Security device, network system, and fraud detection method

A network system, comprising:

• a security device;
• an external device;
• a vehicle, the vehicle includes a communication device that communicates with the external device;
• at least one bus;
• and
• a plurality of electronic control units that is installed in the vehicle and that exchanges frames via the at least one bus,
• wherein the security device includes
• processing circuitry, and
• storage including at least one set of instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations including
• receiving a first frame from the at least one bus,
• determining whether the first frame satisfies predetermined conditions, the predetermined conditions being conditions for determining whether the first frame is a suspect of being an attack frame,
• transmitting a determination request to an external device that is outside of the vehicle, in a case where the determining determines that the predetermined conditions are satisfied,
• obtaining determination results from the external device in accordance with the determination request,
• outputting first presentation information in a case where the determining determines that the predetermined conditions are satisfied, and
• outputting second presentation information in a case where the obtaining obtains the determination results.

A security device connected to at least one network in a mobility, the at least one network comprises a first network, the security device comprising:

• processing circuitry;
• and
• storage including at least one set of instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations including:
• receiving a first frame from the first network;
• determining whether the first frame satisfies predetermined conditions, the predetermined conditions being conditions for determining whether the first frame is a suspect of being an attack frame;
• transmitting a determination request to an external device that is outside of the mobility, in a case where the determining determines that the predetermined conditions are satisfied;
• obtaining determination results from the external device in accordance with the determination request;
• outputting first presentation information in a case where the determining determines that the predetermined conditions are satisfied;
• and
• outputting second presentation information in a case where the obtaining obtains the determination results.

A fraud detection method used in an onboard network system where a plurality of electronic control units exchange frames via at least one bus, the fraud detection method comprising:

• receiving a frame from the at least one bus;
• determining whether the received frame satisfies predetermined conditions, the predetermined conditions begin conditions for determining whether the received frame is a suspect of being an attack frame;
• presenting first presentation information in a case where the determining determines that the predetermined conditions are satisfied;
• transmitting a determination request to an external device that is outside of the vehicle in the case where the determining determines that predetermined conditions are satisfied;
• obtaining determination results from the external device in response to the determination request;
• and
• presenting second presentation information in a case where the obtaining obtains the determination results from the external device.

A security device connected to at least one bus in a vehicle, the security device comprising:

• a processor;
• and
• a memory including instructions that, when executed by the processor, cause the processor to perform operations including:
• receiving a frame from the at least one bus;
• determining, with regard to the frame received in the receiving, whether predetermined conditions are satisfied to determine whether the frame is a suspect of being an attack frame;
• presenting first presentation information in a case where the predetermined conditions are satisfied;
• obtaining, by transmitting a determination request to an external device that is outside of the vehicle in the case where the predetermined conditions are satisfied, determination results from the external device in response to the determination request;
• and
• presenting second presentation information in a case where the determination results are obtained from the external device in the obtaining.