Device and method for detecting attack in network

An attack detection method performed by an attack detection device, the method comprising:

• receiving a message from a communication device in a network;
• calculating, according to a reception time of a first message in periodic messages that are periodically transmitted in a specified transmission cycle in the network, a reception range for a target message in the periodic messages that are received after the first message;
• and
• when a second message is received outside of the reception range after the reception time of the first message, determining whether the second message includes information indicating that the second message has been transmitted at a time interval shorter than the transmission cycle, and
• when the second message including the information indicating that the second message has been transmitted at a time interval shorter than the transmission cycle, updating the reception range for a target message in the periodic messages that are received after the second message according to a reception time of the second message and the transmission cycle.

A non-transitory computer-readable recording medium having stored therein an attack detection program that causes a processor implemented in an attack detection device to execute an attack detection process, the process comprising:

• receiving a message from a communication device in a network via a transceiver implemented in the attack detection device;
• calculating, according to a reception time of a first message in periodic messages that are periodically transmitted in a specified transmission cycle in the network, a reception range for a target message in the periodic messages that are received after the first message;
• and
• when a second message is received outside of the reception range after the reception time of the first message, determining whether the second message includes information indicating that the second message has been transmitted at a time interval shorter than the transmission cycle, and
• when the second message includes the information indicating that the second message has been transmitted at a time interval shorter than the transmission cycle, updating the reception range for a target message in the periodic messages that are received after the second message according to a reception time of the second message and the transmission cycle.