Detection device, detection system, and detection method

Abstract

Provided is a detection device that detects an abnormality in a network in which a plurality of messages including response messages are sent and received by a plurality of communication apparatuses, the detection device including: an acquisition unit that acquires a plurality of items of load information respectively indicating communication loads at a plurality of locations in the network and respectively indicating communication loads due to the messages sent by the corresponding communication apparatuses; and a detection unit that detects an abnormality in the network on the basis of the consistency of the plurality of items of load information acquired by the acquisition unit.

Description

Detection device, detection system, and detection method

[0001] This application claims priority from Japanese Patent Application No. 2022-88140, filed May 31, 2022, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Patent Document 1 (WO 2020 / 234940) discloses the following suspicious IP address estimation device: That is, the suspicious IP address estimation device includes an acquisition means for acquiring, as a suspicious IP address, an IP address associated with a target based on the exposure of the target in the mass media, and a transmission means for transmitting the suspicious IP address to a network monitoring information database device.

[0003] Furthermore, Patent Document 2 (JP 2021-507375 A) discloses a method for monitoring devices, including the steps of: accessing a first indicator associated with a first device and indicating a security risk level; accessing communication information associated with the first device; determining, by a processing device, a second device communicating with the first device based on the communication information; setting a second indicator associated with the second device based on information associated with the first device; and storing the second indicator associated with the second device.

[0004] International Publication No. 2020 / 234940 Special Publication No. 2021-507375

[0005] The detection device of the present disclosure is a detection device that detects abnormalities in a network, in which multiple messages including response messages are sent and received by multiple communication devices, and the detection device is equipped with an acquisition unit that acquires multiple load information that respectively indicate the communication load at multiple locations in the network, the multiple load information each indicating the communication load due to the messages from different senders, and a detection unit that detects abnormalities in the network based on the consistency of the multiple load information acquired by the acquisition unit.

[0006] The detection system of the present disclosure is a detection system that detects abnormalities in a network, in which multiple messages including response messages are sent and received by multiple communication devices in the network, and the detection system includes: multiple extraction devices that extract the messages from different senders that pass through different points in the network; multiple observation units that observe the messages extracted by the multiple extraction devices; a load calculation unit that generates multiple load information indicating the communication load at multiple points in the network based on the observation results by the multiple observation units; and a detection unit that detects abnormalities in the network based on the consistency of the multiple load information generated by the load calculation units.

[0007] The detection method disclosed herein is a detection method in a detection device that detects abnormalities in a network, in which multiple messages including response messages are sent and received by multiple communication devices in the network, and the detection method includes a step of acquiring multiple load information that respectively indicates the communication load at multiple locations in the network, and each of the load information indicates the communication load due to the messages from different senders, and a step of detecting an abnormality in the network based on the consistency of the acquired multiple load information.

[0008] One aspect of the present disclosure can be realized not only as a detection device equipped with such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the detection device.

[0009] FIG. 1 is a diagram illustrating an example of the configuration of a detection system and a network to be detected according to a first embodiment of the present disclosure. FIG. 2 is a diagram illustrating a state in which an unauthorized device has been added to a network to be detected by the detection system according to the first embodiment of the present disclosure. FIG. 3 is a diagram illustrating an example of detection processing in a detection device according to the first embodiment of the present disclosure. FIG. 4 is a flowchart defining an example of an operation procedure when the detection device according to the first embodiment of the present disclosure performs detection processing. FIG. 5 is a diagram illustrating an example of the configuration of a detection system and a network to be detected according to a second embodiment of the present disclosure. FIG. 6 is a diagram illustrating a state in which an unauthorized device has been added to a network to be detected by the detection system according to the second embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of the detection processing in a detection device according to the second embodiment of the present disclosure. FIG. 8 is a diagram illustrating an example of a sequence of detection processing in a detection system according to the second embodiment of the present disclosure. FIG. 9 is a diagram illustrating an example of the configuration of a detection system and a network to be detected according to a third embodiment of the present disclosure. FIG. 10 is a diagram illustrating an example of the detection processing in a detection device according to the third embodiment of the present disclosure. FIG. 11 is a diagram illustrating an example of the configuration of a detection system and a network to be detected according to a fourth embodiment of the present disclosure. Fig. 12 is a diagram showing a state in which an unauthorized device has been added to a network that is a detection target of a detection system according to a fourth embodiment of the present disclosure. Fig. 13 is a diagram showing an example of the configuration of a detection system and a network that is a detection target according to a fifth embodiment of the present disclosure. Fig. 14 is a diagram showing an example of detection processing in a detection device according to the fifth embodiment of the present disclosure. Fig. 15 is a diagram showing an example of a response information table stored in a storage unit in a detection device according to the fifth embodiment of the present disclosure.

[0010] Conventionally, techniques have been proposed for detecting abnormalities such as unauthorized access in a network.

[0011] [Problem to be Solved by the Present Disclosure] The technology described in Patent Literature 1 monitors suspicious IP addresses on a network to quickly detect an increase in communication load, but it is necessary to acquire information on communication loads under normal conditions in advance. Furthermore, with the technology described in Patent Literature 1, it is necessary to re-acquire information on communication loads under normal conditions on the changed network every time the network configuration is changed. Similarly, with the technology described in Patent Literature 2, it is necessary to acquire information on traffic under normal conditions in advance, and it is also necessary to re-acquire information on traffic under normal conditions on the changed network every time the network configuration is changed.

[0012] There is a need for a technology that goes beyond the technologies described in Patent Documents 1 and 2 and is capable of stably detecting anomalies in a network using less information.

[0013] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection device, a detection system, and a detection method that can stably detect anomalies in a network using less information.

[0014] Effect of the Present Disclosure According to the present disclosure, anomalies in a network can be stably detected using less information.

[0015] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0016] (1) A detection device according to an embodiment of the present disclosure is a detection device that detects an abnormality in a network, in which a plurality of communication devices send and receive a plurality of messages including a response message, and the detection device includes: an acquisition unit that acquires a plurality of load information indicating the communication load at a plurality of locations in the network, the plurality of load information indicating the communication load due to the messages from different senders; and a detection unit that detects an abnormality in the network based on the consistency of the plurality of load information acquired by the acquisition unit.

[0017] In this way, by using a configuration that detects abnormalities in a network based on the consistency of multiple pieces of load information that respectively indicate the communication loads at multiple locations on the network, abnormalities can be detected without using load information in the network under normal conditions, so abnormalities can be detected without having to obtain normal load information in advance or obtain normal load information for the network after each change in network configuration. Therefore, abnormalities in the network can be detected stably using less information.

[0018] (2) In the above (1), the acquisition unit may acquire three or more pieces of load information each indicating the communication load at three or more locations in the network, and the detection unit may identify an abnormal location in the network based on the consistency for each combination of two pieces of load information included in the three or more pieces of load information.

[0019] This allows for more detailed identification of abnormalities in the network.

[0020] (3) In (1) or (2) above, the message may be sent and received in the network between a first communication device and a plurality of communication devices different from the first communication device, and the acquisition unit may acquire first load information indicating the communication volume of the message sent from the first communication device and second load information indicating the communication volume of the message sent from a communication device different from the first communication device, and the detection unit may detect an abnormality in the network based on the consistency between the communication volume of the message indicated by the first load information and the communication volume of the message indicated by the second load information.

[0021] With this configuration, it is possible to detect abnormalities in a network where one-to-many communication is performed.

[0022] (4) In any of (1) to (3) above, the detection device may further include an extraction device that extracts the message transmitted from the communication device, and an observation unit that observes the output of the extracted message by the extraction device that outputs the extracted message to other communication devices and the detection device, and the acquisition unit may generate the load information based on the observation results of the observation unit.

[0023] This configuration increases the degree of freedom in determining the location at which the communication load is measured in the network.

[0024] (5) In the above (3), the acquisition unit may acquire the load information indicating the communication load calculated based on the number of response messages predicted based on the type of the message sent by the first communication device and the communication volume of the message sent by the first communication device.

[0025] With this configuration, abnormalities in the network can be detected using load information based on the number of response messages to the first communication device predicted based on the type of message, making it possible to detect abnormalities in a network where various types of messages, such as multicast messages and broadcast messages, are sent and received.

[0026] (6) In the above (5), the acquisition unit may acquire the load information indicating the communication load calculated based on the number of response messages predicted further based on header information of the message sent by the first communication device.

[0027] With this configuration, the number of response messages can be predicted based on the type and content of the message, making it possible to more accurately detect abnormalities in a network where various types of messages are sent and received.

[0028] (7) A detection system according to an embodiment of the present disclosure is a detection system that detects anomalies in a network, in which a plurality of communication devices send and receive a plurality of messages including a response message, and the detection system includes a plurality of extraction devices that extract the messages from different sources that pass through different locations in the network, a plurality of observation units that observe the messages extracted by the plurality of extraction devices, a load calculation unit that generates a plurality of load information indicating the communication load at a plurality of locations in the network based on the observation results of the plurality of observation units, and a detection unit that detects anomalies in the network based on the consistency of the plurality of load information generated by the load calculation units.

[0029] In this way, by using a configuration that detects abnormalities in a network based on the consistency of multiple pieces of load information that respectively indicate the communication loads at multiple locations on the network, abnormalities can be detected without using load information in the network under normal conditions, so abnormalities can be detected without having to obtain normal load information in advance or obtain normal load information for the network after each change in network configuration. Therefore, abnormalities in the network can be detected stably using less information.

[0030] (8) A detection method according to an embodiment of the present disclosure is a detection method in a detection device that detects an abnormality in a network, in which a plurality of communication devices send and receive a plurality of messages including a response message in the network, and the detection method includes a step of acquiring a plurality of load information indicating the communication load at a plurality of locations in the network, the plurality of load information indicating the communication load due to the messages from different senders, and a step of detecting an abnormality in the network based on the consistency of the acquired plurality of load information.

[0031] In this way, by using a method for detecting abnormalities in a network based on the consistency of multiple pieces of load information indicating the communication loads at multiple locations on the network, abnormalities can be detected without using load information in the network under normal conditions, so abnormalities can be detected without having to obtain normal load information in advance or obtain normal load information for the network after each change in network configuration. Therefore, abnormalities in the network can be detected stably using less information.

[0032] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0033] First Embodiment [Configuration and Basic Operation] FIG. 1 is a diagram illustrating an example of the configuration of a detection system and a detection target network according to a first embodiment of the present disclosure. Referring to FIG. 1 , a detection system 301 includes a detection device 101 and extraction devices 121A and 121B. The extraction devices 121A and 121B are examples of extraction devices. The extraction device 121A includes communication ports PA1 and PA2. The extraction device 121B includes communication ports PB1 and PB2. The extraction device 121A receives a message via one of the communication ports PA1 and PA2 and transmits it via the other of the communication ports PA1 and PA2. The extraction device 121B receives a message via one of the communication ports PB1 and PB2 and transmits it via the other of the communication ports PB1 and PB2. The detection system 301 detects anomalies in a network 201.

[0034] The network 201 includes communication devices 111A and 111B, which are the communication devices 111, and a switch device 141. The switch device 141 relays information exchanged between the communication devices 111A and 111B. The switch device 141 includes communication ports 122A and 122B. The communication ports 122A and 122B are, for example, connectors or terminals. The network 201 may be an in-vehicle network, a home network, or a factory automation network.

[0035] Communication device 111A is connected to communication port PA2 in extractor 121A via transmission line 1. Communication device 111B is connected to communication port PB2 in extractor 121B via transmission line 1. Communication port PA1 in extractor 121A is connected to communication port 122A in switch device 141 via transmission line 1. Communication port PB1 in extractor 121B is connected to communication port 122B in switch device 141 via transmission line 1. Transmission line 1 is, for example, an Ethernet (registered trademark) cable.

[0036] In the network 201, a plurality of communication devices 111 transmit and receive a plurality of messages including a response message.

[0037] More specifically, the plurality of communication devices 111 transmit a response message to another communication device 111 in response to a received message received from the other communication device 111, and transmit and receive messages in accordance with a predetermined communication protocol Prtl such as ARP (Address Resolution Protocol) and SOME / IP (Scalable service-oriented Middleware over IP).

[0038] For example, communication device 111A operating as a client periodically or irregularly generates a message addressed to communication device 111B conforming to communication protocol Prtl, and transmits the generated message to switch device 141 via transmission line 1 and extraction device 121A. Switch device 141 transmits a message received from communication device 111A to communication device 111B via transmission line 1 and extraction device 121B.

[0039] When communication device 111B operating as a server receives a message from communication device 111A via switch device 141, it generates a response message conforming to communication protocol Prtl and transmits the generated response message to switch device 141 via transmission line 1 and extraction device 121B. Switch device 141 transmits the response message received from communication device 111B to communication device 111A via transmission line 1 and extraction device 121A.

[0040] Extraction devices 121A and 121B extract messages from different senders that pass through different locations on network 201. More specifically, extraction device 121A includes a filter fa (not shown) that extracts, from received messages, messages that include the address of communication device 111A as the sender address. Extraction device 121B includes a filter fb (not shown) that extracts, from received messages, messages that include the address of communication device 111B as the sender address. Extraction devices 121A and 121B have the function of a repeater hub.

[0041] The extraction device 121A copies a message extracted by filter fa from messages received via communication port PA2. The extraction device 121A transmits the extracted message via communication port PA1. The extraction device 121A further transmits a copy of the extracted message to the detection device 101 via transmission line 1. Note that the extraction device 121A may transmit the extracted message to the detection device 101 via transmission line 1, and then transmit a copy of the extracted message via communication port PA1.

[0042] The extraction device 121B also copies messages extracted by filter fb from messages received via communication port PB2. The extraction device 121B transmits the extracted messages via communication port PB1. The extraction device 121B further transmits copies of the extracted messages to the detection device 101 via transmission line 1. Note that the extraction device 121B may transmit the extracted messages to the detection device 101 via transmission line 1, and then transmit copies of the extracted messages via communication port PB1.

[0043] The extraction device 121A is not limited to a configuration in which it is connected to the communication device 111A via the transmission line 1. The extraction device 121A may be an adapter attached to the communication device 111A. In this case, the extraction device 121A extracts a message output from the communication device 111A, outputs the extracted message to the switch device 141 via the transmission line 1, and outputs a copy of the extracted message to the detection device 101 via the transmission line 1.

[0044] Furthermore, the extraction device 121B is not limited to a configuration in which it is connected to the communication device 111B via the transmission line 1. The extraction device 121B may be an adapter attached to the communication device 111B. In this case, the extraction device 121B extracts a message output from the communication device 111B, outputs the extracted message to the switch device 141 via the transmission line 1, and outputs a copy of the extracted message to the detection device 101 via the transmission line 1.

[0045] (Detection Device) The detection device 101 includes a receiving unit 11, a load calculation unit 21, a detection unit 31, and a storage unit 41. The receiving unit 11 includes observation units 10A and 10B that are the observation unit 10. The load calculation unit 21 includes calculation units 20A and 20B that are the calculation unit 20. The load calculation unit 21 is an example of an acquisition unit. Part or all of the receiving unit 11, the load calculation unit 21, and the detection unit 31 are realized, for example, by a processing circuit including one or more processors. The storage unit 41 is, for example, a non-volatile memory included in the processing circuit. The detection device 101 performs detection processing to detect an abnormality in the network 201.

[0046] The storage unit 41 stores network information indicating the topology of the network 201 and the communication protocol Prtl in the network 201. For example, the network information is saved in the storage unit 41 by an administrator of the network 201.

[0047] The multiple observation units 10 observe messages passing through different points on the network 201. That is, the observation units 10A and 10B observe the messages extracted by the extraction devices 121A and 121B, respectively.

[0048] For example, the observation unit 10A observes the output of extracted messages by the extraction device 121A. More specifically, the observation unit 10A receives the messages extracted by the extraction device 121A via the transmission line 1. The observation unit 10A periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages received during an observation period T1 of a predetermined length. The observation unit 10A outputs the observation results including the extracted messages to the calculation unit 20A.

[0049] Furthermore, for example, the observation unit 10B observes the output of extracted messages by the extraction device 121B. More specifically, the observation unit 10B receives the messages extracted by the extraction device 121B via the transmission line 1. The observation unit 10B periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages received during the observation period T1. The observation unit 10B outputs the observation results including the extracted messages to the calculation unit 20B.

[0050] The load calculation unit 21 acquires a plurality of pieces of load information that respectively indicate the communication loads at a plurality of locations in the network 201, and each of the pieces of load information indicates the communication loads due to messages from different senders. For example, the load calculation unit 21 generates each piece of load information based on the observation results of each of the observation units 10A and 10B.

[0051] More specifically, the calculation unit 20A receives the observation results from the observation unit 10A and calculates the communication volume VA per unit time of messages included in the received observation results. The communication volume VA indicates the communication volume per unit time of messages that include the address of the communication device 111A as the source address and pass through the extraction device 121A. The calculation unit 20A outputs load information indicating the calculated communication volume VA to the detection unit 31. The load information is an example of first load information.

[0052] The calculation unit 20B receives the observation results from the observation unit 10B and calculates the communication volume VB per unit time of messages included in the received observation results. The communication volume VB indicates the communication volume per unit time of messages that include the address of the communication device 111B as the source address and pass through the extraction device 121B. The calculation unit 20B outputs load information indicating the calculated communication volume VB to the detection unit 31. The load information is an example of second load information.

[0053] The detection unit 31 performs detection processing based on the consistency of the plurality of pieces of load information generated by the load calculation unit 21 .

[0054] For example, the detection unit 31 receives load information from the calculation units 20A and 20B, and determines whether an abnormality has occurred in the network 202 based on the comparison result between the communication volume VA indicated by the load information received from the calculation unit 20A and the communication volume VB indicated by the load information received from the calculation unit 20B.

[0055] More specifically, if the absolute value of the difference between the communication volume VA and the communication volume VB is less than a predetermined value, the detection unit 31 determines that no abnormality has occurred in the network 201, and stores the determination result in the storage unit 41. On the other hand, if the absolute value of the difference between the communication volume VA and the communication volume VB is equal to or greater than a predetermined value, the detection unit 31 determines that an abnormality has occurred in the network 201, and stores the determination result in the storage unit 41. Furthermore, for example, if the detection unit 31 determines that an abnormality has occurred in the network 201, it notifies the administrator of the network 201 of the determination result by voice or display. Note that the detection unit 31 may be configured to notify a management device (not shown) of the determination result via the network 201 or another network (not shown).

[0056] 2 is a diagram illustrating a state in which an unauthorized device has been added to a network that is the detection target of the detection system according to the first embodiment of the present disclosure. Fig. 2 illustrates a state in which an unauthorized device 111X and a repeater hub 121X have been added to a network 201. The repeater hub 121X is provided between the extraction device 121B and the communication device 111B, and is connected to a communication port PB2 of the extraction device 121B via a transmission line 1. The unauthorized device 111X is connected to the repeater hub 121X via a transmission line 1.

[0057] The unauthorized device 111X generates an unauthorized message addressed to the communication device 111A according to the communication protocol Prtl, disguising the source as the communication device 111B, and transmits the generated unauthorized message to the repeater hub 121X.

[0058] The repeater hub 121X outputs messages received from the communication device 111B to the extraction device 121B and the unauthorized device 111X, outputs messages received from the extraction device 121B to the communication device 111B and the unauthorized device 111X, and outputs unauthorized messages received from the unauthorized device 111X to the communication device 111B and the extraction device 121B.

[0059] FIG. 3 is a diagram illustrating an example of a detection process in the detection device according to the first embodiment of the present disclosure.

[0060] 3, for example, communication device 111A transmits a message to communication device 111B via switch device 141. Observation unit 10A in receiving unit 11 of detection device 101 receives, via transmission line 1, the message transmitted by communication device 111A and extracted by extraction device 121A.

[0061] The communication device 111B receives a message from the communication device 111A via the switch device 141 and transmits a response message to the communication device 111A via the switch device 141. Furthermore, the unauthorized device 111X transmits an unauthorized message to the communication device 111A via the switch device 141. The unauthorized message transmitted by the unauthorized device 111X is output to the communication device 111B by the repeater hub 121X. The observation unit 10B in the receiving unit 11 of the detection device 101 receives, via the transmission line 1, the unauthorized message transmitted by the unauthorized device 111X and extracted by the extraction device 121B, in addition to the response message transmitted by the communication device 111B and extracted by the extraction device 121B.

[0062] Therefore, the communication volume VB calculated by the calculation unit 20B is greater than the communication volume VA calculated by the calculation unit 20A.

[0063] In this case, the detection unit 31 determines that an abnormality has occurred in the network 201 because the absolute value of the difference between the traffic volume VA and the traffic volume VB is equal to or greater than a predetermined value.

[0064] [Operation Flow] FIG. 4 is a flowchart defining an example of an operation procedure when the detection device according to the first embodiment of the present disclosure performs a detection process.

[0065] 4, first, the detection device 101 observes messages passing through different points in the network 201. More specifically, the detection device 101 receives the message extracted by the extraction device 121A via transmission line 1, and receives the message extracted by the extraction device 121B via transmission line 1 (step S11).

[0066] Next, based on the message observation results, the detection device 101 generates multiple pieces of load information indicating the communication loads at multiple locations on the network 201. More specifically, the detection device 101 calculates the communication volume VA per unit time of the messages received from the extraction device 121A and the communication volume VB per unit time of the messages received from the extraction device 121B (step S12).

[0067] Next, the detection device 101 compares the traffic volume VA with the traffic volume VB (step S13).

[0068] Next, if the absolute value of the difference between the traffic volume VA and the traffic volume VB is less than a predetermined value (YES in step S14), the detection device 101 determines that no abnormality has occurred in the network 201 (step S15).

[0069] On the other hand, if the absolute value of the difference between the traffic volume VA and the traffic volume VB is equal to or greater than the predetermined value (NO in step S14), the detection device 101 determines that an abnormality has occurred in the network 201 (step S16).

[0070] Next, the detection device 101 notifies the administrator of the network 201 of the determination result by voice or display (step S17).

[0071] In the detection device 101 according to the embodiment of the present disclosure, the calculation unit 20 in the load calculation unit 21 is configured to calculate the communication volume per unit time based on messages included in the observation results received from the observation unit 10, but this is not limited to this. Instead of calculating the communication volume, the calculation unit 20 may be configured to acquire the communication volume from outside the detection device 101. In other words, instead of generating load information, the load calculation unit 21 may acquire load information generated outside the detection device 101.

[0072] Furthermore, in the detection system 301 according to the embodiment of the present disclosure, the extraction device 121A is configured to copy messages extracted by filter fa from messages received via communication port PA2, transmit the extracted messages via communication port PA1, and transmit copies of the extracted messages to the detection device 101 via transmission line 1, but this is not limited to this. The extraction device 121A may also be configured to copy all messages received via communication port PA2, transmit all messages received via communication port PA2 via communication port PA1, and transmit messages extracted by filter fa from the copies of the extracted messages to the detection device 101 via transmission line 1.

[0073] Alternatively, the observation unit 10A may include the filter fa instead of the extraction device 121A. In this case, the extraction device 121A copies all messages received via communication port PA2, transmits all messages received via communication port PA2 via communication port PA1, and transmits copies of the extracted messages to the detection device 101 via transmission line 1. The observation unit 10A extracts messages that comply with the above-mentioned communication protocol Prtl from the messages extracted by the filter fa among the messages received from the extraction device 121A.

[0074] Similarly, the extraction device 121B may be configured to duplicate all messages received via communication port PB2, transmit all messages received via communication port PB2 via communication port PB1, and transmit messages extracted from the duplicated messages using filter fb to the detection device 101 via transmission line 1. Alternatively, the observation unit 10B may be configured to include filter fb instead of the extraction device 121B. In this case, the extraction device 121B duplicates all messages received via communication port PB2, transmits all messages received via communication port PB2 via communication port PB1, and transmits duplicates of the extracted messages to the detection device 101 via transmission line 1. The observation unit 10B extracts messages that comply with the above-mentioned communication protocol Prtl from the messages extracted using filter fb from the messages received from the extraction device 121B.

[0075] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0076] Second Embodiment This embodiment relates to a detection system 302 that, unlike the detection system 301 according to the first embodiment, identifies an abnormality location based on the consistency of each combination of load information. Except for the details described below, the detection system 302 is the same as the detection system 301 according to the first embodiment.

[0077] 5 is a diagram illustrating an example of the configuration of a detection system and a detection target network according to a second embodiment of the present disclosure. Referring to FIG. 5 , compared to the detection system 301 according to the first embodiment, the detection system 302 includes a detection device 102 instead of the detection device 101, and further includes an observation unit 10C. The detection system 302 detects anomalies in a network 202. Compared to the network 201, the network 202 includes a switch device 142 instead of the switch device 141. The observation unit 10C is provided in the switch device 142. Like the switch device 141, the switch device 142 includes communication ports 122A and 122B, and relays information exchanged between the communication devices 111A and 111B.

[0078] Compared to the detection device 101, the detection device 102 includes a load calculation unit 22 instead of the load calculation unit 21, and a detection unit 32 instead of the detection unit 31. Compared to the load calculation unit 21, the load calculation unit 22 further includes a calculation unit 20C which is the calculation unit 20. The load calculation unit 22 generates three pieces of load information which respectively indicate the communication loads at three locations in the network 202. The load calculation unit 22 is an example of an acquisition unit.

[0079] The observation unit 10C observes messages arriving at the communication port 122B of the switch device 142. More specifically, the observation unit 10C receives messages via the communication port 122B, outputs the received messages to a relay processing unit (not shown), and also duplicates the messages. The observation unit 10C periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages duplicated during the observation period T1. The observation unit 10C transmits the observation results, including the extracted messages, to the detection device 102 via the transmission line 1.

[0080] For example, the calculation unit 20C generates load information based on the observation results of the observation unit 10C. More specifically, the calculation unit 20C receives the observation results from the observation unit 10C via the transmission line 1, and calculates the communication volume VC per unit time of messages included in the received observation results. The communication volume VC indicates the communication volume per unit time of messages received by the switch device 142 via the communication port 122B. The calculation unit 20C outputs load information indicating the calculated communication volume VC to the detection unit 32.

[0081] In the detection process, the detection unit 32 identifies an abnormal location in the network 202 based on the consistency of each combination of two pieces of load information included in the three pieces of load information received from the calculation units 20A, 20B, and 20C.

[0082] For example, the detection unit 32 receives load information from the calculation units 20A, 20B, and 20C, and identifies an abnormal location in the network 202 based on a comparison result for each combination of two traffic volumes included in the traffic volumes VA, VB, and VC indicated by the three pieces of load information received.

[0083] As an example, the detection unit 32 determines that no abnormality has occurred in the network 202 when the absolute value of the difference between the communication amount VA and the communication amount VB, the absolute value of the difference between the communication amount VB and the communication amount VC, and the absolute value of the difference between the communication amount VA and the communication amount VC are less than a predetermined value.

[0084] On the other hand, the detection unit 32 determines that an abnormality has occurred in the network 202 when at least one of the absolute value of the difference between the communication amount VA and the communication amount VB, the absolute value of the difference between the communication amount VB and the communication amount VC, and the absolute value of the difference between the communication amount VA and the communication amount VC is equal to or greater than a predetermined value.

[0085] For example, if the value obtained by subtracting the communication volume VA from the communication volume VB is equal to or greater than a predetermined value, and the value obtained by subtracting the communication volume VA from the communication volume VC is equal to or greater than a predetermined value, the detection unit 32 determines that an abnormality such as the insertion of a fraudulent message addressed to communication device 111A has occurred between communication device 111B and extraction device 121B, because a greater number of messages than expected are passing through extraction device 121B toward switch device 142.

[0086] Furthermore, for example, if the absolute value of the difference between the communication volume VA and the communication volume VB is less than a predetermined value, and the value obtained by subtracting the communication volume VA from the communication volume VC is equal to or greater than a predetermined value, the detection unit 32 determines that an abnormality such as the insertion of an unauthorized message addressed to communication equipment 111A has occurred between the extraction device 121B and the switch device 142, since a greater number of messages than expected have arrived at communication port 122B in switch device 142.

[0087] For example, when the detection unit 32 determines that an abnormality has occurred in the network 202, it notifies the administrator of the network 202 of the determination result including the identified abnormality location by voice or display.

[0088] 6 is a diagram illustrating a state in which an unauthorized device has been added to a network to be detected by a detection system according to a second embodiment of the present disclosure. Fig. 6 illustrates a state in which an unauthorized device 111Y and a repeater hub 121Y have been added to a network 202. The repeater hub 121Y is provided between a communication port 122B of a switch device 142 and an extraction device 121B, and is connected to a communication port PB1 of the extraction device 121B via a transmission line 1. The unauthorized device 111Y is connected to the repeater hub 121Y via a transmission line 1.

[0089] The fraudulent device 111Y generates a fraudulent message addressed to the communication device 111A according to the communication protocol Prtl, pretending that the sender is the communication device 111B, and transmits the generated fraudulent message to the repeater hub 121Y.

[0090] Repeater hub 121Y outputs messages received from extraction device 121B to switch device 142 and unauthorized device 111Y, outputs messages received from switch device 142 to extraction device 121B and unauthorized device 111Y, and outputs unauthorized messages received from unauthorized device 111Y to switch device 142 and extraction device 121B.

[0091] FIG. 7 is a diagram illustrating an example of a detection process in the detection device according to the second embodiment of the present disclosure.

[0092] 7 , for example, communication device 111A transmits a message to communication device 111B via switch device 142. Observation unit 10A in receiving unit 11 of detection device 102 receives, via transmission line 1, the message transmitted by communication device 111A and extracted by extraction device 121A.

[0093] The communication device 111B receives a message from the communication device 111A via the switch device 142 and transmits a response message to the communication device 111A via the switch device 142. The unauthorized device 111Y transmits an unauthorized message to the communication device 111A via the repeater hub 121Y and the switch device 142. The unauthorized message transmitted by the unauthorized device 111Y is output to the extraction device 121B by the repeater hub 121Y. Since the extraction device 121B receives the unauthorized message via communication port PB1, it transmits the unauthorized message to the communication device 111B via communication port PB2, but does not extract or copy the unauthorized message using the filter fb. Therefore, the unauthorized message transmitted by the unauthorized device 111Y does not reach the observation unit 10B in the receiving unit 11 of the detection device 102.

[0094] The observation unit 10B in the receiving unit 11 of the detection device 102 receives the response message transmitted by the communication device 111B and extracted by the extraction device 121B via the transmission line 1. On the other hand, the observation unit 10C receives the unauthorized message transmitted by the unauthorized device 111Y in addition to the response message transmitted by the communication device 111B.

[0095] Therefore, the communication volume VC calculated by the calculation unit 20C is greater than the communication volume VA calculated by the calculation unit 20A and the communication volume VB calculated by the calculation unit 20B.

[0096] In this case, the detection unit 32 determines that an abnormality has occurred between the extraction device 121B and the switch device 142 because the absolute value of the difference between the communication volume VA and the communication volume VB is less than a predetermined value and the value obtained by subtracting the communication volume VA from the communication volume VC is greater than or equal to a predetermined value.

[0097] FIG. 8 is a diagram illustrating an example of a sequence of a detection process in the detection system according to the second embodiment of the present disclosure.

[0098] Referring to FIG. 8, first, the observation unit 10A extracts one or more messages conforming to the communication protocol Prtl from one or more messages extracted by the extraction device 121A during the observation period T1 (step S21).

[0099] Furthermore, the observation unit 10B extracts one or more messages conforming to the communication protocol Prtl from the one or more messages extracted by the extraction device 121B during the observation period T1 (step S22).

[0100] The observation unit 10C also extracts one or more messages conforming to the communication protocol Prtl from the one or more messages copied during the observation period T1 (step S23).

[0101] Next, the observation unit 10A outputs the observation result including the extracted message to the load calculation unit 22 (step S24).

[0102] The observation unit 10B also outputs the observation result including the extracted message to the load calculation unit 22 (step S25).

[0103] The observation unit 10C also transmits the observation results including the extracted messages to the load calculation unit 22 (step S26).

[0104] Next, the load calculation unit 22 calculates the communication volume VA per unit time due to messages contained in the observation results received from the observation unit 10A, the communication volume VB per unit time due to messages contained in the observation results received from the observation unit 10B, and the communication volume VC per unit time due to messages contained in the observation results received from the observation unit 10C (step S27).

[0105] Next, the load calculation unit 22 outputs the load information indicating the communication volume VA, the load information indicating the communication volume VB, and the load information indicating the communication volume VC to the detection unit 32 (step S28).

[0106] The detection unit 32 performs detection processing based on the consistency of the multiple pieces of load information received from the load calculation unit 22. For example, if the absolute value of the difference between the communication volume VA and the communication volume VB is less than a predetermined value and the value obtained by subtracting the communication volume VA from the communication volume VC is equal to or greater than a predetermined value, the detection unit 32 determines that an abnormality has occurred between the extraction device 121B and the switch device 142 (step S29).

[0107] Next, the detection unit 32 notifies the administrator of the network 202 of the determination result by voice or display (step S30).

[0108] In addition, in the detection system 302 according to an embodiment of the present disclosure, the observation unit 10C may be configured to suspend copying and extraction of messages until an observation instruction is received from the detection device 102, and to copy and extract messages when an observation instruction is received from the detection device 102.

[0109] More specifically, the detection unit 32 in the detection device 102 compares the traffic volume VA with the traffic volume VB, and if it determines that an abnormality has occurred in the network 202, it outputs a calculation instruction to the calculation unit 20C.

[0110] When the calculation unit 20C receives a calculation instruction from the detection unit 32, it transmits an observation instruction to the observation unit 10C via the transmission line 1.

[0111] The observation unit 10C receives an observation instruction from the calculation unit 20C, copies messages received via the communication port 122B during an observation period T2 having the same length as the observation period T1, and extracts one or more messages conforming to the communication protocol Prtl from the one or more copied messages. The observation unit 10C transmits the observation results including the extracted messages to the detection device 102 via the transmission line 1.

[0112] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0113] Third Embodiment This embodiment relates to a detection system 303 that, unlike the detection system 301 according to the first embodiment, detects anomalies in a network 203 in which one-to-many communication is performed by communication devices 111. Other than the details described below, the detection system 303 is the same as the detection system 301 according to the first embodiment.

[0114] FIG. 9 is a diagram illustrating an example of the configuration of a detection system and a detection target network according to a third embodiment of the present disclosure. Referring to FIG. 9 , compared to the detection system 301 according to the first embodiment, the detection system 303 includes a detection device 103 instead of the detection device 101, and further includes an extraction device 121D. The extraction device 121D is an example of an extraction device. The extraction device 121D includes communication ports PD1 and PD2. The extraction device 121D transmits a message received via one of the communication ports PD1 and PD2 via the other of the communication ports PD1 and PD2. The detection system 303 detects anomalies in the network 203.

[0115] Network 203 includes communication devices 111A, 111B, and 111D, which are communication devices 111, and a switch device 143. Communication device 111B is an example of a first communication device, communication device 111A is an example of a second communication device, and communication device 111D is an example of a third communication device. Switch device 143 relays information exchanged between communication devices 111A and 111D and communication device 111B. Switch device 143 includes communication ports 122A, 122B, and 122D.

[0116] The communication device 111D is connected to a communication port PD2 in the extractor 121D via a transmission line 1. The communication port PD1 in the extractor 121D is connected to a communication port 122D in the switch device 143 via a transmission line 1.

[0117] One-to-two communication is performed on network 203. More specifically, messages are sent and received between communication device 111B and communication devices 111A and 111D, which are different from communication device 111B, on network 203. Here, it is assumed that messages are not sent and received between communication device 111A and communication device 111D on network 203.

[0118] For example, communication device 111A operating as a client periodically or irregularly generates a message addressed to communication device 111B conforming to communication protocol Prtl, and transmits the generated message to switch device 143 via transmission line 1 and extraction device 121A. Switch device 143 transmits the message received from communication device 111A to communication device 111B via transmission line 1 and extraction device 121B.

[0119] When communication device 111B operating as a server receives a message from communication device 111A via switch device 143, it generates a response message conforming to communication protocol Prtl and transmits the generated response message to switch device 143 via transmission line 1 and extraction device 121B. Switch device 143 transmits the response message received from communication device 111B to communication device 111A via transmission line 1 and extraction device 121A.

[0120] Furthermore, for example, communications device 111D operating as a client periodically or irregularly generates messages addressed to communications device 111B conforming to communications protocol Prtl, and transmits the generated messages to switching device 143 via transmission line 1 and extraction device 121D. Switching device 143 transmits messages received from communications device 111D to communications device 111B via transmission line 1 and extraction device 121B.

[0121] When communication device 111B receives a message from communication device 111D via switch device 143, it generates a response message conforming to communication protocol Prtl and transmits the generated response message to switch device 143 via transmission line 1 and extraction device 121B. Switch device 143 transmits the response message received from communication device 111B to communication device 111D via transmission line 1 and extraction device 121D.

[0122] The extraction device 121D includes a filter fd (not shown) that extracts messages received via communication port PD2 that include the address of communication device 111D as the source address. The extraction device 121D has the functionality of a repeater hub. The extraction device 121D copies messages extracted by filter fd from messages received via communication port PD2. The extraction device 121D transmits the extracted messages via communication port PD1. The extraction device 121D further transmits copies of the extracted messages to the detection device 103 via transmission line 1.

[0123] Compared to the detection device 101 according to the first embodiment, the detection device 103 includes a receiving unit 12 instead of the receiving unit 11, a load calculation unit 23 instead of the load calculation unit 21, and a detection unit 33 instead of the detection unit 31. Compared to the receiving unit 11, the receiving unit 12 further includes an observation unit 10D which is the observation unit 10. Compared to the load calculation unit 21, the load calculation unit 23 further includes a calculation unit 20D which is the calculation unit 20. The load calculation unit 23 is an example of an acquisition unit. The detection device 103 performs detection processing to detect an abnormality in the network 203 where one-to-two communication is performed.

[0124] For example, the observation unit 10D observes the output of extracted messages by the extraction device 121D. More specifically, the observation unit 10D receives the messages extracted by the extraction device 121D via the transmission line 1. The observation unit 10D periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages received during an observation period T1 of a predetermined length. The observation unit 10D outputs observation results including the extracted messages to the calculation unit 20D.

[0125] The calculation unit 20D receives the observation results from the observation unit 10D and calculates the communication volume VD per unit time of messages included in the received observation results. The communication volume VD indicates the communication volume per unit time of messages that include the address of the communication device 111D as the source address and pass through the extraction device 121D. The calculation unit 20D outputs load information indicating the calculated communication volume VD to the detection unit 33. This load information is an example of second load information.

[0126] The detection unit 33 detects an abnormality in the network 203 based on the consistency between the communication volume VB of messages sent by the communication device 111B and the combined result of the communication volume VA of messages sent by the communication device 111A and the communication volume VD of messages sent by the communication device 111D.

[0127] For example, the detection unit 33 receives load information from the calculation units 20A, 20B, and 20D, and calculates a communication volume VAD, which is the sum of the communication volume VA indicated by the load information received from the calculation unit 20A and the communication volume VD indicated by the load information received from the calculation unit 20D. Then, the detection unit 33 determines whether an abnormality has occurred in the network 203 based on a comparison result between the calculated communication volume VAD and the communication volume VB indicated by the load information received from the calculation unit 20B.

[0128] More specifically, when the absolute value of the difference between the communication volume VAD and the communication volume VB is less than a predetermined value, the detection unit 33 determines that no abnormality has occurred in the network 203, and stores the determination result in the storage unit 41. On the other hand, when the absolute value of the difference between the communication volume VAD and the communication volume VB is equal to or greater than a predetermined value, the detection unit 33 determines that an abnormality has occurred in the network 203, and stores the determination result in the storage unit 41. Furthermore, for example, when the detection unit 33 determines that an abnormality has occurred in the network 203, it notifies the administrator of the network 203 of the determination result by voice or display.

[0129] FIG. 10 is a diagram illustrating an example of a detection process in a detection device according to the third embodiment of the present disclosure.

[0130] 10 , for example, communication device 111A transmits a message to communication device 111B via switch device 143. Observation unit 10A in receiving unit 12 of detection device 103 receives, via transmission line 1, the message transmitted by communication device 111A and extracted by extraction device 121A.

[0131] Communication device 111B receives a message from communication device 111A via switch device 143 and transmits a response message to communication device 111A via switch device 143. Observation unit 10B in receiving unit 12 of detection device 103 receives, via transmission line 1, the response message transmitted by communication device 111B and extracted by extraction device 121B.

[0132] Further, for example, the communication device 111D transmits a message to the communication device 111B via the switch device 143. The observation unit 10D in the reception unit 12 of the detection device 103 receives the message transmitted by the communication device 111D and extracted by the extraction device 121D via the transmission line 1.

[0133] Communication device 111B receives a message from communication device 111D via switch device 143 and transmits a response message to communication device 111D via switch device 143. Observation unit 10B in receiving unit 12 of detection device 103 receives, via transmission line 1, the response message transmitted by communication device 111B and extracted by extraction device 121B.

[0134] When network 203 is normal, the difference between the communication volume VAD, which is the sum of the communication volume VA calculated by calculation unit 20A and the communication volume VD calculated by calculation unit 20D, and the communication volume VB calculated by calculation unit 20B is, for example, zero. On the other hand, when an abnormality such as the insertion of a fraudulent message occurs in network 203, the consistency between the communication volume VAD and the communication volume VB decreases, and the difference between the communication volume VAD and the communication volume VB becomes a large value. Therefore, detection unit 33 can determine whether an abnormality has occurred in network 203 based on the difference between the communication volume VAD and the communication volume VB.

[0135] In the detection device 103 according to the embodiment of the present disclosure, the detection unit 33 is configured to calculate the communication volume VAD and determine whether or not an abnormality has occurred in the network 203 based on the results of comparing the calculated communication volume VAD with the communication volume VB, but this is not limited to this. The detection unit 33 may also be configured to calculate a value obtained by adding or subtracting a predetermined adjustment value to the sum of the communication volume VA and the communication volume VD instead of the communication volume VAD as a result of combining the communication volumes VA and VD, and determine whether or not an abnormality has occurred in the network 203 based on the results of comparing the calculated value with the communication volume VB.

[0136] Furthermore, although the detection device 103 according to the embodiment of the present disclosure is configured to detect an abnormality in the network 203 where one-to-two communication is performed in the detection process, this is not limited to this. The detection device 103 may be configured to detect an abnormality in a network where one-to-N or more communications are performed in the detection process, where N is an integer greater than or equal to three. More specifically, in this network, messages are sent and received between the communication device 111B and three or more communication devices 111 other than the communication device 111B. In this case, the detection unit 33 of the detection device 103 detects an abnormality in the network based on the consistency between the communication volume VB of messages sent by the communication device 111B and the combined communication volume of messages sent by the three or more communication devices 111.

[0137] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0138] <Fourth Embodiment> Compared to the detection system 303 according to the third embodiment, the present embodiment relates to a detection system 304 that identifies an abnormal location based on consistency for each combination of load information. The detection system 303 is the same as the detection system 303 according to the third embodiment except for the contents described below.

[0139] 11 is a diagram illustrating an example of the configuration of a detection system and a detection target network according to a fourth embodiment of the present disclosure. Referring to FIG. 11 , a detection system 304, compared to the detection system 303 according to the third embodiment, includes a detection device 104 instead of the detection device 103, and further includes observation units 10E and 10F. The detection system 304 detects anomalies in a network 204. Compared to the network 203, the network 204 includes a switch device 144 instead of the switch device 143. The observation units 10E and 10F are provided in the switch device 144. Like the switch device 143, the switch device 144 includes communication ports 122A, 122B, and 122D, and relays information exchanged between the communication devices 111A and 111D and the communication device 111B.

[0140] Compared to the detection device 103 according to the third embodiment, the detection device 104 includes a load calculation unit 24 instead of the load calculation unit 23, and a detection unit 34 instead of the detection unit 33. Compared to the load calculation unit 23, the load calculation unit 24 further includes calculation units 20E and 20F, which are the calculation unit 20. The load calculation unit 24 is an example of an acquisition unit.

[0141] The observation units 10E and 10F observe messages arriving at the communication ports 122A and 122D of the switch device 144, respectively.

[0142] More specifically, the observation unit 10E receives messages via the communication port 122A, outputs the received messages to a relay processing unit (not shown), and duplicates the messages. The observation unit 10E periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages duplicated during the observation period T1. The observation unit 10E transmits the observation results, including the extracted messages, to the detection device 104 via the transmission line 1.

[0143] The observation unit 10F receives messages via the communication port 122D, outputs the received messages to a relay processing unit (not shown), and also duplicates the messages. The observation unit 10F periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages duplicated during the observation period T1. The observation unit 10F transmits the observation results, including the extracted messages, to the detection device 104 via the transmission line 1.

[0144] For example, the calculation unit 20E generates load information based on the observation results of the observation unit 10E. More specifically, the calculation unit 20E receives the observation results from the observation unit 10E via the transmission line 1, and calculates the communication volume VE per unit time of messages included in the received observation results. The communication volume VE indicates the communication volume per unit time of messages received by the switch device 144 via the communication port 122A. The calculation unit 20E outputs load information indicating the calculated communication volume VE to the detection unit 34.

[0145] Furthermore, for example, the calculation unit 20F generates load information based on the observation results of the observation unit 10F. More specifically, the calculation unit 20F receives the observation results from the observation unit 10F via the transmission line 1, and calculates the communication volume VF per unit time of messages included in the received observation results. The communication volume VF indicates the communication volume per unit time of messages received by the switch device 144 via the communication port 122D. The calculation unit 20F outputs load information indicating the calculated communication volume VF to the detection unit 34.

[0146] In the detection process, the detection unit 34 identifies an abnormal location in the network 204 based on the consistency of each combination of two pieces of load information included in the five pieces of load information received from the calculation units 20A, 20B, 20D, 20E, and 20F.

[0147] For example, the detection unit 34 receives load information from the calculation units 20A, 20B, 20D, 20E, and 20F, and identifies abnormal locations in the network 204 based on the comparison results for each combination of two communication volumes included in the communication volumes VA, VB, VD, VE, and VF indicated by the five pieces of load information received.

[0148] As an example, the detection unit 34 calculates a communication volume VAD, which is the sum of the communication volume VA and the communication volume VD, and a communication volume VEF, which is the sum of the communication volume VE and the communication volume VF. If the absolute value of the difference between the communication volume VAD and the communication volume VB, the absolute value of the difference between the communication volume VEF and the communication volume VB, and the absolute value of the difference between the communication volume VAD and the communication volume VEF are less than a predetermined value, the detection unit 34 determines that no abnormality has occurred in the network 204.

[0149] On the other hand, the detection unit 34 determines that an abnormality has occurred in the network 204 if at least one of the absolute value of the difference between the communication volume VAD and the communication volume VB, the absolute value of the difference between the communication volume VEF and the communication volume VB, and the absolute value of the difference between the communication volume VAD and the communication volume VEF is greater than or equal to a predetermined value.

[0150] For example, if the value obtained by subtracting the communication volume VB from the communication volume VAD is equal to or greater than a predetermined value, and the value obtained by subtracting the communication volume VA from the communication volume VE is equal to or greater than a predetermined value, the detection unit 34 determines that an abnormality such as the insertion of a fraudulent message addressed to communication equipment 111B has occurred between the extraction device 121A and the switch device 144, since a number of messages greater than the expected number have arrived at communication port 122A in switch device 144.

[0151] Furthermore, for example, if the value obtained by subtracting the communication volume VB from the communication volume VAD is equal to or greater than a predetermined value, and the value obtained by subtracting the communication volume VD from the communication volume VF is equal to or greater than a predetermined value, the detection unit 34 determines that an abnormality such as the insertion of an unauthorized message addressed to communication equipment 111B has occurred between the extraction device 121D and the switch device 144, since a number of messages greater than the expected number have arrived at communication port 122D in switch device 144.

[0152] For example, when the detection unit 34 determines that an abnormality has occurred in the network 204, it notifies the administrator of the network 204 of the determination result including the identified abnormal location by voice or display.

[0153] 12 is a diagram illustrating a state in which an unauthorized device has been added to a network that is the detection target of a detection system according to a fourth embodiment of the present disclosure. Fig. 12 illustrates a state in which an unauthorized device 111Z and a repeater hub 121Z have been added to a network 204. The repeater hub 121Z is provided between a communication port 122A of a switch device 144 and an extraction device 121A, and is connected to a communication port PA1 of the extraction device 121A via a transmission line 1. The unauthorized device 111Z is connected to the repeater hub 121Z via a transmission line 1.

[0154] The unauthorized device 111Z generates an unauthorized message addressed to the communication device 111B conforming to the communication protocol Prtl, disguising the source as the communication device 111A, and transmits the generated unauthorized message to the repeater hub 121Z.

[0155] The repeater hub 121Z outputs messages received from the extraction device 121A to the switch device 144 and the unauthorized device 111Z, outputs messages received from the switch device 144 to the extraction device 121A and the unauthorized device 111Z, and outputs unauthorized messages received from the unauthorized device 111Z to the switch device 144 and the extraction device 121A.

[0156] For example, communication device 111D transmits a message to communication device 111B via switch device 144. Observation unit 10D in receiving unit 12 of detection device 104 receives the message transmitted by communication device 111D and extracted by extraction device 121D via transmission line 1. Observation unit 10F also receives the message transmitted by communication device 111D.

[0157] Communication device 111B receives a message from communication device 111D via switch device 144 and transmits a response message addressed to communication device 111D to switch device 144. Observation unit 10B in receiving unit 12 of detection device 104 receives, via transmission line 1, the response message transmitted by communication device 111B and extracted by extraction device 121B.

[0158] Also, for example, communication device 111A transmits a message to communication device 111B via switch device 144. Observation unit 10A in receiver 12 of detection device 104 receives, via transmission line 1, the message transmitted by communication device 111A and extracted by extraction device 121A. Meanwhile, observation unit 10E receives, in addition to the message transmitted by communication device 111A, an unauthorized message transmitted by unauthorized device 111Z. Extraction device 121A receives the unauthorized message transmitted by unauthorized device 111Z via communication port PA1, and transmits the unauthorized message to communication device 111A via communication port PA2, without extracting or duplicating the unauthorized message using filter fa. Therefore, the unauthorized message transmitted by unauthorized device 111Z does not reach observation unit 10A in receiver 12 of detection device 104.

[0159] Communication device 111B receives a message from communication device 111A via switch device 144 and transmits a response message addressed to communication device 111A to switch device 144. Observation unit 10B in receiving unit 12 of detection device 104 receives, via transmission line 1, the response message transmitted by communication device 111B and extracted by extraction device 121B.

[0160] Communication device 111B receives the unauthorized message from unauthorized device 111Z via switch device 144, and transmits a response message addressed to communication device 111A to switch device 144. Observation unit 10B in receiving unit 12 of detection device 104 receives, via transmission line 1, the response message transmitted by communication device 111B and extracted by extraction device 121B.

[0161] Therefore, the communication volume VB calculated by the calculation unit 20B is larger than the communication volume VAD, which is the sum of the communication volume VA calculated by the calculation unit 20A and the communication volume VD calculated by the calculation unit 20D. Also, the communication volume VE calculated by the calculation unit 20E is larger than the communication volume VA.

[0162] In this case, the detection unit 34 determines that an abnormality has occurred between the extraction device 121A and the switch device 144 because the value obtained by subtracting the communication volume VB from the communication volume VAD is greater than or equal to a predetermined value, the value obtained by subtracting the communication volume VD from the communication volume VF is less than the predetermined value, and the value obtained by subtracting the communication volume VA from the communication volume VE is greater than or equal to a predetermined value.

[0163] Next, other embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0164] Fifth Embodiment This embodiment relates to a detection system 305 that, compared to the detection system 303 according to the third embodiment, detects anomalies in a network 205 in which one-to-many multicast communication and broadcast communication are performed by communication devices 111. Other than the details described below, the fifth embodiment is the same as the detection system 303 according to the third embodiment.

[0165] FIG. 13 is a diagram illustrating an example of the configuration of a detection system and a detection target network according to a fifth embodiment of the present disclosure. Referring to FIG. 13 , compared to the detection system 303 according to the third embodiment, the detection system 305 includes a detection device 105 instead of the detection device 103, and further includes an extraction device 121G. The extraction device 121G is an example of an extraction device. The extraction device 121G includes communication ports PG1 and PG2. The extraction device 121G transmits a message received via one of the communication ports PG1 and PG2 via the other of the communication ports PG1 and PG2. The detection system 305 detects anomalies in the network 205.

[0166] The network 205 includes communication devices 111A, 111B, 111D, and 111G, which are communication devices 111, and a switch device 145. The communication device 111B is an example of a first communication device. The communication devices 111A, 111D, and 111G are examples of second communication devices and examples of third communication devices. The switch device 145 relays information exchanged between the communication devices 111A, 111D, and 111G and the communication device 111B. The switch device 145 includes communication ports 122A, 122B, 122D, and 122G.

[0167] The communication device 111G is connected to a communication port PG2 in the extractor 121G via a transmission line 1. The communication port PG1 in the extractor 121G is connected to a communication port 122G in the switch device 143 via a transmission line 1.

[0168] Messages are transmitted and received between communication device 111B and communication devices 111A, 111D, and 111G over network 205. Here, it is assumed that messages are not transmitted and received between communication device 111A and communication device 111D, between communication device 111D and communication device 111G, and between communication device 111A and communication device 111G.

[0169] For example, the communication device 111B multicasts a message conforming to the communication protocol Prtl to some or all of the communication devices 111A, 111D, and 111G via the switch device 145 periodically or irregularly.

[0170] Of communication devices 111A, 111D, and 111G, communication device 111 that is included in the multicast group identified by the multicast address stored in the message sent by communication device 111B generates a response message conforming to communication protocol Prtl and transmits the generated response message to communication device 111B via switch device 145.

[0171] Furthermore, for example, the communication device 111B broadcasts a message conforming to the communication protocol Prtl to the communication devices 111A, 111D, and 111G via the switch device 145 periodically or irregularly.

[0172] Of communication devices 111A, 111D, and 111G, communication device 111 that should respond to a message received from communication device 111B via switch device 145 generates a response message that conforms to communication protocol Prtl and transmits the generated response message to communication device 111B via switch device 145.

[0173] The extraction device 121G includes a filter fg (not shown) that extracts messages received via communication port PG2 that include the address of communication device 111G as the source address. The extraction device 121G extracts messages extracted by filter fg from the messages received via communication port PG2. The extraction device 121G transmits the extracted messages via communication port PG1. The extraction device 121G further transmits copies of the extracted messages to the detection device 105 via transmission line 1.

[0174] Compared to the detection device 103 according to the third embodiment, the detection device 105 includes a receiving unit 13 instead of the receiving unit 12, a load calculation unit 25 instead of the load calculation unit 23, a detection unit 35 instead of the detection unit 33, and a storage unit 42 instead of the storage unit 41. Compared to the receiving unit 12, the receiving unit 13 further includes an observation unit 10G that is the observation unit 10. Compared to the load calculation unit 23, the load calculation unit 25 includes a calculation unit 20BB that is the calculation unit 20 instead of the calculation unit 20B, and further includes a calculation unit 20G that is the calculation unit 20. The load calculation unit 25 is an example of an acquisition unit. The detection device 105 performs detection processing to detect an abnormality in the network 205.

[0175] The storage unit 42 stores network information indicating the topology of the network 205 and the communication protocol Prtl in the network 205. For example, the network information is saved in the storage unit 42 by an administrator of the network 205.

[0176] The storage unit 42 also stores an address correspondence table Tb1 that indicates the correspondence between destination addresses included in messages transmitted by the communication device 111B, type information indicating the type of the message, and destination device information indicating the number of communication devices 111 to which the message is addressed. The type information in the address correspondence table Tb1 indicates whether the message transmitted by the communication device 111B is a unicast message, a multicast message, or a broadcast message. For example, in the address correspondence table Tb1, the number of destination communication devices 111 corresponding to a broadcast message is "3." The address correspondence table Tb1 is obtained in advance from the communication device 111 or the switch device 145 by the detection unit 35, for example, and stored in the storage unit 42. The address correspondence table Tb1 may also be stored in the storage unit 42 by an administrator of the network 205.

[0177] For example, the observation unit 10G observes the output of extracted messages by the extraction device 121G. More specifically, the observation unit 10G receives the messages extracted by the extraction device 121G via the transmission line 1. The observation unit 10G periodically or irregularly extracts one or more messages conforming to the above-mentioned communication protocol Prtl from one or more messages received during an observation period T1 of a predetermined length. The observation unit 10G outputs the observation results including the extracted messages to the calculation unit 20G.

[0178] The calculation unit 20G receives the observation results from the observation unit 10G and calculates the communication volume VG per unit time of the messages included in the received observation results. The communication volume VG indicates the communication volume per unit time of the messages that include the address of the communication device 111G as the source address and pass through the extraction device 121G. The calculation unit 20G outputs load information indicating the calculated communication volume VG to the detection unit 35.

[0179] The calculation unit 20BB calculates the communication volume VB based on the number of response messages predicted based on the type of message transmitted by the communication device 111B and the communication volume of the messages transmitted by the communication device 111B. In particular, the calculation unit 20BB receives the observation results from the observation unit 10B, predicts the number of response messages to the communication device 111B in response to the message transmitted by the communication device 111B for each message included in the received observation results, and calculates the product Pmv of the predicted number of response messages and the communication volume of the messages transmitted by the communication device 111B. The calculation unit 20BB then calculates the sum of the products Pmv for each message included in the observation results as the communication volume VB.

[0180] More specifically, the calculation unit 20BB acquires the destination address from the message included in the observation result, and acquires type information and destination device information corresponding to the acquired destination address from the address correspondence table Tb1 in the storage unit 42.

[0181] If the type of message indicated by the acquired type information is a unicast message, the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the unicast message will be 1. Then, the calculation unit 20BB calculates the product Pmv as 1 times the communication volume of the unicast message.

[0182] Furthermore, for example, if the type of message indicated by the acquired type information is a multicast message and the number of destination communication devices 111 indicated by the acquired destination device information is, for example, "2," the calculation unit 20BB predicts that the number of response messages to the communication device 111B in response to the multicast message will be 2. Then, the calculation unit 20BB calculates twice the communication volume of the multicast message as the product Pmv.

[0183] Furthermore, for example, if the type of message indicated by the acquired type information is a broadcast message, as described above, the number of destination communication devices 111 indicated by the destination device information corresponding to the type information in the address correspondence table Tb1 is "3," and therefore the calculation unit 20BB predicts that the number of response messages to the broadcast message to communication device 111B will be 3. Then, the calculation unit 20BB calculates the product Pmv as three times the communication volume of the broadcast message.

[0184] FIG. 14 is a diagram illustrating an example of a detection process in a detection device according to the fifth embodiment of the present disclosure.

[0185] 14 , for example, communication device 111B multicasts a message to communication devices 111A and 111D via switch device 145. Observation unit 10B in receiving unit 13 of detection device 105 receives, via transmission line 1, the message transmitted by communication device 111B and extracted by extraction device 121B, and outputs the observation result including the received message to calculation unit 20BB.

[0186] Communication device 111A receives a message from communication device 111B via switch device 145, and transmits a response message to communication device 111B via switch device 145. Observation unit 10A in receiving unit 13 of detection device 105 receives, via transmission line 1, the response message transmitted by communication device 111A and extracted by extraction device 121A, and outputs the observation result including the received response message to calculation unit 20A.

[0187] Communication device 111D receives a message from communication device 111B via switch device 145, and transmits a response message to communication device 111B via switch device 145. Observation unit 10D in receiving unit 13 of detection device 105 receives, via transmission line 1, the response message transmitted by communication device 111D and extracted by extraction device 121D, and outputs the observation result including the received response message to calculation unit 20D.

[0188] Calculation unit 20BB receives the observation result from observation unit 10B, acquires the destination address from the message included in the received observation result, and acquires type information and destination device information corresponding to the acquired destination address from address correspondence table Tb1 in storage unit 42. Because the type of message indicated by the acquired type information is a multicast message and the number of destination communication devices 111 indicated by the acquired destination device information is "2," calculation unit 20BB predicts that the number of response messages to communication device 111B in response to the multicast message will be "2," and calculates twice the communication volume of the multicast messages as communication volume VB.

[0189] When the network 205 is normal, the difference between the communication volume VAD, which is the sum of the communication volume VA calculated by the calculation unit 20A and the communication volume VD calculated by the calculation unit 20D, and the communication volume VB calculated by the calculation unit 20BB is, for example, zero. On the other hand, when an abnormality such as the insertion of a fraudulent message occurs in the network 205, the consistency between the communication volume VAD and the communication volume VB decreases, and the difference between the communication volume VAD and the communication volume VB becomes large. Therefore, even in the network 205 in which one-to-many multicast communication and broadcast communication are performed by the communication device 111, the detection unit 35 can determine whether an abnormality has occurred in the network 205 based on the difference between the communication volume VAD and the communication volume VB.

[0190] (Variation 1) Note that, when the type of message indicated by the type information acquired from the address correspondence table Tb1 is a broadcast message, the calculation unit 20BB predicts that the number of response messages to the broadcast message to the communication device 111B will be three based on the number of destination communication devices 111 indicated by the destination device information corresponding to the type information in the address correspondence table Tb1, and calculates the communication volume VB based on the predicted number of response messages and the communication volume of the messages, but this is not limited to this. For example, the calculation unit 20BB calculates the communication volume VB based on the predicted number of response messages further based on header information of the messages transmitted by the communication device 111B and the communication volume of the messages.

[0191] FIG. 15 is a diagram illustrating an example of a response information table stored in a storage unit in a detection device according to the fifth embodiment of the present disclosure.

[0192] 15 , the storage unit 42 stores a response information table Tb2 indicating, for each communication protocol Prt1 of a broadcast message transmitted by the communication device 111B, a correspondence relationship between the header information of the broadcast message and the number of response messages expected to be sent to the communication device 111B. The response information table Tb2 is obtained in advance from the communication device 111 or the switch device 145 by the detection unit 35, for example, and stored in the storage unit 42.

[0193] For example, response information table Tb2 indicates that when the operation code of a broadcast message conforming to ARP is "1," the number of expected response messages is "1." This is because when an ARP request message is broadcast by communication device 111B, any one of communication devices 111A, 111D, and 111G that has an IP address that matches the IP address specified in the ARP request message will transmit an ARP response message as a response message to communication device 111B. The operation code is an example of header information.

[0194] Furthermore, for example, response information table Tb2 indicates that when the Type in the SOME / IP-SD (Service Discovery) header of a broadcast message conforming to SOME / IP is "0x01," the broadcast message is an Offer message conforming to SOME / IP, and the number of expected response messages is "1." This is because, when an Offer message is broadcast by communication device 111B operating as a server, any one of communication devices 111A, 111D, and 111G operating as clients that is to receive the service specified in the Offer message will send a Subscribe message conforming to SOME / IP as a response message to communication device 111B. Here, a number beginning with "0x" means that the numbers following "0x" are expressed in hexadecimal. The Type in the SOME / IP-SD header is an example of header information.

[0195] Furthermore, for example, response information table Tb2 indicates that when the Type in the SOME / IP-SD header of a broadcast message conforming to SOME / IP is "0x00," the broadcast message is a Find message conforming to SOME / IP, and the number of expected response messages is "1." This is because, in a case where communication device 111B operates as a client and communication devices 111A, 111D, and 111G operate as servers, when a Find message is broadcast by communication device 111B, any one of communication devices 111A, 111D, and 111G that can provide the service specified by the Find message will transmit an Offer message conforming to SOME / IP as a response message to communication device 111B.

[0196] If the type of message indicated by the type information acquired from the address correspondence table Tb1 in the storage unit 42 is a broadcast message, the calculation unit 20BB acquires header information of the broadcast message.

[0197] The calculation unit 20BB refers to the response information table Tb2 in the storage unit 42, and if the acquired header information is included in the response information table Tb2, it recognizes the number of predicted response messages corresponding to the header information. On the other hand, if the acquired header information is not included in the response information table Tb2, the calculation unit 20BB predicts that the number of response messages will be three based on the address correspondence table Tb1, as described above. The calculation unit 20BB calculates the product Pmv of the number of predicted response messages and the communication volume of the broadcast message. Then, the calculation unit 20BB calculates the sum of the products Pmv for each message included in the observation result as the communication volume VB.

[0198] As an example, when the operation code of a broadcast message conforming to ARP is "1," the calculation unit 20BB refers to the response information table Tb2 and recognizes that the number of response messages to the communication device 111B in response to the broadcast message is 1. Then, the calculation unit 20BB calculates the product Pmv as 1 times the communication volume of the broadcast message.

[0199] (Variation 2) Note that, in the above description, the calculation unit 20BB is configured to acquire type information and destination device information from the address correspondence table Tb1 in the storage unit 42, predict the number of response messages to the communication device 111B based on the acquired type information and destination device information, and calculate the communication volume VB based on the predicted number of response messages and the communication volume of the messages, but this is not limited to this. For example, the calculation unit 20BB calculates the communication volume VB based on the predicted number of response messages further based on a window size in communication conforming to TCP (Transmission Control Protocol) and the communication volume of the messages.

[0200] More specifically, when communication conforming to TCP is performed between communication devices 111, window size control may be performed. When window size control is performed, communication devices 111A, 111D, and 111G transmit one response message to communication device 111B via switch device 145 in response to multiple messages received from communication device 111B via switch device 145. Specifically, for example, when the window size is set to "3," communication devices 111A, 111D, and 111G transmit one response message to communication device 111B via switch device 145 in response to three messages received from communication device 111B via switch device 145.

[0201] For example, the storage unit 42 stores a window control table Tb3 that indicates the correspondence between port numbers, whether window control is being performed, and window sizes when window control is being performed.

[0202] The calculation unit 20BB acquires a port number from a message included in the observation result received from the observation unit 10B, and acquires a window size corresponding to the acquired port number from the window control table Tb3 in the storage unit 42. The calculation unit 20BB predicts the number of response messages to the communication device 111B based on the acquired window size. The calculation unit 20BB calculates the product Pmv of the predicted number of response messages and the communication volume of the messages included in the observation result. The calculation unit 20BB then calculates the sum of the products Pmv for each message included in the observation result as the communication volume VB.

[0203] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0204] Each process (each function) in the above-described embodiments is realized by a processing circuit (circuitry) including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or may execute each of the processes according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet to execute the processes. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed into the memory from the recording medium.

[0205] The above description includes the features noted below. [Note 1] A detection device that detects an abnormality in a network, wherein a plurality of messages including a response message are transmitted and received by a plurality of communication devices in the network, the detection device comprises: an acquisition unit that acquires a plurality of load information indicating communication loads at a plurality of locations in the network, and a detection unit that detects an abnormality in the network based on consistency of the plurality of load information acquired by the acquisition unit, wherein the messages are transmitted and received by the plurality of communication devices via a switch device in the network, and the acquisition unit acquires the load information indicating the communication load in the switch device.

[0206] 1 Transmission line 10, 10A, 10B, 10C, 10D, 10E, 10F, 10G Observation unit 11, 12, 13 Receiving unit 20, 20A, 20B, 20C, 20D, 20E, 20F, 20G, 20BB Calculation unit 21, 22, 23, 24, 25 Load calculation unit (acquisition unit) 31, 32, 33, 34, 35 Detection unit 41, 42 Storage unit 111A, 111B, 111D, 111G Communication device 111X, 111Y, 111Z Unauthorized device 121A, 121B, 121D, 121G Extraction device 121X, 121Y, 121Z Repeater hub 122A, 122B, 122D, 122G Communication port 101, 102, 103, 104, 105 Detection device 141, 142, 143, 144, 145 Switch device 201, 202, 203, 204, 205 Network 301, 302, 303, 304, 305 Detection system Tb1 Address correspondence table Tb2 Response information table PA1, PA2, PB1, PB2, PD1, PD2, PG1, PG2 Communication port

Claims

1. A detection device for detecting an anomaly in a network, comprising: In the network, a plurality of communication devices transmit and receive a plurality of messages including a response message; The detection device includes: an acquisition unit that acquires a plurality of pieces of load information indicating communication loads at a plurality of locations in the network, the plurality of pieces of load information indicating communication loads due to the messages from different transmission sources; a detection unit that detects an abnormality in the network based on consistency of the plurality of pieces of load information acquired by the acquisition unit.

2. the acquiring unit acquires three or more pieces of load information indicating communication loads at three or more locations in the network, The detection device according to claim 1 , wherein the detection unit identifies an abnormality location in the network based on the consistency for each combination of two pieces of the load information included in the three or more pieces of load information.

3. In the network, the message is transmitted and received between a first communication device and a plurality of communication devices different from the first communication device; the acquisition unit acquires first load information indicating a communication volume of the message whose sender is the first communication device, and second load information indicating a communication volume of the message whose sender is a communication device other than the first communication device, the second load information corresponding to each of the plurality of communication devices other than the first communication device, The detection device according to claim 1 or claim 2, wherein the detection unit detects an abnormality in the network based on the consistency between the message communication volume indicated by the first load information and the combined result of the message communication volume indicated by each of the plurality of second load information.

4. The detection device further comprises: an extraction device that extracts the message transmitted from the communication device, the extraction device outputting the extracted message to other communication devices and the detection device, the extraction device including an observation unit that observes an output of the extracted message by the extraction device; The detection device according to claim 1 , wherein the acquisition unit generates the load information based on an observation result of the observation unit.

5. The detection device according to claim 3, wherein the acquisition unit acquires the load information indicating a communication load calculated based on a number of response messages predicted based on a type of the message transmitted by the first communication device and a communication volume of the message transmitted by the first communication device.

6. The detection device according to claim 5 , wherein the acquisition unit acquires the load information indicating a communication load calculated based on a number of the response messages predicted further based on header information of the message transmitted by the first communication device.

7. The network includes a switch device that relays the messages transmitted and received between the communication devices, The detection device according to claim 1 , wherein each of the load information indicates the communication load in a transmission path between the switch device and the communication device of the source.

8. The network includes a switch device that relays the messages transmitted and received between the communication devices, The detection device according to claim 1 or claim 2, wherein the plurality of load information include load information indicating the communication load in the switch device and load information indicating the communication load in a transmission path between the switch device and the source communication equipment.

9. A detection system for detecting an anomaly in a network, comprising: In the network, a plurality of communication devices transmit and receive a plurality of messages including a response message; The detection system comprises: A plurality of extraction devices each extracting the messages from different transmission sources passing through different points in the network; a plurality of observation units each observing the message extracted by the plurality of extraction devices; a load calculation unit that generates a plurality of load information indicating communication loads at a plurality of points in the network based on observation results by the plurality of observation units; a detection unit that detects an abnormality in the network based on consistency of the plurality of pieces of load information generated by the load calculation unit.

10. A detection method for a detection device that detects an anomaly in a network, comprising: In the network, a plurality of communication devices transmit and receive a plurality of messages including a response message; The detection method includes: acquiring a plurality of pieces of load information each indicating a communication load at a plurality of locations in the network, the plurality of pieces of load information each indicating a communication load due to the message from a different transmission source; detecting an anomaly in the network based on consistency of the acquired plurality of pieces of load information.