Extraction device, extraction method, recording medium, and detection device

1. A monitoring apparatus comprising:

an extraction device comprising:

at least one first memory configured to store instructions; and

at least one first processor configured to execute the instructions to:

sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;

extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle; and

exclude the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle, and

a detection device that is communicably connected to the extraction device comprising:

at least one second memory configured to store instructions; and

at least one second processor configured to execute the instructions to:

determine a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the feature extracted by the extraction device and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the feature extracted by the extraction device; and

update, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,

wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

2. The extraction device according to claim 1 , wherein the feature of the bit change in the data field is inversion of a bit at a specific position in the data field.

3. The extraction device according to claim 1 , wherein the feature of the bit change in the data field is a combination of bits designated as 0 and 1 in the data field.

4. An extraction method comprising:

sorting frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;

extracting, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle;

excluding the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle;

determining a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the extracted feature and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the extracted feature; and

updating, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,

wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

5. A non-transitory computer-readable recording medium storing a program for causing a computer to:

sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle;

extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle;

exclude the frames that have the same identifier and maintain the cycle from the set of frames having the same identifier, and select the frames that are out of the cycle;

determine a detection target frame out of the cycle to be an illegal frame when the data field of the detection target frame does not match the extracted feature and determine the detection target frame out of the cycle to be a normal frame when the data field of the detection target frame matches the extracted feature; and

update, after a frame out of the cycle is determined to be a normal frame, a base point of the cycle to a frame that is output at a time of an event occurrence,

wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.

6. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is inversion of a bit at a specific position in the data field.

7. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is a combination of bits designated as 0 and 1 in the data field.

8. The extraction device according to claim 2 , wherein the feature of the bit change in the data field is that a bit at a specific position in the data field takes the same value before and after the event occurrence.