In-vehicle apparatus and log collection system

1. An in-vehicle apparatus connected to a server via a network and mounted on a vehicle, comprising: the in-vehicle apparatus including: a processor and a memory storing instructions that when executed configure the processor to:

collect a log of the in-vehicle apparatus at predetermined time intervals;

accumulate in a log storage at least a part of the log;

store in the log storage log priority information indicating a priority of the log to be accumulated in the log storage;

determine whether the collected log is to be accumulated or not to be accumulated in the log storage based on the log priority information;

transmit a log accumulated in the log storage to the server; and

update a log priority table with the log priority information, which is stored in the log storage and used for determining whether the collected log is to be accumulated or not to be accumulated in the log storage, based on an update command received from the server; and

the server including:

a server processor configured to analyze a log received from the in-vehicle apparatus at least by determining a difference between a received packet amount per time unit of the in-vehicle apparatus present at a particular location with a received packet amount in another location and comparing the difference to a threshold value;

detect a possibility of attack on the in-vehicle apparatus, at least in response to the comparison exceeding the threshold value; and

transmit the update command to the in-vehicle apparatus to update the log priority information stored in the log priority information storage, when the possibility of attack is detected and initiate an emergency stop service request.

2. The in-vehicle apparatus connected to the server via the network according to claim 1 , further comprising: a log information storage storing log information indicating a content of the log to be collected; and the processor being further configured to update the log information stored in the log information storage.

3. The in-vehicle apparatus connected to a server via a network according to claim 2 , wherein the processor is further configured to execute a log acquisition program incorporating the log information, and update the log information by rewriting the log acquisition program.

4. The in-vehicle apparatus connected to the server via the network according to claim 1 , further comprising: the processor being further configured to control a service to be provided to a passenger of the vehicle, wherein the service is stopped based on an instruction from the server.

5. The in-vehicle apparatus connected to the server via the network according to claim 1 , wherein the log priority information includes a condition regarding at least one of a valid time or a valid area, and the processor is further configured to regard the log priority information to be valid and determine a log to be accumulated in the log storage when at least one of a time or a position of the in-vehicle apparatus matches the condition in the log priority information when the log has been collected.

6. A log collection system comprising the in-vehicle apparatus connected to the server via the network according to claim 1 , wherein the in-vehicle apparatus further comprises a log information storage storing log information indicating a content of the log to be collected, and wherein the server processor is further configured to update the log information stored in the log information storage.

7. A log collection system comprising the in-vehicle apparatus connected to the server via the network according to claim 1 , wherein the server processor is further configured to output the update command to, in addition to the in-vehicle apparatus that has transmitted a log in which a possibility of attack has been detected, another in-vehicle apparatus that satisfies at least one of conditions of having a same model as that of the in-vehicle apparatus, or being within a predetermined distance from a position where a log in which a possibility of attack has been detected is acquired.

8. A log collection system comprising the in-vehicle apparatus connected to the server via the network according to claim 1 , wherein the processor is further configured to control a service to be provided to a passenger of the vehicle; and the server processor is further configured to output a stop command of the service to the in-vehicle apparatus when the attack is detected.

9. A log collection system comprising the in-vehicle apparatus connected to the server via the network according to claim 1 , wherein the log priority information includes a condition regarding at least one of a valid time or a valid area; and the server processor is further configured to determine at least one of the valid time or the valid area in the updated log priority information based on at least one of a time or a position where the in-vehicle apparatus has collected a log in which a possibility of the attack is detected.