Method for monitoring a network for anomalies

1. A method for monitoring a network for anomalies, the network provided for data transmission and having a plurality of devices connected to one another overfixedly prescribed signal transmission paths, which comprises the steps of:

assigning one of the devices to be a master device having a counter and a trigger apparatus, and by said master device a prescribed signal feature of a signal transmitted via the network is acquired;

reading, upon acquisition of the prescribed signal feature, a master counter state of the counter of the master device, corresponding to a time of the acquisition;

determining via an evaluation apparatus, under predetermined anomaly-free conditions, a setpoint value of at least one network-specific parameter defined by a physical property of the network, wherein a frequency difference between a frequency of a clock generator of an actual source device, from which the signal was transmitted, and a clock generator of the master device, coupled to the counter of the master device, forms the network-specific parameter;

determining a respective actual value of the at least one network-specific parameter by the evaluation apparatus from a difference between a read master counter state and a further counter state;

indicating an anomaly if a predetermined deviation criterion between the respective actual value and the setpoint value is met;

additionally acquiring a second prescribed signal feature of the signal by the trigger apparatus of the master device;

reading a second master counter state, corresponding to a time of an acquisition of the second prescribed signal feature, wherein the actual value of the frequency difference is determined on a basis of a difference between the master counter state and the second master counter state and taking into account a prescribed data transmission rate and/or network clock frequency used in the network and/or a communication protocol used in the network and/or a type of modulation used in the network;

calculating a relative frequency deviation as

Δ f rel =ΔC X /ΔC XMM ,

wherein

ΔC X indicates a number of cycles awaited by the actual source device between the transmission of the first and second prescribed signal features; and

ΔC XMM indicates the difference between the master counter state and the second master counter state.

2. The method according to claim 1 , wherein:

a propagation time pattern of the signal in the network constitutes the at least one network-specific parameter and it is provided, for determining an actual value;

one of the devices of the network is a client device that has a counter and a trigger apparatus;

the signal is transmitted via the network both to the master device and to the client device; and

the prescribed signal feature to be acquired by the trigger apparatus of the client device and a client counter state, corresponding to a time of an acquisition, of the counter of the client device to be read, wherein an actual value of the propagation time pattern is determined on a basis of the client counter state, which serves as the further counter state.

3. The method according to claim 2 , which further comprises:

transmitting a reference signal from the client device to the master device in which a read reference client counter state corresponding to a sending time of a prescribed signal feature of the reference signal is transmitted to the master device;

acquiring the prescribed signal feature of the reference signal by the trigger apparatus of the master device and reading a reference master counter state, corresponding to a time of an acquisition of the prescribed signal feature of the reference signal; and

using the reference client counter state and the reference master counter state to determine the actual value of a propagation time pattern.

4. The method according to claim 3 , which further comprises calculating the actual value of the propagation time pattern PAT of the signal by:

PAT=[ C XM −C XC ]−[ C RM −C RC ]=[ C XM −C RM ]−[ C XC −C RC ],

wherein:

C XM indicates the master counter state corresponding to the prescribed signal feature;

C XC indicates the client counter state corresponding t the prescribed signal feature;

C RM indicates the reference master counter state; and

C RC indicates the reference client counter state.

5. The method according to claim 2 , which further comprises:

additionally determining the actual value of the propagation time pattern by a client-side part of the evaluation apparatus that is configured so as to perform own calculations; and

indicating the anomaly if the deviation criterion between a respective determined actual value and the setpoint value is recognized as being met by the evaluation apparatus and/or by the client-side part of the evaluation apparatus.

6. The method according to claim 1 , which further comprises recognizing the anomaly in the network if the actual source device simulates being another purported source device of the network; and wherein in a check as to whether the deviation criterion is met, the evaluation apparatus takes into account a temperature, acquired by way of a respective temperature sensor, of the master device and of the another purported source device.

7. The method according to claim 1 , which further comprises determining the master counter state corresponding to the prescribed signal feature, in order to improve a resolution, by way of an interpolating measurement method.

8. The method according to claim 1 , wherein the master device has a selection logic unit, by way of which the signal feature is selected and/or prescribed automatically.

9. The method according to claim 1 , which further comprises determining the master counter state corresponding to the prescribed signal feature, in order to improve a resolution, by way of an interpolating measurement method performed by a time-to-digital converter.

10. The method according to claim 1 , wherein the master device has a selection logic unit, by way of which the signal feature is selected and/or prescribed automatically, depending on a line code used in the network and/or a type of modulation used in the network.