Data analysis apparatus

A data analysis apparatus, comprising:

• a processor;
• and
• a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including:
• obtaining a plurality of anomaly analysis results, the anomaly analysis results each being a result of analyzing an anomaly in an in-vehicle network and including information identifying at least anomaly data, the in-vehicle network being provided in each of a first vehicle and a second vehicle and including one or more networks;
• identifying a primary ECU having higher relevance to the anomaly data indicated in the plurality of anomaly analysis results among ECUs connected to the in-vehicle network, the identifying being performed for each of the first vehicle and the second vehicle;
• identifying, as a secondary ECU set, a plurality of ECUs connected to a network connected to the primary ECU among the one or more networks, the identifying being made for each of the first vehicle and the second vehicle;
• identifying, as anomaly-relevant ECUs, common ECUs included in both of the secondary ECU set identified for the first vehicle and the secondary ECU set identified for the second vehicle, the common ECUs satisfying one or more predetermined conditions;
• and
• outputting information indicating at least the anomaly-relevant ECUs.