Communication apparatus and non-transitory computer readable storage medium

1. A communication apparatus that transfers received data, comprising:

an arithmetic device;

a storage device coupled to the arithmetic device; and

a communication interface coupled to the arithmetic device,

the storage device storing a whitelist to manage an allowed object that is allowed to perform communications via the communication apparatus,

comprising:

the arithmetic device being coupled to a memory storing instructions that when executed by the arithmetic device configure the arithmetic device to:

perform transfer control on the received data based on the whitelist;

analyze behavior related to communications performed by the allowed object, and

calculate a monitoring parameter that indicates the behavior related to the communications performed by the allowed object,

detect the allowed object where an abnormality occurred based on the monitoring parameter,

wherein the monitoring parameter is a communication interval of the communications performed by the allowed object, and

wherein the arithmetic device is further configured to:

detect the allowed object where an abnormality occurred based on comparison results of the communication interval and a threshold value,

analyze communications performed by a plurality of allowed objects via the communication apparatus;

calculate the communication interval of each of the plurality of the allowed objects based on analysis results of the communications performed by the plurality of the allowed objects; and

store the communication interval of the each of the plurality of the allowed objects in the storage device as the threshold value.

2. The communication apparatus according to claim 1 ,

wherein the arithmetic device is further configured to:

manage a maximum communication interval as the threshold value; and

determine that a first allowed object occurring an abnormality in a case where the communication interval of the first allowed object is greater than the maximum communication interval.

3. The communication apparatus according to claim 1 ,

wherein the arithmetic device is further configured to:

manage a minimum communication interval as the threshold value; and

determine that a first allowed object occurring an abnormality in a case where the communication interval of the first allowed object is smaller than the minimum communication interval.

4. The communication apparatus according to claim 1 ,

wherein the arithmetic device is further configured to:

generate an alert for notifying that the allowed object occurring an abnormality is detected in a case of detecting the allowed object occurring an abnormality; and

transmit the alert.

5. The communication apparatus according to claim 1 ,

wherein the arithmetic device is further configured to instruct the transfer unit to cut off the communications performed by the allowed object occurring an abnormality in a case of detecting the allowed object occurring an abnormality.

6. A non-transitory computer readable storage medium having stored thereon a program which is executed by a communication apparatus that transfers received data,

the communication apparatus including an arithmetic device, a storage device coupled to the arithmetic device, and a communication interface coupled to the arithmetic device, and the storage device storing therein a whitelist to manage an allowed object that is allowed to perform communications via the communication apparatus,

the program causing the communication apparatus to execute:

a first procedure of performing transfer control on the received data based on the whitelist; and

a second procedure of analyzing behavior related to communications performed by the allowed object, and

the second procedure including:

a procedure of calculating a monitoring parameter that indicates the behavior related to the communications performed by the allowed object; and

a procedure of detecting the allowed object where an abnormality occurred based on the monitoring parameter

wherein the monitoring parameter is a communication interval of the communications performed by the allowed object,

wherein the second procedure includes detecting the allowed object where an abnormality occurred based on comparison results of the communication interval and a threshold value, and

wherein the program further causes the communication apparatus to execute:

a procedure of analyzing communications performed by a plurality of allowed objects via the communication apparatus;

a procedure of calculating the communication interval of each of the plurality of the allowed objects based on analysis results of the communication of the plurality of the allowed objects; and

a procedure of storing the communication interval of the each of the plurality of the allowed objects in the storage device as the threshold value.

7. The non-transitory computer readable storage medium according to claim 6 ,

wherein the communication apparatus manages a maximum communication interval as the threshold value, and

wherein the second procedure includes a procedure of determining that a first allowed object occurring an abnormality in a case where the communication interval of the first allowed object is greater than the maximum communication interval.

8. The non-transitory computer readable storage medium according to claim 6 ,

wherein the communication apparatus manages a minimum communication interval as the threshold value, and

wherein the second procedure includes a procedure of determining that a first allowed object occurring an abnormality in a case where the communication interval of the first allowed object is smaller than the minimum communication interval.

9. The non-transitory computer readable storage medium according to claim 6 ,

wherein the program causes the communication apparatus to execute:

a procedure of generating an alert for notifying that the allowed object occurring an abnormality is detected;

and a procedure of transmitting the alert.

10. The non-transitory computer readable storage medium according to claim 6 , wherein the program causes the communication apparatus to execute a procedure of cutting off the communications performed by the allowed object occurring an abnormality in a case of detecting the allowed object occurring an abnormality.