Anomaly monitoring apparatus and anomaly monitoring method

An anomaly monitoring apparatus in a remote operation system for remotely operating a mobility entity, the anomaly monitoring apparatus comprising:

• a processor;
• a memory;
• a log collector that:
• collects an operation log from an operation apparatus which remotely operates the mobility entity and a control log from a control apparatus installed in the mobility entity, the operation log being a history of operation commands, and the control log being a history of control commands;
• and
• collects a location log from the control apparatus, the location log being a history of location information of the mobility entity;
• an anomaly detector that detects whether an anomaly is present in the mobility entity based on at least one of the operation log or the control log;
• an attack origin identifier that, when the anomaly detector detects an anomaly, identifies an attack origin that caused the anomaly in the mobility entity from among a plurality of attack origins based on a result of comparing the operation log with the control log;
• and
• an anomaly notifier that makes a notification for taking a countermeasure for the attack origin identified by the attack origin identifier,
• wherein
• the anomaly notifier provides the notification to a periphery of the control apparatus upon a detection of occupancy by a driver in the mobile entity,
• the attack origin includes a location where an attack that caused the anomaly in the mobility entity was performed,
• the anomaly detector detects a presence or absence of an anomaly in each of the operation log and the control log based on a first rule,
• the first rule further includes information pertaining to an anomaly in the location log,
• the anomaly detector detects an anomaly in each of the operation log, the control log, and the location log based on the first rule,
• the attack origin identifier identifies a second attack origin, different from a first attack origin, as the attack origin when an anomaly is present in only the location log, the first attack origin being the attack origin when the operation log and the control log do not match, and
• the log collector, the anomaly detector, the attack origin identifier, and the anomaly notifier are software instructions stored in the memory and executed by the processor.