Attack detection device, attack detection method, and attack detection program

An attack detection method, comprising:

• detecting, by acquiring an abnormality detection result which includes a facility ID for identifying a facility, occurrence of an abnormality in a facility that is associated with the facility ID, and transmitting the abnormality detection result;
• and
• determining that there is an attack on the facility associated with the facility ID that is included in the abnormality detection result transmitted in the detecting the occurrence of the abnormality, by obtaining, based on the facility ID, an adjustment frequency of the facility associated with the facility ID from adjustment history data when the adjustment frequency exceeds an allowable number of times set in advance for the facility, the adjustment history data associating the facility ID with an adjustment time at which an abnormality that has occurred in the facility is adjusted.

An attack detection program for causing a computer to execute:

• detecting, by acquiring an abnormality detection result which includes a facility ID for identifying a facility, occurrence of an abnormality in a facility that is associated with the facility ID, and transmitting the abnormality detection result;
• and
• determining that there is an attack on the facility associated with the facility ID that is included in the abnormality detection result transmitted in the detecting the occurrence of the abnormality, by obtaining, based on the facility ID, an adjustment frequency of the facility associated with the facility ID from adjustment history data, when the adjustment frequency exceeds an allowable number of times set in advance for the facility, the adjustment history data associating the facility ID with an adjustment time at which an abnormality that has occurred in the facility is adjusted.