Information processing device, control method, and recording medium for detecting an anomaly in behavior of an application operating on a device in a mobility

1. An information processing device that is connected to a mobility network, the mobility network being provided to a mobility, the information processing device comprising:

a memory that stores determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to the mobility is normal; and

a processor that obtains behavior information indicating the behavior of the application, and detects an anomaly in the behavior of the application based on (i) state information that indicates a state of the mobility and is obtained via the mobility network, (ii) the behavior information obtained, and (iii) the determination criterion information stored in the memory,

wherein the determination criterion information includes a determination model that is generated in advance by machine learning to be used in determining a likelihood that the behavior of the application is normal, and

the processor:

calculates, using the determination model, (i) a first feature amount from a history of the behavior information obtained and (ii) a second feature amount from a history of the state information obtained;

calculates an evaluation value indicating the likelihood from the first feature amount calculated and the second feature amount calculated; and

compares the likelihood indicated by the evaluation value with a threshold to detect the anomaly in the behavior of the application.

2. The information processing device according to claim 1 ,

wherein the processor estimates the state of the mobility based on the state information, and

the processor detects the anomaly in the behavior of the application with further consideration to a result of an estimation of the state of the mobility.

3. The information processing device according to claim 1 ,

wherein the processor notifies an outside of the information processing device that the anomaly in the behavior of the application is detected, when the processor detects the anomaly.

4. A control method performed by an information processing device that is connected to a mobility network, the mobility network being provided to a mobility, the control method comprising:

storing, by a memory, determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to the mobility is normal;

obtaining behavior information indicating the behavior of the application operating on the device provided to the mobility; and

detecting, by a processor, an anomaly in the behavior of the application based on (i) state information that indicates a state of the mobility and is obtained via the mobility network, (ii) the behavior information obtained, and (iii) determination criterion information stored in advance in the memory,

wherein the determination criterion information includes a determination model that is generated in advance by machine learning to be used in determining a likelihood that the behavior of the application is normal, and

in the detecting, the processor:

calculates, using the determination model, (i) a first feature amount from a history of the behavior information obtained and (ii) a second feature amount from a history of the state information obtained;

calculates an evaluation value indicating the likelihood from the first feature amount calculated and the second feature amount calculated; and

compares the likelihood indicated by the evaluation value with a threshold to detect the anomaly in the behavior of the application.