Communication device, communication method and non-transitory storage medium
A communication unit receives a message in a network. A first anomaly detector detects an anomalous message by detecting values of a plurality of monitoring items from the message received by the communication unit and determining whether each of the detected values of the plurality of monitoring items is inside a corresponding first reference range and a corresponding second reference range. The second reference range is narrower than the first reference range. The first anomaly detector detects the message as the anomalous message, when any of the detected values is outside the first reference range, and detects the message as the anomalous message, when any of the detected values is inside the first reference range and is outside the second reference range and when a predetermined rule is satisfied.
1. A communication device comprising:
a processor; and
a memory including at least one program that, when executed by the processor, causes the processor to perform operations including:
receiving a message in a network; and
detecting an anomalous message by detecting values of a plurality of first monitoring items from the message and determining whether each of the detected values of the plurality of first monitoring items is inside a corresponding first reference range and a corresponding second reference range, the second reference range being narrower than the first reference range,
wherein
the processor detects the message as the anomalous message, when any of the detected values is outside the first reference range,
the processor detects the message as the anomalous message, when any of the detected values is inside the first reference range and is outside the second reference range and when a predetermined rule is satisfied,
the plurality of first monitoring items includes different types of items, and
the predetermined rule is satisfied when a number of monitoring items, out of the plurality of first monitoring items for which the detected values are inside the first reference range and are outside the second reference range, is at least equal to a predetermined count n, the predetermined count n being an integer at least equal to 2 and at most equal to a number of the plurality of first monitoring items.
2. The communication device according to claim 1 , wherein
when any of the detected values is outside the first reference range, the processor detects the message as the anomalous message without determining whether the any of the detected values is inside the second reference range, and
when any of the detected values is inside the first reference range, the processor determines whether the any of the detected values is inside the second reference range.
3. The communication device according to claim 1 , wherein
the processor determines whether any of the detected values is inside the second reference range, and
when the any of the detected values is inside the first reference range,
the processor skips determination with respect to at least a next detected value, when the any of the detected value is determined as being inside the second reference range and a number of monitoring items out of the plurality of first monitoring items inside the second reference range is at least equal to a predetermined count m, the predetermined count m being an integer at least equal to 1 and at most equal to the number of the plurality of first monitoring items, and
the processor continues determination with respect to the next detected value when the number of monitoring items inside the second reference range is less than the predetermined count m.
4. The communication device according to claim 1 , further comprising a second processor configured to detect the anomalous message by detecting a value of at least one second monitoring item different from the plurality of first monitoring items from the message and comparing each detected value of the at least one second monitoring item with a corresponding reference value,
wherein the second processor detects the message as the anomalous message, when each detected value of the at least one second monitoring item does not coincide with the corresponding referenced value.
5. The communication device according to claim 4 , wherein
the processor skips the determining when the second anomaly detector detects the message as the anomalous message, and
the processor performs the determining when the second anomaly detector does not detect the message as the anomalous message.
6. The communication device according to claim 1 wherein
the different types of items include a transmission period, a transmission frequency, a payload variation, and a payload range.
7. The communication device according to claim 1 , wherein
the different types of items are each included in the message and associated with a same message ID.
8. A communication method in a communication device, the communication method comprising:
receiving a message in a network; and
detecting an anomalous message by detecting values of a plurality of monitoring items from the message received in the network and determining whether each of the detected values of the plurality of monitoring items is inside a corresponding first reference range and a corresponding second reference range, the second reference range being narrower than the first reference range,
wherein
in the detecting the anomalous message, the message is detected as the anomalous message, when any of the detected values is outside the first reference range,
in the detecting the anomalous message, the message is detected as the anomalous message, when any of the detected values is inside the first reference range and is outside the second reference range and when a predetermined rule is satisfied,
the plurality of first monitoring items includes different types of items, and
the predetermined rule is satisfied when a number of monitoring items, out of the plurality of first monitoring items for which the detected values are inside the first reference range and are outside the second reference range, is at least equal to a predetermined count n, the predetermined count n being an integer at least equal to 2 and at most equal to a number of the plurality of first monitoring items.
9. A non-transitory storage medium storing a communication program that causes a computer to execute:
receiving a message in a network; and
detecting an anomalous message by detecting values of a plurality of monitoring items from the message received in the network and determining whether each of the detected values of the plurality of monitoring items is inside a corresponding first reference range and a corresponding second reference range, the second reference range being narrower than the first reference range,
wherein
in the detecting the anomalous message, the message is detected as the anomalous message, when any of the detected values is outside the first reference range,
in the detecting the anomalous message, the message is detected as the anomalous message, when any of the detected values is inside the first reference range and is outside the second reference range and when a predetermined rule is satisfied,
the plurality of first monitoring items includes different types of items, and
the predetermined rule is satisfied when a number of monitoring items, out of the plurality of first monitoring items for which the detected values are inside the first reference range and are outside the second reference range, is at least equal to a predetermined count n, the predetermined count n being an integer at least equal to 2 and at most equal to a number of the plurality of first monitoring items.