Device and method for detecting attack in network

An attack detection device comprising:

• a receiver configured to receive a massage that includes target identification information transmitted in a network;
• and
• a processor configured to
• predict a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value,
• count a number of messages received by the receiver in the monitor period so as to generate a count value, and
• decide whether the network has been attacked according to a result of a comparison between the predicted value and the count value, wherein
• when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state,
• when the count value is equal to a reference value with the warning flag being in OFF state, the reference value being obtained by adding 1 to the predicted value, the processor changes the warning flag from OFF state to ON state, and
• when the count value is equal to the reference value with the warning flag being in ON state, the processor decides that the network has been attacked.

A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the attack detection process comprising:

• receiving, by using a receiver, a massage that includes target identification information transmitted in a network;
• predicting a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value;
• counting a number of massages received by the receiver in the specified monitor period so as to generate a count value;
• and
• deciding whether the network has been attacked according to the predicted value, a reference value that is obtained by adding an early-arrival acceptable value specified in advance to the predicted value, and the count value, wherein
• when the count value is larger than the predicted value and equal to or smaller than the reference value, it is decided whether the network has been attacked according to a result of a comparison between the count value and the predicted value after an early-arrival grace period corresponding to the early-arrival acceptable value has elapsed.

A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the attack detection process comprising:

• receiving, by using a receiver, a massage that includes target identification information transmitted in a network;
• predicting a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value;
• counting a number of massages received by the receiver in the specified monitor period so as to generate a count value;
• and
• setting a warning flag in OFF state when the count value is equal to or smaller than the predicted value;
• changing the warning flag from OFF state to ON state when the count value is equal to a reference value obtained by adding 1 to the predicted value with the warning flag being in OFF state;
• and
• deciding that the network has been attacked when the count value is equal to the reference value with the warning flag being in ON state.