In-vehicle apparatus and log collection system

An in-vehicle apparatus connected to a server via a network and mounted on a vehicle, comprising:

• the in-vehicle apparatus including:
• a processor and a memory storing instructions that when executed configure the processor to:
• collect a log of the in-vehicle apparatus at predetermined time intervals;
• accumulate in a log storage at least a part of the log;
• store in the log storage log priority information indicating a priority of the log to be accumulated in the log storage;
• determine whether the collected log is to be accumulated or not to be accumulated in the log storage based on the log priority information;
• transmit a log accumulated in the log storage to the server;
• and
• update a log priority table with the log priority information, which is stored in the log storage and used for determining whether the collected log is to be accumulated or not to be accumulated in the log storage, based on an update command received from the server;
• and
• the server including:
• a server processor configured to analyze a log received from the in-vehicle apparatus at least by determining a difference between a received packet amount per time unit of the in-vehicle apparatus present at a particular location with a received packet amount in another location and comparing the difference to a threshold value;
• detect a possibility of attack on the in-vehicle apparatus, at least in response to the comparison exceeding the threshold value;
• and
• transmit the update command to the in-vehicle apparatus to update the log priority information stored in the log priority information storage, when the possibility of attack is detected and initiate an emergency stop service request.