Patent ID: 8332503
Filing Date: 2012-12-11
Classification: H04J,H04L

Abstract:
1. A detection device comprising: learning means for extracting a sequence pattern of at least two consecutive messages from a first group of messages generated by a system, and for counting a number of the sequence pattern of messages in the first group; memory means for storing the sequence pattern and the number of the sequence pattern of messages in the first group; and collation means for referencing the sequence pattern and the number of the sequence pattern of the messages in the first group stored in the memory means, for counting a number of the sequence pattern of messages in a second group of messages generated by the system, and for determining abnormality when the number of the sequence pattern of the messages in the second group is not within a range set using the number of the sequence pattern of messages in the first group, the collation means is to determine the abnormality when a proportion of the counted number of the sequence pattern of messages in the second group to the number of the sequence pattern of messages in the first group is equal to or larger than a certain number.