Patent ID: 11886588
Assignee: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA
Field: Measurement (Instruments)
Classification: CPC G  H | IPC G

Claim 12:
13. An intrusion point identification method for identifying an intrusion point at which a threat intrudes into one or more moving bodies, the intrusion point identification method comprising, as information processing to be performed by a processor:
collecting and storing threat information, the threat information including sets of (i) a threat information number uniquely linked to a moving body identification number identifying a moving body from among the one or more moving bodies into which the threat has intruded, (ii) route information indicating whether an attack by the threat that has intruded into the moving body is an attack by physical access or an attack remotely via a network, (iii) discovery information indicating a discovery date of the attack, and (iv) severity level of vulnerability for the threat;
(i) collecting logs indicating points that indicate locations of the one or more moving bodies in association with dates and times, each of the points being one of a plurality of predetermined points, (ii) extracting, from the logs collected, histories of points that indicate locations of the one or more moving bodies within a predetermined period, the predetermined period being set based on the discovery information, and (iii) storing the histories of the points as history information;
identifying an intrusion point of the threat from a first attack source located within a predetermined distance from the moving body by an attack among the points indicated in the history information stored; and
outputting the intrusion point identified, wherein
for each of the points indicated in the history information, the collecting the logs includes further calculating and storing a total number of moving bodies that have been at each point indicated in the history information,
the identifying includes, for each of the threat information numbers included in the threat information, (i) extracting points of the moving body corresponding to the moving body identification number included in the history information and (ii) calculating a score indicating a degree of abnormality for each of extracted points by using the route information, the severity level of vulnerability, and the total number of moving bodies at each of the points, and
the intrusion point of the threat is identified according to the calculated scores.