PROBLEM TO BE SOLVED: To detect unauthorized communication, where a detector having limitation in the resources and installation space is involved in an important task in the control system, at high speed with high accuracy.SOLUTION: Based on the respective response times, indicating the difference between respective reception times of multiple control commands transmitted from a first controller to a second controller, and the reception times of responses for the multiple control commands, transmitted from the second controller to the first controller, a detector generates a filter policy indicating whether or not a control command belongs to an important task, acquires a detection policy indicating whether or not a control command belonging to an important task is an unauthorized command, and when a determination is made that a received control command belongs to an important task in the detection processing, with reference to the filter policy, a determination is made whether or not the control command received with reference to the detection policy is an unauthorized command.SELECTED DRAWING: Figure 1
展开▼
