Abnormality detection device, method thereof, and communication system

An abnormality detection method comprising:

• receiving a communication frame via a communication network;
• calculating and setting a predicted time range that includes a scheduled reception time of the communication frame of a target frame type from among a plurality of frame types when the communication frame is received, the predicted time range being calculated with reference to a reception time of the received communication frame;
• and
• determining the communication frame of the target frame type as an abnormal frame when the communication frame of the target frame type is received outside the predicted time range.

A non-transitory computer-readable medium having instructions stored thereon that, when executed cause an electronic control unit to perform a method, comprising:

• receiving a communication frame via a communication network;
• calculating and setting a predicted time range that is a time range including a scheduled reception time of the communication frame of a target frame type from among a plurality of frame types when the communication frame is received, the predicted time range being calculated with reference to a reception time of the received communication frame;
• and
• determining the communication frame of the target frame type as an abnormal frame when the communication frame of the target frame type is received outside the predicted time range.

A communication system comprising:

• a first electronic control unit and a second electronic control unit connected with each other via a communication network;
• and
• an abnormality detection device, wherein
• the first electronic control unit and the second electronic control unit respectively configured to transmit and to receive a communication frame,
• the abnormality detection device includes:
• a receiver configured to receive the communication frame that is transmitted and received by the first and second electronic control unit;
• a frame information storage configured to store information regarding the communication frame;
• a reception predictor configured to calculate and to set a predicted time range that is a time range including a scheduled reception time of the communication frame of a target frame type from among a plurality of frame types received by the receiver when the communication frame of the target frame type is received by the receiver, the predicted time range calculated with reference to a reception time of the communication frame by the receiver;
• and
• an abnormality determiner configured to determine the communication frame of the target frame type as an abnormal frame when the communication frame of the target frame type is received outside the predicted time range.