Detection device, detection system and detection method

Abstract

A detection device for detecting an abnormality in a network in which a plurality of communication devices transmit and receive a plurality of messages including a response message, the detection device being provided with: an acquisition unit for acquiring a plurality of pieces of load information; the plurality of pieces of load information respectively represent communication loads of a plurality of parts in the network and respectively represent communication loads generated due to the fact that a sending source is the message of the corresponding communication device; and a detection unit that detects an abnormality in the network on the basis of the matching of the plurality of pieces of load information acquired by the acquisition unit.

Description

Technical Field

[0001] The present disclosure relates to a detection device, a detection system and a detection method.

[0002] This application claims the benefit of priority based on Japanese patent application No. 2022-88140, filed on May 31, 2022, and incorporates the entire disclosure of that application herein. Background Art

[0003] Patent document 1 (International Publication No. 2020 / 234940) discloses the following device for inferring IP addresses requiring attention. That is, the device for inferring IP addresses requiring attention comprises: an acquisition unit that acquires IP addresses associated with an object as IP addresses requiring attention based on the exposure of the object mentioned in the mass media; and a sending unit that sends the IP addresses requiring attention to a NW monitoring information database device.

[0004] In addition, Patent Document 2 (Japanese Patent Application No. 2021-507375) discloses the following method for monitoring a device. That is, the method includes: a step of accessing a first indicator associated with a first device and indicating a security risk level; a step of accessing communication information associated with the first device; a step of determining, by a processing device, a second device that communicates with the first device based on the communication information; a step of setting a second indicator associated with the second device based on information associated with the first device; and a step of saving the second indicator associated with the second device.

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: International Publication No. 2020 / 234940

[0008] Patent Document 2: Japanese Patent Application No. 2021-507375 Summary of the invention

[0009] The detection device disclosed in the present invention is a detection device for detecting anomalies in a network. In the network, multiple messages including response messages are sent and received by multiple communication devices. The detection device comprises: an acquisition unit, which acquires multiple load information, each of which represents the communication loads at multiple locations in the network and each represents the communication loads generated by the messages from different sending sources; and a detection unit, which detects the anomalies in the network based on the matching of the multiple load information acquired by the acquisition unit.

[0010] The detection system disclosed in the present invention is a detection system for detecting anomalies in a network, in which a plurality of messages including response messages are sent and received by a plurality of communication devices, and the detection system comprises: a plurality of extraction devices for respectively extracting the messages from different sending sources that respectively pass through different parts of the network; a plurality of observation units for respectively observing the messages extracted by the plurality of extraction devices; a load calculation unit for generating a plurality of load information respectively representing the communication loads of a plurality of parts of the network based on the observation results of the plurality of observation units; and a detection unit for detecting anomalies in the network based on the matching of the plurality of load information generated by the load calculation unit.

[0011] The detection method disclosed in the present invention is a detection method in a detection device for detecting anomalies in a network. In the network, multiple messages including response messages are sent and received by multiple communication devices. The detection method includes the following steps: obtaining multiple load information, each of which respectively represents the communication loads of multiple parts in the network and respectively represents the communication loads generated by the messages from different sending sources; and detecting the anomalies in the network based on the matching of the multiple load information obtained.

[0012] One aspect of the present disclosure can be implemented not only as a detection device having such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that implements part or all of the detection device. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a diagram showing an example of the configuration of a detection system and a network to be detected according to the first embodiment of the present disclosure.

[0014] Figure 2 This is a diagram showing a state in which a rogue device is added to a network that is a detection target of the detection system according to the first embodiment of the present disclosure.

[0015] Figure 3 It is a diagram showing an example of detection processing in the detection device according to the first embodiment of the present disclosure.

[0016] Figure 4 This is a flowchart that defines an example of an operation procedure when the detection device according to the first embodiment of the present disclosure performs a detection process.

[0017] Figure 5 It is a diagram showing an example of the configuration of a detection system and a network as a detection target according to the second embodiment of the present disclosure.

[0018] Figure 6This is a diagram showing a state in which a rogue device is added to a network to be detected by the detection system according to the second embodiment of the present disclosure.

[0019] Figure 7 It is a diagram showing an example of detection processing in the detection device according to the second embodiment of the present disclosure.

[0020] Figure 8 This is a diagram showing an example of a sequence of detection processing in the detection system according to the second embodiment of the present disclosure.

[0021] Fig. 9 It is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a third embodiment of the present disclosure.

[0022] Fig.10 It is a diagram showing an example of detection processing in the detection device according to the third embodiment of the present disclosure.

[0023] Fig.11 It is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a fourth embodiment of the present disclosure.

[0024] Fig.12 This is a diagram showing a state in which an unauthorized device is added to a network that is a detection target of the detection system according to the fourth embodiment of the present disclosure.

[0025] Fig.13 It is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a fifth embodiment of the present disclosure.

[0026] Fig.14 It is a diagram showing an example of detection processing in the detection device according to the fifth embodiment of the present disclosure.

[0027] Fig.15 It is a diagram showing an example of a response information table stored in a storage unit in a detection device according to a fifth embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] Conventionally, technologies for detecting abnormalities such as unauthorized access to a network have been proposed.

[0029] [Technical Problems to be Solved by the Present Disclosure]

[0030] Although the technology described in Patent Document 1 detects the increase of communication load quickly by monitoring the IP address of interest on the network, it is necessary to obtain the information of communication load in normal state in advance. In addition, in the technology described in Patent Document 1, it is necessary to obtain the information of communication load in normal state in the changed network again every time the network structure is changed. The technology described in Patent Document 2 also needs to obtain the information of flow rate in normal state in advance, and it is necessary to obtain the information of flow rate in normal state in the changed network again every time the network structure is changed.

[0031] There is a demand for a technology that exceeds the technologies described in Patent Documents 1 and 2 and can stably detect anomalies in a network using less information.

[0032] The present disclosure is completed to solve the above-mentioned technical problems, and its purpose is to provide a detection device, a detection system and a detection method that can stably detect anomalies in a network using less information.

[0033] [Effects of the present disclosure]

[0034] According to the present disclosure, it is possible to stably detect anomalies in a network using less information.

[0035] [Description of Embodiments of the Present Disclosure]

[0036] First, the contents of the embodiments of the present disclosure are listed and described.

[0037] (1) The detection device involved in the embodiment of the present disclosure is a detection device for detecting anomalies in a network. In the network, multiple messages including response messages are sent and received by multiple communication devices. The detection device comprises: an acquisition unit, which acquires multiple load information, each of which represents the communication loads at multiple locations in the network and each represents the communication loads generated by the messages from different sending sources; and a detection unit, which detects the anomaly in the network based on the matching of the multiple load information acquired by the acquisition unit.

[0038] In this way, by detecting abnormalities in the network based on the matching of multiple load information indicating communication loads at multiple locations in the network, it is possible to detect abnormalities without using load information when the network is normal, and thus it is possible to detect abnormalities without having to obtain load information when the network is normal in advance or to obtain load information when the network structure is changed after the change. Therefore, it is possible to stably detect abnormalities in the network using less information.

[0039] (2) In the above (1), the acquisition unit may also acquire three or more load information respectively representing the communication loads of three or more parts in the network, and the detection unit may also determine the abnormal part in the network based on the matching of each combination of two of the load information included in the three or more load information.

[0040] This makes it possible to identify abnormal locations in the network in more detail.

[0041] (3) In the above (1) or (2), in the network, the message can be sent and received between the first communication device and multiple communication devices different from the first communication device, and the acquisition unit can also obtain the first load information indicating the communication volume of the message whose sending source is the first communication device and the second load information indicating the communication volume of the message whose sending source is the communication device different from the first communication device. The detection unit can also detect the abnormality in the network based on the matching between the communication volume of the message shown by the first load information and the communication volume of the message shown by the second load information.

[0042] With such a structure, it is possible to detect abnormality in a network performing one-to-many communication.

[0043] (4) In any one of the above (1) to (3), the detection device may also include an observation unit that observes the output of the extracted message by the extraction device, the extraction device extracts the message sent from the communication device and outputs the extracted message to other communication devices and the detection device, and the acquisition unit may also generate the load information based on the observation results of the observation unit.

[0044] With such a configuration, the degree of freedom of the measurement position of the communication load in the network can be increased.

[0045] (5) In the above (3), the acquisition unit may also acquire the load information representing the communication load calculated based on the number of response messages and the communication volume of the messages sent by the first communication device, wherein the number of response messages is predicted based on the type of the messages sent by the first communication device.

[0046] Through such a structure, it is possible to detect anomalies in the network using load information based on the number of response messages to the first communication device, wherein the number of response messages is predicted based on the type of message, thereby being able to detect anomalies in a network that sends and receives multiple types of messages such as multicast messages and broadcast messages.

[0047] (6) In the above (5), the acquisition unit may acquire the load information indicating the communication load calculated based on the number of response messages, wherein the number of response messages is also predicted based on header information of the message sent by the first communication device.

[0048] With such a configuration, the number of response messages can be predicted based on the type and content of the messages, and thus abnormalities in a network that transmits and receives a variety of messages can be detected more accurately.

[0049] (7) The detection system involved in the embodiment of the present disclosure is a detection system for detecting anomalies in a network, in which a plurality of messages including response messages are sent and received by a plurality of communication devices, and the detection system comprises: a plurality of extraction devices, respectively extracting the messages from different sending sources that pass through different parts of the network; a plurality of observation units, respectively observing the messages extracted by the plurality of extraction devices; a load calculation unit, generating a plurality of load information respectively representing the communication loads of a plurality of parts of the network based on the observation results of the plurality of observation units; and a detection unit, detecting anomalies in the network based on the matching of the plurality of load information generated by the load calculation unit.

[0050] In this way, by detecting abnormalities in the network based on the matching of multiple load information indicating communication loads at multiple locations in the network, it is possible to detect abnormalities without using load information when the network is normal, and thus it is possible to detect abnormalities without having to obtain load information when the network is normal in advance or to obtain load information when the network structure is changed after the change. Therefore, it is possible to stably detect abnormalities in the network using less information.

[0051] (8) The detection method involved in the embodiment of the present disclosure is a detection method in a detection device for detecting anomalies in a network, in which a plurality of messages including response messages are sent and received by a plurality of communication devices, and the detection method comprises the following steps: obtaining a plurality of load information, wherein the plurality of load information respectively represent the communication loads at a plurality of locations in the network and respectively represent the communication loads generated by the messages from different sending sources; and detecting the anomalies in the network based on the matching of the plurality of load information obtained.

[0052] In this way, by using a method for detecting anomalies in a network based on the matching of multiple load information respectively indicating communication loads at multiple locations in the network, anomalies can be detected without using load information when the network is normal, and thus anomalies can be detected without obtaining load information when the network is normal in advance or obtaining load information when the network structure is changed after the change. Therefore, anomalies in the network can be stably detected using less information.

[0053] The following is an explanation of the embodiments of the present disclosure using the accompanying drawings. It should be noted that the same or corresponding parts in the drawings are marked with the same reference numerals, and their descriptions are not repeated. In addition, at least a part of the embodiments described below can also be arbitrarily combined.

[0054] <First Embodiment>

[0055] [Structure and basic movements]

[0056] Figure 1 1 is a diagram showing an example of the configuration of a detection system and a network to be detected according to the first embodiment of the present disclosure. Figure 1 , the detection system 301 includes the detection device 101 and the extraction devices 121A and 121B. The extraction devices 121A and 121B are examples of extraction devices. The extraction device 121A includes communication ports PA1 and PA2. The extraction device 121B includes communication ports PB1 and PB2. The extraction device 121A sends a message received via one of the communication ports PA1 and PA2 via the other of the communication ports PA1 and PA2. The extraction device 121B sends a message received via one of the communication ports PB1 and PB2 via the other of the communication ports PB1 and PB2. The detection system 301 detects anomalies in the network 201.

[0057] The network 201 includes communication devices 111A and 111B as the communication device 111 and a switch device 141. The switch device 141 relays information exchanged between the communication devices 111A and 111B. The switch device 141 includes communication ports 122A and 122B. The communication ports 122A and 122B are, for example, connectors or terminals. The network 201 may be an in-vehicle network, a home network, or a factory automation network.

[0058] The communication device 111A is connected to the communication port PA2 in the extraction device 121A via the transmission line 1. The communication device 111B is connected to the communication port PB2 in the extraction device 121B via the transmission line 1. The communication port PA1 in the extraction device 121A is connected to the communication port 122A in the switch device 141 via the transmission line 1. The communication port PB1 in the extraction device 121B is connected to the communication port 122B in the switch device 141 via the transmission line 1. The transmission line 1 is, for example, an Ethernet (registered trademark) cable.

[0059] In the network 201 , a plurality of messages including response messages are sent and received by a plurality of communication devices 111 .

[0060] In more detail, multiple communication devices 111 send and receive messages according to communication protocols Prtl specified by ARP (Address Resolution Protocol) and SOME / IP (Scalable service-Oriented MiddlewarE over IP) that send response messages to other communication devices 111 as responses to reception messages received from other communication devices 111.

[0061] For example, the communication device 111A acting as a client periodically or irregularly generates a message to the communication device 111B according to the communication protocol Prt1, and sends the generated message to the switch device 141 via the transmission line 1 and the extraction device 121A. The switch device 141 sends the message received from the communication device 111A to the communication device 111B via the transmission line 1 and the extraction device 121B.

[0062] When the communication device 111B operating as a server receives a message from the communication device 111A via the switch device 141, it generates a response message in accordance with the communication protocol Prt1, and sends the generated response message to the switch device 141 via the transmission line 1 and the extraction device 121B. The switch device 141 sends the response message received from the communication device 111B to the communication device 111A via the transmission line 1 and the extraction device 121A.

[0063] The extraction devices 121A and 121B extract messages from different sources that pass through different locations in the network 201. More specifically, the extraction device 121A includes a filter fa (not shown) that extracts messages that include the address of the communication device 111A as the source address from among the received messages. The extraction device 121B includes a filter fb (not shown) that extracts messages that include the address of the communication device 111B as the source address from among the received messages. The extraction devices 121A and 121B function as relay hubs.

[0064] The extraction device 121A copies the message extracted by the filter fa from the message received via the communication port PA2. The extraction device 121A sends the extracted message via the communication port PA1. The extraction device 121A also sends a copy of the extracted message to the detection device 101 via the transmission line 1. It should be noted that the extraction device 121A can also send the extracted message to the detection device 101 via the transmission line 1 and send a copy of the extracted message via the communication port PA1.

[0065] In addition, the extraction device 121B copies the message extracted by the filter fb from the message received via the communication port PB2. The extraction device 121B sends the extracted message via the communication port PB1. The extraction device 121B also sends a copy of the extracted message to the detection device 101 via the transmission line 1. It should be noted that the extraction device 121B can also send the extracted message to the detection device 101 via the transmission line 1 and send a copy of the extracted message via the communication port PB1.

[0066] It should be noted that the extraction device 121A is not limited to a structure connected to the communication device 111A via the transmission line 1. The extraction device 121A may also be an adapter installed in the communication device 111A. In this case, the extraction device 121A extracts a message output from the communication device 111A, outputs the extracted message to the switch device 141 via the transmission line 1, and outputs a copy of the extracted message to the detection device 101 via the transmission line 1.

[0067] In addition, the extraction device 121B is not limited to the structure connected to the communication device 111B via the transmission line 1. The extraction device 121B may also be an adapter installed in the communication device 111B. In this case, the extraction device 121B extracts the message output from the communication device 111B, outputs the extracted message to the switch device 141 via the transmission line 1, and outputs a copy of the extracted message to the detection device 101 via the transmission line 1.

[0068] (Detection device)

[0069] The detection device 101 includes a receiving unit 11, a load calculation unit 21, a detection unit 31, and a storage unit 41. The receiving unit 11 includes observation units 10A and 10B as the observation unit 10. The load calculation unit 21 includes calculation units 20A and 20B as the calculation unit 20. The load calculation unit 21 is an example of an acquisition unit. Part or all of the receiving unit 11, the load calculation unit 21, and the detection unit 31 are implemented, for example, by a processing circuit (Circuitry) including one or more processors. The storage unit 41 is, for example, a non-volatile memory included in the above-mentioned processing circuit. The detection device 101 performs a detection process for detecting an abnormality in the detection network 201.

[0070] The storage unit 41 stores network information indicating the topology of the network 201 and the communication protocol Prt1 in the network 201. For example, the network information is stored in the storage unit 41 by the administrator of the network 201.

[0071] The plurality of observation units 10 observe messages passing through different locations in the network 201. That is, the observation units 10A and 10B observe messages extracted by the extraction devices 121A and 121B, respectively.

[0072] For example, the observation unit 10A observes the output of the extracted message by the extraction device 121A. More specifically, the observation unit 10A receives the message extracted by the extraction device 121A via the transmission line 1. The observation unit 10A extracts one or more messages according to the above-mentioned communication protocol Prt1 from one or more messages received in the observation period T1 of a predetermined length period regularly or irregularly. The observation unit 10A outputs the observation result including the extracted message to the calculation unit 20A.

[0073] In addition, for example, the observation unit 10B observes the output of the extracted message by the extraction device 121B. More specifically, the observation unit 10B receives the message extracted by the extraction device 121B via the transmission line 1. The observation unit 10B extracts one or more messages according to the above-mentioned communication protocol Prt1 from one or more messages received in the observation period T1 regularly or irregularly. The observation unit 10B outputs the observation result including the extracted message to the calculation unit 20B.

[0074] The load calculation unit 21 acquires a plurality of load information indicating communication loads at a plurality of locations in the network 201 and indicating communication loads caused by messages from different sources. For example, the load calculation unit 21 generates load information based on the observation results of the observation units 10A and 10B.

[0075] In more detail, the calculation unit 20A receives the observation result from the observation unit 10A, and calculates the communication volume VA per unit time generated by the message included in the received observation result. The communication volume VA represents the communication volume per unit time generated by the message including the address of the communication device 111A as the transmission source address and passing through the extraction device 121A. The calculation unit 20A outputs load information representing the calculated communication volume VA to the detection unit 31. The load information is an example of the first load information.

[0076] The calculation unit 20B receives the observation result from the observation unit 10B, and calculates the communication volume VB per unit time generated by the message included in the received observation result. The communication volume VB represents the communication volume per unit time generated by the message including the address of the communication device 111B as the transmission source address and passing through the extraction device 121B. The calculation unit 20B outputs load information representing the calculated communication volume VB to the detection unit 31. The load information is an example of the second load information.

[0077] The detection unit 31 performs detection processing based on the consistency of the plurality of load information generated by the load calculation unit 21 .

[0078] For example, the detection unit 31 receives load information from the calculation units 20A and 20B, and determines whether an abnormality occurs in the network 202 based on a comparison result between the communication volume VA indicated by the load information received from the calculation unit 20A and the communication volume VB indicated by the load information received from the calculation unit 20B.

[0079] More specifically, when the absolute value of the difference between the communication volume VA and the communication volume VB is less than a specified value, the detection unit 31 determines that no abnormality has occurred in the network 201, and stores the determination result in the storage unit 41. On the other hand, when the absolute value of the difference between the communication volume VA and the communication volume VB is greater than a specified value, the detection unit 31 determines that an abnormality has occurred in the network 201, and stores the determination result in the storage unit 41. In addition, for example, when the detection unit 31 determines that an abnormality has occurred in the network 201, the detection unit 31 notifies the administrator of the network 201 of the determination result through voice or display. It should be noted that the detection unit 31 may also be a structure that notifies the determination result to a management device not shown in the figure via the network 201 or other networks not shown in the figure.

[0080] Figure 2 This is a diagram showing a state in which a rogue device is added to a network that is a detection target of the detection system according to the first embodiment of the present disclosure. Figure 2 The state after adding illegal device 111X and relay hub 121X to network 201 is shown. Relay hub 121X is set between extraction device 121B and communication device 111B, and is connected to communication port PB2 in extraction device 121B via transmission line 1. Illegal device 111X is connected to relay hub 121X via transmission line 1.

[0081] The illegal device 111X generates an illegal message addressed to the communication device 111A, pretending that the transmission source is the communication device 111B and in accordance with the communication protocol Prt1, and transmits the generated illegal message to the relay hub 121X.

[0082] Relay hub 121X outputs a message received from communication device 111B to extraction device 121B and illegal device 111X, outputs a message received from extraction device 121B to communication device 111B and illegal device 111X, and outputs an illegal message received from illegal device 111X to communication device 111B and extraction device 121B.

[0083] Figure 3 It is a diagram showing an example of detection processing in the detection device according to the first embodiment of the present disclosure.

[0084] Reference Figure 3For example, the communication device 111A sends a message to the communication device 111B via the switch device 141. The observation unit 10A in the receiving unit 11 of the detection device 101 receives the message sent by the communication device 111A and extracted by the extraction device 121A via the transmission line 1.

[0085] The communication device 111B receives a message from the communication device 111A via the switch device 141, and sends a response message to the communication device 111A via the switch device 141. In addition, the illegal device 111X sends an illegal message to the communication device 111A via the switch device 141. The illegal message sent by the illegal device 111X is output to the communication device 111B via the relay hub 121X. In addition to receiving the response message sent by the communication device 111B and extracted by the extraction device 121B via the transmission line 1, the observation unit 10B in the receiving unit 11 of the detection device 101 also receives the illegal message sent by the illegal device 111X and extracted by the extraction device 121B via the transmission line 1.

[0086] Therefore, the communication volume VB calculated by the calculation unit 20B becomes a value larger than the communication volume VA calculated by the calculation unit 20A.

[0087] In this case, since the absolute value of the difference between the communication volume VA and the communication volume VB is equal to or larger than the predetermined value, the detection unit 31 determines that an abnormality has occurred in the network 201 .

[0088] [Flow of Action]

[0089] Figure 4 This is a flowchart that defines an example of an operation procedure when the detection device according to the first embodiment of the present disclosure performs a detection process.

[0090] Reference Figure 4 First, the detection device 101 respectively observes messages passing through different parts of the network 201. More specifically, the detection device 101 receives the message extracted by the extraction device 121A through the transmission line 1, and receives the message extracted by the extraction device 121B through the transmission line 1 (step S11).

[0091] Next, based on the observation results of the messages, the detection device 101 generates a plurality of load information respectively indicating the communication loads of the plurality of locations in the network 201. More specifically, the detection device 101 calculates the communication volume VA per unit time generated by the message received from the extraction device 121A and the communication volume VB per unit time generated by the message received from the extraction device 121B (step S12).

[0092] Next, the detection device 101 compares the communication volume VA with the communication volume VB (step S13).

[0093] Next, when the absolute value of the difference between the communication volume VA and the communication volume VB is smaller than a predetermined value (YES in step S14), the detection device 101 determines that no abnormality has occurred in the network 201 (step S15).

[0094] On the other hand, when the absolute value of the difference between the communication amounts VA and VB is equal to or larger than a predetermined value (No in step S14), the detection device 101 determines that an abnormality has occurred in the network 201 (step S16).

[0095] Next, the detection device 101 notifies the administrator of the network 201 of the determination result by voice or display (step S17).

[0096] It should be noted that, in the detection device 101 involved in the embodiment of the present disclosure, the calculation unit 20 in the load calculation unit 21 is assumed to be a structure that calculates the communication volume per unit time generated by the message included in the observation result received from the observation unit 10, but it is not limited to this. The calculation unit 20 may also be a structure that obtains the communication volume from the outside of the detection device 101 instead of calculating the communication volume. That is, the load calculation unit 21 may also obtain load information generated outside the detection device 101 instead of generating load information.

[0097] In addition, in the detection system 301 involved in the embodiment of the present disclosure, the extraction device 121A is assumed to have the following structure: that is, copying the message extracted by the filter fa from among the messages received via the communication port PA2, sending the extracted message via the communication port PA1, and sending the copy of the extracted message to the detection device 101 via the transmission line 1, but the present invention is not limited thereto. The extraction device 121A may also have the following structure: that is, copying all messages received via the communication port PA2, sending all messages received via the communication port PA2 via the communication port PA1, and sending the message extracted by the filter fa from among the copies of the extracted message to the detection device 101 via the transmission line 1.

[0098] In addition, the observation unit 10A may include a filter fa instead of the extraction device 121A. In this case, the extraction device 121A copies all messages received via the communication port PA2, sends all messages received via the communication port PA2 via the communication port PA1, and sends a copy of the extracted message to the detection device 101 via the transmission line 1. The observation unit 10A extracts the message according to the above-mentioned communication protocol Prt1 from the message extracted by the filter fa from the message received from the extraction device 121A.

[0099] Similarly, the extraction device 121B may also be configured as follows: that is, it copies all messages received via the communication port PB2, transmits all messages received via the communication port PB2 via the communication port PB1, and transmits the message extracted by the filter fb from the copy of the extracted message to the detection device 101 via the transmission line 1. In addition, it may be configured such that the filter fb is included in the observation unit 10B instead of the extraction device 121B. In this case, the extraction device 121B copies all messages received via the communication port PB2, transmits all messages received via the communication port PB2 via the communication port PB1, and transmits the copy of the extracted message to the detection device 101 via the transmission line 1. The observation unit 10B extracts the message according to the above-mentioned communication protocol Prt1 from the message extracted by the filter fb from the message received from the extraction device 121B.

[0100] Next, other embodiments of the present disclosure will be described using the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their description will not be repeated.

[0101] <Second Embodiment>

[0102] This embodiment relates to a detection system 302 that specifies an abnormality based on the matching of each combination of load information compared to the detection system 301 of the first embodiment. The contents other than those described below are the same as those of the detection system 301 of the first embodiment.

[0103] Figure 5 2 is a diagram showing an example of the configuration of a detection system and a network to be detected according to a second embodiment of the present disclosure. Figure 5 Compared with the detection system 301 involved in the first embodiment, the detection system 302 includes a detection device 102 instead of the detection device 101, and further includes an observation unit 10C. The detection system 302 detects an abnormality in the network 202. Compared with the network 201, the network 202 includes a switch device 142 instead of the switch device 141. The observation unit 10C is provided in the switch device 142. Similar to the switch device 141, the switch device 142 includes communication ports 122A and 122B, and relays information exchanged between the communication devices 111A and 111B.

[0104] Compared with the detection device 101, the detection device 102 includes a load calculation unit 22 instead of the load calculation unit 21, and includes a detection unit 32 instead of the detection unit 31. Compared with the load calculation unit 21, the load calculation unit 22 further includes a calculation unit 20C as the calculation unit 20. The load calculation unit 22 generates three load information respectively indicating the communication loads of three locations in the network 202. The load calculation unit 22 is an example of an acquisition unit.

[0105] The observation unit 10C observes the message arriving at the communication port 122B in the switch device 142. More specifically, the observation unit 10C receives the message via the communication port 122B, outputs the received message to the relay processing unit (not shown), and copies the message. The observation unit 10C extracts one or more messages according to the above-mentioned communication protocol Prt1 from one or more messages copied in the observation period T1 regularly or irregularly. The observation unit 10C sends the observation result including the extracted message to the detection device 102 via the transmission line 1.

[0106] For example, the calculation unit 20C generates load information based on the observation result of the observation unit 10C. In more detail, the calculation unit 20C receives the observation result from the observation unit 10C via the transmission line 1, and calculates the communication volume VC per unit time generated by the message included in the received observation result. The communication volume VC represents the communication volume per unit time generated by the message received by the switch device 142 via the communication port 122B. The calculation unit 20C outputs the load information representing the calculated communication volume VC to the detection unit 32.

[0107] In the detection process, the detection unit 32 identifies an abnormal location in the network 202 based on the matching of each combination of two load information included in the three load information received from the calculation units 20A, 20B, and 20C.

[0108] For example, the detection unit 32 receives load information from the calculation units 20A, 20B, and 20C, and determines an abnormal location in the network 202 based on the comparison results of each combination of two communication volumes included in the communication volumes VA, VB, and VC shown in the three received load information.

[0109] As an example, the detection unit 32 determines that no abnormality has occurred in the network 202 when the absolute value of the difference between the communication volume VA and the communication volume VB, the absolute value of the difference between the communication volume VB and the communication volume VC, and the absolute value of the difference between the communication volume VA and the communication volume VC are smaller than a specified value.

[0110] On the other hand, the detection unit 32 determines that an abnormality has occurred in the network 202 when at least any one of the absolute value of the difference between the communication volume VA and the communication volume VB, the absolute value of the difference between the communication volume VB and the communication volume VC, and the absolute value of the difference between the communication volume VA and the communication volume VC is greater than a specified value.

[0111] For example, when the value obtained by subtracting the communication volume VA from the communication volume VB is greater than the specified value, and the value obtained by subtracting the communication volume VA from the communication volume VC is greater than the specified value, the detection unit 32 determines that an abnormality such as the insertion of an illegal message sent to the communication device 111A has occurred between the communication device 111B and the extraction device 121B because a larger number of messages than expected have passed through the extraction device 121B toward the switch device 142.

[0112] In addition, for example, when the absolute value of the difference between the communication volume VA and the communication volume VB is less than the specified value and the value obtained by subtracting the communication volume VA from the communication volume VC is greater than the specified value, the detection unit 32 determines that an abnormality such as the insertion of an illegal message sent to the communication device 111A has occurred between the extraction device 121B and the switch device 142 because a larger number of messages than expected have arrived at the communication port 122B in the switch device 142.

[0113] For example, when the detection unit 32 determines that an abnormality has occurred in the network 202, it notifies the administrator of the network 202 of the determination result including the identified abnormal location through voice or display.

[0114] Figure 6 This is a diagram showing a state in which a rogue device is added to a network to be detected by the detection system according to the second embodiment of the present disclosure. Figure 6 The figure shows a state after the illegal device 111Y and the relay hub 121Y are added to the network 202. The relay hub 121Y is provided between the communication port 122B in the switch device 142 and the extraction device 121B, and is connected to the communication port PB1 in the extraction device 121B via the transmission line 1. The illegal device 111Y is connected to the relay hub 121Y via the transmission line 1.

[0115] The illegal device 111Y generates an illegal message addressed to the communication device 111A, pretending that the transmission source is the communication device 111B and in accordance with the communication protocol Prt1, and transmits the generated illegal message to the relay hub 121Y.

[0116] The relay hub 121Y outputs the message received from the extraction device 121B to the switch device 142 and the illegal device 111Y, outputs the message received from the switch device 142 to the extraction device 121B and the illegal device 111Y, and outputs the illegal message received from the illegal device 111Y to the switch device 142 and the extraction device 121B.

[0117] Figure 7 It is a diagram showing an example of detection processing in the detection device according to the second embodiment of the present disclosure.

[0118] Reference Figure 7 For example, the communication device 111A sends a message to the communication device 111B via the switch device 142. The observation unit 10A in the receiving unit 11 of the detection device 102 receives the message sent by the communication device 111A and extracted by the extraction device 121A via the transmission line 1.

[0119] The communication device 111B receives a message from the communication device 111A via the switch device 142, and sends a response message to the communication device 111A via the switch device 142. In addition, the illegal device 111Y sends an illegal message to the communication device 111A via the relay hub 121Y and the switch device 142. The illegal message sent by the illegal device 111Y is output to the extraction device 121B via the relay hub 121Y. It should be noted that since the extraction device 121B receives the illegal message via the communication port PB1, it sends the illegal message to the communication device 111B via the communication port PB2, while on the other hand, the filter fb does not extract and copy the illegal message. Therefore, the illegal message sent by the illegal device 111Y does not reach the observation unit 10B in the receiving unit 11 of the detection device 102.

[0120] The observation unit 10B in the receiving unit 11 of the detection device 102 receives the response message sent by the communication device 111B and extracted by the extraction device 121B via the transmission line 1. On the other hand, the observation unit 10C receives the illegal message sent by the illegal device 111Y in addition to the response message sent by the communication device 111B.

[0121] Therefore, the communication volume VC calculated by the calculation unit 20C becomes a value larger than the communication volume VA calculated by the calculation unit 20A and the communication volume VB calculated by the calculation unit 20B.

[0122] In this case, since the absolute value of the difference between the communication volume VA and the communication volume VB is smaller than the specified value and the value obtained by subtracting the communication volume VA from the communication volume VC is greater than the specified value, the detection unit 32 determines that an abnormality has occurred between the extraction device 121B and the switch device 142.

[0123] Figure 8 This is a diagram showing an example of a sequence of detection processing in the detection system according to the second embodiment of the present disclosure.

[0124] Reference Figure 8 First, the observation unit 10A extracts one or more messages according to the communication protocol Prt1 from one or more messages extracted by the extraction device 121A during the observation period T1 (step S21).

[0125] Furthermore, the observation unit 10B extracts one or more messages in accordance with the communication protocol Prt1 from the one or more messages extracted by the extraction device 121B in the observation period T1 (step S22).

[0126] Furthermore, the observation unit 10C extracts one or more messages in accordance with the communication protocol Prt1 from the one or more messages copied in the observation period T1 (step S23).

[0127] Next, the observation unit 10A outputs the observation result including the extracted message to the load calculation unit 22 (step S24).

[0128] In addition, the observation section 10B outputs the observation result including the extracted message to the load calculation section 22 (step S25 ).

[0129] In addition, the observation unit 10C transmits the observation result including the extracted message to the load calculation unit 22 (step S26).

[0130] Next, the load calculation unit 22 calculates the communication volume VA per unit time generated by the message included in the observation result received from the observation unit 10A, the communication volume VB per unit time generated by the message included in the observation result received from the observation unit 10B, and the communication volume VC per unit time generated by the message included in the observation result received from the observation unit 10C (step S27).

[0131] Next, the load calculation unit 22 outputs load information indicating the communication volume VA, load information indicating the communication volume VB, and load information indicating the communication volume VC to the detection unit 32 (step S28).

[0132] The detection unit 32 performs detection processing based on the matching of the multiple load information received from the load calculation unit 22. For example, when the absolute value of the difference between the communication volume VA and the communication volume VB is less than a specified value, and the value obtained by subtracting the communication volume VA from the communication volume VC is greater than a specified value, the detection unit 32 determines that an abnormality has occurred between the extraction device 121B and the switch device 142 (step S29).

[0133] Next, the detection unit 32 notifies the administrator of the network 202 of the determination result by voice or display (step S30).

[0134] It should be noted that in the detection system 302 involved in the embodiment of the present disclosure, the observation unit 10C can also be structured as follows: that is, the message is not copied and extracted before the observation instruction is received from the detection device 102, and the message is copied and extracted when the observation instruction is received from the detection device 102.

[0135] More specifically, the detection unit 32 in the detection device 102 compares the communication volume VA with the communication volume VB, and when determining that an abnormality has occurred in the network 202, outputs a calculation instruction to the calculation unit 20C.

[0136] When receiving the calculation instruction from the detection unit 32 , the calculation unit 20C transmits an observation instruction to the observation unit 10C via the transmission line 1 .

[0137] The observation unit 10C receives the observation instruction from the calculation unit 20C, copies the message received via the communication port 122B during the observation period T2 having the same length as the observation period T1, and extracts one or more messages according to the communication protocol Prt1 from the copied one or more messages. The observation unit 10C sends the observation result including the extracted message to the detection device 102 via the transmission line 1.

[0138] Next, other embodiments of the present disclosure will be described using the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their description will not be repeated.

[0139] <Third Embodiment>

[0140] This embodiment is related to a detection system 303 that detects anomalies in a network 203 in which one-to-many communication is performed by a communication device 111, compared to the detection system 301 of the first embodiment. The contents other than those described below are the same as those of the detection system 301 of the first embodiment.

[0141] Fig. 9 : is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a third embodiment of the present disclosure. Fig. 9 Compared with the detection system 301 involved in the first embodiment, the detection system 303 includes the detection device 103 instead of the detection device 101, and further includes an extraction device 121D. The extraction device 121D is an example of an extraction device. The extraction device 121D includes communication ports PD1 and PD2. The extraction device 121D sends a message received via one of the communication ports PD1 and PD2 via the other of the communication ports PD1 and PD2. The detection system 303 detects an abnormality in the network 203.

[0142] The network 203 includes communication devices 111A, 111B, and 111D as the communication device 111, and a switch device 143. The communication device 111B is an example of a first communication device, the communication device 111A is an example of a second communication device, and the communication device 111D is an example of a third communication device. The switch device 143 relays information exchanged between the communication devices 111A and 111D and the communication device 111B. The switch device 143 includes communication ports 122A, 122B, and 122D.

[0143] The communication device 111D is connected to the communication port PD2 in the extraction device 121D via the transmission line 1. The communication port PD1 in the extraction device 121D is connected to the communication port 122D in the switch device 143 via the transmission line 1.

[0144] One-to-two communication is performed in the network 203. More specifically, in the network 203, messages are sent and received between the communication device 111B and the communication devices 111A and 111D different from the communication device 111B. Here, it is assumed that in the network 203, messages are not sent and received between the communication device 111A and the communication device 111D.

[0145] For example, the communication device 111A acting as a client periodically or irregularly generates a message to the communication device 111B according to the communication protocol Prt1, and sends the generated message to the switch device 143 via the transmission line 1 and the extraction device 121A. The switch device 143 sends the message received from the communication device 111A to the communication device 111B via the transmission line 1 and the extraction device 121B.

[0146] When the communication device 111B operating as a server receives a message from the communication device 111A via the switch device 143, it generates a response message in accordance with the communication protocol Prt1, and sends the generated response message to the switch device 143 via the transmission line 1 and the extraction device 121B. The switch device 143 sends the response message received from the communication device 111B to the communication device 111A via the transmission line 1 and the extraction device 121A.

[0147] In addition, for example, the communication device 111D acting as a client periodically or irregularly generates a message to the communication device 111B according to the communication protocol Prt1, and sends the generated message to the switch device 143 via the transmission line 1 and the extraction device 121D. The switch device 143 sends the message received from the communication device 111D to the communication device 111B via the transmission line 1 and the extraction device 121B.

[0148] When the communication device 111B receives a message from the communication device 111D via the switch device 143, it generates a response message according to the communication protocol Prt1, and sends the generated response message to the switch device 143 via the transmission line 1 and the extraction device 121B. The switch device 143 sends the response message received from the communication device 111B to the communication device 111D via the transmission line 1 and the extraction device 121D.

[0149] The extraction device 121D includes a filter fd (not shown) that extracts a message including the address of the communication device 111D as a transmission source address received via the communication port PD2. The extraction device 121D has a function as a relay hub. The extraction device 121D copies the message extracted by the filter fd from the message received via the communication port PD2. The extraction device 121D transmits the extracted message via the communication port PD1. The extraction device 121D also transmits a copy of the extracted message to the detection device 103 via the transmission line 1.

[0150] Compared with the detection device 101 involved in the first embodiment, the detection device 103 includes a receiving unit 12 instead of the receiving unit 11, a load calculation unit 23 instead of the load calculation unit 21, and a detection unit 33 instead of the detection unit 31. Compared with the receiving unit 11, the receiving unit 12 further includes an observation unit 10D as the observation unit 10. Compared with the load calculation unit 21, the load calculation unit 23 further includes a calculation unit 20D as the calculation unit 20. The load calculation unit 23 is an example of an acquisition unit. The detection device 103 performs a detection process for detecting an abnormality in the network 203 performing one-to-two communication.

[0151] For example, the observation unit 10D observes the output of the extracted message by the extraction device 121D. More specifically, the observation unit 10D receives the message extracted by the extraction device 121D via the transmission line 1. The observation unit 10D extracts one or more messages according to the above-mentioned communication protocol Prt1 from one or more messages received in the observation period T1 of a predetermined length periodically or irregularly. The observation unit 10D outputs the observation result including the extracted message to the calculation unit 20D.

[0152] The calculation unit 20D receives the observation result from the observation unit 10D, and calculates the communication volume VD per unit time generated by the message included in the received observation result. The communication volume VD represents the communication volume per unit time generated by the message including the address of the communication device 111D as the transmission source address and passing through the extraction device 121D. The calculation unit 20D outputs load information representing the calculated communication volume VD to the detection unit 33. The load information is an example of the second load information.

[0153] The detection unit 33 detects abnormality in the network 203 based on the matching between the communication volume VB of messages transmitted by the communication device 111B and the result obtained by integrating the communication volume VA of messages transmitted by the communication device 111A and the communication volume VD of messages transmitted by the communication device 111D.

[0154] For example, the detection unit 33 receives load information from the calculation units 20A, 20B, and 20D, and calculates the sum of the communication volume VA indicated by the load information received from the calculation unit 20A and the communication volume VD indicated by the load information received from the calculation unit 20D, that is, the communication volume VAD. Then, the detection unit 33 determines whether an abnormality has occurred in the network 203 based on the comparison result of the calculated communication volume VAD and the communication volume VB indicated by the load information received from the calculation unit 20B.

[0155] More specifically, when the absolute value of the difference between the traffic volume VAD and the traffic volume VB is less than a specified value, the detection unit 33 determines that no abnormality has occurred in the network 203, and stores the determination result in the storage unit 41. On the other hand, when the absolute value of the difference between the traffic volume VAD and the traffic volume VB is greater than a specified value, the detection unit 33 determines that an abnormality has occurred in the network 203, and stores the determination result in the storage unit 41. In addition, for example, when the detection unit 33 determines that an abnormality has occurred in the network 203, the administrator of the network 203 is notified of the determination result by voice or display.

[0156] Fig.10 It is a diagram showing an example of detection processing in the detection device according to the third embodiment of the present disclosure.

[0157] Reference Fig.10 For example, the communication device 111A sends a message to the communication device 111B via the switch device 143. The observation unit 10A in the receiving unit 12 of the detection device 103 receives the message sent by the communication device 111A and extracted by the extraction unit 121A via the transmission line 1.

[0158] The communication device 111B receives the message from the communication device 111A via the switch device 143 and sends a response message to the communication device 111A via the switch device 143. The observation unit 10B in the receiving unit 12 of the detection device 103 receives the response message sent by the communication device 111B and extracted by the extraction unit 121B via the transmission line 1.

[0159] In addition, for example, the communication device 111D transmits a message to the communication device 111B via the switch device 143. The observation unit 10D in the receiving unit 12 of the detection device 103 receives the message transmitted by the communication device 111D and extracted by the extraction unit 121D via the transmission line 1.

[0160] The communication device 111B receives a message from the communication device 111D via the switch device 143 and sends a response message to the communication device 111D via the switch device 143. The observation unit 10B in the receiving unit 12 of the detection device 103 receives the response message sent by the communication device 111B and extracted by the extraction unit 121B via the transmission line 1.

[0161] When the network 203 is normal, the difference between the sum of the communication volume VA calculated by the calculation unit 20A and the communication volume VD calculated by the calculation unit 20D, that is, the communication volume VAD and the communication volume VB calculated by the calculation unit 20B is, for example, zero. On the other hand, when an abnormality such as the insertion of an illegal message occurs in the network 203, the matching of the communication volume VAD and the communication volume VB decreases, and the difference between the communication volume VAD and the communication volume VB becomes a large value. Therefore, the detection unit 33 can determine whether an abnormality occurs in the network 203 based on the difference between the communication volume VAD and the communication volume VB.

[0162] It should be noted that, in the detection device 103 involved in the embodiment of the present disclosure, the detection unit 33 is assumed to be a structure that calculates the communication volume VAD and determines whether an abnormality occurs in the network 203 based on the comparison result of the calculated communication volume VAD and the communication volume VB, but is not limited to this. The detection unit 33 may also be a structure that calculates a value obtained by adding or subtracting a predetermined adjustment value from the sum of the communication volume VA and the communication volume VD to replace the communication volume VAD as the result obtained by integrating the communication volume VA and the communication volume VD, and determines whether an abnormality occurs in the network 203 based on the comparison result of the calculated value and the communication volume VB.

[0163] In addition, the detection device 103 involved in the embodiment of the present disclosure is assumed to be a structure that detects anomalies in the network 203 that performs one-to-two communication during the detection process, but is not limited to this. The detection device 103 can also be a structure that detects anomalies in a network that performs one-to-N or more communications when N is set to an integer greater than 3 during the detection process. In more detail, in the network, messages are sent and received between the communication device 111B and more than three communication devices 111 that are different from the communication device 111B. In this case, the detection unit 33 in the detection device 103 detects anomalies in the network based on the matching of the communication volume VB of the message sent by the communication device 111B and the result obtained by integrating the communication volume of the messages respectively sent by the more than three communication devices 111.

[0164] Next, other embodiments of the present disclosure will be described using the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their description will not be repeated.

[0165] <Fourth Embodiment>

[0166] This embodiment relates to a detection system 304 that specifies an abnormality based on the matching of each combination of load information compared to the detection system 303 of the third embodiment. The contents other than those described below are the same as those of the detection system 303 of the third embodiment.

[0167] Fig.11 FIG. 4 is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a fourth embodiment of the present disclosure. Fig.11 Compared with the detection system 303 according to the third embodiment, the detection system 304 includes the detection device 104 instead of the detection device 103, and further includes observation units 10E and 10F. The detection system 304 detects an abnormality in the network 204. Compared with the network 203, the network 204 includes a switch device 144 instead of the switch device 143. The observation units 10E and 10F are provided in the switch device 144. Similar to the switch device 143, the switch device 144 includes communication ports 122A, 122B, and 122D, and relays information exchanged between the communication devices 111A and 111D and the communication device 111B.

[0168] Compared with the detection device 103 according to the third embodiment, the detection device 104 includes a load calculation unit 24 instead of the load calculation unit 23, and a detection unit 34 instead of the detection unit 33. Compared with the load calculation unit 23, the load calculation unit 24 further includes calculation units 20E and 20F as the calculation unit 20. The load calculation unit 24 is an example of an acquisition unit.

[0169] The observation units 10E and 10F observe messages arriving at the communication ports 122A and 122D in the switch device 144 , respectively.

[0170] In more detail, the observation unit 10E receives a message via the communication port 122A, outputs the received message to a relay processing unit (not shown), and copies the message. The observation unit 10E extracts one or more messages according to the communication protocol Prt1 from one or more messages copied in the observation period T1 periodically or irregularly. The observation unit 10E sends the observation result including the extracted message to the detection device 104 via the transmission line 1.

[0171] The observation unit 10F receives the message via the communication port 122D, outputs the received message to the relay processing unit (not shown), and copies the message. The observation unit 10F extracts one or more messages according to the communication protocol Prt1 from one or more messages copied in the observation period T1 periodically or irregularly. The observation unit 10F sends the observation result including the extracted message to the detection device 104 via the transmission line 1.

[0172] For example, the calculation unit 20E generates load information based on the observation result of the observation unit 10E. More specifically, the calculation unit 20E receives the observation result from the observation unit 10E via the transmission line 1, and calculates the communication volume VE per unit time generated by the message included in the received observation result. The communication volume VE represents the communication volume per unit time generated by the message received by the switch device 144 via the communication port 122A. The calculation unit 20E outputs the load information representing the calculated communication volume VE to the detection unit 34.

[0173] In addition, for example, the calculation unit 20F generates load information based on the observation result of the observation unit 10F. More specifically, the calculation unit 20F receives the observation result from the observation unit 10F via the transmission line 1, and calculates the communication volume VF per unit time generated by the message included in the received observation result. The communication volume VF represents the communication volume per unit time generated by the message received by the switch device 144 via the communication port 122D. The calculation unit 20F outputs the load information representing the calculated communication volume VF to the detection unit 34.

[0174] In the detection process, the detection unit 34 identifies an abnormal location in the network 204 based on the matching of each combination of two load information included in the five load information received from the calculation units 20A, 20B, 20D, 20E, and 20F.

[0175] For example, the detection unit 34 receives load information from the calculation units 20A, 20B, 20D, 20E, and 20F, and determines the abnormal part in the network 204 based on the comparison result of each combination of two communication volumes included in the communication volumes VA, VB, VD, VE, and VF shown in the five load information received.

[0176] As an example, the detection unit 34 calculates the communication volume VAD which is the sum of the communication volume VA and the communication volume VD, and the communication volume VEF which is the sum of the communication volume VE and the communication volume VF. The detection unit 34 determines that no abnormality has occurred in the network 204 when the absolute value of the difference between the communication volume VAD and the communication volume VB, the absolute value of the difference between the communication volume VEF and the communication volume VB, and the absolute value of the difference between the communication volume VAD and the communication volume VEF are less than a specified value.

[0177] On the other hand, the detection unit 34 determines that an abnormality has occurred in the network 204 when at least any one of the absolute value of the difference between the communication volume VAD and the communication volume VB, the absolute value of the difference between the communication volume VEF and the communication volume VB, and the absolute value of the difference between the communication volume VAD and the communication volume VEF is greater than a specified value.

[0178] For example, when the value obtained by subtracting the communication volume VB from the communication volume VAD is greater than the specified value, and the value obtained by subtracting the communication volume VA from the communication volume VE is greater than the specified value, the detection unit 34 determines that an abnormality such as the insertion of an illegal message sent to the communication device 111B has occurred between the extraction device 121A and the switch device 144 because a larger number of messages than expected have arrived at the communication port 122A in the switch device 144.

[0179] In addition, for example, when the value obtained by subtracting the communication volume VB from the communication volume VAD is greater than the specified value, and the value obtained by subtracting the communication volume VD from the communication volume VF is greater than the specified value, the detection unit 34 determines that an abnormality such as the insertion of an illegal message sent to the communication device 111B has occurred between the extraction device 121D and the switch device 144 because a larger number of messages than expected arrives at the communication port 122D in the switch device 144.

[0180] For example, when the detection unit 34 determines that an abnormality has occurred in the network 204, it notifies the administrator of the network 204 of the determination result including the identified abnormal part by voice or display.

[0181] Fig.12 This is a diagram showing a state in which an unauthorized device is added to a network that is a detection target of the detection system according to the fourth embodiment of the present disclosure. Fig.12 The figure shows a state after the illegal device 111Z and the relay hub 121Z are added to the network 204. The relay hub 121Z is provided between the communication port 122A in the switch device 144 and the extraction device 121A, and is connected to the communication port PA1 in the extraction device 121A via the transmission line 1. The illegal device 111Z is connected to the relay hub 121Z via the transmission line 1.

[0182] The illegal device 111Z generates an illegal message addressed to the communication device 111B in accordance with the communication protocol Prt1, pretending that the transmission source is the communication device 111A, and transmits the generated illegal message to the relay hub 121Z.

[0183] The relay hub 121Z outputs the message received from the extraction device 121A to the switch device 144 and the illegal device 111Z, outputs the message received from the switch device 144 to the extraction device 121A and the illegal device 111Z, and outputs the illegal message received from the illegal device 111Z to the switch device 144 and the extraction device 121A.

[0184] For example, the communication device 111D sends a message to the communication device 111B via the switch device 144. The observation unit 10D in the receiving unit 12 of the detection device 104 receives the message sent by the communication device 111D and extracted by the extraction device 121D via the transmission line 1. In addition, the observation unit 10F receives the message sent by the communication device 111D.

[0185] The communication device 111B receives a message from the communication device 111D via the switch device 144 and sends a response message to the communication device 111D to the switch device 144. The observation unit 10B in the receiving unit 12 of the detection device 104 receives the response message sent by the communication device 111B and extracted by the extraction unit 121B via the transmission line 1.

[0186] In addition, for example, the communication device 111A sends a message to the communication device 111B via the switch device 144. The observation unit 10A in the receiving unit 12 of the detection device 104 receives the message sent by the communication device 111A and extracted by the extraction device 121A via the transmission line 1. On the other hand, the observation unit 10E receives the illegal message sent by the illegal device 111Z in addition to the message sent by the communication device 111A. It should be noted that since the extraction device 121A receives the illegal message sent by the illegal device 111Z via the communication port PA1, it sends the illegal message to the communication device 111A via the communication port PA2, and on the other hand, the filter fa does not extract and copy the illegal message. Therefore, the illegal message sent by the illegal device 111Z does not reach the observation unit 10A in the receiving unit 12 of the detection device 104.

[0187] The communication device 111B receives the message from the communication device 111A via the switch device 144 and sends a response message to the communication device 111A to the switch device 144. The observation unit 10B in the receiving unit 12 of the detection device 104 receives the response message sent by the communication device 111B and extracted by the extraction unit 121B via the transmission line 1.

[0188] The communication device 111B receives the illegal message from the illegal device 111Z via the switch device 144, and sends the response message to the communication device 111A to the switch device 144. The observation unit 10B in the receiving unit 12 of the detection device 104 receives the response message sent by the communication device 111B and extracted by the extraction unit 121B via the transmission line 1.

[0189] Therefore, the communication volume VB calculated by the calculation unit 20B is greater than the communication volume VAD which is the sum of the communication volume VA calculated by the calculation unit 20A and the communication volume VD calculated by the calculation unit 20D. In addition, the communication volume VE calculated by the calculation unit 20E is greater than the communication volume VA.

[0190] In this case, since the value obtained by subtracting the communication volume VB from the communication volume VAD is greater than the specified value, the value obtained by subtracting the communication volume VD from the communication volume VF is less than the specified value, and the value obtained by subtracting the communication volume VA from the communication volume VE is greater than the specified value, the detection unit 34 determines that an abnormality has occurred between the extraction device 121A and the switch device 144.

[0191] Next, other embodiments of the present disclosure will be described using the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their description will not be repeated.

[0192] <Fifth Embodiment>

[0193] This embodiment is related to a detection system 305 which detects anomalies in a network 205 in which a communication device 111 performs one-to-many multicast communication and broadcast communication, compared with the detection system 303 related to the third embodiment. The contents other than those described below are the same as those of the detection system 303 related to the third embodiment.

[0194] Fig.13 1 is a diagram showing an example of the configuration of a detection system and a network as a detection target according to a fifth embodiment of the present disclosure. Fig.13 Compared with the detection system 303 involved in the third embodiment, the detection system 305 includes the detection device 105 instead of the detection device 103, and further includes an extraction device 121G. The extraction device 121G is an example of an extraction device. The extraction device 121G includes communication ports PG1 and PG2. The extraction device 121G sends a message received via one of the communication ports PG1 and PG2 via the other of the communication ports PG1 and PG2. The detection system 305 detects an abnormality in the network 205.

[0195] The network 205 includes communication devices 111A, 111B, 111D, 111G and a switch device 145 as the communication device 111. The communication device 111B is an example of a first communication device. The communication devices 111A, 111D, 111G are examples of second communication devices and examples of third communication devices. The switch device 145 relays information exchanged between the communication devices 111A, 111D, 111G and the communication device 111B. The switch device 145 includes communication ports 122A, 122B, 122D, 122G.

[0196] The communication device 111G is connected to the communication port PG2 in the extraction device 121G via the transmission line 1. The communication port PG1 in the extraction device 121G is connected to the communication port 122G in the switch device 143 via the transmission line 1.

[0197] In network 205, messages are sent and received between communication device 111B and communication devices 111A, 111D, and 111G. Here, in network 205, it is assumed that messages are not sent and received between communication device 111A and communication device 111D, between communication device 111D and communication device 111G, and between communication device 111A and communication device 111G.

[0198] For example, the communication device 111B multicasts messages according to the communication protocol Prt1 to some or all of the communication devices 111A, 111D, and 111G periodically or irregularly through the switch device 145.

[0199] The communication device 111 included in the multicast group determined by the multicast address carried in the message sent by the communication device 111B among the communication devices 111A, 111D, and 111G generates a response message according to the communication protocol Prtl, and sends the generated response message to the communication device 111B via the switch device 145.

[0200] In addition, for example, the communication device 111B broadcasts a message according to the communication protocol Prt1 to the communication devices 111A, 111D, and 111G via the switch device 145 periodically or irregularly.

[0201] The communication device 111A, 111D, and 111G that is to respond to the message received from the communication device 111B via the switch device 145 generates a response message in accordance with the communication protocol Prtl, and sends the generated response message to the communication device 111B via the switch device 145.

[0202] The extraction device 121G includes a filter fg (not shown) that extracts a message received via the communication port PG2 that includes the address of the communication device 111G as a transmission source address. The extraction device 121G extracts the message extracted by the filter fg from the message received via the communication port PG2. The extraction device 121G transmits the extracted message via the communication port PG1. The extraction device 121G also transmits a copy of the extracted message to the detection device 105 via the transmission line 1.

[0203] Compared with the detection device 103 according to the third embodiment, the detection device 105 includes a receiving unit 13 instead of the receiving unit 12, a load calculation unit 25 instead of the load calculation unit 23, a detection unit 35 instead of the detection unit 33, and a storage unit 42 instead of the storage unit 41. Compared with the receiving unit 12, the receiving unit 13 further includes an observation unit 10G as the observation unit 10. Compared with the load calculation unit 23, the load calculation unit 25 includes a calculation unit 20BB as the calculation unit 20 instead of the calculation unit 20B, and also includes a calculation unit 20G as the calculation unit 20. The load calculation unit 25 is an example of an acquisition unit. The detection device 105 performs a detection process for detecting an abnormality in the network 205.

[0204] The storage unit 42 stores network information indicating the topology of the network 205 and the communication protocol Prt1 in the network 205. For example, the network information is stored in the storage unit 42 by the administrator of the network 205.

[0205] In addition, the storage unit 42 stores an address correspondence table Tb1, which indicates the correspondence between the destination address included in the message sent by the communication device 111B, the type information indicating the type of the message, and the destination device information indicating the number of communication devices 111 at the destination of the message. The type information in the address correspondence table Tb1 indicates whether the message sent by the communication device 111B is a unicast message, a multicast message, or a broadcast message. For example, in the address correspondence table Tb1, the number of communication devices 111 at the destination corresponding to the broadcast message is "3". The address correspondence table Tb1 is obtained in advance from the communication device 111 or the switch device 145 by the detection unit 35, for example, and stored in the storage unit 42. It should be noted that the address correspondence table Tb1 can also be stored in the storage unit 42 by the administrator of the network 205.

[0206] For example, the observation unit 10G observes the output of the extracted message by the extraction device 121G. More specifically, the observation unit 10G receives the message extracted by the extraction device 121G via the transmission line 1. The observation unit 10G extracts one or more messages according to the above-mentioned communication protocol Prt1 from one or more messages received in the observation period T1 of a predetermined length periodically or irregularly. The observation unit 10G outputs the observation result including the extracted message to the calculation unit 20G.

[0207] The calculation unit 20G receives the observation result from the observation unit 10G, and calculates the communication volume VG per unit time generated by the message included in the received observation result. The communication volume VG represents the communication volume per unit time generated by the message including the address of the communication device 111G as the transmission source address and passing through the extraction device 121G. The calculation unit 20G outputs the load information representing the calculated communication volume VG to the detection unit 35.

[0208] The calculation unit 20BB calculates the communication volume VB based on the number of response messages predicted based on the type of the message sent by the communication device 111B and the communication volume of the message sent by the communication device 111B. In detail, the calculation unit 20BB receives the observation result from the observation unit 10B, predicts the number of response messages that respond to the message sent by the communication device 111B for each message included in the received observation result, and calculates the product Pmv of the predicted number of response messages and the communication volume of the message sent by the communication device 111B. Then, the calculation unit 20BB calculates the sum of the products Pmv of each message included in the observation result as the communication volume VB.

[0209] More specifically, the calculation unit 20BB acquires the destination address from the message included in the observation result, and acquires the type information and the destination device information corresponding to the acquired destination address from the address correspondence table Tb1 in the storage unit 42 .

[0210] When the message type indicated by the acquired type information is a unicast message, the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the unicast message is 1. Then, the calculation unit 20BB calculates one times the communication volume of the unicast message as the product Pmv.

[0211] For example, when the type of message indicated by the acquired type information is a multicast message and the number of the communication devices 111 of the destination indicated by the acquired destination device information is, for example, "2", the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the multicast message is 2. Then, the calculation unit 20BB calculates twice the communication volume of the multicast message as the product Pmv.

[0212] For example, when the type of message indicated by the acquired type information is a broadcast message, the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the broadcast message is three, because the number of destination communication devices 111 indicated by the destination device information corresponding to the type information in the address correspondence table Tb1 is "3" as described above. Then, the calculation unit 20BB calculates three times the communication volume of the broadcast message as the product Pmv.

[0213] Fig.14 It is a diagram showing an example of detection processing in the detection device according to the fifth embodiment of the present disclosure.

[0214] Reference Fig.14For example, the communication device 111B multicasts the message to the communication devices 111A and 111D via the switch device 145. The observation unit 10B in the receiving unit 13 of the detection device 105 receives the message sent by the communication device 111B and extracted by the extraction device 121B via the transmission line 1, and outputs the observation result including the received message to the calculation unit 20BB.

[0215] The communication device 111A receives a message from the communication device 111B via the switch device 145, and sends a response message to the communication device 111B via the switch device 145. The observation section 10A in the receiving section 13 of the detection device 105 receives the response message sent by the communication device 111A and extracted by the extraction device 121A via the transmission line 1, and outputs the observation result including the received response message to the calculation section 20A.

[0216] The communication device 111D receives a message from the communication device 111B via the switch device 145, and sends a response message to the communication device 111B via the switch device 145. The observation section 10D in the receiving section 13 of the detection device 105 receives the response message sent by the communication device 111D and extracted by the extraction device 121D via the transmission line 1, and outputs the observation result including the received response message to the calculation section 20D.

[0217] The calculation unit 20BB receives the observation result from the observation unit 10B, obtains the destination address from the message included in the received observation result, and obtains the type information and destination device information corresponding to the obtained destination address from the address correspondence table Tb1 in the storage unit 42. Since the type of the message indicated by the obtained type information is a multicast message, and the number of communication devices 111 at the destination indicated by the obtained destination device information is "2", the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the multicast message is "2", and calculates twice the communication volume of the multicast message as the communication volume VB.

[0218] When the network 205 is normal, the difference between the sum of the communication volume VA calculated by the calculation unit 20A and the communication volume VD calculated by the calculation unit 20D, that is, the communication volume VAD and the communication volume VB calculated by the calculation unit 20BB is, for example, zero. On the other hand, when an abnormality such as the insertion of an illegal message occurs in the network 205, the matching of the communication volume VAD and the communication volume VB decreases, and the difference between the communication volume VAD and the communication volume VB becomes a large value. Therefore, even in the network 205 where the communication device 111 performs one-to-many multicast communication and broadcast communication, the detection unit 35 can determine whether an abnormality occurs in the network 205 based on the difference between the communication volume VAD and the communication volume VB.

[0219] (Variant 1)

[0220] It should be noted that the calculation unit 20BB assumes the following structure: that is, when the type of the message indicated by the type information obtained from the address correspondence table Tb1 is a broadcast message, based on the number of communication devices 111 of the destination indicated by the destination device information corresponding to the type information in the address correspondence table Tb1, it is predicted that the number of response messages to the communication device 111B in response to the broadcast message is three, and the communication volume VB is calculated based on the predicted number of response messages and the communication volume of the message, but it is not limited to this. For example, the calculation unit 20BB calculates the communication volume VB based on the number of response messages predicted based on the header information of the message sent by the communication device 111B and the communication volume of the message.

[0221] Fig.15 It is a diagram showing an example of a response information table stored in a storage unit in a detection device according to a fifth embodiment of the present disclosure.

[0222] Reference Fig.15 For each communication protocol Prt1 of the broadcast message sent by the communication device 111B, the storage unit 42 stores a response information table Tb2 indicating the correspondence between the header information of the broadcast message and the number of response messages predicted to the communication device 111B. The response information table Tb2 is acquired in advance from the communication device 111 or the switch device 145 by the detection unit 35, for example, and stored in the storage unit 42.

[0223] For example, the response information table Tb2 shows that when the operation code of the ARP broadcast message is "1", the number of predicted response messages is "1". This is because, when the ARP request message is broadcast by the communication device 111B, any communication device 111 having an IP address consistent with the IP address specified by the ARP request message among the communication devices 111A, 111D, and 111G sends an ARP response message as a response message to the communication device 111B. The operation code is an example of header information.

[0224] In addition, for example, the response information table Tb2 shows that when the Type in the SOME / IP-SD (Service Discovery) header of the broadcast message according to SOME / IP is "0x01", the broadcast message is an Offer message according to SOME / IP, and the predicted number of response messages is "1". This is because, when the Offer message is broadcast by the communication device 111B acting as a server, any one of the communication devices 111A, 111D, and 111G acting as clients to which the service specified by the Offer message should be provided will send a Subscribe message according to SOME / IP as a response message to the communication device 111B. Here, a number starting with "0x" means that the number after "0x" is expressed in hexadecimal. The Type in the SOME / IP-SD header is an example of header information.

[0225] In addition, for example, the response information table Tb2 shows that when the Type in the SOME / IP-SD header of the broadcast message according to SOME / IP is "0x00", the broadcast message is a Find message according to SOME / IP, and the number of predicted response messages is "1". This is because, when the communication device 111B acts as a client and the communication devices 111A, 111D, and 111G act as servers, when the Find message is broadcast by the communication device 111B, any one of the communication devices 111A, 111D, and 111G that can provide the service specified by the Find message sends an Offer message according to SOME / IP as a response message to the communication device 111B.

[0226] When the type of the message indicated by the type information acquired from the address correspondence table Tb1 in the storage unit 42 is a broadcast message, the calculation unit 20BB acquires the header information of the broadcast message.

[0227] The calculation unit 20BB refers to the response information table Tb2 in the storage unit 42, and identifies the number of predicted response messages corresponding to the header information when the acquired header information is included in the response information table Tb2. On the other hand, the calculation unit 20BB predicts that the number of response messages is three based on the address correspondence table Tb1 as described above when the acquired header information is not included in the response information table Tb2. The calculation unit 20BB calculates the product Pmv of the predicted number of response messages and the communication volume of the broadcast message. Then, the calculation unit 20BB calculates the sum of the products Pmv of each message included in the observation result as the communication volume VB.

[0228] For example, when the operation code of the ARP broadcast message is "1", the calculation unit 20BB recognizes that the number of response messages to the communication device 111B in response to the broadcast message is one by referring to the response information table Tb2. Then, the calculation unit 20BB calculates one times the communication volume of the broadcast message as the product Pmv.

[0229] (Variant 2)

[0230] It should be noted that the calculation unit 20BB assumes the following structure: that is, the type information and the destination device information are obtained from the address correspondence table Tb1 in the storage unit 42, the number of response messages to the communication device 111B is predicted based on the obtained type information and the destination device information, and the communication volume VB is calculated based on the predicted number of response messages and the communication volume of the messages, but it is not limited to this. For example, the calculation unit 20BB calculates the communication volume VB based on the number of response messages predicted based on the window size in the communication according to TCP (Transmission Control Protocol) and the communication volume of the messages.

[0231] In more detail, when the communication devices 111 communicate with each other according to TCP, the window size may be controlled. When the window size is controlled, the communication devices 111A, 111D, and 111G send one response message to the communication device 111B via the switch device 145 for multiple messages received from the communication device 111B via the switch device 145. Specifically, for example, when the window size is set to "3", the communication devices 111A, 111D, and 111G send one response message to the communication device 111B via the switch device 145 for three messages received from the communication device 111B via the switch device 145.

[0232] For example, the storage unit 42 stores a window control table Tb3 indicating the correspondence between the port number, whether window control is performed, and the window size when window control is performed.

[0233] The calculation unit 20BB acquires a port number from a message included in the observation result received from the observation unit 10B, and acquires a window size corresponding to the acquired port number from the window control table Tb3 in the storage unit 42. The calculation unit 20BB predicts the number of response messages to the communication device 111B based on the acquired window size. The calculation unit 20BB calculates the product Pmv of the predicted number of response messages and the communication volume of the messages included in the observation result. Then, the calculation unit 20BB calculates the sum of the products Pmv of each message included in the observation result as the communication volume VB.

[0234] It should be considered that the above embodiments are illustrative in all aspects and not restrictive. The scope of the present invention is shown by the claims rather than the above description, and is intended to include all changes within the meaning and scope equivalent to the claims.

[0235] Each process (function) of the above-mentioned embodiment is implemented by a processing circuit (Circuitry) including one or more processors. The above-mentioned processing circuit can also be composed of an integrated circuit that is combined with one or more memories, various analog circuits, various digital circuits, etc. in addition to the above-mentioned one or more processors. The above-mentioned one or more memories store programs (commands) that enable the above-mentioned one or more processors to perform the above-mentioned processes. The above-mentioned one or more processors can perform the above-mentioned processes according to the above-mentioned programs read from the above-mentioned one or more memories, or they can perform the above-mentioned processes according to the logic circuits pre-designed to perform the above-mentioned processes. The above-mentioned processor can be a CPU (Central Processing Unit: Central Processing Unit), GPU (Graphics Processing Unit: Graphics Processing Unit), DSP (Digital Signal Processor: Digital Signal Processor), FPGA (Field Programmable Gate Array: Field Programmable Gate Array) and ASIC (Application Specific Integrated Circuit: Application Specific Integrated Circuit) and other various processors suitable for computer control. It should be noted that the above-mentioned multiple processors separated physically can also cooperate with each other to perform the above-mentioned processes. For example, the processors installed in each of the physically separated computers may perform the above-mentioned processes in cooperation with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet. The above-mentioned program may be installed in the above-mentioned memory from an external server device or the like via the above-mentioned network, or may be circulated in a state stored in a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor memory, and installed in the above-mentioned memory from the above-mentioned recording medium.

[0236] The above description includes the following additional features.

[0237] [Note 1]

[0238] A detection device is a detection device for detecting anomalies in a network.

[0239] In the network, a plurality of messages including a response message are sent and received by a plurality of communication devices.

[0240] The detection device comprises:

[0241] an acquisition unit, which acquires a plurality of load information respectively indicating communication loads at a plurality of locations in the network; and

[0242] a detection unit, which detects an abnormality in the network based on the matching of the plurality of load information acquired by the acquisition unit,

[0243] In the network, the plurality of communication devices transmit and receive the messages via a switch device.

[0244] The acquisition unit acquires the load information indicating the communication load in the switching device.

[0245] Description of Reference Numerals

[0246] 1 Transmission Line

[0247] 10, 10A, 10B, 10C, 10D, 10E, 10F, 10G Observation Department

[0248] 11, 12, 13 Receiving Department

[0249] 20, 20A, 20B, 20C, 20D, 20E, 20F, 20G, 20BB calculation unit

[0250] 21, 22, 23, 24, 25 load calculation unit (acquisition unit)

[0251] 31, 32, 33, 34, 35 detection department

[0252] 41, 42 Storage unit

[0253] 111A, 111B, 111D, 111G communication equipment

[0254] 111X, 111Y, 111Z illegal devices

[0255] 121A, 121B, 121D, 121G extraction devices

[0256] 121X, 121Y, 121Z relay hub

[0257] 122A, 122B, 122D, 122G communication ports

[0258] 101, 102, 103, 104, 105 detection devices

[0259] 141, 142, 143, 144, 145 switch devices

[0260] 201, 202, 203, 204, 205 Network

[0261] 301, 302, 303, 304, 305 detection systems

[0262] Tb1 address correspondence table

[0263] Tb2 Response Information Table

[0264] PA1, PA2, PB1, PB2, PD1, PD2, PG1, PG2 communication ports.

Claims

1. A detection device for detecting anomalies in a network, In the network, a plurality of messages including a response message are sent and received by a plurality of communication devices. The detection device comprises: an acquisition unit that acquires a plurality of load information, each of which indicates a communication load at a plurality of locations in the network and each of which indicates a communication load generated by the message from a different transmission source; and The detection unit detects an abnormality in the network based on the matching of the plurality of load information acquired by the acquisition unit.

2. The detection device according to claim 1, wherein: The acquisition unit acquires three or more load information respectively indicating communication loads at three or more locations in the network, The detection unit determines an abnormal part in the network based on the matching of each of the combinations of two of the load information included in the three or more load information.

3. The detection device according to claim 1 or 2, wherein: In the network, the message is sent and received between the first communication device and a plurality of communication devices different from the first communication device, the acquisition unit acquires first load information indicating the communication volume of the message whose transmission source is the first communication device and second load information indicating the communication volume of the message whose transmission source is the communication device other than the first communication device, The detection unit detects an abnormality in the network based on the matching between the communication volume of the message indicated by the first load information and the communication volume of the message indicated by the second load information.

4. The detection device according to any one of claims 1 to 3, wherein: The detection device further includes an observation unit for observing the output of the extracted message by the extraction device, wherein the extraction device extracts the message sent from the communication device and outputs the extracted message to the other communication devices and the detection device. The acquisition unit generates the load information based on the observation result of the observation unit.

5. The detection device according to claim 3, wherein: The acquisition unit acquires the load information indicating the communication load calculated based on the number of response messages predicted based on the type of the message transmitted by the first communication device and the communication volume of the message transmitted by the first communication device.

6. The detection device according to claim 5, wherein: The acquisition section acquires the load information indicating the communication load calculated based on the number of response messages predicted also based on header information of the message transmitted by the first communication device.

7. A detection system for detecting anomalies in a network, In the network, a plurality of messages including a response message are sent and received by a plurality of communication devices. The detection system has: A plurality of extraction devices for respectively extracting the messages from different sending sources passing through different locations in the network; A plurality of observation units respectively observing the messages extracted by the plurality of extraction devices; a load calculation unit that generates a plurality of load information that respectively represent communication loads at a plurality of locations in the network based on the observation results of the plurality of observation units; as well as The detection unit detects an abnormality in the network based on the matching of the plurality of load information generated by the load calculation unit.

8. A detection method, a detection method in a detection device for detecting anomalies in a network, In the network, a plurality of messages including a response message are sent and received by a plurality of communication devices. The detection method comprises the following steps: acquiring a plurality of load information, the plurality of load information respectively indicating communication loads at a plurality of locations in the network and respectively indicating communication loads generated by the messages from different transmission sources; and Based on the matching of the obtained multiple load information, anomalies in the network are detected.

Images