Patent ID: 11956262
Assignee: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 2:
3. The anomaly detection device according to claim 1, wherein
a detection rule includes a communication establishment state, the communication establishment state being ON when a server corresponding to a server address included in the detection rule or a client corresponding to a client address included in the detection rule is in a state of performing communication concerning a service corresponding to a communication ID included in the detection rule, the communication establishment state being OFF when the server corresponding to the server address included in the detection rule or the client corresponding to the client address included in the detection rule is not in a state of performing communication concerning the service corresponding to the communication ID included in the detection rule,
the detection rule generator circuit:
checks a communication type written in the communication establishment frame;
sets, to ON, the communication establishment state included in the detection rule that includes a set of the communication ID and the server address written in the communication establishment frame or a set of the communication ID and the client address written in the communication establishment frame, when the communication type is a service offer, a service subscription acknowledgment, a service search, or a service subscription; and
sets, to OFF, the communication establishment state included in the detection rule that includes the set of the communication ID and the server address written in the communication establishment frame or the set of the communication ID and the client address written in the communication establishment frame, when the communication type is a service offer stop or a service subscription stop, and

the anomaly detector circuit, by referring to the detection rule that includes the communication ID written in the communication frame, detects the communication frame as an anomalous frame when the server address or the client address written in the communication frame matches the server address or the client address included in the detection rule and when the communication establishment state included in the detection rule is OFF.