Information processing device and information processing method
A server includes: an obtainer that obtains items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles; and a generator that generates an integrated rule that is suitable for the items of information obtained by the obtainer and is for anomaly detection processing in the in-vehicle network of one of the vehicles; and a provider that outputs the integrated rule generated by the generator. For example, the obtainer obtains condition information indicating a condition pertaining to each of the plurality of vehicles at a time when the communication frame is transmitted on the in-vehicle network, and the generator generates the integrated rule using the items of frame information associated with the condition information.
1. An information processing device, comprising:
an obtainer that obtains items of information, the items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles;
a generator that generates, using the items of information, an integrated rule that is suitable for the plurality of vehicles and that is for anomaly detection processing in the in-vehicle network of each of the plurality of vehicles; and
an outputter that outputs the integrated rule generated by the generator to the plurality of vehicles via a network, wherein
the obtainer obtains, as the item of frame information regarding the communication frame transmitted on the in-vehicle network of each of the plurality of vehicles, individual rules generated based on communication frames transmitted on the in-vehicle network of each of the plurality of vehicles,
the generator generates, as the integrated rule, a rule obtained by integrating the individual rules obtained by the obtainer,
when obtaining the items of information including the individual rules, the obtainer obtains reliability information together with the individual rules, the reliability information indicating reliability of the individual rules, and
when generating the integrated rule, the generator generates the integrated rule with the reliability information obtained together with the individual rules to adjust a degree of contribution of each of the individual rules to the integrated rule.
2. The information processing device according to claim 1 , wherein
the obtainer obtains condition information indicating a condition pertaining to each of the plurality of vehicles at a time when the communication frame is transmitted on the in-vehicle network of each of a plurality of vehicles, and associates the condition information with the item of frame information,
the generator generates the integrated rule using the item of frame information associated with the condition information of each of the plurality of vehicles, among the items of information obtained by the obtainer, and
the outputter outputs the condition information together with the integrated rule.
3. The information processing device according to claim 1 , wherein
the obtainer obtains, as the item of frame information transmitted on the in-vehicle network of each of the plurality of vehicles, (i) communication data indicating the communication frame transmitted on the in-vehicle network or (ii) log data of an in-vehicle device connected to the in-vehicle network, and
the generator generates, as the integrated rule, a rule stipulating a condition to be satisfied by the communication data or the log data obtained by the obtainer.
4. The information processing device according to claim 1 , wherein
the reliability information includes (i) a total number of items of data used in generating the individual rules or (ii) a total mileage of a vehicle, a total travel time of the vehicle, or a total amount of data transmitted by the vehicle.
5. The information processing device according to claim 1 , wherein
the reliability information is generated based on (i) a total number of items of data used in generating the individual rules or (ii) a total mileage of a vehicle, a total travel time of the vehicle, or a total amount of data transmitted by the vehicle.
6. An information processing method, comprising:
obtaining items of information, the items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles;
generating, using the items of information, an integrated rule that is suitable for the plurality of vehicles and that is for anomaly detection processing in the in-vehicle network of each of the plurality of vehicles; and
outputting the integrated rule to the plurality of vehicles via a network, wherein
the obtaining obtains, as the item of frame information regarding the communication frame transmitted on the in-vehicle network of each of the plurality of vehicles, individual rules generated based on communication frames transmitted on the in-vehicle network of each of the plurality of vehicles,
the generating generates the integrated rule as a rule obtained by integrating the individual rules,
the obtaining further obtains reliability information together with the individual rules, the reliability information indicating reliability of the individual rules, and
when generating the integrated rule, the information processing method further generates the integrated rule with the reliability information obtained together with the individual rules to adjust a degree of contribution of each of the individual rules to the integrated rule.
7. An information processing device, comprising:
a processor; and
a memory including a program that, when executed by the processor, causes the processor to perform operations, the operations including:
obtaining items of information, the items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles;
generating, using the items of information, an integrated rule that is suitable for the plurality of vehicles and that is for anomaly detection processing in the in-vehicle network of each of the plurality of vehicles; and
outputting the integrated rule to the plurality of vehicles via a network, wherein
the processor obtains, as the item of frame information regarding the communication frame transmitted on the in-vehicle network of each of the plurality of vehicles, individual rules generated based on communication frames transmitted on the in-vehicle network of each of the plurality of vehicles,
the processor generates, as the integrated rule, a rule obtained by integrating the individual rules obtained by the obtainer,
when obtaining the items of information including the individual rules, the processor obtains reliability information together with the individual rules, the reliability information indicating reliability of the individual rules, and
when generating the integrated rule, the processor generates the integrated rule with the reliability information obtained together with the individual rules to adjust a degree of contribution of each of the individual rules to the integrated rule.
8. The information processing device according to claim 7 , wherein
the processor obtains condition information indicating a condition pertaining to each of the plurality of vehicles at a time when the communication frame is transmitted on the in-vehicle network of each of a plurality of vehicles, and associates the condition information with the item of frame information,
the processor generates the integrated rule using the item of frame information associated with the condition information of each of the plurality of vehicles, among the items of information obtained, and
the processor outputs the condition information together with the integrated rule.
9. The information processing device according to claim 7 , wherein
the processor obtains, as the item of frame information transmitted on the in-vehicle network of each of the plurality of vehicles, (i) communication data indicating the communication frame transmitted on the in-vehicle network or (ii) log data of an in-vehicle device connected to the in-vehicle network, and
the processor generates, as the integrated rule, a rule stipulating a condition to be satisfied by the communication data or the log data obtained.
10. The information processing device according to claim 7 , wherein
the reliability information includes (i) a total number of items of data used in generating the individual rules or (ii) a total mileage of a vehicle, a total travel time of the vehicle, or a total amount of data transmitted by the vehicle.
11. The information processing device according to claim 7 , wherein
the reliability information is generated based on (i) a total number of items of data used in generating the individual rules or (ii) a total mileage of a vehicle, a total travel time of the vehicle, or a total amount of data transmitted by the vehicle.