Patent Description:
Conventionally, anomaly detection devices that detect vehicle-related anomalies are known (for example, refer to Patent Literature (PTL) <NUM>).

[PTL <NUM>] <CIT>
<CIT> relates to a commercial vehicle fleet management system which integrates a vehicle on-board computer, a precise positioning system, and communication system to provide automated calculating and reporting of jurisdictional fuel taxes, road use taxes, vehicle registration fees, and the like. <CIT> relates to a vehicle networking technology and a DSRC communication technology, in particular to a DSRC-based abnormal vehicle behavior detection and tracking method, and belongs to the technical field of computers.

<NPL> relates to the increasing utilization of Electronic Control Units (ECUs) and wireless connectivity in modern vehicles has favored the emergence of security issues. Recently, several attacks have been demonstrated.

There is a demand for improved accuracy of anomaly detection in anomaly detection devices that detect vehicle-related anomalies.

In view of this, an object of the present disclosure is to provide an anomaly detection device capable of detecting anomalies with improved accuracy compared to the conventional anomaly detection device.

In a first embodiment the invention is supported by an anomaly detection device according to independent claim <NUM>.

In a second embodiment the invention is supported by an anomaly detection method according to independent claim <NUM>.

In a further embodiment the invention is supported by a program according to independent claim <NUM>.

With the anomaly detection device, etc., according to one aspect of the present disclosure, it is possible to provide an anomaly detection device capable of detecting anomalies with improved accuracy compared to the conventional anomaly detection device.

A plurality of electronic control units (hereinafter also referred to as ECUs) are mounted on vehicles such as automobiles. The vehicles are controlled by performing communication via an in-vehicle network connecting the ECUs. A controller area network (CAN), which is widely used, is one standard for such an in-vehicle network.

An in-vehicle network that complies with the CAN protocol can be built as a closed communication path on a single vehicle. However, an in-vehicle network built as an externally accessible network is often mounted on a vehicle. For example, in the in-vehicle network, a port is installed through which information passing through the network is taken out for the purpose of being used to diagnose each system mounted on the vehicle, and a car navigation system including a function for connecting to a wireless local area network (LAN) that can be connected to an external network is connected to the in-vehicle network. Making the in-vehicle network externally accessible can lead to improved convenience for users of the vehicle, but increases risk.

For example, in <NUM>, it was demonstrated that unauthorized vehicle control is possible from outside of the in-vehicle network through the misuse of the parking assist feature or the like. Furthermore, in <NUM>, it was demonstrated that unauthorized remote control of a specific model of car is possible, and this model was then recalled as a result of said demonstration.

One technique for attacking the in-vehicle network is externally accessing an ECU connected to the network, taking over the ECU, causing the ECU to transmit a frame for attacks (hereinafter also referred to as an attack frame), and improperly controlling the automobile. The attack frame is an anomalous frame different in some aspect from a normal frame passing through the in-vehicle network that has not been attacked.

As a technique for detecting such an anomaly in the in-vehicle network, a method for applying a statistical approach to travel data of the vehicle is disclosed in PTL <NUM>, for example.

In this anomaly detection technique, a feature, a mechanical learning parameter group, or the like to be used as a reference for anomaly detection is created as an evaluation model, and determination is made on the basis of whether the current data deviates from the evaluation model. However, in such a conventional technique, the evaluation model is created using travel data measured in a wide travel region, and thus in the anomaly detection in which the evaluation model including the travel data obtained in various travel environments is used, for example, even if an anomalous acceleration instruction is provided on an ordinary road by an attack, the acceleration instruction is regarded as being normal and this anomaly cannot be determined as long as its speed can be measured on freeways.

Like this example, with the conventional technique, there is an attack that cannot be determined as being anomalous, depending on the location of the vehicle, leading to the problem of decreased detection accuracy.

In view of this, the inventors repeated diligent examinations and experiments to solve the aforementioned problem. As a result, the inventors have conceived of the anomaly detection device, the anomaly detection method, and the program described below.

An anomaly detection device according to one aspect of the present disclosure includes: an obtainer that obtains vehicle information related to a status of a vehicle and including location data indicating a location of the vehicle; a model storage that stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating the vehicle information of the vehicle located at the cell; and a determiner that calculates, based on the vehicle information and evaluation models each being the evaluation model, an anomaly level indicating a degree of anomaly of the vehicle information, determines, based on the anomaly level, whether the vehicle information is anomalous, and outputs a determination result, the evaluation models corresponding to evaluation cells including a first cell including the location of the vehicle indicated in the location data and one or more second cells each having a predetermined positional relationship with the first cell.

This anomaly detection device determines, on the basis of the evaluation models for evaluation cells each having a predetermined positional relationship with the location of the vehicle, whether the vehicle information is anomalous. Therefore, with this anomaly detection device, it is possible to detect a vehicle-related anomaly on the basis of the evaluation models for a local region corresponding to the location of the vehicle. Thus, with this anomaly detection device, it is possible to detect anomalies with improved accuracy compared to the conventional anomaly detection device.

Furthermore, when the anomaly level is greater than or equal to a threshold value, the determiner may determine that the vehicle information is anomalous.

Furthermore, when the anomaly level is greater than or equal to a threshold value and an evaluation data count, which is a sum of data items used to create the evaluation model for each cell included in the evaluation cells, is less than a first predetermined number, the determiner may correct the anomaly level to reduce the degree of anomaly, and determine, based on the anomaly level corrected, whether the vehicle information is anomalous.

Furthermore, when the anomaly level is greater than or equal to the threshold value and the evaluation data count is less than a second predetermined number smaller than the first predetermined number, the determiner may correct the anomaly level to reduce the degree of anomaly until the degree of anomaly indicates that the vehicle information is normal.

Furthermore, when the anomaly level is greater than or equal to the threshold value and the evaluation data count is less than the first predetermined number, the determiner may correct the anomaly level by multiplying the anomaly level by a ratio of the evaluation data count to the first predetermined number.

Furthermore, the vehicle information may further include speed data indicating a travel speed of the vehicle, when the travel speed indicated in the speed data is less than a first speed, the determiner may set a first predetermined positional relationship to the predetermined positional relationship, and when the travel speed is greater than or equal to the first speed, the determiner may set a second predetermined positional relationship to the predetermined positional relationship, and a total number of the second cells each having the second predetermined positional relationship may be greater than a total number of the second cells each having the first predetermined positional relationship.

Furthermore, the vehicle information may further include speed data indicating a travel speed of the vehicle, when the travel speed indicated in the speed data is less than a first speed, the determiner may set a first predetermined positional relationship to the predetermined positional relationship, and when the travel speed is greater than or equal to the first speed, the determiner may set a second predetermined positional relationship to the predetermined positional relationship, and a total number of second cells arranged in a first direction from the first cell among the second cells each having the second predetermined positional relationship may be greater than a total number of second cells arranged in the first direction from the first cell among the second cells each having the first predetermined positional relationship.

Furthermore, the obtainer may sequentially obtain the vehicle information, the determiner may sequentially calculate the anomaly level, sequentially determine whether the vehicle information is anomalous, and sequentially output the determination result, and the anomaly detection device may further include: an accumulator that sequentially stores, in association with each other, the determination result sequentially output from the determiner and the location data corresponding to the determination result; and an anomaly series determiner that, in a case where a first determination result output from the determiner indicates that the vehicle information is anomalous and a second determination result stored in the accumulator a last time indicates that the vehicle information is anomalous, when a distance between a first location indicated in first location data corresponding to the first determination result and a second location indicated in second location data associated with the second determination result is less than a predetermined distance, determines the first determination result and the second determination result as being of a same anomaly series.

Furthermore, the vehicle information may further include speed data indicating a travel speed of the vehicle, and when the first determination result output from the determiner indicates that the vehicle information is anomalous, the anomaly series determiner may set the predetermined distance according to the travel speed indicated in the speed data corresponding to the first determination result.

Furthermore, the anomaly detection device may further include a display controller that causes a display unit to display at least a portion of the map, and in a case where the anomaly series determiner determines the first determination result and the second determination result as being of the same anomaly series, the anomaly series determiner may determine that each of the first cell corresponding to the first determination result and the first cell corresponding to the second determination result is an anomalous cell, and the display controller may cause the display unit to display at least a portion of the map in a manner that the anomalous cell is displayed in a display format different from a display format of other cells.

Furthermore, in the case where the anomaly series determiner determines the first determination result and the second determination result as being of the same anomaly series, when a first anomalous cell corresponding to the first determination result and a second anomalous cell corresponding to the second determination result have a predetermined relationship, the anomaly series determiner may further determine that a cell located between the first anomalous cell and the second anomalous cell is the anomalous cell.

Furthermore, the vehicle information may further include speed data indicating a travel speed of the vehicle, and when the first determination result indicates that the vehicle information is anomalous, the anomaly series determiner may set the predetermined relationship according to the travel speed indicated in the speed data corresponding to the first determination result.

Furthermore, in the case where the anomaly series determiner determines the first determination result and the second determination result as being of the same anomaly series, when a cell adjacent to a first anomalous cell corresponding to the first determination result and a second anomalous cell corresponding to the second determination result exists and a road area ratio in the cell is less than a predetermined area ratio, the anomaly series determiner may further determine that the cell is the anomalous cell.

An anomaly detection method according to one aspect of the present disclosure is performed by an anomaly detection device which stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating vehicle information related to a status of a vehicle located at the cell and including location data of the vehicle, and the anomaly detection method includes: obtaining the vehicle information; calculating, based on evaluation models each being the evaluation model, an anomaly level indicating a degree of anomaly of the vehicle information, the evaluation models corresponding to evaluation cells including a first cell including a location of the vehicle indicated in the location data and one or more second cells each having a predetermined positional relationship with the first cell; determining, based on the anomaly level, whether the vehicle information is anomalous; and outputting a determination result.

In this anomaly detection method, whether the vehicle information is anomalous is determined on the basis of the evaluation models for evaluation cells each having a predetermined positional relationship with the location of the vehicle. Therefore, with this anomaly detection method, it is possible to detect a vehicle-related anomaly on the basis of the evaluation models for a local region corresponding to the location of the vehicle. Thus, with this anomaly detection method, it is possible to detect anomalies with improved accuracy compared to the conventional anomaly detection device.

A program according to one aspect of the present disclosure causes an anomaly detection device, which stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating vehicle information related to a status of a vehicle located at the cell and including location data of the vehicle, to perform an anomaly detection process including: obtaining the vehicle information; calculating, based on evaluation models each being the evaluation model, an anomaly level indicating a degree of anomaly of the vehicle information, the evaluation models corresponding to evaluation cells including a first cell including a location of the vehicle indicated in the location data and one or more second cells each having a predetermined positional relationship with the first cell; determining, based on the anomaly level, whether the vehicle information is anomalous; and outputting a determination result.

In this anomaly detection program, whether the vehicle information is anomalous is determined on the basis of the evaluation models for evaluation cells each having a predetermined positional relationship with the location of the vehicle. Therefore, with this anomaly detection program, it is possible to detect a vehicle-related anomaly on the basis of the evaluation models for a local region corresponding to the location of the vehicle. Thus, with this anomaly detection program, it is possible to detect anomalies with improved accuracy compared to the conventional anomaly detection device.

Hereinafter, a specific example of an anomaly detection device according to one aspect of the present disclosure will be described with reference to the drawings. Each example described below shows a specific example of the present disclosure. Thus, the numerical values, shapes, structural elements, and the arrangement and connection of the structural elements, steps, the processing order of the steps etc., shown in the following example are mere examples, and are not intended to limit the present disclosure. Note that the figures are schematic diagrams and are not necessarily precise illustrations. In the respective figures, substantially identical elements are assigned the same reference signs, and overlapping description is omitted or simplified.

Hereinafter, an anomaly detection device according to an example will be described. This anomaly detection device detects vehicle-related anomalies, for example, anomalies due to cyberattacks and the like on vehicles.

<FIG> is a block diagram illustrating one example of the configuration of information processing system <NUM> which monitors anomalies in vehicle <NUM> using anomaly detection device <NUM> according to an example.

As illustrated in <FIG>, information processing system <NUM> includes monitoring server <NUM>, vehicle <NUM>, and network <NUM>.

Monitoring server <NUM> is what is called a computer device and includes a processor (not illustrated in the drawings), memory (not illustrated in the drawings), a communication interface (not illustrated in the drawings), a storage device (not illustrated in the drawings), and a display (not illustrated in the drawings).

Monitoring server <NUM> provides anomaly detection device <NUM> and display unit <NUM> by the processor executing a program stored in the memory.

Vehicle <NUM> includes a communication function, and in-vehicle network <NUM> is mounted on vehicle <NUM>. Vehicle <NUM> is, for example, an automobile.

Network <NUM> is a wide area network such as the Internet, and the connection targets of network <NUM> include anomaly detection device <NUM> and in-vehicle network <NUM>.

<FIG> is a block diagram illustrating one example of the configuration of in-vehicle network <NUM>.

As illustrated in <FIG>, in-vehicle network <NUM> includes external communication device <NUM>, various electronic control units (ECUs), and bus <NUM>.

In-vehicle network <NUM> performs communication in compliance with the CAN protocol, for example. Note that in-vehicle network <NUM> is not limited to the CAN and may be a communication network based on Ethernet (registered trademark) or FlexRay (registered trademark), for example.

Bus <NUM> is connected to each of the ECUs and external communication device <NUM> and transmits signals between the connected devices.

External communication device <NUM>, which is connected to network <NUM> and bus <NUM>, transmits, to network <NUM>, a signal passing through bus <NUM>, and sends, to bus <NUM>, a signal received from network <NUM>.

The ECUs mounted on vehicle <NUM> include, for example, an ECU related to a steering wheel, a brake, an engine, a door, a window, or the like. The ECU is, for example, a device including a digital circuit such as a processor and memory, an analog circuit, a communication circuit, and the like. The memory, which is read-only memory (ROM), random-access memory (RAM), or the like, is capable of storing a program to be executed by the processor. The ECU performs various functions, for example, by the processor executing the programs stored in the memory. The ECUs transmit and receive data via bus <NUM> in compliance with the CAN protocol, for example.

The ECUs transmit and receive the data complying with the CAN protocol to and from bus <NUM>. For example, an ECU receives, from bus <NUM>, data transmitted from another ECU, generates data including content to be transmitted to the other ECU, and transmits the generated data to bus <NUM>. Specifically, each ECU performs a process corresponding to the content of the received data, generates data indicating the status of a sensor or a device connected to the ECU or data of an instruction value (control value) for another ECU, and transmits the generated value.

<FIG> is a block diagram illustrating one example of functions provided using monitoring server <NUM>.

As illustrated in <FIG>, monitoring server <NUM> provides anomaly detection device <NUM> and display unit <NUM>.

Anomaly detection device <NUM> is connected to network <NUM> and display unit <NUM>. Anomaly detection device <NUM> performs an anomaly detection process of detecting an anomaly in vehicle <NUM>, and outputs the result to display unit <NUM>. The anomaly detection process will be described later.

Display unit <NUM> is connected to anomaly detection device <NUM> and displays an image based on a signal output from anomaly detection device <NUM>. The image displayed on display unit <NUM> will be described later.

For example, a user using information processing system <NUM> can recognize an anomaly in vehicle <NUM> by visually checking the content displayed on display unit <NUM>.

<FIG> is a block diagram illustrating one example of the configuration of anomaly detection device <NUM>.

As illustrated in <FIG>, anomaly detection device <NUM> includes obtainer <NUM>, model storage <NUM>, determiner <NUM>, anomaly series determiner <NUM>, accumulator <NUM>, and display controller <NUM>.

Obtainer <NUM> obtains vehicle information related to the status of vehicle <NUM> and including location data indicating at least the location of vehicle <NUM>. Obtainer <NUM> sequentially obtains vehicle information at a predetermined time interval, for example.

Obtainer <NUM> communicates with vehicle <NUM> via network <NUM>, for example, thereby receives a vehicle control signal complying with the communication protocol of in-vehicle network <NUM> from vehicle <NUM>, analyzes the received vehicle control signal, and thus obtains the vehicle information.

Herein, the vehicle information is described as including, in addition to the location data, speed data (which may also be referred to simply as "speed") indicating the travel speed of vehicle <NUM>. The vehicle information may further include a turn curvature, acceleration, a yaw rate, an accelerator position, a steering level, and a shift position, for example.

Obtainer <NUM> sequentially outputs the sequentially obtained vehicle information to determiner <NUM> and accumulator <NUM> and holds the latest vehicle information.

Model storage <NUM> stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating vehicle information of vehicle <NUM> located at the cell. The data structure of the evaluation model will be described later with reference to <FIG> to be described later.

<FIG> is a schematic diagram illustrating one example of a map having a grid with a plurality of cells. In this description, it is assumed that the cells have the same square shape, as illustrated in <FIG>. The length of one side of the cell may be the road width of a travel path for vehicle <NUM>, for example, or may be a distance vehicle <NUM> travels for a unit of time, for example, or may be <NUM>, for example.

Note that the cells are assumed herein to have the same square shape, but do not necessarily need to be limited to having the same square shape and may have any shape.

Returning to <FIG>, the description of anomaly detection device <NUM> will be continued.

Determiner <NUM> first refers to the location data included in the vehicle information each time obtainer <NUM> sequentially obtains the vehicle information, and determines, on the basis of the location of vehicle <NUM>, evaluation cells corresponding to evaluation models to be referred to in the anomaly detection process. Here, determiner <NUM> determines, as the evaluation cells, cells including a first cell including the location of vehicle <NUM> indicated in the location data and one or more second cells having a predetermined positional relationship with the first cell.

Next, determiner <NUM> obtains the evaluation models for the determined evaluation cells from model storage <NUM>. Subsequently, an anomaly level indicating the degree of anomaly of the vehicle information is calculated on the basis of the vehicle information and the evaluation models obtained.

Next, determiner <NUM> determines, on the basis of the calculated anomaly level, whether the vehicle information is anomalous, and outputs the determination result. At this time, when the calculated anomaly level is greater than or equal to a threshold value and an evaluation data count, which is the sum of data items used to create the evaluation model for each cell included in the evaluation cells, is less than a first predetermined number, determiner <NUM> corrects the anomaly level to reduce the degree of anomaly, and determines, on the basis of the corrected anomaly level, whether the vehicle information is anomalous. Here, when the calculated anomaly level is greater than or equal to the threshold value and the evaluation data count is less than the first predetermined number, determiner <NUM> corrects the anomaly level by multiplying the anomaly level by the ratio of the evaluation data count to the first predetermined number.

Furthermore, when the calculated anomaly level is greater than or equal to the threshold value and the evaluation data count is less than a second predetermined number smaller than the first predetermined number, determiner <NUM> corrects the anomaly level to reduce the degree of anomaly until the degree of anomaly indicates that the vehicle information is normal, and determines, on the basis of the corrected anomaly level, whether the vehicle information is anomalous.

Accumulator <NUM> sequentially stores, in association with each other, the determination results sequentially output from determiner <NUM> and the location data corresponding to the determination results. Here, when the vehicle information is output from obtainer <NUM>, accumulator <NUM> stores the vehicle information once, and then when the determination result for the vehicle information is output from determiner <NUM>, stores the determination result in association with the vehicle information. The data structure of the vehicle information to be stored in accumulator <NUM> that has not yet been associated with the determination result will be described later with reference to <FIG>.

Anomaly series determiner <NUM> obtains the determination result sequentially output from determiner <NUM> (hereinafter, this determination result will be referred to as "the first determination result"). Subsequently, in the case where the first determination result indicates that the vehicle information is anomalous and a second determination result stored in accumulator <NUM> the last time indicates that the vehicle information is anomalous, when the distance between a first location indicated in first location data corresponding to the first determination result and a second location indicated in second location data associated with the second determination result is less than a predetermined distance, anomaly series determiner <NUM> determines the first determination result and the second determination result as being of the same anomaly series, and outputs the determination result.

Furthermore, in the case where anomaly series determiner <NUM> determines the first determination result and the second determination result as being of the same anomaly series, anomaly series determiner <NUM> determines that each of the first cell corresponding to the first determination result and the first cell corresponding to the second determination result is an anomalous cell.

Furthermore, in the case where anomaly series determiner <NUM> determines the first determination result and the second determination result as being of the same anomaly series, when a first anomalous cell corresponding to the first determination result and a second anomalous cell corresponding to the second determination result have a predetermined relationship, anomaly series determiner <NUM> further determines that a cell located between the first anomalous cell and the second anomalous cell is the anomalous cell.

Furthermore, in the case where anomaly series determiner <NUM> determines the first determination result and the second determination result as being of the same anomaly series, when there is a cell adjacent to the first anomalous cell and the second anomalous cell and the road area ratio in said cell is less than a predetermined area ratio, anomaly series determiner <NUM> further determines that said cell is the anomalous cell.

When the anomaly series determiner outputs a determination result indicating that the first determination result and the second determination result are of the same anomaly series, accumulator <NUM> associates the vehicle information associated with the first determination result and the vehicle information associated with the second determination result with the same anomaly series identifier, and stores the associated vehicle information. The data structure of the vehicle information to be stored in accumulator <NUM> that has already been associated with the determination result from determiner <NUM> and the anomaly series identifier will be described later with reference to <FIG>.

Display controller <NUM> causes display unit <NUM> to display at least a portion of the map having the grid with the plurality of cells. More specifically, display controller <NUM> causes display unit <NUM> to display at least a portion of the aforementioned map so that the anomalous cell set by anomaly series determiner <NUM> is displayed in a display format different from the display format of the other cells.

Next, the structure of data to be handled by anomaly detection device <NUM> will be described.

<FIG> is a schematic diagram illustrating one example of the data structure of vehicle information to be stored in accumulator <NUM> that has not yet been associated with the determination result from determiner <NUM>.

The vehicle information is generated each time obtainer <NUM> receives the vehicle control signal from vehicle <NUM> via network <NUM> and analyzes the vehicle control signal.

As illustrated in <FIG>, the vehicle information that has not yet been associated with the determination result includes: vehicle information ID which is an identifier for the vehicle information; vehicle ID which is an identifier for vehicle <NUM>; a time stamp; location data indicating the location of vehicle <NUM>; cell ID which is an identifier for a cell including the location of vehicle <NUM> (that is, the first cell); and information indicating the travel status of vehicle <NUM> (in this example, the travel speed, the steering angle, the yaw rate, the longitudinal acceleration, and the lateral acceleration).

<FIG> is a schematic diagram illustrating one example of the data structure of vehicle information to be stored in accumulator <NUM> that has already been associated with the determination result from determiner <NUM> and the anomaly series identifier.

As illustrated in <FIG>, the vehicle information that has already been associated with the determination result and the anomaly series identifier includes the determination result from determiner <NUM>, the anomaly level calculated by determiner <NUM>, and anomaly series ID which is an identifier for the anomaly series determined by anomaly series determiner <NUM> in addition to the vehicle information in <FIG> that has not yet been associated with the determination result.

<FIG> is a schematic diagram illustrating one example of the data structure of the evaluation model stored in model storage <NUM>.

As illustrated in <FIG>, the evaluation model includes: cell ID which is an identifier for the cell; the longitudes and latitudes of the four corners of a cell region which are for specifying the cell region; the number of data items used to create the evaluation model; and the minimum and maximum values of information indicating the travel status of the vehicle (in this example, the travel speed, the steering angle, the yaw rate, the longitudinal acceleration, and the lateral acceleration).

Determiner <NUM> calculates the anomaly level, for example, according to the degree of deviation of the travel status of the vehicle indicated in the vehicle information beyond the maximum or minimum value indicated in the evaluation model.

Furthermore, for example, when there are two or more evaluation cells, determiner <NUM> calculates the anomaly level according to the degree of deviation beyond the maximum value that is largest among those indicated in two or more evaluation models or the minimum value that is smallest among those indicated in the two or more evaluation models.

Furthermore, determiner <NUM> may calculate the anomaly level from the vehicle information and the evaluation model using a mechanical learning model learned in advance, for example. In this case, the evaluation model does not necessarily need to include the maximum and minimum values of the information indicating the travel status of the vehicle.

As described above, anomaly detection device <NUM> performs an anomaly detection process of detecting an anomaly in vehicle <NUM>.

Hereinafter, the anomaly detection process performed by anomaly detection device <NUM> will be described.

<FIG> is a flowchart of the anomaly detection process.

<FIG> is a sequence chart of information processing system <NUM> when anomaly detection device <NUM> performs the anomaly detection process.

The anomaly detection process starts by vehicle <NUM> transmitting the vehicle control signal to anomaly detection device <NUM> via network <NUM> (Step S10).

The vehicle control signal may be a CAN message or may be a signal measured by a sensor mounted on vehicle <NUM> or a device external to vehicle <NUM>, for example. Here, the CAN message refers to data that is transmitted and received between the ECUs via bus <NUM> and complies with the CAN protocol.

When the anomaly detection process is started, obtainer <NUM> receives the vehicle control signal, and obtains the vehicle information by analyzing the received vehicle control signal (Step S11).

When the vehicle information is obtained, determiner <NUM> refers to the location data included in the vehicle information, and determines, on the basis of the location of vehicle <NUM>, evaluation cells corresponding to the evaluation models to be referred to in the anomaly detection process (Step S12). A specific evaluation cell determination method will be described later with reference to <FIG> to be described later.

When the evaluation cells are determined, determiner <NUM> obtains from model storage <NUM> the evaluation models for the evaluation cells determined, and calculates, on the basis of the vehicle information and the evaluation models obtained, the anomaly level indicating the degree of anomaly of the vehicle information (Step S13).

When the anomaly level is calculated, determiner <NUM> corrects the anomaly level on the basis of the evaluation data count (Step S14). A specific method for correcting the anomaly level will be described later with reference to <FIG> to be described later.

When the anomaly level is corrected, determiner <NUM> determines, on the basis of the corrected anomaly level, whether the vehicle information is anomalous (Step S15). A specific determination method will be described later with reference to <FIG> to be described later.

After whether the vehicle information is anomalous is determined, in the case where the first determination result output from determiner <NUM> indicates that the vehicle information is anomalous and the second determination result stored in accumulator <NUM> the last time indicates that the vehicle information is anomalous, when the distance between the first location indicated in the first location data corresponding to the first determination result and the second location indicated in the second location data associated with the second determination result is less than the predetermined distance, anomaly series determiner <NUM> determines the first determination result and the second determination result as being of the same anomaly series (Step S16). A specific anomaly series determination method will be described later with reference to <FIG> and <FIG> to be described later.

When the anomaly series is determined, anomaly series determiner <NUM> interpolates an anomalous cell (Step S17). A specific anomalous cell interpolation method will be described later with reference to <FIG> and <FIG> to be described later.

When the anomalous cell is interpolated, display controller <NUM> outputs a display signal to display unit <NUM>, thus controls display content so that the anomalous cell is displayed in a display format different from the display format of the other cells, and causes display unit <NUM> to display at least a portion of the map having the grid with the plurality of cells (Step S18).

When the process in Step S18 is ended, anomaly detection device <NUM> ends the anomaly detection process.

In the anomaly detection process, when the display signal is output, display unit <NUM> obtains the display signal and displays an image based on the obtained display signal (Step S19). An example of the image displayed on display unit <NUM> will be described later with reference to <FIG> to be described later.

<FIG> is a flowchart illustrating one example of the evaluation cell determination method performed by determiner <NUM>. This determination method is one example of a determination method for determining, as the second cells, cells located on the radius of a circle centered on the first cell in which vehicle <NUM> is included.

When the travel speed of vehicle <NUM> indicated in the speed data is less than a first speed (for example, <NUM> per hour), that is, when vehicle <NUM> travels at low speed (Step S21: Low-speed travel), determiner <NUM> determines, as the second cells, eight cells obtained by removing the first cell from a total of nine cells of "<NUM> x <NUM> cells" located on the radius of the circle centered on the first cell (Step S22). In other words, <NUM> x <NUM> cells including the first cell are determined as the evaluation cells.

<FIG> is a schematic diagram illustrating the aforementioned eight cells determined by determiner <NUM>.

When the travel speed of vehicle <NUM> indicated in the speed data is greater than or equal to the first speed, but less than a second speed (for example, <NUM> per hour), that is, when vehicle <NUM> travels at middle speed (Step S21: Middle-speed travel), determiner <NUM> determines, as the second cells, <NUM> cells obtained by removing the first cell from a total of <NUM> cells of "<NUM> x <NUM> cells" located on the radius of the circle centered on the first cell (Step S23). In other words, <NUM> x <NUM> cells including the first cell are determined as the evaluation cells.

<FIG> is a schematic diagram illustrating the aforementioned <NUM> cells determined by determiner <NUM>.

When the travel speed of vehicle <NUM> indicated in the speed data is greater than or equal to the second speed, that is, when vehicle <NUM> travels at high speed (Step S21: High-speed travel), determiner <NUM> determines, as the second cells, <NUM> cells obtained by removing the first cell from a total of <NUM> cells of "<NUM> x <NUM> cells" located on the radius of the circle centered on the first cell (Step S24). In other words, <NUM> x <NUM> cells including the first cell are determined as the evaluation cells.

Thus, determiner <NUM> sets first predetermined positional relationship and second predetermined positional relationship so that the number of second cells each having the second predetermined positional relationship is greater than the number of second cells each having the first predetermined positional relationship in the case where when the travel speed of vehicle <NUM> is less than the first speed, determiner <NUM> sets the first predetermined positional relationship to the predetermined positional relationship and when the travel speed of vehicle <NUM> is greater than or equal to the first speed, determiner <NUM> sets the second predetermined positional relationship to the predetermined positional relationship.

<FIG> is a flowchart illustrating another example of the evaluation cell determination method performed by determiner <NUM>. This determination method is one example of a determination method for determining, as the second cells, cells located in specific directions with respect to the first cell in which vehicle <NUM> is included.

When the travel speed of vehicle <NUM> indicated in the speed data is less than the first speed (for example, <NUM> per hour), that is, when vehicle <NUM> travels at low speed (Step S31: Low-speed travel), determiner <NUM> determines, as the second cells, eight cells obtained by removing the first cell from a total of nine cells of "<NUM> x <NUM> cells" located on the radius of the circle centered on the first cell (Step S32). In other words, <NUM> x <NUM> cells including the first cell are determined as the evaluation cells.

When the travel speed of vehicle <NUM> indicated in the speed data is greater than or equal to the first speed, but less than the second speed (for example, <NUM> per hour), that is, when vehicle <NUM> travels at middle speed (Step S31: Middle-speed travel), determiner <NUM> determines, as the second cells, <NUM> cells obtained by adding, to the aforementioned eight cells, three cells located ahead of the vehicle in the vehicle travel direction and three cells located behind the vehicle in the vehicle travel direction (Step S33). In other words, <NUM> x <NUM> cells including the first cell and three cells located each forward and backward in the vehicle travel direction are determined as the evaluation cells.

When the travel speed of vehicle <NUM> indicated in the speed data is greater than or equal to the second speed, that is, when vehicle <NUM> travels at high speed (Step S31: High-speed travel), determiner <NUM> determines, as the second cells, a total of <NUM> cells obtained by adding, to the aforementioned <NUM> cells, three cells located ahead of the vehicle in the vehicle travel direction and three cells located behind the vehicle in the vehicle travel direction (Step S34). In other words, <NUM> x <NUM> cells including the first cell and six cells located each forward and backward in the vehicle travel direction are determined as the evaluation cells.

Thus, determiner <NUM> sets first predetermined positional relationship and second predetermined positional relationship so that the number of second cells arranged in a first direction (in this example, the vehicle travel direction) from the first cell among the second cells each having the second predetermined positional relationship is greater than the number of second cells arranged in the first direction from the first cell among the second cells each having the first predetermined positional relationship in the case where when the travel speed of vehicle <NUM> is less than the first speed, determiner <NUM> sets the first predetermined positional relationship to the predetermined positional relationship and when the travel speed of vehicle <NUM> is greater than or equal to the first speed, determiner <NUM> sets the second predetermined positional relationship to the predetermined positional relationship.

<FIG> is a flowchart illustrating one example of a method in which determiner <NUM> corrects the anomaly level.

In creating the evaluation model, a certain number of data items are needed in order to sufficiently cover data within cells. However, since the grid with the plurality of cells is imposed on the map, there are cases where the number of data items used to create the evaluation model for each cell is biased. Therefore, if the number of data items used to create the evaluation model is not enough, determiner <NUM> corrects the anomaly level so as to reflect, in the anomaly level, the fact that the number of data items is not enough.

The anomaly level to be corrected by determiner <NUM> is an anomaly level indicating that the vehicle information is anomalous. Therefore, determiner <NUM> determines whether the anomaly level is greater than or equal to a threshold value indicating that the vehicle information is anomalous (Step S41), and when determiner <NUM> determines that the anomaly level is less than the threshold value (Step S41: No), determiner <NUM> does not correct the anomaly level.

When determiner <NUM> determines that the anomaly level is greater than or equal to the threshold value (Step S41: Yes), determiner <NUM> checks an evaluation data count which is the sum of data items used to create the evaluation model for each cell included in the evaluation cells (Step S42).

When the evaluation data count is greater than or equal to the first predetermined number indicating that the number of data items used to create the evaluation model is enough (First predetermined number ≤ evaluation data count in Step S42) in the process in Step S42, determiner <NUM> does not correct the anomaly level because the number of data items used to create the evaluation model is enough.

Here, the first predetermined number may be, for example, a value obtained by multiplying the number of cells included in the evaluation cells by a predetermined number, that is, a value indicating that the number of data items used to create the evaluation model per cell is enough.

When the evaluation data count is greater than or equal to the second predetermined number indicating that the number of data items used to create the evaluation model is deficient, but less than the first predetermined number (Second predetermined number ≤ evaluation data count < first predetermined number in Step S42) in the process in Step S42, determiner <NUM> corrects the anomaly level to reduce the degree of anomaly because the number of data items used to create the evaluation model is not enough, but is not deficient (Step S44). At this time, determiner <NUM> corrects the degree of anomaly by multiplying the degree of anomaly by the ratio of the evaluation data count to the first predetermined number.

Here, the second predetermined number may be, for example, a value obtained by multiplying the number of cells included in the evaluation cells by a predetermined number, that is, a value indicating that the number of data items used to create the evaluation model per cell is deficient.

When the evaluation data count is less than the second predetermined number (Evaluation data count < second predetermined number) in the process in Step S42, determiner <NUM> corrects the anomaly level to reduce the degree of anomaly until the degree of anomaly indicates that the vehicle information is normal, that is, to have a normal value, because the number of data items used to create the evaluation model is deficient (Step S43).

<FIG> is a flowchart illustrating one example of a determination method in which determiner <NUM> determines whether the vehicle information is anomalous.

Determiner <NUM> determines whether the anomaly level corrected or not corrected by the anomaly level correction method illustrated in <FIG> is greater than or equal to the threshold value indicating that the vehicle information is anomalous (Step S51). When determiner <NUM> determines that the anomaly level is greater than or equal to the threshold value in the process in Step S51 (Step S51: Yes), determiner <NUM> determines that the vehicle information is anomalous (Step S53), and when determiner <NUM> determines that the anomaly level is less than the threshold value (Step S51: No), determiner <NUM> determines that the vehicle information is normal (Step S52). Subsequently, accumulator <NUM> stores the determination result from determiner <NUM> in association with the vehicle information (Step S54).

<FIG> is a flowchart illustrating one example of an anomaly series determination method performed by anomaly series determiner <NUM>.

When determiner <NUM> determines that the vehicle information is anomalous, anomaly series determiner <NUM> determines whether said anomaly belongs to the same anomaly series of anomalies that continuously occur from the anomaly determined in the past. The determination result of this determination can be useful, for example, in providing a notification to the driver of vehicle <NUM> and an analytical work by an analysist who deals with the anomaly.

When determiner <NUM> determines whether the vehicle information is anomalous, anomaly series determiner <NUM> checks whether the determination result (hereinafter also referred to as "the first determination result") is anomalous (Step S61).

When the first determination result is "normal" in the process in Step S61 (Step S61: No), anomaly series determiner <NUM> does not determine that the first determination result is of the same anomaly series as the first determination result. Therefore, accumulator <NUM> assigns information that does not indicate a specific anomaly series, for example, signal "-", to the anomaly series ID of vehicle information corresponding to the first determination result, and stores the vehicle information, for example.

When the first determination result is "anomalous" in the process in Step S61 (Step S61: Yes), anomaly series determiner <NUM> calculates the travel distance of vehicle <NUM> from the first location indicated in the vehicle information corresponding to the first determination result to the second location indicated in the vehicle information that is the latest vehicle information stored in accumulator <NUM> and has been determined by determiner <NUM> as being anomalous (hereinafter also referred to as "the second determination result") (Step S62).

When the travel distance of vehicle <NUM> is calculated, anomaly series determiner <NUM> determines whether the travel distance of the vehicle is less than a predetermined distance (Step S63).

When the travel distance of the vehicle is determined as being less than the predetermined distance in the process in Step S63 (Step S63: Yes), anomaly series determiner <NUM> determines that the first determination result and the second determination result are of the same anomaly series (Step S64). Therefore, accumulator <NUM> assigns the same anomaly series ID as the anomaly series ID of the vehicle information corresponding to the second determination result, to the anomaly series ID of the vehicle information corresponding to the first determination result, and stores the vehicle information, for example.

When the travel distance of the vehicle is determined as being greater than or equal to the predetermined distance in the process in Step S63 (Step S63: No), anomaly series determiner <NUM> determines that the first determination result and the second determination result are not of the same anomaly series (Step S65). Therefore, accumulator <NUM> assigns new anomaly series ID different from the anomaly series ID of the vehicle information corresponding to the second determination result, to the anomaly series ID of the vehicle information corresponding to the first determination result, and stores the vehicle information, for example.

<FIG> is a flowchart illustrating another example of an anomaly series determination method performed by anomaly series determiner <NUM>.

The anomaly series determination method illustrated in <FIG> is one example of the determination method performed when the predetermined distance is a fixed value. In contrast, the anomaly series determination method illustrated in <FIG> is one example of the determination method performed when the predetermined distance depends on the travel speed of vehicle <NUM>.

Therefore, the anomaly series can be determined with higher accuracy in the anomaly series determination method illustrated in <FIG> than in the anomaly series determination method illustrated in <FIG>.

The anomaly series determination method illustrated in <FIG> is a determination method different from the anomaly series determination method illustrated in <FIG> in that the process in Step S76 to the process in Step S79 are additionally included. Therefore, the following description focuses on the process in Step S76 to the process in Step S79.

When the travel distance of vehicle <NUM> is calculated in the process in Step S62, anomaly series determiner <NUM> checks the travel speed of vehicle <NUM> indicated in the speed data (Step S76).

When the travel speed of vehicle <NUM> is less than the first speed (for example, <NUM>/h), that is, when vehicle <NUM> travels at low speed (Step S76: Low-speed travel) in the process in Step S76, anomaly series determiner <NUM> sets <NUM> to the predetermined distance (Step S77).

When the travel speed of vehicle <NUM> is greater than or equal to the first speed, but less than the second speed (for example, <NUM>/h), that is, when vehicle <NUM> travels at middle speed (Step S76: Middle-speed travel) in the process in Step S76, anomaly series determiner <NUM> sets <NUM> to the predetermined distance (Step S78).

When the travel speed of vehicle <NUM> is greater than or equal to the second speed, that is, when vehicle <NUM> travels at high speed (Step S76: High-speed travel) in the process in Step S76, anomaly series determiner <NUM> sets <NUM> to the predetermined distance (Step S79).

When the process in Step S77, the process in Step S78, or the process in Step S79 is ended, the processing proceeds to the process in Step S63.

<FIG> is a flowchart illustrating one example of an anomalous cell interpolation method performed by anomaly series determiner <NUM>.

When vehicle <NUM> travels at high speed as compared to the cell size or when the location data does not accurately indicate the location of vehicle <NUM> due to the effects of noise or the like, for example, there are cases where the anomalous cells corresponding to the determination results determined as being of the same anomaly series are not necessarily adjacent to each other. In the case where the anomalous cells corresponding to the determination results determined as being of the same anomaly series are not adjacent to each other, a cell located between these anomalous cells is also regarded as an anomalous cell; thus, it is possible to more accurately determine a section in which an anomaly related to vehicle <NUM> is occurring.

Anomaly series determiner <NUM> obtains vehicle information assigned with the same anomaly series ID from the vehicle information stored in accumulator <NUM> (Step S81), and checks whether the anomalous cells corresponding to the determination results determined as being of the same anomaly series include anomalous cells that are not adjacent to each other (Step S82).

When there are no anomalous cells that are not adjacent to each other in the process in Step S82 (Step S82: No), anomaly series determiner <NUM> ends the process.

When there are anomalous cells that are not adjacent to each other in the process in Step S82 (Step S82: Yes), anomaly series determiner <NUM> checks the travel speed of vehicle <NUM> indicated in the speed data (Step S83).

When the travel speed of vehicle <NUM> is less than the first speed (for example, <NUM>/h), that is, when vehicle <NUM> travels at low speed (Step S83: Low-speed travel) in the process in Step S83, anomaly series determiner <NUM> determines that the number of anomalous cells to be interpolated is one (Step S84).

When the travel speed of vehicle <NUM> is greater than or equal to the first speed, but less than the second speed (for example, <NUM>/h), that is, when vehicle <NUM> travels at middle speed (Step S83: Middle-speed travel) in the process in Step S83, anomaly series determiner <NUM> determines that the number of anomalous cells to be interpolated is two (Step S85).

When the travel speed of vehicle <NUM> is greater than or equal to the second speed, that is, when vehicle <NUM> travels at high speed (Step S83: High-speed travel) in the process in Step S83, anomaly series determiner <NUM> determines that the number of anomalous cells to be interpolated is three (Step S86).

When the number of anomalous cells to be interpolated is determined through the process in Step S84, the process in Step S85, or the process in Step S86, anomaly series determiner <NUM> determines whether the number of cells located between the anomalous cells that are not adjacent to each other is the determined number of anomalous cells (Step S87).

When the number of cells located between the anomalous cells that are not adjacent to each other is the determined number of anomalous cells in the process in Step S87 (Step S87: Yes), anomaly series determiner <NUM> determines a cell located between the anomalous cells as an anomalous cell to interpolate the anomalous cell (Step S88).

When the number of cells located between the anomalous cells that are not adjacent to each other is not the determined number of anomalous cells in the process in Step S87 (Step S87: No), anomaly series determiner <NUM> does not determine a cell located between the anomalous cells as an anomalous cell to not interpolate the anomalous cell.

<FIG> is a flowchart illustrating another example of the anomalous cell interpolation method performed by anomaly series determiner <NUM>.

In the case where a grid with a plurality of cells is imposed on a map, there may be a cell in which the ratio of a road area included in said cell is relatively low. When the ratio of a road area included in a cell is relatively low, the vehicle information of said cell is less likely to be obtained. Therefore, it is anticipated that a cell to be determined as an anomalous cell may not be determined as an anomalous cell. In order to deal with this, in a travel path of vehicle <NUM>, a cell in which the ratio of a road area included in said cell is relatively low and which is adjacent to two or more anomalous cells is also determined as an anomalous cell, and thus a cell having a relatively low road area ratio can be determined as an anomalous cell.

Anomaly series determiner <NUM> obtains the vehicle information assigned with the same anomaly series ID from the vehicle information stored in accumulator <NUM> (Step S91).

When the vehicle information is obtained, anomaly series determiner <NUM> obtains map information of the neighborhood of the anomalous cell corresponding to the obtained vehicle information (Step S92).

When the map information is obtained, anomaly series determiner <NUM> determines, on the basis of the map information, whether the cells in the travel path of vehicle <NUM> include a cell that has not been determined as an anomalous cell and in which the road area ratio is less than a predetermined area ratio (Step S93).

When there is a corresponding cell in the process in Step S93 (Step S93: Yes), anomaly series determiner <NUM> determines whether the corresponding cell is adjacent to two or more anomalous cells (Step S94).

When there is no corresponding cell in the process in Step S93 (Step S93: No), anomaly series determiner <NUM> ends the process.

When the corresponding cell is adjacent to two or more anomalous cells in the process in Step S94 (Step S94: Yes), anomaly series determiner <NUM> determines the corresponding cell as an anomalous cell to interpolate the anomalous cell (Step S95).

When the corresponding cell is not adjacent to two or more anomalous cells in the process in Step S94 (Step S94: No), anomaly series determiner <NUM> does not determine the corresponding cell as an anomalous cell to not interpolate the anomalous cell.

When anomaly series determiner <NUM> interpolates the anomalous cell, display controller <NUM> causes display unit <NUM> to display at least a portion of the map having the grid with the plurality of cells in such a manner that said anomaly cell is displayed in a display format different from the display format of the other cells.

<FIG> is a schematic diagram illustrating one example of an image which display controller <NUM> causes display unit <NUM> to display. In <FIG>, the cells shaded with diagonal lines are the anomalous cells determined by anomaly series determiner <NUM>, and the black-filled circles indicate the locations of vehicle <NUM> indicated in the vehicle information determined by determiner <NUM> as being anomalous.

In this manner, display controller <NUM> can cause display unit <NUM> to effectively display the detection result of anomaly detection device <NUM> in order to make the detection result useful, for example, in providing a notification to the driver of vehicle <NUM> and an analytical work by an analysist who deals with the anomaly.

As described above, anomaly detection device <NUM> determines, on the basis of the evaluation models for evaluation cells each having a predetermined positional relationship with the location of vehicle <NUM>, whether the vehicle information is anomalous. Therefore, with anomaly detection device <NUM>, it is possible to detect a vehicle-related anomaly on the basis of the evaluation models for a local region corresponding to the location of vehicle <NUM>. Thus, with anomaly detection device <NUM>, it is possible to detect anomalies with improved accuracy compared to the conventional anomaly detection device.

Furthermore, with anomaly detection device <NUM>, the range of cells to be used as the evaluation cells can be more appropriately determined according to the travel speed of vehicle <NUM>. Moreover, with anomaly detection device <NUM>, in the case where the number of data items used to create the evaluation model is not enough due to a grid with a plurality of cells being imposed on the map, resulting in the number of data items used to create the evaluation model for each cell being biased, the anomaly level can be corrected so as to reflect the fact that the number of data items is not enough. In addition, with anomaly detection device <NUM>, it is possible to group, as anomalies of the same anomaly series, anomalies that occur continuously from an anomaly determined in the past.

Thus, with anomaly detection device <NUM>, it is possible to effectively detect an anomaly in vehicle <NUM>.

As described above, the example is presented as an exemplification of the technique disclosed in the present application. However, the present disclosure is not limited to this example. Various modifications to the present example that can be conceived by those skilled in the art, and forms configured by combining structural elements in different examples, without departing from the teachings of the present disclosure may be included in the scope of one or more aspects of the present disclosure.

Some or all of the structural elements included in anomaly detection device <NUM> may be configured from a single system Large Scale Integration (LSI), for example. A system LSI is a super-multifunction LSI manufactured with a plurality of components integrated on a single chip, and is specifically a computer system configured of a microprocessor, read-only memory (ROM), and random-access memory (RAM), for example. A computer program is stored in the ROM. The system LSI achieves its function as a result of the microprocessor operating according to the computer program.

Note that although a system LSI is mentioned here, there are instances where the designations IC, LSI, super LSI, and ultra LSI are used depending on the level of integration. Furthermore, the method of circuit integration is not limited to LSIs, and implementation through a dedicated circuit or a general-purpose processor is also possible. A field programmable gate array (FPGA) which allows programming after LSI manufacturing or a reconfigurable processor which allows reconfiguration of the connections and settings of the circuit cells inside the LSI may also be used.

In addition, depending on the emergence of circuit integration technology that replaces LSI due to progress in semiconductor technology or other derivative technology, it is obvious that such technology may be used to integrate the function blocks. Possibilities in this regard include the application of biotechnology and the like.

(<NUM>) One aspect of the present disclosure may be not only anomaly detection device <NUM> described above, but also an anomaly detection method including, as steps, characteristic components included in anomaly detection device <NUM>. Furthermore, one aspect of the present disclosure may also be a computer program for causing a computer to execute the respective characteristic steps included in the anomaly detection method. Moreover, one aspect of the present disclosure may also be a non-transitory computer-readable recording medium on which this sort of computer program is recorded.

Claim 1:
An anomaly detection device (<NUM>) for detecting vehicle information anomalies, comprising:
an obtainer (<NUM>) configured to obtain vehicle information related to a status of a vehicle (<NUM>) and including location data indicating a location of the vehicle (<NUM>), a travel status of the vehicle (<NUM>), and a cell ID which is an identifier for a first cell including the location of the vehicle (<NUM>);
a model storage (<NUM>) configured to store a stored plurality of evaluation models, wherein the model storage (<NUM>) stores, for each of a plurality of cells of a grid imposed on a map, an evaluation model for evaluating the vehicle information of the vehicle located at the cell; and
a determiner (<NUM>) configured to refer to the location data included in the vehicle information, and to determine, on the basis of the locations of the vehicle (<NUM>), a plurality of evaluation cells corresponding to an obtained plurality of evaluation models, wherein when the determined plurality of evaluation cells are determined, the determiner (<NUM>) is configured to obtain from the storage (<NUM>) the obtained plurality of evaluation models for the plurality evaluation cells determined,
to calculate, based on the vehicle information and the obtained plurality of evaluation models, an anomaly level indicating a degree of anomaly of the vehicle information, wherein the anomaly level is calculated according to a degree of deviation of the travel status of the vehicle indicated in the vehicle information and values indicated in the plurality of evaluation models;
to determine, based on the anomaly level, whether the vehicle information is anomalous, and
to output, a determination result, the obtained plurality of evaluation models corresponding to the determined evaluation cells including the first cell including the location of the vehicle indicated in the location data and one or more second cells each having a predetermined positional relationship with the first cell.