Information processing device and method of controlling information processing device

Abstract

A log management module includes: an anomaly detection information receiver that receives anomaly detection information; a detection history information storage that stores detection history information; an attack route information storage that stores attack route information indicating a candidate for an attack route in the CAN bus; an attack route estimator that estimates an attack route including the specific device, based on the attack route information; and a collection target determiner that, upon receipt of the anomaly detection information by the anomaly detection information receiver, determines, as collection targets whose log information for analysis which is for analyzing presence or absence of an undetected anomaly in the CAN bus is to be collected, one or more candidate devices which have been narrowed down from the devices, are present on the attack route estimated by the attack route estimator, and have no history of anomaly detection.