Device and method for detecting attack in network

Patent metadata

Field	Value
Publication number	US-10873591-B2
Application number	US-201916249973-A
Country	US
Kind code	B2
Filing date	Jan 17, 2019
Priority date	Jan 19, 2018
Publication date	Dec 22, 2020
Grant date	Dec 22, 2020

Abstract

An attack detection device includes: a receiver configured to receive a massage that includes target identification information transmitted in a network; and a processor. The processor predicts a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle so as to generate a predicted value. The processor counts a number of massages received by the receiver in the monitor period so as to generate a count value. When the count value is larger than the predicted value and smaller than or equal to a reference value that is obtained by adding an early-arrival acceptable value to the predicted value, the processor decides whether the network has been attacked according to a result of a comparison between the predicted value and the count value after an early-arrival grace period corresponding to the early-arrival acceptable value elapses.

First claim

What is claimed is:

1. An attack detection device comprising:
a receiver configured to receive a massage that includes target identification information transmitted in a network; and
a processor configured to
predict a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value,
count a number of massages received by the receiver in the specified monitor period so as to generate a count value, and
decide whether the network has been attacked according to the predicted value, a first reference value that is obtained by adding an early-arrival acceptable value specified in advance to the predicted value, and the count value, wherein

when the count value is larger than the predicted value and smaller than or equal to the first reference value, the processor decides whether the network has been attacked according to a result of a comparison between the predicted value and the count value after an early-arrival grace period corresponding to the early-arrival acceptable value elapses.

2. The attack detection device according to claim 1 , wherein
the early-arrival grace period is expressed by an integer in units of the transmission cycle,
when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state,
when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in OFF state, the processor records the predicted value as a start value and changes the warning flag from OFF state to ON state, and
when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state and the predicted value is larger than a second reference value, the second reference value being obtained by adding the early-arrival grace period to the start value, the processor decides that the network has been attacked.

3. The attack detection device according to claim 2 , wherein
when the processor decides that the network has been attacked, the processor subtracts 1 from the count value.

4. The attack detection device according to claim 3 , wherein
when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state, and when the predicted value is larger than the second reference value, and when a new count value that is obtained after subtracting 1 from the count value is equal to or smaller than the predicted value, the processor changes the warning flag from ON state to OFF state.

5. The attack detection device according to claim 2 , wherein
when the count value is larger than the first reference value, the processor decides that the network has been attacked.

6. The attack detection device according to claim 1 , wherein
the early-arrival grace period is expressed in units of the transmission cycle,
when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state,
when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in OFF state, the processor records the predicted value as a start value and changes the warning flag from OFF state to ON state, and
when the count value is larger than the predicted value and equal to or smaller than the first reference value with the warning flag being in ON state and the count value is larger than a second reference value, the second reference value being obtained by adding the early-arrival grace period to the start value, the processor decides that the network has been attacked.

7. An attack detection device comprising:
a receiver configured to receive a massage that includes target identification information transmitted in a network; and
a processor configured to
predict a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value,
count a number of messages received by the receiver in the monitor period so as to generate a count value, and
decide whether the network has been attacked according to a result of a comparison between the predicted value and the count value, wherein

when the count value is equal to or smaller than the predicted value, the processor sets a warning flag in OFF state,
when the count value is equal to a reference value with the warning flag being in OFF state, the reference value being obtained by adding 1 to the predicted value, the processor changes the warning flag from OFF state to ON state, and
when the count value is equal to the reference value with the warning flag being in ON state, the processor decides that the network has been attacked.

8. The attack detection device according to claim 7 , wherein
when the processor decides that the network has been attacked, the processor subtracts 1 from the count value and changes the warning flag from ON state to OFF state.

9. The attack detection device according to claim 7 , wherein
when the count value is larger than the reference value, the processor decides that the network has been attacked.

10. The attack detection device according to claim 7 , wherein
when the count value is equal to or larger than a specified threshold, the processor performs a reset process of updating the count value to zero and updating the predicted value to a value obtained by subtracting the count value from the predicted value.

11. The attack detection device according to claim 10 , wherein
the processor performs the reset process when the count value is equal to or larger than the threshold and a time at which the receiver receives a message falls within an acceptable range set for a targeted reception time.

12. The attack detection device according to claim 10 , wherein
the processor performs the reset process when the count value is equal to or larger than the threshold and a difference in reception time between two consecutive messages received by the receiver falls within an acceptable range set for the transmission cycle.

13. A non-transitory computer-readable recording medium having stored therein a program for causing a processor to execute an attack detection process, the attack detection process comprising:
receiving, by using a receiver, a massage that includes target identification information transmitted in a network;
predicting a number of massages to be received by the receiver in a specified monitor period based on a transmission cycle corresponding to the target identification information so as to generate a predicted value;
counting a number of massages received by the receiver in the specified monitor period so as to generate a count value; and
deciding whether the network has been attacked according to the predicted value, a reference value that is obtained by adding an early-arrival acceptable value specified in advance to the predicted value, and the count value, wherein
when the count value is larger than the predicted value and equal to or smaller than the reference value, it is decided whether the network has been attacked according to a result of a comparison between the count value and the predicted value after an early-arrival grace period corresponding to the early-arrival acceptable value has elapsed.

14. A non-transitory computer-readable recording medium having stored therein a program for causing a

Assignees

• Fujitsu Ltd

Inventors

• Yajima Jun
• Hasebe Takayuki

Classifications

• H04L12/4625 Primary

  Single bridge functionality, e.g. connection of two networks over a single bridge · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L43/16

  Threshold monitoring · CPC title