A vehicle apparatus, comprising: a plurality of in-vehicle apparatuses installed in a vehicle; a determiner that determines whether or not a malicious attack is being carried out on the plurality of in-vehicle apparatuses based on anomaly detection in the plurality of in-vehicle apparatuses , and a controller that, in accordance with a depth of penetration of a malicious attack, changes at least one of a communication method with an outside of the vehicle or a defense method against the malicious attack, and changes a storage method for logs pertaining to the plurality of in-vehicle apparatuses , based on an anomaly occurrence order in the plurality of in-vehicle apparatus , wherein the determiner determines that the malicious attack is being carried out when the anomaly occurrence order matches a predetermined order, and the predetermined order is an order in which at least two in-vehicle apparatuses of the plurality of in-vehicle apparatuses are arranged from close to an external network to far from the external network in a predetermined penetration route, wherein the in-vehicle apparatus close to the external network is an information-related in-vehicle apparatus which has a shallow relationship with a drive control of the vehicle , whereas the in-vehicle apparatus far from the external network is a control-related in-vehicle apparatus which has a deep relationship with the drive control of the vehicle , wherein when changing the storage method in accordance with the depth of penetration of the malicious attack, the controller changes the storage method by changing an in-vehicle apparatus that is used as a storage location of the logs, among the plurality of in-vehicle apparatuses , in accordance with the depth of penetration. a plurality of in-vehicle apparatuses installed in a vehicle; a determiner that determines whether or not a malicious attack is being carried out on the plurality of in-vehicle apparatuses based on anomaly detection in the plurality of in-vehicle apparatuses , and a controller that, in accordance with a depth of penetration of a malicious attack, changes at least one of a communication method with an outside of the vehicle or a defense method against the malicious attack, and changes a storage method for logs pertaining to the plurality of in-vehicle apparatuses , the predetermined order is an order in which at least two in-vehicle apparatuses of the plurality of in-vehicle apparatuses are arranged from close to an external network to far from the external network in a predetermined penetration route, wherein the in-vehicle apparatus close to the external network is an information-related in-vehicle apparatus which has a shallow relationship with a drive control of the vehicle , whereas the in-vehicle apparatus far from the external network is a control-related in-vehicle apparatus which has a deep relationship with the drive control of the vehicle , wherein when changing the storage method in accordance with the depth of penetration of the malicious attack, the controller changes the storage method by changing an in-vehicle apparatus that is used as a storage location of the logs, among the plurality of in-vehicle apparatuses , in accordance with the depth of penetration. <EOS>