Detection rule output method, security system, and detection rule output device

A detection rule output device that outputs a detection rule used in a security system that determines attack details based on log information of a vehicle, the detection rule output device comprising:

• a communication interface that acquires vehicle configuration information regarding a configuration of an in-vehicle network provided in the vehicle, intrusion detection system (IDS) information regarding one or more intrusion detection systems (IDSes) mounted in the vehicle, and attack information to be detected regarding an attack on the vehicle to be detected;
• a processor;
• and
• a memory including a program that, when executed by the processor, causes the processor to:
• generate an attack path based on the vehicle configuration information;
• generate the detection rule that includes at least one of the attack path, abnormality details indicating details of the abnormality that has occurred in the vehicle, or a scenario of the attack, in which the attack path is associated with the attack details based on the IDS information and the attack information to be detected;
• and
• output, to a storage device included in the security system, the detection rule that is for detecting a location in the vehicle where an abnormality has occurred and the abnormality that has occurred in the location.