehicles including the vehicle is stored; and a processing unit that performs, using a rule stored in at least one of the local rule storage or the global rule storage, an anomaly detection process on a frame transmitted on the in-vehicle network.

Abstract: A communication device is a communication device connected to a mobility network which is a network mounted in a mobility and which is used by a plurality of electronic control devices for communication. The communication device includes: a holding unit which holds range information indicating a transferable path range determined for a message on the mobility network; a receiving unit which receives the message on the mobility network; and a determining unit which determines validity of the received message by using the range information.

Abstract: An anomaly detection device for detecting anomaly in frames flowing through an in-vehicle network system includes: an obtainer that obtains one or more frames; a first holder holding a first rule defining a rule indicating that when a frame satisfies a first condition based on a source or a destination, the frame is to be transferred; a first frame controller that transfers the one or more frames in accordance with the first rule; a second holder holding a second rule defining a rule indicating that a frame satisfying a second condition is to be determined as being anomalous; and a second frame controller that performs, in accordance with the second rule, an anomaly detection process on each of the one or more frames transferred by the first frame controller. When an anomalous frame is detected, the second frame controller provides or stores a detection result.

Abstract: A priority determination system includes: an anomaly obtainer that obtains anomaly data items each indicating anomaly in a corresponding one of moving bodies; a state obtainer that obtains state data items each indicating a state of a corresponding one of the moving bodies; a risk value calculator that calculates, for each of the anomaly data items, a risk value indicating a risk of the anomaly based on a state data item of the corresponding one of the moving bodies; a priority determiner that determines a priority of a task for dealing with the anomaly indicated by each of the anomaly data items, based on the risk value of the anomaly data item; and an outputter that provides output based on a result of the determination.

Abstract: An abnormality detection apparatus for a mobility entity and for detecting an abnormality in a network system is provided. The network system includes a first network and a second network that use different communication protocols. A first communication circuit receives state information indicating a state of the mobility entity. The state information is acquired from the second network. A second communication circuit transmits and receives a first frame according to a communication protocol used in the first network. A memory stores an abnormality detection rule. A processor detects, based on the state information and the abnormality detection rule, whether a control command included in the first frame received by the second communication circuit is abnormal. In a case where the control command is abnormal, the processor prohibits the control command from being transmitted.

Abstract: An anomaly detection system is on an in-vehicle network including: a first network connected to first devices that communicate using a first protocol; and a second network connected to second devices that includes a driving assistance controller communicates using a second protocol. The system includes: a communicator receiving, through the first network, first unit data including (i) source information indicating a source first device and (ii) second unit data including a data identifier; a database storing rule; and an anomaly determiner that determines whether the first unit data has anomaly by comparing the source information and the data identifier with the rule. Based on the rule, the first unit data is determined to have anomaly when the source first device is a sensing device and, according to the identifier, the second unit data is to be received by the controller.

Abstract: A vehicle anomaly detection server includes: a communicator that communicates with a vehicle to receive a log of an in-vehicle network in the vehicle; a processor; and a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including: selecting, when information indicating that an anomaly is occurring to a first vehicle among vehicles is obtained by the processor, an anomaly-related vehicle from among the vehicles based on the anomaly, the first vehicle being the vehicle that communicates with the communicator; transmitting, to the anomaly-related vehicle via the communicator, a first request to transmit a log of an in-vehicle network in the anomaly-related vehicle; and determining whether an anomaly is occurring to the anomaly-related vehicle, based on information indicated by the log transmitted from the anomaly-related vehicle and received by the communicator.

Abstract: An information processing device that detects an anomaly in an in-vehicle network provided in a vehicle includes: a local rule storage in which at least an individual rule which is a rule generated for the vehicle is stored; a global rule storage in which an integrated rule which is a rule generated for a plurality of vehicles including the vehicle is stored; and a processing unit that performs, using a rule stored in at least one of the local rule storage or the global rule storage, an anomaly detection process on a frame transmitted on the in-vehicle network.