Unauthorized communication detection reference deciding method, unauthorized communication detection reference deciding system, and non- transitory computer-readable recording medium storing a program

Abstract

A reference message determining method is used in unauthorized communication detection in an onboard network system that is executed by an information processing system including at least one memory. The onboard network system including a network and one or more electronic control units connected to the network. The method includes executing unauthorized activity detection for determining whether or not a message received from the network is an attack message. A message that could not be determined to be unauthorized is regarded as a gray message. The method also includes determining whether or not the gray message is unauthorized again at a predetermined timing. In a case where the gray message is determined to be an attack message in the unauthorized-activity-detection executing operation, a communication pattern is identified based on information relating to the gray message and information relating to the plurality of the received messages previously determined as unauthorized.