Patent ID: 11956262
Assignee: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 5:
6. The anomaly detection device according to claim 1, wherein
the anomaly detection device stores in advance at least one of a server count per communication ID or a client count per communication ID in the in-vehicle network system, the server count per communication ID indicating a maximum number of servers to be used for each communication ID, the client count per communication ID indicating a maximum number of clients to be used for each communication ID, and
the detection rule generator circuit:
checks whether there is a detection rule that includes the set of the communication ID and the server address written in the communication establishment frame, and when the detection rule does not exist,
determines that the communication establishment frame is anomalous when a type count of the server address in a detection rule that includes the communication ID is higher than the server count per communication ID, or
adds a detection rule that includes the set of the communication ID and the server address written in the communication establishment frame when the type count of the server address in the detection rule that includes the communication ID is equal to or lower than the server count per communication ID; or
checks whether there is a detection rule that includes the set of the communication ID and the client address written in the communication establishment frame, and when the detection rule does not exist,
determines that the communication establishment frame is anomalous when a type count of the client address in a detection rule that includes the communication ID is higher than the client count per communication ID, or
adds a detection rule that includes the set of the communication ID and the client address written in the communication establishment frame when the type count of the client address in the detection rule that includes the communication ID is equal to or lower than the client count per communication ID.