CPC H04L 63/1425 (2013.01) [B60R 16/023 (2013.01); G06F 11/3013 (2013.01); G06F 11/3476 (2013.01); H04L 9/3242 (2013.01); H04W 4/48 (2018.02); H04L 12/40013 (2013.01)] | 7 Claims |
1. A log generation method for generating a log of communication on an in-vehicle network, the log generation method comprising:
performing a plurality of determination processes for determining, by using different methods, whether or not a message sent to the in-vehicle network is anomalous;
generating a log in accordance with results of the plurality of determination processes; and
transmitting the generated log,
wherein the generating includes determining at least one information item to be included in the log in accordance with a combination of the results of the plurality of determination processes,
the plurality of determination processes includes a first determination process for determining that the message is anomalous and a second determination process for determining that the message is anomalous, the first determination process and the second determination process being performed independently from each other, and
in the generating,
in a case where the first determination process and the second determination process both determine independently that the message is anomalous,
(A) when a reason for which the first determination process determines that the message is anomalous is different from a reason for which the second determination process determines that the message is anomalous, the at least one information item is:
a first type identifier indicating that the first determination process determines that the message is anomalous;
first information item indicating the reason for which the first determination process determines that the message is anomalous;
a second type identifier indicating that the second determination process determines that the message is anomalous; and
second information item indicating the reason for which the second determination process determines that the message is anomalous, and
(B) when the reason for which the first determination process determines that the message is anomalous is same as the reason for which the second determination process determines that the message is anomalous, the at least one information item is:
the first type identifier;
the second type identifier; and
one of the first information item and the second information item.
|