Attack detection device, attack detection method, and non-transitory computer-readable recording medium

An attack detection method executed by a processor, the attack detection method comprising:

• receiving messages periodically transmitted from a communication device in a network;
• calculating a plurality of reception ranges in which periodic messages are predicted to be received, the periodic messages each including identification information identical to that included in a reference message that is selected from the received messages and each being transmitted two or more periods after the reference message, the reception ranges each being calculated by using a transmission period of its corresponding periodic message identified by the identical identification information;
• storing the reception ranges and orders in association with each other, each of the orders being a predicted order of reception of its corresponding periodic message, the predicted order being predicted in reference to the reference message;
• and
• determining that an attack on the network is detected when a reception time of a certain message including the identification information does not belong to a reception range associated with the order of reception of the certain message among the reception ranges each associated with the order of reception of its corresponding periodic message in reference to the reference message.

A non-transitory computer-readable recording medium having stored therein an attack detection program that causes a computer to execute a process comprising:

• receiving messages periodically transmitted from a communication device in a network;
• calculating a plurality of reception ranges in which periodic messages are predicted to be received, the periodic messages each including identification information identical to that included in a reference message that is selected from the received messages and each being transmitted two or more periods after the reference message, the reception ranges each being calculated by using a transmission period of its corresponding periodic message identified by the identical identification information;
• storing the reception ranges and orders in association with each other, each of the orders being a predicted order of reception of its corresponding periodic message, the predicted order being predicted in reference to the reference message;
• and
• determining that an attack on the network is detected when a reception time of a certain message including the identification information does not belong to a reception range associated with the order of reception of the certain message among the reception ranges each associated with the order of reception of its corresponding periodic message in reference to the reference message.