Device and method for detecting attack in network
AssigneeFujitsu Limited
InventorsJun Yajima, Takayuki Hasebe, Yasuhiko Abe
Life of this patent
Estimating the term…
Abstract
An attack detection device includes: a receiver configured to receive messages that are periodically transmitted from a communication device in a network; and a processor. The processor predicts a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value. The processor counts a number of messages received by the receiver in the specified monitor range so as to generate a count value. The processor detects an attack in the network according to a result of a comparison between the predicted value and the count value.
Claims9
An attack detection device comprising:
- a receiver configured to receive messages that are periodically transmitted from a communication device in a network;
- and
- a processor configured to
- predict a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value,
- count a number of messages received by the receiver in the specified monitor range so as to generate a count value,
- reset the count value and the predicted value when the count value is greater than or equal to a specified threshold;
- and
- detect an attack in the network according to a result of a comparison between the predicted value and the count value, wherein
- the processor updates the count value to zero and updates the predicted value to a value obtained by subtracting the count value from the predicted value in a process of resetting the count value and the predicted value.
An attack detection method comprising:
- receiving, using a receiver, messages that are periodically transmitted from a communication device in a network;
- predicting a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value;
- counting a number of messages received by the receiver in the specified monitor range so as to generate a count value;
- resetting the count value and the predicted value when the count value is greater than or equal to a specified threshold;
- and
- detecting an attack in the network according to a result of a comparison between the predicted value and the count value, wherein
- the count value is updated to zero and the predicted value is updated to a value obtained by subtracting the count value from the predicted value in a process of resetting the count value and the predicted value.
A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the processor being implemented in an attack detection device, the attack detection device including a receiver, the attack detection device being connected to a network in which messages are periodically transmitted from a communication device, the attack detection process comprising:
- predicting a number of messages to be received by the receiver in a specified monitor range based on a transmission cycle of the messages so as to generate a predicted value;
- counting a number of messages received by the receiver in the specified monitor range so as to generate a count value;
- resetting the count value and the predicted value when the count value is greater than or equal to a specified threshold;
- and
- detecting an attack in the network according to a result of a comparison between the predicted value and the count value, wherein
- the count value is updated to zero and the predicted value is updated to a value obtained by subtracting the count value from the predicted value in a process of resetting the count value and the predicted value.
Dependencies are inferred from the claim text.