Detection device and detection method

Abstract

This detection device comprises: a calculation unit which calculates a reception interval of a target message; a detection unit which performs a detection process on the basis of the reception interval; and a counter unit which counts a plurality of burst messages including a delayed message, which is a target message of which the reception interval is greater than a transmission period by a predetermined value, and one or a plurality of target messages which is / are received continuous to the delayed message and of which the reception interval is no greater than the predetermined value. The detection unit determines, on the basis of a counter value from the counter unit, whether the detection process based on the reception interval is to be performed on at least any one burst message among the plurality of burst messages.

Description

Technical Field

[0001] The present disclosure relates to a detection device and a detection method. This application claims priority based on Japanese Patent Application No. 2022-65792 filed on April 12, 2022, and incorporates all of its disclosures herein.

Background Art

[0002] Patent Document 1 (International Publication No. 2021 / 111685) discloses the following detection device. That is, the detection device is a detection device that detects an illegal message in a vehicle network, and includes an acquisition unit that acquires a target distribution that is a distribution of reception intervals of periodic messages transmitted in the vehicle network, an extraction unit that extracts a part of the target distribution acquired by the acquisition unit according to a predetermined criterion, and a detection unit that performs a detection process for detecting the illegal message based on the part of the target distribution extracted by the extraction unit.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

[0004] The detection device of this disclosure is a detection device for detecting anomalies in a network in which a plurality of target messages, including periodic messages transmitted and received at a predetermined transmission cycle, are transmitted and received, and comprises: a calculation unit for calculating the reception interval of the target messages; a detection unit for performing detection processing to detect anomalies in the network based on the reception interval calculated by the calculation unit; and a counting unit for counting a plurality of burst messages, which include a delayed message that is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and one or more of the target messages received following the delayed message, whose reception interval is less than or equal to a predetermined value, wherein the detection unit determines, based on the count value by the counting unit, whether or not to perform the detection processing based on the reception interval for at least one of the plurality of burst messages.

[0005] The detection method of this disclosure is a detection method for a detection device that detects an anomaly in a network in which a plurality of target messages, including periodic messages transmitted and received at a predetermined transmission cycle, are transmitted and received, and includes the steps of: calculating the reception interval of the target messages; performing a detection process to detect an anomaly in the network based on the calculated reception interval; and counting a plurality of burst messages, which include a delayed message that is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and one or more of the target messages received following the delayed message, whose reception interval is less than or equal to a predetermined value, wherein in the step of performing the detection process, it is determined whether or not to perform the detection process based on the reception interval for at least one of the plurality of burst messages based on the count value of the plurality of burst messages.

[0006] One aspect of this disclosure can be implemented not only as a detection device equipped with such characteristic processing steps, but also as a program for causing a computer to execute such characteristic processing steps, as a semiconductor integrated circuit that implements part or all of the detection device, or as a system including the detection device. [Brief explanation of the drawing]

[0007] [Figure 1] Figure 1 is a diagram showing the configuration of a communication system according to an embodiment of the present disclosure. [Figure 2] Figure 2 shows the configuration of a relay device according to an embodiment of the present disclosure. [Figure 3] Figure 3 shows an example of the distribution of target messages and reception times received by a relay device according to an embodiment of the present disclosure. [Figure 4] Figure 4 shows an example of statistical values ​​used in detection processing in a relay device according to an embodiment of the present disclosure. [Figure 5] Figure 5 shows another example of the distribution of target messages and reception times received by a relay device according to an embodiment of the present disclosure. [Figure 6] Figure 6 shows an example of statistical values ​​used in detection processing in a relay device according to a comparative example of the embodiment of the present disclosure. [Figure 7] Figure 7 shows an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. [Figure 8] Figure 8 shows another example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. [Figure 9] Figure 9 shows an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. [Figure 10] Figure 10 shows another example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. [Figure 11]Figure 11 shows an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. [Figure 12] Figure 12 shows an example of a correspondence table stored in the storage unit of a relay device according to an embodiment of the present disclosure. [Figure 13] Figure 13 is a flowchart illustrating an example of the operation procedure when the relay device according to the embodiment of this disclosure performs detection processing. [Figure 14] Figure 14 is a flowchart illustrating an example of the operation procedure when a relay device according to an embodiment of the present disclosure performs a burst message counting process. [Figure 15] Figure 15 shows an example of a network connection topology according to an embodiment of the present disclosure. [Figure 16] Figure 16 shows another example of a correspondence table stored in the storage unit of a relay device according to an embodiment of the present disclosure. [Modes for carrying out the invention]

[0008] Traditionally, technologies have been proposed to improve network security.

[0009] [Issues this disclosure aims to address] Beyond the technology described in Patent Document 1, there is a need for technology that can more accurately detect anomalies in networks.

[0010] This disclosure was made to solve the above-mentioned problems, and its purpose is to provide a detection device and detection method that can more accurately detect anomalies in a network.

[0011] [Effects of this disclosure] According to this disclosure, it is possible to more accurately detect anomalies in the network.

[0012] [Description of Embodiments in this Disclosure] First, the content of the embodiments of the present disclosure will be listed and described.

[0013] (1) The detection device according to an embodiment of the present disclosure is a detection device that detects an abnormality in a network in which a plurality of target messages including periodic messages transmitted and received at a predetermined transmission period are transmitted and received, and includes a calculation unit that calculates a reception interval of the target messages, and a detection unit that performs a detection process for detecting an abnormality in the network based on the reception interval calculated by the calculation unit. The detection device further includes a count unit that counts a plurality of burst messages including a delay message that is the target message whose reception interval is greater than or equal to a predetermined value than the transmission period, and one or more target messages whose reception intervals are less than or equal to the predetermined value and are received following the delay message. The detection unit determines whether to perform the detection process based on the reception interval for at least any one of the plurality of burst messages based on the count value by the count unit.

[0014] Thus, in a detection device that performs a detection process based on the reception interval of target messages, a configuration that determines whether to perform a detection process based on the reception interval of burst messages based on the count value of the burst messages can determine whether to target a plurality of burst messages for the detection process according to the likelihood that the plurality of burst messages include an illegal target message. Therefore, for example, it is possible to suppress overlooking illegal messages included in a plurality of burst messages while suppressing false detection due to the occurrence of a burst phenomenon. Accordingly, an abnormality in the network can be detected more accurately.

[0015] (2) In the above (1), when the count value is less than or equal to a threshold value, the detection unit may not perform the detection process based on the reception interval of at least any one of the plurality of burst messages.

[0016] This configuration allows for the exclusion of multiple burst messages that are unlikely to contain malicious target messages from the detection process, thereby suppressing false positives caused by burst phenomena.

[0017] (3) In (1) or (2) above, if the count value is greater than the threshold value, the detection unit may perform the detection process based on the reception interval of the plurality of burst messages.

[0018] This configuration allows detection processing to be performed based on the reception intervals of multiple burst messages that may contain malicious target messages, without excluding them from the detection process. This reduces the likelihood of missing malicious messages.

[0019] (4) In any of (1) to (3) above, the detection unit may determine the threshold value according to the reception interval of the target message which is the delayed message.

[0020] This configuration allows for a more appropriate determination of whether or not to perform detection processing based on the reception interval of burst messages, using a threshold determined according to the degree of delay of the delayed message.

[0021] (5) In any of (1) to (4) above, the detection unit may calculate a detection index that increases or decreases according to the relationship between the reception interval and reference information relating to the reception interval, and perform the detection process based on the calculated detection index, and the detection unit may not calculate the detection index for at least one of the burst messages among the plurality of burst messages if the count value is less than or equal to the threshold value.

[0022] This configuration allows for more accurate detection of network anomalies based on a detection index that indicates the degree of deviation of the message reception interval from normal values, while suppressing false detections caused by burst phenomena.

[0023] (6) In any of (1) to (5) above, the counting unit may terminate the count if the next target message is not received within a predetermined time from the time of receipt of the target message which is the burst message, and the detection unit may suspend the detection process until the counting by the counting unit is completed, and resume the detection process after the counting by the counting unit is completed.

[0024] This configuration allows the counting of burst messages to stop when the burst phenomenon ends, enabling the detection process to resume at a more appropriate time.

[0025] (7) A detection method according to an embodiment of the present disclosure is a detection method in a detection device for detecting an anomaly in a network in which a plurality of target messages, including periodic messages transmitted and received at a predetermined transmission cycle, are transmitted and received, comprising the steps of: calculating the reception interval of the target messages; performing a detection process to detect an anomaly in the network based on the calculated reception interval; and counting a plurality of burst messages, which include a delayed message that is a target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and one or more of the target messages received following the delayed message, whose reception interval is less than or equal to a predetermined value, wherein in the step of performing the detection process, it is determined whether or not to perform the detection process based on the reception interval for at least one of the plurality of burst messages based on the count value of the plurality of burst messages.

[0026] Thus, in a detection device that performs detection processing based on the reception interval of target messages, a method is used to determine whether or not to perform detection processing based on the reception interval of burst messages, based on the count value of burst messages. This allows for the determination of whether or not to target multiple burst messages for detection processing, depending on the likelihood that multiple burst messages contain an invalid target message. For example, this can suppress false detections caused by burst phenomena while also suppressing the oversight of invalid messages contained in multiple burst messages. Therefore, anomalies in the network can be detected more accurately.

[0027] Embodiments of this disclosure will be described below with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and their descriptions will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any way.

[0028] [Configuration and Basic Operation] Figure 1 is a diagram showing the configuration of a communication system according to an embodiment of the present disclosure. Referring to Figure 1, the communication system 301 comprises a relay device 101 and a plurality of communication devices 111. The communication system 301 is mounted, for example, in a vehicle. In this case, the communication devices 111 are, for example, on-board ECUs (Electronic Control Units). Note that the communication system 301 may also be configured to include other relay devices (not shown) besides the relay device 101.

[0029] The relay device 101 and the communication device 111 constitute a network 201. More specifically, the relay device 101 and the communication device 111 are connected to each other via a transmission line 10. The communication system 301 may be configured such that the relay device 101 is connected to the communication device 111 on a one-to-one basis via a line-type transmission line 10 as shown in Figure 1, or it may be connected to the communication device 111 via other relay devices and transmission lines 10 not shown, or it may be connected to multiple communication devices 111 on a one-to-many basis via a bus-type transmission line 10. The transmission line 10 is, for example, a cable conforming to standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network).

[0030] The relay device 101 is capable of communicating with the communication device 111. The relay device 101 performs relay processing, for example, to relay information exchanged between multiple communication devices 111 connected to different transmission lines 10.

[0031] Network 201 receives and receives multiple messages, including messages that are sent periodically.

[0032] More specifically, in network 201, for example, messages are periodically transmitted from communication device 111 to other communication devices 111 via relay device 101, according to a predetermined arrangement. Hereinafter, messages transmitted periodically in network 201 will also be referred to as periodic messages. Note that "periodic messages" are not limited to messages transmitted strictly periodically, but refer to messages of a type that should be transmitted periodically.

[0033] In addition to periodic messages, network 201 also has messages that are sent irregularly from one communication device 111 to another via relay device 101. Hereafter, messages sent irregularly in network 201 will also be referred to as event messages.

[0034] The transmission of messages by the communication device 111 may be done by broadcast, unicast, or multicast.

[0035] The relay device 101 functions as a detection device and detects abnormalities in the network 201.

[0036] [Relay device] Figure 2 shows the configuration of a relay device according to an embodiment of the present disclosure. Referring to Figure 2, the relay device 101 comprises a communication processing unit 11, a calculation unit 12, a processing unit 14, a storage unit 15, and a plurality of communication ports 16. The processing unit 14 is an example of a counting unit and an example of a detection unit. Some or all of the communication processing unit 11, the calculation unit 12, and the processing unit 14 are implemented by a processing circuit (Circuitry) including, for example, one or more processors. The storage unit 15 is, for example, a flash memory included in the processing circuit. The communication ports 16 are, for example, connectors or terminals. A transmission line 10 is connected to each communication port 16.

[0037] The communication processing unit 11 performs relay processing to relay messages transmitted between communication devices 111. For example, when the communication processing unit 11 receives a message from a communication device 111 via the corresponding transmission line 10 and corresponding communication port 16, it generates a message CP, which is a copy of the received message, and adds a timestamp indicating the time the received message was received to the generated message CP. Then, the communication processing unit 11 transmits the received message to another communication device 111 via the corresponding communication port 16 and corresponding transmission line 10, and outputs the message CP with the timestamp to the calculation unit 12.

[0038] (Calculation of reception interval) The calculation unit 12 calculates the reception interval of the target message, which is the message to be detected by the relay device 101. The relay device 101 may be configured to perform detection processing on one type of message transmitted from one communication device 111, or it may be configured to perform detection processing on multiple types of messages transmitted from each of multiple communication devices 111, for each type of message. Below, an example is described in which the relay device 101 performs detection processing on a message transmitted from a certain communication device 111 as the "target message M". Multiple target messages M transmitted in the network 201 include periodic messages transmitted from the communication device 111 according to a predetermined transmission period Cm.

[0039] More specifically, the calculation unit 12 obtains the reception time t of the target message M among the messages relayed by the communication processing unit 11.

[0040] For example, the memory unit 15 stores an ID for each type of target message. Hereinafter, the ID of a target message will also be referred to as the target ID, and the ID of target message M will also be referred to as target ID_M.

[0041] The calculation unit 12 receives a message CP from the communication processing unit 11 and checks the ID contained in the received message CP and the target ID in the storage unit 15.

[0042] Then, if the ID contained in the message CP received from the communication processing unit 11 matches the target ID_M, the calculation unit 12 recognizes that the original message of the message CP is the target message M, and obtains the reception time t of the target message M by referring to the timestamp attached to the message CP.

[0043] When the calculation unit 12 obtains the reception time t of the target message M, it calculates the reception interval x of the target message M as the difference between the reception time t of the target message M and the reception time t of the previous target message M. More specifically, the calculation unit 12 calculates the reception interval xm of the target message Mm by subtracting the reception time t(m-1) of the (m-1)th target message M(m-1), which was received by the communication processing unit 11, from the reception time tm of the mth target message Mm received by the communication processing unit 11. Here, m is a positive integer. The calculation unit 12 stores the calculated reception interval xm and reception time tm in the storage unit 15. If there are multiple target messages, the calculation unit 12 calculates the reception interval xm and reception time tm for each target message and stores the calculated reception interval xm and reception time tm in the storage unit 15 for each target ID.

[0044] (Detection process) The processing unit 14 performs detection processing to detect anomalies in the network 201 based on the reception interval x calculated by the calculation unit 12.

[0045] For example, the processing unit 14 calculates a statistical value T of the reception interval x using the standard deviation σ of the reception interval x calculated by the calculation unit 12, and performs detection processing based on the calculated statistical value T. The statistical value T indicates the degree of deviation of the reception interval x from the normal state. The statistical value T is an example of a detection index.

[0046] More specifically, when the calculation unit 12 stores the reception interval xm of the target message Mm in the storage unit 15, the processing unit 14 calculates the abnormality level Dm of the target message Mm according to the following equation (1).

number

[0047] Here, μ is the average value of the reception interval x and is an example of reference information regarding the target message M. The standard deviation σ and the average value μ are stored in the storage unit 15. For example, the standard deviation σ is calculated in advance by the manufacturer of the communication system 301 based on the reception interval x and stored in the storage unit 15. Also, for example, the average value μ is a value calculated in advance by the manufacturer of the communication system 301 based on the design value of the transmission period Cm of the target message M in the network 201 and is stored in the storage unit 15 in advance. The processing unit 14 may periodically or irregularly calculate the standard deviation σ and average value μ based on multiple reception intervals x corresponding to multiple target messages M, and update the standard deviation σ and average value μ in the storage unit 15 with the calculated standard deviation σ and average value μ.

[0048] The processing unit 14 calculates the abnormality level Dm of the target message Mm, and then calculates the statistical value Tm of the target message Mm according to the following formula (2).

number

[0049] Here, k is a limiting parameter. The limiting parameter k is a pre-set constant. As shown in equation (2), the statistical value Tm of the target message Mm is the larger of the following two values: the sum of the statistical value T(m-1) of the target message M(m-1) and the anomaly score Dm, minus the limiting parameter k, and zero.

[0050] As shown in equations (1) and (2), the statistical value Tm increases or decreases depending on the relationship between the reception interval xm of the target message Mm and the mean value μ. Specifically, if the reception interval xm deviates significantly from the mean value μ, and the anomaly score Dm becomes greater than the limit parameter k, the statistical value Tm of the target message Mm will be greater than the statistical value T(m-1) of the previous target message M(m-1). On the other hand, if the reception interval xm is close to the mean value μ, and the anomaly score Dm becomes smaller than the limit parameter k, the statistical value Tm of the target message Mm will be zero or less than the statistical value T(m-1) of the previous target message M(m-1).

[0051] The processing unit 14 performs detection processing to detect anomalies in the network 201 based on the calculated statistical value T. For example, the processing unit 14 detects an anomaly in the network 201 based on the calculated statistical value T and a predetermined threshold Thx.

[0052] More specifically, the processing unit 14 compares the calculated statistical value T with the threshold Thx. If the statistical value T is less than or equal to the threshold Thx, the processing unit 14 determines that no abnormality has occurred in network 201. On the other hand, if the statistical value T is greater than the threshold Thx, the processing unit 14 determines that an abnormality has occurred in network 201.

[0053] Figure 3 shows an example of the distribution of target messages and reception times received by a relay device according to an embodiment of the present disclosure. In Figure 3, the horizontal axis represents time.

[0054] Referring to Figure 3, the multiple target messages M received by the communication processing unit 11 include target messages M1 to M4, M6, M8, M10, and M12, which are legitimate periodic messages received at timings based on the transmission period Cm during the period from reception time t1 to reception time t12, and target messages M5, M7, M9, M11, and M13, which are invalid messages BM, received at timings based on the transmission period Cm during the period from reception time t5 to reception time t13. In other words, during the period from reception time t5 to reception time t13, legitimate periodic messages and invalid periodic messages arrive alternately at the relay device 101.

[0055] Figure 4 shows an example of statistical values ​​used in detection processing in a relay device according to an embodiment of the present disclosure. In Figure 4, the horizontal axis represents time, and the vertical axis represents statistical values. Figure 4 shows statistical values ​​T1 to T13 calculated by the calculation unit 12 based on the reception times t1 to t13 of the target messages M1 to M13 shown in Figure 3.

[0056] Referring to Figure 4, during the period from reception time t1 to reception time t4, only legitimate target messages M1 to M4 transmitted with a constant transmission period Cm are received by the communication processing unit 11, and the reception interval x1 to x4 is approximately equal to the average value μ, so the statistical values ​​T1 to T4 calculated by the processing unit 14 are zero.

[0057] The processing unit 14 determines that no abnormalities occurred in network 201 during the period from reception time t1 to reception time t4, since the calculated statistical values ​​T1 to T4 are less than or equal to the threshold Thx.

[0058] On the other hand, during the period from reception time t5 to reception time t13, in addition to the target messages M6, M8, M10, and M12 transmitted with a transmission cycle Cm, the malicious message BM is also received by the communication processing unit 11, and the reception interval x5 to x13 deviates from the average value μ, so the statistical values ​​T5 to T13 calculated by the processing unit 14 gradually increase.

[0059] The processing unit 14 determines that an anomaly occurred in network 201 at reception time t9 because the calculated statistical value T9 exceeds the threshold Thx. When the processing unit 14 determines that an anomaly has occurred in network 201, it transmits alarm information indicating that an anomaly has occurred in network 201 to a higher-level device outside the communication system 301 via the communication processing unit 11. The higher-level device is, for example, a server or other device that receives the alarm information and performs predetermined processing.

[0060] Here, the threshold Thx can be arbitrarily set by the manufacturer of network 201. For example, by setting the threshold Thx to a smaller value, it is possible to determine earlier that an anomaly has occurred in network 201 after the transmission of malicious messages on network 201 has begun.

[0061] Figure 5 shows another example of the distribution of target messages and reception times received by a relay device according to an embodiment of the present disclosure. In Figure 5, the horizontal axis represents time. Figure 5 shows the distribution of reception times for target messages M1 to M9, which are legitimate periodic messages.

[0062] Referring to Figure 5, while target messages M1 and M2 arrive at the relay device 101 with a transmission cycle Cm, the target message M3, which would normally arrive at the relay device 101 after the transmission cycle Cm from the reception time t2 of target message M2, may be delayed due to the processing load at the source communication device 111 of target message M and increased or concentrated traffic on the network 201. In particular, in the network 201 where the relay device 101 is connected to multiple communication devices 111 in a one-to-many relationship, delays in the arrival of target message M at the relay device 101 are likely to occur due to waiting for access rights from the source communication device 111. Also, in the network 201 where the relay device 101 is connected to the communication device 111 via other relay devices, delays in the arrival of target message M at the relay device 101 are likely to occur due to congestion at those other relay devices. As shown in Figure 5, if the target message M3 is delayed, for example, target messages M4 to M7 that follow target message M3 will arrive at the relay device 101 at very short intervals due to the delay of target message M3. Hereafter, the phenomenon in which multiple target messages M arrive at the relay device 101 at short intervals will also be referred to as the burst phenomenon.

[0063] [assignment] Figure 6 shows an example of statistical values ​​used in detection processing in a relay device according to a comparative example of the embodiment of the present disclosure. In Figure 6, the horizontal axis represents time, and the vertical axis represents statistical values. Figure 6 shows statistical values ​​T1 to T9 calculated by the calculation unit 12 based on the reception times t1 to t9 of the target messages M1 to M9 shown in Figure 5.

[0064] Referring to Figure 6, the delay in the target message M3 causes the reception interval x3 to be greater than the average value μ, thus increasing the calculated statistical value T3. Also, because the target messages M4 to M7 arrive at the relay device at very short intervals, the reception intervals x4 to x7 become smaller than the average value μ, so the calculated statistical values ​​T4 to T7 gradually increase.

[0065] In the comparative example relay device, for example, if the statistical value T5 exceeds the threshold Thx, it is determined that an anomaly has occurred in network 201. In other words, even if no malicious message has arrived, the comparative example relay device will determine that an anomaly has occurred in network 201 if the reception interval x of the target message M becomes shorter due to a burst phenomenon.

[0066] To suppress such false positives, one possible method is to exclude the reception interval x of the target message M that arrives during the period in which the burst phenomenon is occurring from the detection process. However, with this method, if a malicious message arrives during the period in which the burst phenomenon is occurring, that malicious message cannot be detected.

[0067] Therefore, the relay device 101 according to the embodiment of this disclosure solves the above problem with the following configuration.

[0068] (Detection of delayed message DEM) The processing unit 14 detects a delayed message DEM, which is a target message M in which the reception interval x is greater than or equal to a predetermined value than the transmission period Cm.

[0069] More specifically, when the calculation unit 12 stores the reception interval x and reception time t of the target message M in the storage unit 15, the processing unit 14 compares the reception interval x with a predetermined threshold ThD to determine whether the target message M is a delayed message DEM, such as the target message M3 described above. The threshold ThD is a threshold used to detect delayed messages DEMs, and is, for example, twice the transmission period Cm of a periodic message.

[0070] Figure 7 shows an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. In Figure 7, the horizontal axis represents time.

[0071] Referring to Figure 7, the processing unit 14 determines that if the reception interval xm of the target message Mm is less than the threshold ThD, the target message Mm is not a delayed message DEM. In this case, the processing unit 14 calculates a statistical value Tm for the reception interval xm. Then, the processing unit 14 compares the calculated statistical value Tm with the threshold Thx and determines whether or not an anomaly has occurred in network 201 based on the comparison result.

[0072] Figure 8 shows another example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. In Figure 8, the horizontal axis represents time.

[0073] Referring to Figure 8, the processing unit 14 determines that a target message Mm is a delayed message DEM if its reception interval xm is greater than or equal to the threshold ThD. In this case, the processing unit 14 suspends the calculation of the statistical value T of the reception interval x of the delayed message DEM until the calculation time tB, which is the time obtained by adding the threshold ThB to the reception time t of the delayed message DEM. That is, the processing unit 14 suspends the calculation of the statistical value Tm of the reception interval xm until the calculation time tBm, which is the time obtained by adding the threshold ThB to the reception time tm of the target message Mm, which is a delayed message DEM. The processing unit 14 then waits for the calculation unit 12 to save the reception interval x(m+1) of the next target message M(m+1) to the storage unit 15.

[0074] For example, the threshold ThB is pre-set based on the IFG (InterFrame Gap) of the frame in which the message is stored. Preferably, the threshold ThB is the transmission time of the frame corresponding to the smallest IFG plus a predetermined margin set based on fluctuations in the frame's transmission timing. The threshold ThB may also be the transmission period Cm minus a predetermined value.

[0075] (Determination of burst phenomenon) When the processing unit 14 detects a delayed message DEM, it determines whether or not a burst phenomenon has occurred.

[0076] More specifically, the processing unit 14 determines whether a burst phenomenon has occurred depending on whether a new target message M arrives at the relay device 101 by the calculation time tB for the delayed message DEM. If a new message other than the target message M arrives at the relay device 101 by the calculation time tB, the processing unit 14 may update the calculation time tB to the time the new message was received plus a threshold ThB.

[0077] Figure 9 is a diagram showing an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. In Figure 9, the horizontal axis represents time. Figure 9 shows the reception time t(m+1) of the target message M(m+1) received by the communication processing unit 11 after the reception time tm shown in Figure 8.

[0078] Referring to Figure 9, the processing unit 14 determines that a burst phenomenon has not occurred if the calculation time tBm for the target message Mm arrives before the next target message M(m+1), which is a delayed message DEM, is received by the communication processing unit 11. In other words, the processing unit 14 determines that a burst phenomenon has not occurred if the calculation time tBm arrives before the reception interval x(m+1) and reception time t(m+1) for the target message M(m+1) are stored in the storage unit 15 by the calculation unit 12. In this case, the processing unit 14 releases the above-mentioned hold and calculates the statistical value Tm of the reception interval xm according to the above-mentioned equations (1) and (2). Then, the processing unit 14 compares the calculated statistical value Tm with the threshold Thx and determines whether or not an abnormality has occurred in the network 201 based on the comparison result.

[0079] Figure 10 shows another example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. In Figure 10, the horizontal axis represents time. Figure 10 shows the reception time t(m+1) of the target message M(m+1) received by the communication processing unit 11 after the reception time tm shown in Figure 8.

[0080] Referring to Figure 10, the processing unit 14 determines that a burst phenomenon occurred at the reception time tm of the target message Mm if the communication processing unit 11 receives the next target message M(m+1), which is a delayed message DEM, by the calculation time tBm for the target message Mm. In other words, the processing unit 14 determines that a burst phenomenon occurred at the reception time tm of the target message Mm if the calculation unit 12 stores the reception interval x(m+1) and reception time t(m+1) of the target message M(m+1) in the storage unit 15 before the calculation time tBm arrives.

[0081] When the processing unit 14 determines that a burst phenomenon occurred at the reception time tm of the target message Mm, it outputs burst occurrence information, including the reception time t(m+1) of the target message M(m+1), to the calculation unit 12.

[0082] When the calculation unit 12 receives burst occurrence information from the processing unit 14, it determines whether the burst phenomenon has ended based on the termination determination time tE, which is the time obtained by adding a threshold ThB to the reception time t of the target message M.

[0083] More specifically, the calculation unit 12 determines that the burst phenomenon is continuing if, after the reception time t(m+1) indicated by the received burst occurrence information, the next target message M(m+q+2) is received by the communication processing unit 11 before the termination determination time tE(m+q+1) for the target message M(m+q+1). In other words, the calculation unit 12 determines that the burst phenomenon is continuing if, before the termination determination time tE(m+q+1) arrives, the communication processing unit 11 outputs a message CP containing a timestamp indicating the reception time t(m+q+2). Here, q is a positive integer.

[0084] On the other hand, the calculation unit 12 determines that the burst phenomenon has ended if, after the reception time t(m+1) indicated by the received burst occurrence information, the termination determination time tE(m+q+1) for the target message M(m+q+1) arrives before the next target message M(m+q+2) following the target message M(m+q+1) is received by the communication processing unit 11. In other words, the calculation unit 12 determines that the burst phenomenon has ended if the termination determination time tE(m+q+1) arrives before the message CP containing the timestamp indicating the reception time t(m+q+2) is output by the communication processing unit 11. If the calculation unit 12 determines that the burst phenomenon has ended, it outputs burst termination information to the processing unit 14.

[0085] Furthermore, if a new message other than the target message M arrives at the relay device 101 before the termination determination time tE, the calculation unit 12 may update the termination determination time tE to the time the new message was received plus a threshold ThB. In other words, the calculation unit 12 may update the termination determination time tE based on the timestamp contained in the received message CP, regardless of the ID contained in the received message CP, each time it receives a message CP from the communication processing unit 11 after the reception time t(m+1) indicated by the burst occurrence information, and if the communication processing unit 11 does not output the next message CP before the termination determination time tE arrives, it may determine that the burst phenomenon has ended.

[0086] (Burst message count) The processing unit 14 counts multiple burst messages Mbst, each containing a detected delayed message DEM and one or more target messages M received following the delayed message DEM with a reception interval x less than or equal to the threshold ThB. In other words, the processing unit 14 counts multiple target messages M received consecutively by the communication processing unit 11, including a target message M that is a delayed message DEM and one or more target messages M whose reception interval x following the target message M is less than or equal to the threshold ThB, as burst messages Mbst.

[0087] For example, the processing unit 14 counts the burst messages Mbst, which are the target messages M received by the communication processing unit 11 during the period in which the burst phenomenon is occurring.

[0088] More specifically, based on the comparison result between the reception interval x(m+1) and the threshold ThB, the processing unit 14 determines that a burst phenomenon occurred at the reception time tm of the target message Mm, determines that the target message Mm is the first burst message Mbst and the target message M(m+1) is the second burst message Mbst, and stores the count value CNT of the burst message Mbst, which is "2".

[0089] Figure 11 is a diagram showing an example of the reception time of a target message received by a relay device according to an embodiment of the present disclosure. In Figure 11, the horizontal axis represents time. Figure 11 shows the reception times t of multiple target messages M received by the communication processing unit 11 after the reception time tm shown in Figure 10.

[0090] Referring to Figure 11, after the processing unit 14 determines that a burst phenomenon has occurred, it increments and updates the count value CNT each time the calculation unit 12 stores the reception interval x(m+n) and reception time t(m+n) of the target message M(m+n) in the storage unit 15. Here, n is an integer of 2 or more.

[0091] More specifically, when the calculation unit 12 stores the reception interval x(m+2) and reception time t(m+2) of the target message M(m+2) in the storage unit 15, the processing unit 14 updates the count value CNT to "3".

[0092] Similarly, when the calculation unit 12 stores the reception interval x(m+N) and reception time t(m+N) of the target message M(m+N) in the storage unit 15, the processing unit 14 updates the count value CNT to "N+1".

[0093] For example, the processing unit 14 terminates the count if the next target message M is not received by the communication processing unit 11 within a predetermined time t from the reception time t of the target message M, which is a burst message Mbst. More specifically, the processing unit 14 terminates the count of burst message Mbst when it receives burst termination information from the calculation unit 12.

[0094] (Restrictions on the interval for receiving burst messages) The processing unit 14 determines, based on the count value CNT, whether or not to perform detection processing based on the reception interval x of multiple burst messages Mbst.

[0095] For example, if the count value CNT is less than or equal to the threshold ThC, the processing unit 14 does not perform detection processing based on the reception interval x of at least one of the multiple burst messages Mbst. More specifically, if the count value CNT is less than or equal to the threshold ThC, the processing unit 14 restricts the use of the reception interval x of at least one of the multiple burst messages Mbst in the detection processing. More specifically, when the processing unit 14 finishes counting the burst messages Mbst, it compares the count value CNT with the threshold ThC. If the count value CNT is less than or equal to the threshold ThC, the processing unit 14 discards the reception interval x of all burst messages Mbst without using them in the detection processing.

[0096] For example, the processing unit 14 determines a threshold ThC used for comparison with the count value CNT, according to the reception interval x of the target message M, which is a delayed message DEM.

[0097] Figure 12 shows an example of a correspondence table stored in the storage unit of a relay device according to an embodiment of the present disclosure. Referring to Figure 12, the storage unit 15 stores a correspondence table Tb1 that shows the correspondence between the reception interval x of a delayed message DEM and a threshold ThC. For example, in the correspondence table Tb1, the threshold ThC is set to a value obtained by adding the number of target messages M received by the communication processing unit 11 during the period from the reception time t of the target message M immediately preceding the delayed message DEM to the reception time t of the delayed message DEM, and a predetermined margin, assuming that the target message M arrives at the relay device 101 at a timing according to the transmission period Cm.

[0098] For example, the processing unit 14 obtains a threshold ThC corresponding to the reception interval xm of the target message Mm, which has been determined to be a delayed message DEM, from the correspondence table Tb1 in the storage unit 15. As an example, if the reception interval xm of the target message Mm, which has been determined to be a delayed message DEM, is 4 times or more the transmission period Cm and less than 5 times the transmission period Cm, the processing unit 14 obtains "5" as the threshold ThC.

[0099] Referring again to Figure 11, the processing unit 14 compares the acquired threshold ThC with the count value CNT. If the count value CNT is less than or equal to the threshold ThC, the reception interval xm, x(m+1)..., x(m+N) of the target message Mm, M(m+1)..., M(m+N), which is a burst message Mbst, is discarded without being used in the detection process.

[0100] More specifically, if the count value CNT is less than or equal to the threshold ThC, the statistical value T for the burst message Mbst is not calculated. That is, the processing unit 14 erases the reception intervals xm, x(m+1)..., x(m+N) from the storage unit 15 without calculating the statistical values ​​Tm, T(m+1)..., T(m+N) for the reception intervals xm, x(m+1)..., x(m+N).

[0101] If the count value CNT is less than or equal to the threshold ThC, the likelihood of malicious messages being included in the multiple burst messages Mbst received by the communication processing unit 11 is low. Therefore, by discarding the burst messages Mbst at the reception interval x without using them in the detection process, false detections due to the occurrence of a burst phenomenon can be suppressed.

[0102] For example, if the processing unit 14 determines that a burst phenomenon has occurred, it suspends the detection process until the count of the burst message Mbst is completed, and resumes the detection process after the count of the burst message Mbst is completed.

[0103] More specifically, the processing unit 14 determines that if the reception interval x(m+N+1) of the target message M(m+N+1) is greater than the threshold ThB and less than the threshold ThD, the burst phenomenon ended at the reception time t(m+N) of the target message M(m+N) and that the target message M(m+N+1) is not a delayed message DEM, and calculates the statistical value T(m+N+1) of the reception interval x(m+N+1). More specifically, the processing unit 14 calculates the statistical value T(m+N+1) according to the above-described equation (1), using the statistical value T(m-1) of the target message M(m-1) immediately preceding the burst message Mbst, instead of the statistical value T(m+N) of the reception interval x(m+N).

[0104] Then, the processing unit 14 compares the calculated statistical value T(m+N+1) with the threshold Thx and determines whether or not an anomaly has occurred in network 201 based on the comparison result.

[0105] Next, the processing unit 14 determines that the reception interval x(m+N+2) of the target message M(m+N+2) is stored in the storage unit 15 by the calculation unit 12, and if the reception interval x(m+N+2) is less than the threshold ThD, the target message M(m+N+2) is not a delayed message DEM, and calculates a statistical value T(m+N+2) of the reception interval x(m+N+2).

[0106] Then, the processing unit 14 compares the calculated statistical value T(m+N+2) with the threshold Thx and determines whether or not an anomaly has occurred in network 201 based on the comparison result.

[0107] Furthermore, if the processing unit 14 determines that the burst phenomenon has ended at the reception time t(m+N) of the target message M(m+N), it may erase the reception interval x(m+N+1) from the storage unit 15 without calculating the statistical value T(m+N+1) of the reception interval x(m+N+1). In this case, the processing unit 14 waits for the calculation unit 12 to save the reception interval x(m+N+2) to the storage unit 15, and instead of the statistical value T(m+N+1) of the reception interval x(m+N+1), it uses the statistical value T(m-1) of the target message M(m-1) immediately preceding the burst message Mbst to calculate the statistical value T(m+N+2) according to the above-described equation (1).

[0108] (Detection process using the reception interval of burst messages) If the count value CNT is greater than the threshold ThC, the processing unit 14 performs detection processing based on the reception interval x of the burst message Mbst.

[0109] More specifically, the processing unit 14 compares the threshold ThC with the count value CNT, and if the count value CNT is greater than the threshold ThC, it calculates the statistical values ​​Tm, T(m+1)···, T(m+N) of the reception interval xm, x(m+1)···, x(m+N) of the target message Mm, M(m+1)···, M(m+N), which is a burst message Mbst.

[0110] Then, the processing unit 14 compares the calculated statistical values ​​Tm, T(m+1)···, T(m+N) with the threshold value Thx, and determines whether or not an anomaly has occurred in network 201 based on the comparison result.

[0111] If the count value CNT is greater than the threshold ThC, there is a possibility that multiple burst messages Mbst received by the communication processing unit 11 contain malicious messages. Therefore, by performing detection processing as usual based on the reception interval x of burst messages Mbst, it is possible to suppress the oversight of malicious messages.

[0112] <Variation> The processing unit 14 is configured to calculate a statistical value T of the reception interval x and perform detection processing based on the calculated statistical value T, but it is not limited to this configuration. The processing unit 14 may also be configured to perform detection processing without calculating the statistical value T. As an example, the processing unit 14 calculates the moving average A of the reception interval x of the most recent p target messages M received by the communication processing unit 11, and performs detection processing based on the calculated moving average A. p is an integer of 2 or more. The moving average A is an example of a detection index.

[0113] More specifically, the processing unit 14 calculates the reception interval xm of the target message Mm, and then calculates the moving average value Am of the reception intervals xm, x(m-1), x(m-2)..., x(m-p+1). Here, the reception intervals x(m-1), x(m-2)..., x(m-p+1) are examples of reference information related to the target message M. Hereafter, the reception intervals x(m-1), x(m-2)..., x(m-p+1) will also be referred to as the reference interval rm. The moving average value Am increases or decreases depending on the relationship between the reception interval xm of the target message Mm and the reference interval rm.

[0114] For example, the moving average value A calculated by the processing unit 14 gradually decreases over the period from reception time t5 to reception time t13, as shown in Figure 3, when multiple target messages M received by the communication processing unit 11 include an invalid message BM.

[0115] The processing unit 14 detects anomalies in network 201 based on the calculated moving average value A and a predetermined threshold value Thy. More specifically, the processing unit 14 compares the calculated moving average value A with the threshold value Thy. If the moving average value A is greater than or equal to the threshold value Thy, the processing unit 14 determines that no anomaly has occurred in network 201. On the other hand, if the moving average value A is less than the threshold value Thy, the processing unit 14 determines that an anomaly has occurred in network 201.

[0116] If the count value CNT of the burst message Mbst is less than or equal to the threshold ThC, the processing unit 14 discards the reception interval x of the burst message Mbst without using it to calculate the moving average value A. Then, if the reception interval x of the target message M received after the burst message Mbst is greater than or equal to a predetermined value, the processing unit 14 calculates the moving average value A of the reception intervals x of the most recent p target messages M received by the communication processing unit 11, excluding the burst message Mbst, and performs detection processing based on the calculated moving average value A.

[0117] [Operation Flow] Figure 13 is a flowchart illustrating an example of the operation procedure when the relay device according to the embodiment of this disclosure performs detection processing.

[0118] Referring to Figure 13, first, the relay device 101 waits for the arrival of the target message M (NO in step S102), and when it receives the target message M (YES in step S102), it calculates the reception interval x of the received target message M (step S104).

[0119] Next, if the calculated reception interval x is less than the threshold ThD (YES in step S106), the relay device 101 determines that the received target message M is not a delayed message DEM and performs detection processing based on the calculated reception interval x. More specifically, the relay device 101 calculates a statistical value T of the reception interval x, compares the calculated statistical value T with the threshold Thx, and determines whether or not an abnormality has occurred in the network 201 based on the comparison result. If the relay device 101 determines in the detection processing that an abnormality has occurred in the network 201, it transmits, for example, alarm information to a higher-level device outside the communication system 301 (step S108).

[0120] Next, the relay device 101 waits for the arrival of a new target message M (NO in step S102).

[0121] On the other hand, if the relay device 101 determines that the received target message M is a delayed message DEM when the calculated reception interval x is greater than or equal to the threshold ThD (NO in step S106), it determines whether or not a burst phenomenon has occurred. More specifically, the relay device 101 waits for the arrival of the next target message M after the delayed message DEM or for the calculation time tB for the delayed message DEM to arrive. If the relay device 101 receives the next target message M after the delayed message DEM before the calculation time tB arrives, it determines that a burst phenomenon has occurred. If the calculation time tB arrives before the next target message M after the delayed message DEM arrives, it determines that a burst phenomenon has not occurred (step S110).

[0122] Next, if the relay device 101 determines that no burst phenomenon has occurred (YES in step S112), it performs detection processing. More specifically, the relay device 101 calculates the statistical value T of the reception interval x of the delayed message DEM and the statistical value T of the reception interval x of the next target message M of the delayed message DEM, compares each of the calculated statistical values ​​T with the threshold Thx, and determines whether or not an abnormality has occurred in the network 201 based on the comparison result (step S108).

[0123] Next, the relay device 101 waits for the arrival of a new target message M (NO in step S102).

[0124] On the other hand, if the relay device 101 determines that a burst phenomenon is occurring (NO in step S112), it counts the burst message Mbst. More specifically, the relay device 101 waits for the arrival of a new target message M and counts the burst message Mbst, which is the target message M received during the period in which the burst phenomenon is occurring (step S114).

[0125] Next, if the count value CNT of the burst message Mbst is greater than the threshold ThC (YES in step S116), the relay device 101 performs detection processing based on the reception interval x of the burst message Mbst. More specifically, the relay device 101 calculates the statistical value T of the reception interval x of multiple burst messages Mbst, compares each calculated statistical value T with the threshold Thx, and determines whether or not an abnormality has occurred in the network 201 based on the comparison result (step S108).

[0126] Next, the relay device 101 waits for the arrival of a new target message M (NO in step S102).

[0127] On the other hand, if the count value CNT of the burst message Mbst is less than or equal to the threshold ThC (NO in step S116), the relay device 101 discards the reception interval x of the burst message Mbst (step S118).

[0128] Next, the relay device 101 waits for the arrival of a new target message M (NO in step S102).

[0129] Figure 14 is a flowchart illustrating an example of the operation procedure when a relay device according to an embodiment of the present disclosure performs a burst message counting process. Figure 14 shows details of step S114 in Figure 13.

[0130] Referring to Figure 14, first, the relay device 101 waits for the threshold ThB to elapse from the reception time t of the burst message Mbst, and for the reception of a new target message M (NO in step S302 and NO in step S304). If a new target message M is received before the threshold ThB has elapsed from the reception time t of the burst message Mbst (NO in step S302 and YES in step S304), the relay device 101 determines that the received target message M is the burst message Mbst and updates the count value CNT by incrementing it (step S306).

[0131] On the other hand, if the relay device 101 receives a new target message M, and a threshold ThB has elapsed from the reception time t of the burst message Mbst (YES in step S302 and NO in step S304), it determines that the burst phenomenon has ended and terminates the count of the burst message Mbst (step S308).

[0132] In the communication system 301 according to the embodiment of this disclosure, the relay device 101 is configured to detect abnormalities in the network 201, but this is not the only configuration. In the communication system 301, a device other than the relay device 101 may function as a detection device and detect abnormalities in the network 201. For example, the communication system 301 includes a detection device connected to the relay device 101 via a transmission line 10. When the relay device 101 receives a message from the communication device 111, it sends a mirror message, which is a copy of the received message, to the detection device via the transmission line 10. The detection device calculates the reception interval x and performs detection processing based on the reception time of the mirror message received by the relay device 101.

[0133] Furthermore, while the communication system 301 according to the embodiment of this disclosure is configured such that the relay device 101, which functions as a detection device, is directly connected to the transmission line 10, the invention is not limited to this configuration.

[0134] Figure 15 shows an example of a network connection topology according to an embodiment of the present disclosure. Referring to Figure 15, the detection device 151 may be configured to be connected to the transmission line 10 via the communication device 111. In this case, the detection device 151 detects an anomaly in the network 201, for example, by monitoring the messages received by the communication device 111. More specifically, the communication device 111 outputs the received messages to the detection device 151. The detection device 151 comprises a calculation unit 12, a processing unit 14, and a storage unit 15. The calculation unit 12 in the detection device 151 acquires the reception time t of the target message M received by the communication device 111, and calculates the reception interval x based on the acquired reception time t.

[0135] Furthermore, while the relay device 101 according to the embodiment of this disclosure is configured such that the storage unit 15 stores the correspondence table Tb1, the invention is not limited to this configuration.

[0136] Figure 16 shows another example of a correspondence table stored in the storage unit of a relay device according to an embodiment of the present disclosure. Referring to Figure 16, the storage unit 15 may be configured to store a correspondence table Tb2 that shows the correspondence between the reception interval x of a delayed message DEM and a threshold ThC, instead of, or in addition to, the correspondence table Tb1. For example, in the correspondence table Tb2, the threshold ThC is set to a value obtained by adding the number of target messages M received by the communication processing unit 11 during the period from the reception time t of the target message M immediately preceding the delayed message DEM to the reception time t of the delayed message DEM, the number of event messages that are estimated to be received by the communication processing unit 11 based on the frequency of events during that period, and a predetermined margin, assuming that the target message M arrives at the relay device 101 at a timing according to the transmission period Cm.

[0137] The storage unit 15 may not be configured to store the correspondence tables Tb1 and Tb2. In this case, for example, the processing unit 14 uses a predetermined calculation formula to calculate a threshold ThC based on the reception interval x and transmission period Cm of the target message M which has been determined to be a delayed message DEM.

[0138] Furthermore, in the relay device 101 according to the embodiment of this disclosure, the processing unit 14 is configured to discard the reception interval x of all burst messages Mbst without using it for detection processing when the count value CNT is less than or equal to the threshold ThC, but it is not limited to this. The processing unit 14 may be configured to discard the reception interval x of some burst messages Mbst while using the reception interval x of other burst messages Mbst for detection processing. For example, the processing unit 14 may use the reception interval x of the delayed message DEM among the multiple burst messages Mbst for detection processing, while discarding the reception interval x of one or more burst messages Mbst excluding the delayed message DEM.

[0139] Furthermore, in the relay device 101 according to the embodiment of this disclosure, the processing unit 14 is configured to perform detection processing based on the reception interval x of the burst message Mbst when the count value CNT is greater than the threshold ThC, but it is not limited to this. The processing unit 14 may be configured not to perform detection processing based on the reception interval x of the burst message Mbst when the count value CNT is greater than the threshold ThC. For example, if the count value CNT is greater than the threshold ThC, the processing unit 14 may determine that an abnormality has occurred in the network 201 without performing detection processing.

[0140] Furthermore, in the relay device 101 according to the embodiment of this disclosure, the processing unit 14 is configured to determine a threshold ThC used for comparison with the count value CNT according to the reception interval x of the target message M, which is a delayed message DEM, but the invention is not limited to this. The processing unit 14 may be configured to use a predetermined threshold ThC for comparison with the count value CNT regardless of the reception interval x of the target message M, which is a delayed message DEM.

[0141] Furthermore, in the relay device 101 according to the embodiment of this disclosure, the processing unit 14 is configured to suspend the detection process until the count of the burst message Mbst is completed when it determines that a burst phenomenon has occurred, and to resume the detection process after the count of the burst message Mbst is completed, but it is not limited to this. The processing unit 14 may perform the detection process retrospectively based on a predetermined number of reception intervals x stored in the storage unit 15 by the calculation unit 12. When the processing unit 14 performs the detection process retrospectively, it may be configured not to suspend or resume the detection process. More specifically, the processing unit 14 discards the reception intervals x of the burst message Mbst, which are part of the reception intervals x stored in the storage unit 15, based on the comparison result of the count value CNT and the threshold value ThC, and performs the detection process based on the remaining reception intervals x.

[0142] Furthermore, in the relay device 101 according to the embodiment of this disclosure, the processing unit 14 is configured to receive burst termination information from the calculation unit 12 and terminate the count of burst message Mbst, but it is not limited to this. The processing unit 14 may also be configured to determine the end of the burst phenomenon and terminate the count based on the comparison result of the reception interval x and the threshold ThB. More specifically, if the reception interval x(m+N+1) of the target message M(m+N+1) is greater than the threshold ThB, the processing unit 14 determines that the burst phenomenon has ended at the reception time t(m+N) of the target message M(m+N), and terminates the count of the burst message Mbst End the count.

[0143] By the way, there is a need for technology that can more accurately detect anomalies in networks.

[0144] In contrast, in the relay device 101 according to the embodiment of the present disclosure, the calculation unit 12 calculates the reception interval x of the target message M. The processing unit 14 performs detection processing to detect an anomaly in the network 201 based on the reception interval x calculated by the calculation unit 12. The processing unit 14 counts a plurality of burst messages Mbst, which include a delayed message DEM, which is a target message M whose reception interval x is greater than or equal to a predetermined value than the transmission period Cm, and one or more target messages M that are received following the delayed message DEM and whose reception interval x is less than or equal to a predetermined value. Based on the count value CNT of the burst messages Mbst, the processing unit 14 decides whether or not to perform detection processing based on the reception interval x for at least one of the plurality of burst messages Mbst.

[0145] Thus, in the relay device 101, which performs detection processing based on the reception interval x of the target message M, the use of the reception interval x of the burst message Mbst in the detection processing is restricted based on the count value CNT of the burst message Mbst. This configuration allows for the exclusion of multiple burst messages Mbst that are unlikely to contain a malicious target message M from the detection processing, thereby suppressing false detections caused by burst phenomena. Consequently, abnormalities in the network 201 can be detected more accurately.

[0146] The embodiments described above should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and all modifications within the meaning and scope of the claims are intended to be included.

[0147] Each process (each function) of the above-described embodiment is implemented by a processing circuit (Circuitry) including one or more processors. The processing circuit may consist of one or more memories, various analog circuits, various digital circuits, etc., in addition to the one or more processors, as well as an integrated circuit. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the above processes. The one or more processors may execute each of the above processes according to the programs read from the one or more memories, or they may execute each of the above processes according to logic circuits that have been pre-designed to execute each of the above processes. The processors may be various processors suitable for computer control, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), DSP (Digital Signal Processor), FPGA (Field Programmable Gate Array), and ASIC (Application Specific Integrated Circuit). Furthermore, the physically separated multiple processors may cooperate with each other to execute each of the above processes. For example, the processors installed in each of several physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), WAN (Wide Area Network), and the Internet to perform the above processes. The program may be installed in the memory via the network from an external server device, or it may be distributed on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), DVD-ROM (Digital Versatile Disk Read Only Memory), and semiconductor memory, and then installed in the memory from the recording medium.

[0148] The above description includes the following features. [Note 1] A detection device for detecting anomalies in a network where multiple target messages, including periodic messages transmitted and received at predetermined transmission cycles, are transmitted and received, A calculation unit that calculates the reception interval for the target message, A detection unit performs detection processing to detect anomalies in the network based on the reception interval calculated by the calculation unit, The system includes a counting unit that detects a delayed message which is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and counts a plurality of burst messages which include the delayed message and one or more of the target messages whose reception interval is less than or equal to a predetermined value and which are received following the delayed message, The detection unit determines, based on the count value from the counting unit, whether or not to perform the detection process based on the reception interval for at least one of the multiple burst messages. The detection unit discards the reception interval of the plurality of burst messages if the count value from the count unit is less than or equal to a threshold, and performs the detection process based on the reception interval of the plurality of burst messages if the count value is greater than the threshold.

[0149] [Note 2] A detection device for detecting anomalies in a network where multiple target messages, including periodic messages transmitted and received at predetermined transmission cycles, are transmitted and received, Equipped with a processing circuit, The aforementioned processing circuit is The reception interval for the aforementioned target message is calculated, Based on the calculated reception interval, a detection process is performed to detect anomalies in the network. The system detects a delayed message which is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and counts a plurality of burst messages which include the delayed message and one or more of the target messages whose reception interval is less than or equal to a predetermined value and which are received following the delayed message. A detection device that determines, based on the count value, whether or not to perform the detection process based on the reception interval for at least one of the plurality of burst messages. [Explanation of symbols]

[0150] 10 Transmission lines 11 Communication Processing Unit 12 Calculation Section 14 Processing Unit (Counting Unit, Detection Unit) 15 Storage section 16 communication ports 101 Relay device 111 Communication equipment 151 Detection device 201 Network 301 Communication Systems Tb1, Tb2 Corresponding Table

Claims

1. A detection device for detecting anomalies in a network where multiple target messages, including periodic messages transmitted and received at predetermined transmission cycles, are transmitted and received, A calculation unit that calculates the reception interval for the target message, A detection unit performs detection processing to detect anomalies in the network based on the reception interval calculated by the calculation unit, The system includes a counting unit that counts a plurality of burst messages, including a delayed message which is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and one or more of the target messages which are received following the delayed message and whose reception interval is less than or equal to a predetermined value. The detection unit determines, based on the count value from the count unit, whether or not to perform the detection process based on the reception interval for at least one of the plurality of burst messages.

2. The detection device according to claim 1, wherein the detection unit does not perform the detection processing based on the reception interval of at least one of the plurality of burst messages if the count value is less than or equal to a threshold value.

3. The detection device according to claim 1 or 2, wherein the detection unit performs the detection process based on the reception interval of the plurality of burst messages when the count value is greater than the threshold value.

4. The detection device according to claim 1 or 2, wherein the detection unit determines the threshold according to the reception interval of the target message, which is the delayed message.

5. The detection unit calculates a detection index that increases or decreases according to the relationship between the reception interval and reference information related to the reception interval, and performs the detection process based on the calculated detection index. The detection device according to claim 1 or 2, wherein the detection unit does not calculate the detection index for at least one of the multiple burst messages if the count value is less than or equal to the threshold value.

6. The counting unit terminates the count if the next target message is not received within a predetermined time from the time the previous target message, which is a burst message, was received. The detection device according to claim 1 or 2, wherein the detection unit suspends the detection process until the counting by the counting unit is completed, and resumes the detection process after the counting by the counting unit is completed.

7. A detection method in a detection device for detecting anomalies in a network where multiple target messages, including periodic messages transmitted and received at predetermined transmission cycles, are transmitted and received, A step of calculating the reception interval for the aforementioned target message, The steps include: performing a detection process to detect anomalies in the network based on the calculated reception interval; The step includes counting a plurality of burst messages, which include a delayed message that is the target message whose reception interval is greater than or equal to a predetermined value than the transmission cycle, and one or more of the target messages received following the delayed message, whose reception interval is less than or equal to a predetermined value. A detection method comprising the step of performing the detection processing, wherein, based on the count value of the plurality of burst messages, it is determined whether or not to perform the detection processing based on the reception interval for at least one of the plurality of burst messages.

Images