Relay device, detection method, and detection program

A relay device that performs relay processing of relaying data between a plurality of function units mounted on a vehicle, comprising:

• a counting unit that counts each of the numbers of relayed packets being the numbers of packets relayed to respective target function units being the plurality of function units of a same type in the relay processing;
• and
• a detection unit that monitors a count value of the numbers counted by the counting unit, and detects unauthorized communication with the target function units based on a maximum value and a minimum value of the numbers of relayed packets counted by the counting unit.

A detection method for a relay device that performs relay processing of relaying data between a plurality of function units mounted on a vehicle, comprising steps of:

• counting each of the numbers of relayed packets being the numbers of packets relayed to respective target function units being the plurality of function units of a same type in the relay processing;
• and
• monitoring a counted count value and detecting unauthorized communication with the target function units based on a maximum value and a minimum value of the numbers of relayed packets that are counted.

A detection program used in a relay device that performs relay processing of relaying data between a plurality of function units mounted on a vehicle causing a computer to function as:

• a counting unit that counts each of the numbers of relayed packets being the numbers of packets relayed to respective target function units being the plurality of function units of a same type in the relay processing;
• and
• a detection unit that monitors a count value of the numbers counted by the counting unit and detects unauthorized communication with the target function units based on a maximum value and a minimum value of the numbers of relayed packets counted by the counting unit.