# US 11,122,070 B2 · Monitoring device monitoring network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,070 B2
- Document ID: US11122070B2
- Status: Granted
- Kind: B2
- Application number: 16/710,485
- Filed: 2019-12-11
- Published: 2020-04-16
- Granted: 2021-09-14
- Earliest claimed: 2015-04-23
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Seiji Munetoh
- Web page: https://patentgrep.com/patent/US11122070B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G07C 5/008: {communicating information to a remotely located station (transmission systems for measured values G08C)}
- H04W 4/48: for in-vehicle communication
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A monitoring device configured to monitor a network to which plural controllers are connected which includes a decoder configured to extract target data belonging to a target data group from data received from the plural controllers, a first comparator configured to determine whether an immutable part of the target data is known or anomalous, a second comparator configured to determine whether a reception interval of the target data group is normal or anomalous, a third comparator configured to determine whether the number of the target data having been received and included in the target data group is normal or anomalous, and determine whether each reception interval between the target data is normal or anomalous, and a warning counter configured to individually count the number of anomalies determined by the first comparator, the number of anomalies determined by the second comparator, and the number of anomalies determined by the third comparator.

## Claims

### Claim 1

A monitoring device configured to monitor a network connected to a plurality of controllers, the monitoring device comprising:
a first comparator configured to determine whether a reception interval of a target data group is normal or anomalous;
a second comparator configured to determine whether a total count of a target data received and included in the target data group is normal or anomalous by comparing the total count of the target data received against an expected total count of target data, and determine whether each reception interval between the target data is normal or anomalous; and
a warning counter configured to individually count anomalies determined by the first comparator, and anomalies determined by the second comparator.

### Claim 2 (depends on 1)

The monitoring device of claim 1, further comprising:
a first register configured to set identification information of the target data; and
a decoder configured to extract the target data belonging to the target data group by comparing the data received from the plurality of controllers and a value of the identification information set in the first register.

### Claim 3 (depends on 2)

The monitoring device of claim 2, further comprising:
a second register configured to set information of an immutable part of the target data; and
a third comparator configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register.

### Claim 4 (depends on 3)

The monitoring device of claim 3, further comprising:
a third register configured to set a normal value of the reception interval of the target data group;
a fourth register configured to set a normal value of each reception interval between the target data of the target data group;
a fifth register configured to set a normal value of the expected total count of the target data of the target data group;
a first counter configured to count the reception interval of the target data group; and
a second counter configured to count each reception interval between the target data of the target data group, wherein:
the first comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and
the second comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the total count of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.

### Claim 5 (depends on 1)

The monitoring device of claim 1, wherein:
the monitoring device is installed in a gateway, wherein the gateway is connected to a plurality of network buses, the plurality of network buses connected to the plurality of controllers; and
the monitoring device is configured to monitor data received through a plurality of interfaces of the gateway for the plurality of network buses.

### Claim 6 (depends on 1)

The monitoring device of claim 1, wherein the monitoring device is installed in each of the plurality of controllers, and the monitoring device is configured to monitor data output from the corresponding one of the plurality of controllers.

### Claim 7

A semiconductor integrated circuit, comprising:
a plurality of comparators; and
a warning counter, wherein:
a first comparator of the plurality of comparators is configured to determine whether a reception interval of a target data group is normal or anomalous;
a second comparator of the plurality of comparators is configured to determine whether a total count of a target data having been received and included in the target data group is normal or anomalous by comparing the total count of the target data received against an expected total count of target data, and each reception interval between the target data is normal or anomalous; and
the warning counter is configured to individually count anomalies determined by the first comparator, and anomalies determined by the second comparator.

### Claim 8 (depends on 7)

The semiconductor integrated circuit of claim 7, further comprising:
a first register configured to set identification information of the target data; and
a decoder configured to extract the target data belonging to the target data group by comparing the data received from the outside and a value of the identification information set in the first register.

### Claim 9 (depends on 8)

The semiconductor integrated circuit of claim 8, further comprising:
a second register configured to set information of the immutable part of the target data; and
a first comparator configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register.

### Claim 10 (depends on 9)

The semiconductor integrated circuit of claim 9, further comprising:
a third register configured to set a normal value of the reception interval of the target data group;
a fourth register configured to set a normal value of each reception interval between the target data of the target data group;
a fifth register configured to set a normal value of the expected total count number of the target data of the target data group;
a first counter configured to count the reception interval of the target data group; and
a second counter configured to count each reception interval between the target data of the target data group, wherein:
the first comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and
the second comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the total count of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.

### Claim 11

A network device, comprising:
a plurality of controllers; and
a monitoring device configured to monitor data output from each of the plurality of controllers, wherein the monitoring device comprises:
a first comparator configured to determine whether a reception interval of a target data group is normal or anomalous;
a second comparator configured to determine whether a total count of a target data having been received and included in the target data group is normal or anomalous by comparing the total count of the target data received against an expected total count amount of target data, and each reception interval between the target data is normal or anomalous; and
a warning counter configured to individually count anomalies determined by the first comparator, and anomalies determined by the second comparator.

### Claim 12 (depends on 11)

The network device of claim 11, further comprising:
a plurality of network buses connected to the plurality of controllers; and
a gateway connected to the plurality of network buses, wherein the monitoring device is installed in the gateway, and the monitoring device is configured to monitor data output from the plurality of controllers and received through interfaces of the gateway for the plurality of network buses.

### Claim 13 (depends on 11)

The network device of claim 11, wherein the monitoring device is installed in each of the plurality of controllers, and the monitoring device is configured to monitor data output from the corresponding one of the plurality of controllers.

### Claim 14 (depends on 11)

The network device of claim 11, further comprising a communication device connected to an external network and configured to send information of a monitoring result of the monitoring device to a server on the external network.

### Claim 15 (depends on 11)

The network device of claim 11, wherein the monitoring device includes:
a first register configured to set identification information of the target data; and
a decoder configured to extract the target data belonging to the target data group by comparing the data received from the plurality of controllers and a value of the identification information set in the first register.

### Claim 16 (depends on 15)

The monitoring device of claim 15, wherein the monitoring device includes:
a second register configured to set information of an immutable part of the target data; and
a third comparator configured to determine whether the immutable part of the target data is known or anomalous by comparing the immutable part of the target data and a value of the information set in the second register.

### Claim 17 (depends on 16)

The monitoring device of claim 16, wherein the monitoring device includes:
a third register configured to set a normal value of the reception interval of the target data group;
a fourth register configured to set a normal value of each reception interval between the target data of the target data group;
a fifth register configured to set a normal value of the expected total count of the target data of the target data group;
a first counter configured to count the reception interval of the target data group; and
a second counter configured to count each reception interval between the target data of the target data group, wherein:
the first comparator is configured to determine whether the reception interval of the target data group is normal or anomalous by comparing a value counted by the first counter and the normal value set in the third register; and
the second comparator is configured to determine whether each reception interval between the target data is normal or anomalous by comparing a value counted by the second counter and the normal value set in the fourth register, and determine whether the total count of the target data of the target data group is normal or anomalous on the basis of the normal value set in the fifth register.