Network monitoring device and computer program product

1. A network monitoring device that monitors a message that is periodically transmitted in a network in which the message identified by an identifier is transmitted and received, the network monitoring device, comprising:

a reception time recording unit, implemented in computer hardware, configured to record a reception time in association with the identifier, every time a message to be monitored is received; and

an unauthorized-transmission determination unit, implemented in computer hardware, configured to determine presence of an unauthorized transmission on the received message to be monitored, based on a latest reception time T i , a reception time T i-m of the m-th previous message, a message transmission period F, and a constant σ determined in advance, in a period from the reception time T i-m to the reception time T i , every time the message to be monitored is received, wherein

the unauthorized-transmission determination unit calculates an integer part k of (T i T i-m +σ)/F, and determines that an unauthorized transmission takes place when m-k is equal to or more than one.

2. The network monitoring device according to claim 1 , wherein in a case where m=1, when a maximum value of delay in the network is Δmax, the constant σ is set to a value that satisfies Δmax≤σ<(F−Δmax)/2.

3. The network monitoring device according to claim 1 , wherein in a case where m≥2, when a maximum value of delay in the network is Δmax, the constant σ is set to a value that satisfies Δmax≤σ<F−Δmax.

4. A network monitoring device that monitors a message that is periodically transmitted in a network in which the message identified by an identifier is transmitted and received, the network monitoring device, comprising:

a reception time recording unit, implemented in computer hardware, configured to record a reception time in association with the identifier, every time a message to be monitored is received; and

an unauthorized-transmission determination unit, implemented in computer hardware, configured to determine presence of an unauthorized transmission on the received message to be monitored, based on a latest reception time T i , a reception time T i-m of the m previous message, a message transmission period F, and a constant σ determined in advance, in a period from the reception time T i-m to the reception time T i , every time the message to be monitored is received, wherein

the unauthorized-transmission determination unit sets a threshold M to be M=m×F−σ, and determines that an unauthorized transmission takes place when T i −T i-m is less than the threshold M.

5. The network monitoring device according to claim 4 , wherein in a case where m=1, when a maximum value of delay in the network is Δmax, the constant σ is set to a value that satisfies Δmax≤σ<(F−Δmax)/2.

6. The network monitoring device according to claim 4 , wherein in a case where m≥2, when a maximum value of delay in the network is Δmax, the constant σ is set to a value that satisfies Δmax≤σ<F−Δmax.

7. The network monitoring device according to claim 1 , further comprising an unauthorized-transmission detection time processing unit, implemented in computer hardware, configured to execute predetermined unauthorized-transmission detection time processing, when the unauthorized-transmission determination unit determines that an unauthorized transmission takes place.

8. The network monitoring device according to claim 7 , wherein the unauthorized-transmission detection time processing unit executes a process of transmitting an unauthorized-transmission detection message including the identifier of the message to be monitored that is determined to be an unauthorized transmission, to the network, as the unauthorized-transmission detection time processing.

9. The network monitoring device according to claim 8 , wherein the unauthorized-transmission detection time processing unit further executes a process of discarding the received message to be monitored, as the unauthorized-transmission detection time processing.

10. The network monitoring device according to claim 9 , wherein the unauthorized-transmission detection time processing unit discards the message to be monitored, when a value of a certain position of the received message to be monitored is a predetermined value.

11. The network monitoring device according to claim 7 , wherein the unauthorized-transmission detection time processing unit executes a process equivalent to normal time processing that is executed when the unauthorized-transmission determination unit determines that an unauthorized transmission does not take place, after masking a certain position of the received message to be monitored with a certain value, as the unauthorized-transmission detection time processing.

12. The network monitoring device according to claim 11 , wherein the unauthorized-transmission detection time processing unit masks the certain position of the message to be monitored with the certain value, when a value of the certain position of the received message to be monitored is a predetermined value.

13. The network monitoring device according to claim 7 , wherein the unauthorized-transmission detection time processing unit executes a process of stopping normal time processing that is executed when the unauthorized-transmission determination unit determines that an unauthorized transmission does not take place, on a message that is received from a bus identical to a bus of the message to be monitored that is determined as an unauthorized transmission, as the unauthorized-transmission detection time processing.

14. A computer program product having a non-transitory computer readable recording medium including a plurality of instructions, wherein the instructions, when executed by the computer, cause the computer to perform:

recording a reception time in association with an identifier, every time a message to be monitored is received, the message to be monitored being periodically transmitted in a network in which a message identified by the identifier is transmitted and received; and

determining presence of an unauthorized transmission on the received message to be monitored, based on a latest reception time T i , a reception time T i-m of an m-th previous message, a message transmission period F, and a constant σ determined in advance, in a period from the reception time T i-m to the reception time T i , every time the message to be monitored is received, wherein

the determining includes

calculating an integer part k of (T i −T i-m +σ)/F, and

determining that an unauthorized transmission takes place when m-k is equal to more than one.

15. A computer program product having a non-transitory computer readable recording medium including a plurality of instructions, wherein the instructions, when executed by the computer, cause the computer to perform:

recording a reception time in association with an identifier, every time a message to be monitored is received, the message to be monitored being periodically transmitted in a network in which a message identified by the identifier is transmitted and received; and

determining presence of an unauthorized transmission on the received message to be monitored, based on a latest reception time T i , a reception time T i-m of an m-th previous message, a message transmission period F, and a constant σ determined in advance, in a period from the reception time T i-m to the reception time T i , every time the message to be monitored is received, wherein

the determining includes

setting a threshold M to be M=(m×F)−σ, and

determining that an unauthorized transmission takes place when T i −T i-m is less than the threshold M.