Information processing device and information processing method

An information processing method executed by an information processing device that detects an anomaly in an in-vehicle network provided in a vehicle, the vehicle including at least one of a vehicle acceleration detector connected to the in-vehicle network, a vehicle body state detector connected to the in-vehicle network, a vehicle steering detector connected to the in-vehicle network, or a vehicle frame period detector connected to the in-vehicle network,

• the information processing device including:
• an individual rule storage connected to the in-vehicle network and in which at least an individual rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering or vehicle frame period is stored, the individual rule being a rule generated for the vehicle;
• and
• an integrated rule storage connected to the in-vehicle network and in which an integrated rule relating to at least one of the vehicle acceleration, vehicle body state, vehicle steering and vehicle frame period is stored, the integrated rule being a rule generated for a plurality of vehicles including the vehicle,
• the information processing method comprising:
• obtaining a frame transmitted on the in-vehicle network;
• and
• performing, by a processor connected to the in-vehicle network and using a one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule, or one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule stored in a respective at least one of the individual rule storage or the integrated rule storage, an anomaly detection process on the frame obtained, wherein
• in the performing of the anomaly detection process, when one of the individual vehicle acceleration rule, individual vehicle body state rule, individual vehicle steering rule, or individual vehicle frame period rule is stored in the individual rule storage and one of the integrated vehicle acceleration rule, integrated vehicle body state rule, integrated vehicle steering rule, or integrated vehicle frame period rule is stored in the integrated rule storage, the anomaly detection process is performed by the processor by at least one of:
• prioritizing one of the individual or integrated vehicle acceleration rules over the other, prioritizing one of the individual or integrated vehicle body state rules over the other, prioritizing one of the individual vehicle steering rules over the other, or prioritizing one of the individual vehicle frame period rules over the other, depending on whether vehicle acceleration, a vehicle body, vehicle steering, or vehicle frame is a detection target.