| CPC H04L 63/10 (2013.01) [G07C 5/008 (2013.01)] | 13 Claims |

|
1. A detection device configured to detect an unauthorized message in an in-vehicle network, comprising:
circuitry configured to
monitor a periodic message that is periodically transmitted and an event message that is non-periodically transmitted, as messages in the in-vehicle network, each message having, assigned thereto, identification information of a transmission source and a sequence number;
change a counter value corresponding to the identification information, when the detection device has received the event message from the in-vehicle network; and
compare, in a first step, the sequence number with the counter value, based on a result of monitoring by the circuitry, and perform provisional determination for detection of an unauthorized message, based on a result of the comparison, wherein
conclusively determine, in a second step, the unauthorized message, based on an interval of messages that satisfy a predetermined condition regarding the sequence number, among messages to which the same identification information is assigned, and on a predetermined transmission cycle of the periodic message.
|