Information processing device and information processing method

1. An information processing device that detects an anomaly in an in-vehicle network provided in a vehicle, the vehicle including at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector connected to the in-vehicle network, the information processing device comprising:

an individual rule storage connected to the in-vehicle network and in which at least an individual rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering or vehicle frame period is stored, the individual rule being a rule generated for the vehicle;

an integrated rule storage connected to the in-vehicle network and in which an integrated rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering or vehicle frame period is stored, the integrated rule being a rule generated for a plurality of vehicles including the vehicle; and

a processor connected to the in-vehicle network that performs, using one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule, or one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule stored in a respective at least one of the individual rule storage or the integrated rule storage, an anomaly detection process on a frame transmitted on the in-vehicle network, wherein

when one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule is stored in the individual rule storage and one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule is stored in the integrated rule storage, the processor performs the anomaly detection process by at least one of: prioritizing one of the individual or integrated vehicle acceleration rules over the other, prioritizing one of the individual or integrated vehicle body state rules over the other, prioritizing one of the individual vehicle steering rules over the other, or prioritizing one of the individual vehicle frame period rules over the other, depending on whether vehicle acceleration, a vehicle body, vehicle steering, or vehicle frame is a detection target.

2. The information processing device according to claim 1 , wherein

an initial rule is further stored in the individual rule storage, the initial rule being a predetermined rule regarding the vehicle, and

even when a rule is stored in the individual rule storage and a rule is stored in the integrated rule storage, if the initial rule is stored in the individual rule storage, the processor performs the anomaly detection process, using the integrated rule stored in the integrated rule storage.

3. The information processing device according to claim 1 , wherein

when a rule is stored in only one of the individual rule storage and the integrated rule storage, the processor performs the anomaly detection process using the rule which is stored.

4. The information processing device according to claim 1 , wherein

the processor further performs an invalidation process of invalidating the frame in which an anomaly is detected in the anomaly detection process.

5. The information processing device according to claim 1 , wherein

the processor further performs an alert process of outputting an alert for the frame in which an anomaly is detected in the anomaly detection process.

6. The information processing device according to claim 1 , wherein

the processor performs at least one process out of (i) an invalidation process of invalidating the frame in which an anomaly is detected in the anomaly detection process or (ii) an alert process of outputting an alert for the frame in which an anomaly is detected in the anomaly detection process, the at least one process being predetermined according to a detection target.

7. The information processing device according to claim 1 , wherein

a plurality of rules each to be applied to the vehicle in a different one of situations are stored in the individual rule storage,

the at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector performs sensing inside or outside the vehicle, and

the processor selects one rule from among the one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule stored in the individual rule storage, according to a result of sensing by the at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector, and performs the anomaly detection process using, as the individual rule, the one rule selected.

8. The information processing device according to claim 1 , wherein

a plurality of rules each to be applied to the vehicle in a different one of situations are stored in the integrated rule storage,

the at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector performs sensing inside or outside the vehicle, and

the processor selects one rule from among the one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule stored in the integrated rule storage, according to a result of sensing by the at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector, and performs the anomaly detection process using, as the integrated rule, the one rule selected.

9. The information processing device according to claim 1 , further comprising:

an individual rule history storage in which the individual rule prior to updating is stored, when the individual rule stored in the individual rule storage is updated, wherein

when a predetermined condition is satisfied, the processor:

copies the individual rule stored in the individual rule history storage into the individual rule storage; and

performs the anomaly detection process after copying the individual rule.

10. The information processing device according to claim 1 , further comprising:

an integrated rule history storage in which the integrated rule prior to updating is stored, when the integrated rule stored in the integrated rule storage is updated, wherein

when a predetermined condition is satisfied, the processor:

copies the integrated rule stored in the integrated rule history storage into the integrated rule storage; and

performs the anomaly detection process after copying the integrated rule.

11. An information processing method executed by an information processing device that detects an anomaly in an in-vehicle network provided in a vehicle, the vehicle including at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector connected to the in-vehicle network,

the information processing device including:

an individual rule storage connected to the in-vehicle network and in which at least an individual rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering or vehicle frame period is stored, the individual rule being a rule generated for the vehicle; and

an integrated rule storage connected to the in-vehicle network and in which an integrated rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering and vehicle frame period is stored, the integrated rule being a rule generated for a plurality of vehicles including the vehicle,

the information processing method comprising:

obtaining a frame transmitted on the in-vehicle network; and

performing, by a processor connected to the in-vehicle network and using a one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule, or one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule stored in a respective at least one of the individual rule storage or the integrated rule storage, an anomaly detection process on the frame obtained, wherein

in the performing of the anomaly detection process, when one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule is stored in the individual rule storage and one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule is stored in the integrated rule storage, the anomaly detection process is performed by the processor by at least one of: prioritizing one of the individual or integrated vehicle acceleration rules over the other, prioritizing one of the individual or integrated vehicle body state rules over the other, prioritizing one of the individual vehicle steering rules over the other, or prioritizing one of the individual vehicle frame period rules over the other, depending on whether vehicle acceleration, a vehicle body, vehicle steering, or vehicle frame is a detection target.