# US 10,873,591 B2 · Device and method for detecting attack in network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,591 B2 - Document ID: US10873591B2 - Status: Granted - Kind: B2 - Application number: 16/249,973 - Filed: 2019-01-17 - Published: 2019-07-25 - Granted: 2020-12-22 - Earliest claimed: 2018-01-19 - Assignees: Fujitsu Limited - Applicants: Fujitsu Limited - Inventors: Jun Yajima; Takayuki Hasebe - Web page: https://patentgrep.com/patent/US10873591B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - H04L 12/40: Bus networks - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/0894: Packet rate - H04L 43/16: Threshold monitoring - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2012/40215: {Controller Area Network CAN} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An attack detection device includes: a receiver configured to receive a massage that includes target identification information transmitted in a network; and a processor. The processor predicts a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle so as to generate a predicted value. The processor counts a number of massages received by the receiver in the monitor period so as to generate a count value. When the count value is larger than the predicted value and smaller than or equal to a reference value that is obtained by adding an early-arrival acceptable value to the predicted value, the processor decides whether the network has been attacked according to a result of a comparison between the predicted value and the count value after an early-arrival grace period corresponding to the early-arrival acceptable value elapses. ## Claims ### Claim 1 An attack detection device comprising: a receiver configured to receive a massage that includes target identification information transmitted in a network; and a processor configured to predict a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value, count a number of massages received by the receiver in the specified monitor period so as to generate a count value, and decide whether the network has been attacked according to the predicted value, a first reference value that is obtained by adding an early-arrival acceptable value specified in advance to the predicted value, and the count value, wherein when the count value is larger than the predicted value and smaller than or equal to the first reference value, the processor decides whether the network has been attacked according to a result of a comparison between the predicted value and the count value after an early-arrival grace period corresponding to the early-arrival acceptable value elapses. ### Claim 2 (depends on 1) The attack detection device according to claim 1, wherein the early-arrival grace period is expressed by an integer in units of the transmission cycle, when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state, when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in OFF state, the processor records the predicted value as a start value and changes the warning flag from OFF state to ON state, and when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state and the predicted value is larger than a second reference value, the second reference value being obtained by adding the early-arrival grace period to the start value, the processor decides that the network has been attacked. ### Claim 3 (depends on 2) The attack detection device according to claim 2, wherein when the processor decides that the network has been attacked, the processor subtracts 1 from the count value. ### Claim 4 (depends on 3) The attack detection device according to claim 3, wherein when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state, and when the predicted value is larger than the second reference value, and when a new count value that is obtained after subtracting 1 from the count value is equal to or smaller than the predicted value, the processor changes the warning flag from ON state to OFF state. ### Claim 5 (depends on 2) The attack detection device according to claim 2, wherein when the count value is larger than the first reference value, the processor decides that the network has been attacked. ### Claim 6 (depends on 1) The attack detection device according to claim 1, wherein the early-arrival grace period is expressed in units of the transmission cycle, when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state, when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in OFF state, the processor records the predicted value as a start value and changes the warning flag from OFF state to ON state, and when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state and the count value is larger than a second reference value, the second reference value being obtained by adding the early-arrival grace period to the start value, the processor decides that the network has been attacked. ### Claim 7 An attack detection device comprising: a receiver configured to receive a massage that includes target identification information transmitted in a network; and a processor configured to predict a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value, count a number of messages received by the receiver in the monitor period so as to generate a count value, and decide whether the network has been attacked according to a result of a comparison between the predicted value and the count value, wherein when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state, when the count value is equal to a reference value with the warning flag being in OFF state, the reference value being obtained by adding 1 to the predicted value, the processor changes the warning flag from OFF state to ON state, and when the count value is equal to the reference value with the warning flag being in ON state, the processor decides that the network has been attacked. ### Claim 8 (depends on 7) The attack detection device according to claim 7, wherein when the processor decides that the network has been attacked, the processor subtracts 1 from the count value and changes the warning flag from ON state to OFF state. ### Claim 9 (depends on 7) The attack detection device according to claim 7, wherein when the count value is larger than the reference value, the processor decides that the network has been attacked. ### Claim 10 (depends on 7) The attack detection device according to claim 7, wherein when the count value is equal to or larger than a specified threshold, the processor performs a reset process of updating the count value to zero and updating the predicted value to a value obtained by subtracting the count value from the predicted value. ### Claim 11 (depends on 10) The attack detection device according to claim 10, wherein the processor performs the reset process when the count value is equal to or larger than the threshold and a time at which the receiver receives a message falls within an acceptable range set for a targeted reception time. ### Claim 12 (depends on 10) The attack detection device according to claim 10, wherein the processor performs the reset process when the count value is equal to or larger than the threshold and a difference in reception time between two consecutive messages received by the receiver falls within an acceptable range set for the transmission cycle. ### Claim 13 A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the attack detection process comprising: receiving, by using a receiver, a massage that includes target identification information transmitted in a network; predicting a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value; counting a number of massages received by the receiver in the specified monitor period so as to generate a count value; and deciding whether the network has been attacked according to the predicted value, a reference value that is obtained by adding an early-arrival acceptable value specified in advance to the predicted value, and the count value, wherein when the count value is larger than the predicted value and equal to or smaller than the reference value, it is decided whether the network has been attacked according to a result of a comparison between the count value and the predicted value after an early-arrival grace period corresponding to the early-arrival acceptable value has elapsed. ### Claim 14 A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the attack detection process comprising: receiving, by using a receiver, a massage that includes target identification information transmitted in a network; predicting a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value; counting a number of massages received by the receiver in the specified monitor period so as to generate a count value; and setting a warning flag in OFF state when the count value is equal to or smaller than the predicted value; changing the warning flag from OFF state to ON state when the count value is equal to a reference value obtained by adding 1 to the predicted value with the warning flag being in OFF state; and deciding that the network has been attacked when the count value is equal to the reference value with the warning flag being in ON state.