# US 2021/0344700 A1 · Vehicle security monitoring apparatus, method and non-transitory computer readable medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344700 A1 - Document ID: US20210344700A1 - Status: Published application - Kind: A1 - Application number: 17/377,855 - Filed: 2021-07-16 - Published: 2021-11-04 - Earliest claimed: 2019-01-21 - Assignees: NTT Communications Corporation - Applicants: NTT Communications Corporation - Inventors: Satoshi Ueno; Haruki Oda; Atsushi Wakasugi - Web page: https://patentgrep.com/patent/US20210344700A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - B60R 16/0232: {for measuring vehicle parameters and indicating critical, abnormal or dangerous conditions} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 12/40169: {Flexible bus arrangements (arrangements for maintenance or administration involving management of faults; events, alarms H04L41/06; automatic restoration of network faults H04L41/0654)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - B60R 16/0315: {using multiplexing techniques (multiplexing for transmission of signals G08C15/00; multiplexing for electrical communication in general H04J)} - H04L 2012/40273: {the transportation system being a vehicle} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A vehicle security monitoring apparatus is capable of communicating with an in-vehicle network having a function of transmitting log data related to an operation state of an in-vehicle apparatus, and the vehicle security monitoring apparatus is configured to acquire the log data, and to detect an abnormal state in the in-vehicle network based on the acquired log data. The vehicle security monitoring apparatus is configured to estimate an influence range affected by the detected abnormal state, and to manage information indicating the estimated influence range. ## Claims ### Claim 1 A vehicle security monitoring apparatus capable of communicating with an in-vehicle network having a function of transmitting log data related to an operation state of an in-vehicle apparatus, the vehicle security monitoring apparatus comprising: a log data acquisition unit configured to acquire the log data; an abnormality detection unit configured to detect an abnormal state in the in-vehicle network based on the acquired log data; a first estimation unit configured to estimate an influence range affected by the detected abnormal state; and an estimation information management unit configured to manage information indicating the estimated influence range. ### Claim 2 (depends on 1) The vehicle security monitoring apparatus according to claim 1, further comprising a second estimation unit configured to estimate a degree of risk caused by the detected abnormal state, wherein the estimation information management unit is further configured to manage information indicating the estimated degree of risk. ### Claim 3 (depends on 1) The vehicle security monitoring apparatus according to claim 1, further comprising a third estimation unit configured to estimate at least one of a threat type and an occurrence factor of the detected abnormal state, wherein the estimation information management unit is further configured to manage information indicating at least one of the estimated threat type and the estimated occurrence factor. ### Claim 4 (depends on 1) The vehicle security monitoring apparatus according to claim 1, further comprising a first transmission control unit configured to select a notification target of a response related to the influence range based on the information indicating the influence range managed by the estimation information management unit, and to transmit notification information including information indicating the response to the selected notification target. ### Claim 5 (depends on 2) The vehicle security monitoring apparatus according to claim 2, further comprising a second transmission control unit configured to set a priority for a notification target of a response based on information indicating the degree of risk managed by the estimation information management unit, and to transmit notification information including information indicating a response to a notification target according to the priority. ### Claim 6 (depends on 3) The vehicle security monitoring apparatus according to claim 3, further comprising a third transmission control unit configured to generate response instruction information including a response action corresponding to an abnormal state based on the abnormal state detected by the abnormality detection unit, and information each piece of which indicates at least one of the influence range, the degree of risk, the threat type, and the occurrence factor managed by the estimation information management unit, and to transmit the generated response instruction information to a notification target. ### Claim 7 (depends on 6) The vehicle security monitoring apparatus according to claim 6, wherein the estimation information management unit is configured to store information defining a combination of a threat type and a degree of risk, and the third transmission control unit is configured to determine a notification target of a response instruction and a response action corresponding to the abnormal state with reference to information defining a combination of the stored threat type and degree of risk. ### Claim 8 (depends on 4) The vehicle security monitoring apparatus according to claim 4, wherein the first transmission control unit is configured to select a vehicle or an in-vehicle network corresponding to at least one of a manufacturer or a vendor, a vehicle type, a model year, and a use area of a vehicle in which the in-vehicle network or a system thereof is mounted as a notification target of a response related to the influence range, and to transmit notification information including information indicating the response to the selected vehicle or in-vehicle network. ### Claim 9 A vehicle security monitoring method executed by a vehicle security monitoring apparatus capable of communicating with an in-vehicle network having a function of transmitting log data related to an operation state of an in-vehicle apparatus, the vehicle security monitoring apparatus comprising: acquiring the log data; detecting an abnormal state in the in-vehicle network based on the acquired log data; and estimating an influence range affected by the detected abnormal state; and managing information indicating the estimated influence range. ### Claim 10 (depends on 9) The vehicle security monitoring method according to claim 9, further comprising estimating a degree of risk caused by the detected abnormal state, wherein the managing the estimated information further includes managing information indicating the estimated degree of risk. ### Claim 11 (depends on 9) The vehicle security monitoring method according to claim 9, further comprising estimating at least one of a threat type and an occurrence factor of the detected abnormal state, wherein the managing the estimated information further comprising managing information indicating at least one of the estimated threat type and occurrence factor. ### Claim 12 A non-transitory computer readable medium storing a program that causes a hardware processor of a vehicle security monitoring apparatus capable of communicating with an in-vehicle network having a function of transmitting log data related to an operation state of an in-vehicle apparatus, to: acquire the log data; detect an abnormal state in the in-vehicle network based on the acquired log data; estimate an influence range affected by the detected abnormal state; and manage information indicating the estimated influence range.