Information processing apparatus, information processing method, and recording medium

1. An information processing apparatus connected to one or more vehicles and a threat information server via a network, the threat information server storing at least one piece of threat information, each of the at least one piece of threat information indicating an attack on a vehicle and a resolution state to the attack associated with each other, the information processing apparatus comprising:

a processor; and

a memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations including:

obtaining a detection result of an attack on one of the one or more vehicles connected to the information processing apparatus;

(a) determining whether the attack indicated by the detection result is included in any one of the at least one piece of threat information stored in the threat information server;

(b) when the attack indicated by the detection result is included in any one of the at least one piece of threat information, determining whether the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved or indicates that the attack has been resolved;

(c) deciding a processing priority level of the attack indicated by the detection result, based on a determination result obtained in operation (a) and a determination result obtained in operation (b); and

(d) outputting the processing priority level decided in operation (c),

wherein in operation (c):

the processing priority level of the attack indicated by the detection result is decided to be a first priority level when the attack indicated by the detection result is not included in any of the at least one piece of threat information; and

when the attack indicated by the detection result is included in the one of the at least one piece of threat information:

the processing priority level is decided to be a second priority level lower than the first priority level in the case where the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved; and

the processing priority level is decided to be a third priority level lower than the second priority level in the case where the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has been resolved.

2. The information processing apparatus according to claim 1 ,

wherein the information processing apparatus is further connected, via the network, to a vehicle information server which stores vehicle information including at least a countermeasure application state of the one of the one or more vehicles connected to the information processing apparatus, the countermeasure application state indicating whether a countermeasure has been applied against the attack on a vehicle,

the operations further include:

(e) determining whether the countermeasure application state against the attack indicated by the detection result included in the vehicle information stored in the vehicle information server indicates that any countermeasure has not been applied or a countermeasure has been applied; and

(f) determining whether an attack count indicated by the detection result is greater than or equal to a predetermined count, and

in operation (c), the processing priority level is decided based on the determination result obtained in operation (a), the determination result obtained in operation (b), a determination result obtained in operation (e), and a determination result obtained in operation (f).

3. The information processing apparatus according to claim 2 ,

wherein, in operation (c), when the attack indicated by the detection result is included in the one of the at least one piece of threat information and the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has been resolved, the processing priority level is decided to be a third priority level lower than the second priority level in the case where the attack count indicated by the detection result is smaller than the predetermined count.

4. The information processing apparatus according to claim 2 ,

wherein, in operation (c), when the attack indicated by the detection result is included in the one of threat information and the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has been resolved, the processing priority level is decided to be a second priority level lower than a first priority level and higher than a third priority level in the case where the countermeasure application state indicates that any countermeasure has not been applied and the attack count indicated by the detection result is greater than or equal to the predetermined count.

5. The information processing apparatus according to claim 2 ,

wherein, in operation (c), when the attack indicated by the detection result is included in the one of the at least one piece of threat information and the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has been resolved, the processing priority level is decided to be a first priority level higher than a second priority level in the case where the countermeasure application state indicates that a countermeasure has been applied and the attack count indicated by the detection result is greater than or equal to the predetermined count.

6. The information processing apparatus according to claim 1 ,

the operations further include:

(g) controlling content to be displayed in a display unit which displays pieces of information each regarding the attack indicated by the detection result, based on the processing priority level decided in operation (c),

wherein, in operation (g):

the content to be displayed in the display unit is controlled in such a manner that a first piece of information is displayed preferentially to both a second piece of information and a third piece of information, the first piece of information being a piece of information regarding the attack indicated by the detection result having the processing priority level that has been decided to be a first priority level, the second piece of information being a piece of information regarding the attack indicated by the detection result having the processing priority level that has been decided to be a second priority level lower than the first priority level, the third piece of information being a piece of information regarding the attack indicated by the detection result having the processing priority level that has been decided to be a third priority level lower than the second priority level; and

the content to be displayed in the display unit is further controlled in such a manner that the third piece of information is not displayed.

7. The information processing apparatus according to claim 1 ,

in the deciding,

deciding the processing priority level of the attack indicated by the detection result, based on the determination result obtained in operation (a) and the determination result obtained in operation (b), when the attack indicated by the detection result is included in any one of the at least one piece of threat information, and

deciding the processing priority level of the attack indicated by the detection result, based on the determination result obtained in operation (a), when the attack indicated by the detection result is not included in the at least one piece of threat information.

8. The information processing apparatus according to claim 1 ,

wherein the operations further include:

(f) determining whether an attack count indicated by the detection result is greater than or equal to a predetermined count, and

in operation (c), the processing priority level is decided based on the determination result obtained in operation (a), the determination result obtained in operation (b), and a determination result obtained in operation (f).

9. The information processing apparatus according to claim 8 ,

in the deciding,

deciding the processing priority level of the attack indicated by the detection result, based on the determination result obtained in operation (a), the determination result obtained in operation (b) and the determination result obtained in operation (f), when the attack indicated by the detection result is included in any one of the at least one piece of threat information, and

deciding the processing priority level of the attack indicated by the detection result, based on the determination result obtained in operation (a) and the determination result obtained in operation (f), when the attack indicated by the detection result is not included in the at least one piece of threat information.

10. An information processing method executed by a processor included in an information processing apparatus, the information processing apparatus being connected to one or more vehicles and a threat information server via a network, the threat information server storing at least one piece of threat information, each of the at least one piece of threat information indicating an attack on a vehicle and a resolution state to the attack associated with each other, the information processing method comprising the steps of:

obtaining a detection result of an attack on one of the one or more vehicles connected to the information processing apparatus;

(i) determining whether the attack indicated by the detection result is included in any one of the at least one piece of threat information stored in the threat information server;

(ii) when the attack indicated by the detection result is included in any one of the at least one piece of threat information, determining whether the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved or indicates that the attack has been resolved;

deciding a processing priority level of the attack indicated by the detection result, based on a determination result obtained in step (i) and a determination result obtained in step (ii); and

outputting the processing priority level decided,

wherein in the deciding:

the processing priority level of the attack indicated by the detection result is decided to be a first priority level when the attack indicated by the detection result is not included in any of the at least one piece of threat information; and

when the attack indicated by the detection result is included in the one of the at least one piece of threat information:

the processing priority level is decided to be a second priority level lower than the first priority level in the case where the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has not been resolved; and

the processing priority level is decided to be a third priority level lower than the second priority level in the case where the resolution state to the attack indicated by the detection result included in the one of the at least one piece of threat information indicates that the attack has been resolved.

11. A non-transitory computer-readable recording medium storing a program causing the information processing apparatus recited in claim 8 to execute the information processing method recited in claim 10 .