Anomaly detection device and anomaly detection method

An anomaly detection device that detects an anomaly in an in-vehicle network system including two or more electronic control units and one or more networks, the anomaly detection device comprising:

• an electronic control unit (ECU) attribute storage in which attributes of the two or more electronic control units are stored, each of the attributes being set for a corresponding one of the two or more electronic control units;
• a processor;
• and
• a memory including a program that, when executed by the processor, causes the processor to perform functions, the functions including:
• receiving and transmitting a message on the one or more networks;
• and
• detecting an anomalous communication by using an attribute of a message source electronic control unit or an attribute of a message destination electronic control unit among the attributes stored in the ECU attribute storage, the message source electronic control unit being one of the two or more electronic control units that is a source of the message, the message destination electronic control unit being one of the two or more electronic control units that is a destination of the message, wherein
• each of the attributes stored in the ECU attribute storage indicates at least one of a function of a corresponding one of the two or more electronic control units or a type of information that is handled by the corresponding one of the two or more electronic control units, and
• each of the attributes at least represents a functional category shared by a set of one or more of the electronic control units.