Information processing method, anomaly determination method, and information processing device

An anomaly determination method that is executed by a vehicle that determines an anomaly upon receiving a detection rule for an attack against the vehicle from an information processing device that manages the detection rule, the anomaly determination method comprising:

• receiving a plurality of detection rules from the information processing device based on attack information related to an attack detected in the vehicle, the plurality of detection rules each being the detection rule;
• determining, based on priorities, whether an anomaly has occurred in the vehicle due to the attack against the vehicle that has been detected, by using one or more detection rules of the plurality of detection rules, the priorities being determined for the plurality of detection rules;
• and
• notifying a result of the determining when the anomaly is determined to have occurred in the vehicle,
• wherein the priorities indicate at least one of (i) an order in which the plurality of detection rules are used, or (ii) whether to use the plurality of detection rules when determining whether an anomaly has occurred in the monitored object.

An information processing device that detects an attack against a monitored object by communicating with the monitored object, the information processing device comprising:

• an obtainment circuit that obtains attack information related to an attack against the monitored object;
• and
• a determination circuit that determines, based on the attack information, priorities of a plurality of detection rules used for determining whether an anomaly has occurred in the monitored object when the monitored object is attacked, and stores the priorities in association with the plurality of detection rules,
• wherein the priorities indicate at least one of (i) an order in which the plurality of detection rules are used, or (ii) whether to use the plurality of detection rules when determining whether an anomaly has occurred in the monitored object.