ATTACK/ABNORMALITY DETECTION DEVICE, ATTACK/ABNORMALITY DETECTION METHOD, AND ATTACK/ABNORMALITY DETECTION PROGRAM

摘要

The attack/abnormality detection device according to the present invention is provided with: a command extraction unit that extracts, from both an aggregate of normal production commands and an aggregate of actual production commands, elements having the same command destination as that included in a newly received actual production command, wherein each aggregate is stored in a command storage region, and each production command includes information about a command destination and an order of arrival; and a detection unit that compares the command content of each pair of extracted elements that are associated with the same order of arrival, and that belong respectively to the aggregate of normal production commands and the aggregate of actual production commands, thereby detecting attack/abnormality.