Anomaly detection method and anomaly detection device

An anomaly detection device included in a communication network adopting a time-triggered protocol based on a time slot,

• the communication network including a plurality of communication devices that connect to each other, each of the plurality of communication devices transmitting or receiving one or more frames for each predetermined time slot in a predetermined cycle, the predetermined time slot being one time slot of a plurality of time slots, the predetermined cycle being one cycle of repeated cycles,
• the anomaly detection device comprising:
• a frame receiver that receives the one or more frames;
• and
• an anomaly detector that detects an occurrence of an anomalous frame in accordance with a number of repeated cycles of each cycle in the plurality of cycles and the each predetermined time slot in which each of the one or more frames is received by the frame receiver,
• wherein the anomaly detector performs the detection by verifying a statistic on the one or more frames against a rule indicating a reference range of the statistic, the one or more frames being received in at least one cycle including the predetermined cycle, each frame of the one or more frames is classified according to a first type, the first type being a type according to meta information included in each frame of the one or more frames, the statistic includes a first statistic on a total number of each type of frames classified according to the first type, in the predetermined cycle, the rule includes a first rule indicating a reference range of the first statistic, and the anomaly detector detects an occurrence of an anomalous frame from among the one or more frames by verifying the first statistic against the first rule.