CPC H04L 63/1425 (2013.01) [G06N 7/00 (2013.01); H04L 41/16 (2013.01); H04L 43/08 (2013.01); H04L 63/08 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] | 10 Claims |
1. A monitoring apparatus comprising:
a memory; and
a processor configured to:
receive messages that each include a data value;
acquire at least one of a difference between the data values of two received messages or a difference between reception times of the two received messages, the two received messages having a same identifier;
determine whether one of the received message is an abnormal message and whether the one of the receive message is a suspicious message including a possibility of abnormality, based on the acquired difference, a second criteria used for determining the abnormality, and a first criteria that is different from the second criteria;
record at least one of the data value of the one received message or the reception time of the one received message when the one received message is determined to be the suspicious message; and
record at least the one of the data value of the one received message or the reception time of the one received message, and perform a process in occurrence of an error when the one received message is determined to be the abnormal message.
|