Vehicle abnormality detection device and vehicle abnormality detection method

1. A vehicle abnormality detection device, comprising a memory and a processor configured to:

transmit and receive, among a plurality of control devices on an in-vehicle network configured by a plurality of layers via a firewall, abnormality information of a first control device in which an abnormality is detected by the vehicle abnormality detection device,

wherein the vehicle abnormality detection device stores configuration information identifying electronic devices disposed in each layer of the plurality of layers;

acquire a candidate for a second control device that has a possibility to cause the abnormality in the first control device received by the processor, the first control device and the second control device being disposed within a second layer of the layers;

manage the first control device and the second control device as abnormality cause control devices when an abnormality occurs in the second control device before a time when the abnormality of the first control device is detected by the vehicle abnormality detection device; and

acquire, in response to determining that the abnormality occurring in the second control device is not related to external communication, a candidate for a third control device, disposed within a first layer of the layers adjacent to the second layer, that has a possibility to cause the abnormality in the abnormality cause control devices,

when the third control device undergoes an abnormality before a time when the abnormality of the abnormality cause control devices is detected by the vehicle abnormality detection device, the processor also manages the third control device as a new abnormality cause control device,

wherein the third control device connects the first layer and the second layer,

wherein the vehicle abnormality detection device includes a first vehicle abnormality detection device, and a second vehicle abnormality detection device with a same configuration as the first vehicle abnormality detection device, and

one of the first vehicle abnormality detection device and the second vehicle abnormality detection device is determined as being abnormal in response to different detection results being produced by the first vehicle abnormality detection device and the second vehicle abnormality detection device.

2. The vehicle abnormality detection device according to claim 1 , the processor being further configured to identify that an external attack occurs when the abnormality of the abnormality cause control devices managed by the processor is an abnormality relating to the external communication.

3. The vehicle abnormality detection device according to claim 1 , wherein the vehicle abnormality detection device is provided inside a vehicle.

4. The vehicle abnormality detection device according to claim 1 , the processor being further configured to:

manage the first control device and the second control device as abnormality cause control devices, by storing information indicating that the first control device and the second control device are abnormal.

5. A vehicle abnormality detection method performed by a vehicle abnormality detection device implemented with a memory and a processor, comprising:

receiving abnormality information of a first control device in which an abnormality is detected by the vehicle abnormality detection device on an in-vehicle network including a plurality of control devices and configured by a plurality of layers, the vehicle abnormality detection device storing configuration information identifying electronic devices disposed in each layer of the plurality of layers;

acquiring a candidate for a second control device that has a possibility to cause the abnormality of the first control device the first control device and the second control device being disposed within a second layer of the layers;

managing the first control device and the second control device as abnormality cause control devices when an abnormality occurs in the second control device before a time when the abnormality of the first control device is detected by the vehicle abnormality detection device, and

acquiring, in response to determining that the abnormality occurring in the second control device is not related to external communication, a candidate for a third control device, disposed within a first layer of the layers adjacent to the second layer, that has a possibility to cause the abnormality in the abnormality cause control devices,

in response to the third control device undergoing an abnormality before a time when the abnormality of the abnormality cause control devices is detected by the vehicle abnormality detection device, the third control device is managed as a new abnormality cause control device,

wherein the third control device connects the first layer and the second layer, and

wherein the vehicle abnormality detection device includes a first vehicle abnormality detection device, and a second vehicle abnormality detection device with a same configuration as the first vehicle abnormality detection device, and

one of the first vehicle abnormality detection device and the second vehicle abnormality detection device is determined as being abnormal in response to different detection results being produced by the first vehicle abnormality detection device and the second vehicle abnormality detection device.