Information processing device and information processing method

1. An information processing device provided outside of a vehicle, the information processing device comprising:

a processor; and

a memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations including:

obtaining, from an onboard system of the vehicle, a first log, the first log including, per sampling interval, a first data amount of communication data, the communication data flowing through the onboard system of the vehicle, the communication data corresponding to an onboard network of the vehicle;

determining whether the first log indicates that an abnormality is included in the communication data;

outputting, in a case where the determining determines that the abnormality is included in the communication data, first detection results to the onboard system, the first detection results indicating the abnormality is included in the communication data, and the first detection results including an instruction that instructs the onboard system to transmit a second log to the information processing device, the instruction further instructing the onboard system to shorten the sampling interval; and

outputting, in a case where the determining determines that the abnormality is not included in the communication data and a determination is made that a current timing is a timing of transmitting the first log, a change instruction to the onboard system to lengthen the sampling interval,

wherein the second log includes, per the sampling interval, a second data amount of the communication data, the second data amount being more than the first data amount.

2. The information processing device according to claim 1 ,

wherein the operations further include:

obtaining the second log from the onboard system after outputting the first detection results; and

further determining whether the abnormality is included in the communication data, using the second log.

3. The information processing device according to claim 2 ,

wherein,

in a case where the further determining determines that the abnormality is included in the communication data, the information processing device does not output second detection results of the further determining to the onboard system.

4. The information processing device according to claim 1 ,

wherein the operations further include:

outputting the first detection results to a terminal device in the case where the determining determines that the abnormality is included in the communication data.

5. The information processing device according to claim 1 ,

wherein the operations further include:

outputting a second change instruction to the onboard system to change a duration of a period during which the first data amount of the communication data, which is included in the first log, is collected per the sampling interval.

6. The information processing device according to claim 5 ,

wherein the operations further include:

outputting the second change instruction to a plurality of onboard systems of a plurality of vehicles, the plurality of vehicles having a same vehicle type as the vehicle.

7. The information processing device according to claim 5 ,

wherein the operations further include:

outputting the second change instruction to a plurality of onboard systems of a plurality of vehicles, the plurality of vehicles being in a same region as the vehicle.

8. The information processing device according to claim 1 ,

wherein the outputting further outputs, in the case where the determining determines that the abnormality is included in the communication data, a second change instruction to the onboard system to increase a duration of a period during which the first data amount of the communication data, which is included in the first log, is collected per the sampling interval.

9. The information processing device according to claim 1 ,

wherein the operations further include:

outputting a second change instruction to the onboard system to change the sampling interval.

10. The information processing device according to claim 9 ,

wherein the operations further include:

outputting the second change instruction to a plurality of onboard systems of a plurality of vehicles, the plurality of vehicles having a same vehicle type as the vehicle.

11. The information processing device according to claim 9 ,

wherein the operations further include:

outputting the second change instruction to a plurality of onboard systems of a plurality of vehicles, the plurality of vehicles being in a same region as the vehicle.

12. The information processing device according to claim 1 ,

wherein the second log includes a plurality of types of the communication data, and

the first log includes at least one of the plurality of types of the communication data.

13. The information processing device according to claim 1 ,

wherein the first log is compressed by the onboard system,

the second log is compressed by the onboard system, and

the operations further include:

decompressing the compressed first log;

obtaining, from the onboard system, the second log that is compressed; and

decompressing the compressed second log.

14. An information processing method performed by an information processing device provided outside of a vehicle, the information processing method comprising:

obtaining, from an onboard system of the vehicle, a first log, the first log including, per sampling interval, a first data amount of communication data, the communication data flowing through the onboard system of the vehicle, the communication data corresponding to an onboard network of the vehicle;

determining whether the first log indicates that an abnormality is included in the communication data; and

outputting, in a case where the determining determines that the abnormality is included in the communication data, first detection results to the onboard system, the first detection results indicating the abnormality is included in the communication data, and the first detection results including an instruction that instructs the onboard system to transmit a second log to the information processing device, the instruction further instructing the onboard system to shorten the sampling interval; and

outputting, in a case where the determining determines that the abnormality is not included in the communication data and a determination is made that a current timing is a timing of transmitting the first log, a change instruction to the onboard system to lengthen the sampling interval,

wherein the second log includes, per the sampling interval, a second data amount of the communication data, the second data amount being more than the data first amount.