Anomaly detection method and anomaly detection apparatus

Abstract

An anomaly detection method involves: for a detection object data string consisting of multiple consecutive detection object data, calculating multiple distances between the multiple detection object data; using the calculated multiple distances to extract multiple feature quantities of the detection object data string; using the extracted multiple feature quantities to calculate anomaly degree information related to the anomaly degree of the detection object data string; extracting multiple feature quantities consisting of L consecutive distances (L is an integer greater than 2) from the multiple distances; using the difference related to each of the extracted multiple feature quantities to calculate auxiliary information for calculating the anomaly degree information; calculating each object window based on one or more pieces of information consisting of N (L+1 or greater) detection object data; and using all the multiple auxiliary information calculated based on the N detection object data to calculate the anomaly degree information.

Description

Technical Field

[0001] This disclosure relates to an anomaly detection method and apparatus for detecting anomalies in data strings such as payloads in packets. Background Technology

[0002] Previously, information processing techniques that use data utilized in network systems and the like as objects were known (see, for example, Non-Patent Literature 1 and Non-Patent Literature 2).

[0003] Existing technical documents

[0004] Non-patent literature

[0005] Non-patent literature 1: Ye, N. (2000, June). Amarkov chain model of temporal behavior for anomaly detection. In Proceedings of the 2000 IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop (Vol. 166, p. 169). WestPoint, NY.

[0006] Non-patent literature 2: Otey, ME, Ghoting, A., & Parthasarathy, S. (2006). Fastdistributed outlier detection in mixed-attribute data sets. Data mining and knowledge discovery, 12 (2-3), 203-228 Summary of the Invention

[0007] The problem the invention aims to solve

[0008] The goal is to detect anomalies in data strings, such as packet strings, used in network systems.

[0009] Therefore, the purpose of this disclosure is to provide an anomaly detection method and an anomaly detection device for detecting anomalies in data strings such as packet strings.

[0010] means for solving problems

[0011] An anomaly detection method disclosed herein involves calculating multiple distances between a data string consisting of multiple consecutive data sets of the detected objects, extracting multiple feature quantities from the data string using the calculated distances, and calculating anomaly degree information related to the degree of anomaly of the data string using the extracted feature quantities. In the extraction of the multiple feature quantities, each feature quantity is extracted from L consecutive distances (L is an integer greater than 2). In the calculation of the anomaly degree information, for each of the extracted feature quantities, auxiliary information for calculating the anomaly degree information is calculated using the difference associated with that feature quantity. Each object window is calculated based on one or more pieces of information consisting of N (N is an integer greater than L+1) data sets of the detected objects. The anomaly degree information is calculated using all of the auxiliary information calculated based on the N data sets of the detected objects.

[0012] An anomaly detection device according to the present disclosure includes: a distance calculation unit for detecting object data, which calculates multiple distances between the multiple detection object data for a detection object data string consisting of multiple consecutive detection object data; a feature extraction unit, which extracts multiple feature quantities of the detection object data string using the multiple distances calculated by the distance calculation unit; and an information calculation unit, which calculates anomaly degree information related to the degree of anomaly of the detection object data string using the multiple feature quantities extracted by the feature extraction unit, wherein the feature extraction unit extracts the multiple feature quantities consisting of L consecutive distances (L is an integer greater than 2) from the multiple distances, and the information calculation unit calculates auxiliary information for calculating the anomaly degree information for each of the multiple feature quantities extracted by the feature extraction unit using the difference related to that feature quantity, calculates each object window for each of the N (N is an integer greater than L+1) detection object data using one or more pieces of information, and calculates the anomaly degree information using all of the multiple auxiliary information calculated based on the N detection object data.

[0013] Invention Effects

[0014] An anomaly detection method and anomaly detection device according to the present disclosure can detect anomalies in data strings such as packet strings. Attached Figure Description

[0015] Figure 1 This is a block diagram illustrating the configuration of the anomaly detection device in the implementation method.

[0016] Figure 2 This is a schematic diagram illustrating an example of configuration information.

[0017] Figure 3This is a schematic diagram representing the data structure of a packet in the Modbus / TCP protocol.

[0018] Figure 4 This is a schematic diagram representing the data structure of a packet in the BACnet / IP protocol.

[0019] Figure 5 This is a schematic diagram representing an example of a reference packet data string.

[0020] Figure 6 This is a schematic diagram illustrating an example of how the reference packet data distance calculation unit selects packet data byte by byte in an implementation method.

[0021] Figure 7 This is a schematic diagram illustrating an example of how the distance calculation unit of the reference package data in the implementation method calculates the Levenstein distance between two strings.

[0022] Figure 8 This is a schematic diagram illustrating an example of how the distance calculation unit of the reference packet data in the implementation method calculates the Levenstein distance between two byte strings.

[0023] Figure 9 This is a schematic diagram illustrating an example of how the reference distance calculation unit calculates the reference distance in an embodiment.

[0024] Figure 10 This is a schematic diagram illustrating an example of how the reference feature extraction unit extracts reference features in an embodiment.

[0025] Figure 11 This is a schematic diagram illustrating an example of how the distance calculation unit calculates the distance between the data packets of the detection object in the embodiment.

[0026] Figure 12 This is a schematic diagram illustrating an example of how the feature extraction unit extracts features from the detection object packet data string in an embodiment.

[0027] Figure 13 This is a schematic diagram illustrating an example of how the auxiliary information calculation unit of the implementation method calculates auxiliary information of the detected target packet string.

[0028] Figure 14 This is a flowchart of the reference feature extraction process.

[0029] Figure 15 This is a flowchart of the anomaly detection and processing.

[0030] Figure 16 This is a diagram representing an example of the detection log output by an intrusion detection system. Detailed Implementation

[0031] (The process of implementing a technical solution of this disclosure)

[0032] There is a growing trend of cyberattacks on ICS (Industrial Control Systems). In ICS, even anomalous packet strings generated by malicious attackers are nearly indistinguishable from normal packets when viewed individually, because normal command strings of control devices can be highly vulnerable to attack.

[0033] Previously, rule-based and anomaly-based methods were known for detecting packet string anomalies. However, rule-based methods have the problem of difficulty in detecting packet string anomalies not covered by the rules, while anomaly-based methods have the problem of difficulty in detecting packet string anomalies unless there are extreme increases in data volume and / or number of packets, or extreme byte string disorder.

[0034] Therefore, in order to solve these problems, the inventors conducted repeated and dedicated research and experiments. Furthermore, focusing on the fact that normal packet strings containing commands for controlling devices possess a certain context, the inventors discovered that packet strings deviating from this context can be detected as abnormal. As a result, the inventors conceived the following anomaly detection method and anomaly detection device.

[0035] An anomaly detection method disclosed herein involves calculating multiple distances between a data string consisting of multiple consecutive data sets of the detected objects, extracting multiple feature quantities from the data string using the calculated multiple distances, and calculating anomaly degree information related to the degree of anomaly of the data string using the extracted multiple feature quantities. In the extraction of the multiple feature quantities, each feature quantity is extracted from L consecutive distances (L is an integer greater than 2). In the calculation of the anomaly degree information, for each of the extracted multiple feature quantities, auxiliary information for calculating the anomaly degree information is calculated using the difference associated with that feature quantity. Each object window is calculated based on one or more pieces of information consisting of N (N is an integer greater than L+1) data sets of the detected objects. The anomaly degree information is calculated using all of the multiple auxiliary information calculated based on the N data sets of the detected objects.

[0036] According to the above anomaly detection method, the contextual features of the target data string can be extracted as feature quantities. Furthermore, using the extracted feature quantities, information about anomalies in the target data string can be calculated. Thus, according to the above anomaly detection method, anomalies in data strings such as packet strings can be detected.

[0037] Alternatively, in calculating the plurality of distances, the data portion of the packet can be used as the data of the detected object to calculate the plurality of distances.

[0038] Alternatively, the multiple distances can be calculated using the Levenstein distance between the multiple detection object data.

[0039] Alternatively, the Levenstein distance between the plurality of detected object data can be calculated for each of the P (P is an integer greater than or equal to 1) separate detected object data in the detected object data string, taking at least a portion of the bit string constituting the data part as an object, and calculated in units of Q (Q is an integer greater than or equal to 1 and less than 16) bits. When calculating the plurality of distances, the plurality of distances are calculated by calculating the distance between each of the P separate detected object data in the detected object data string.

[0040] Alternatively, the calculation of the plurality of distances may be limited to the calculation of detection object data of the same category among the plurality of detection object data.

[0041] Alternatively, the difference could also be the Lp distance.

[0042] Alternatively, in calculating the auxiliary information, for each of the extracted plurality of feature quantities, the Lp distance with each of the pre-stored plurality of reference feature quantities is calculated, and the K nearest neighbor algorithm applied to each of the calculated Lp distances is used to calculate the K nearest neighbor distance with the pre-stored plurality of reference feature quantities as the auxiliary information.

[0043] Alternatively, in calculating the anomaly information, each object window can be calculated based on one or more pieces of information, and the anomaly information can be calculated by summing all the auxiliary information calculated based on the N detected object data.

[0044] Alternatively, for each of one or more reference data strings consisting of multiple consecutive reference data, multiple reference distances of the multiple reference data are calculated. Using each of the calculated multiple reference distances, multiple reference feature quantities of the one or more reference data strings are extracted. In the calculation of anomaly degree information related to the degree of anomaly of the detected object data string, each of the extracted reference feature quantities is also used to calculate the anomaly degree information.

[0045] Alternatively, the multiple reference distances can be calculated using the Levenstein distance between the multiple reference data.

[0046] Alternatively, the Levenstein distance between the plurality of reference data can be calculated for each of the P (P is an integer greater than or equal to 1) separate reference data in each of the more than one reference data strings. Taking at least a portion of the bit string constituting the data portion of the packet as the reference data as the object, the distance is calculated in units of Q (Q is an integer greater than or equal to 1 and less than 16). In the calculation of the plurality of reference distances, the plurality of reference distances are calculated separately by calculating the reference distance for each of the P separate reference data in each of the more than one reference data strings.

[0047] Alternatively, for each of one or more reference data strings consisting of multiple consecutive reference data, multiple reference distances of the multiple reference data are calculated, and each of the calculated multiple reference distances is used to extract multiple reference feature quantities of the one or more reference data strings, and each of the extracted multiple reference feature quantities is stored as each of the pre-stored multiple reference feature quantities.

[0048] Alternatively, in calculating the plurality of reference distances, each of the reference distances may be calculated only among reference data of the same category among the plurality of reference data.

[0049] An anomaly detection device disclosed herein comprises: a distance calculation unit for detecting object data, which calculates multiple distances between the multiple detection object data for a detection object data string consisting of a plurality of consecutive detection object data; a feature extraction unit, which extracts multiple feature quantities of the detection object data string using the multiple distances calculated by the distance calculation unit; and an information calculation unit, which calculates anomaly degree information related to the degree of anomaly of the detection object data string using the multiple feature quantities extracted by the feature extraction unit, wherein the feature extraction unit extracts the multiple feature quantities consisting of L consecutive distances (L is an integer greater than 2) from the multiple distances, and the information calculation unit calculates auxiliary information for calculating the anomaly degree information for each of the multiple feature quantities extracted by the feature extraction unit using differences related to that feature quantity, calculates each object window for each of the N detection object data consisting of one or more pieces of information, and calculates the anomaly degree information using all of the multiple auxiliary information calculated based on the N (N is an integer greater than L+1) detection object data.

[0050] According to the above-described anomaly detection device, features of the context of the target data string can be extracted as feature quantities. Furthermore, using the extracted feature quantities, information related to anomalies in the target data string can be calculated. Thus, according to the above-described anomaly detection device, anomalies in data strings such as packet strings can be detected.

[0051] Alternatively, it may also include: a reference data distance calculation unit that calculates multiple reference distances for each of one or more reference data strings composed of multiple consecutive reference data; and a reference feature extraction unit that extracts multiple reference features of the one or more reference data strings using each of the multiple reference distances calculated by the reference data distance calculation unit, and the information calculation unit further calculates the anomaly information using each of the reference features extracted by the reference feature extraction unit.

[0052] The following describes specific examples of an anomaly detection method and anomaly detection device according to the present disclosure, with reference to the accompanying drawings. The embodiments shown herein represent specific examples of the present disclosure. Therefore, the numerical values, shapes, constituent elements, configurations and connection methods of the constituent elements, as well as the steps (processes) and order of steps shown in the following embodiments are examples and do not limit the present disclosure. Among the constituent elements in the following embodiments, those not described in the independent claims are constituent elements that can be arbitrarily added. Furthermore, the figures are schematic diagrams and not strictly illustrated.

[0053] (Implementation Method)

[0054] The anomaly detection device of the embodiment will now be described. This anomaly detection device detects anomalies in the target packet string.

[0055] [1. Composition]

[0056] Figure 1 This is a block diagram illustrating the configuration of the anomaly detection device 1 in the implementation method.

[0057] like Figure 1 As shown, the anomaly detection device 1 comprises: a first profile determination unit 11, a first extraction unit 12, a reference packet data string group storage unit 13, a reference packet data inter-distance calculation unit 14, a reference feature extraction unit 15, a reference feature storage unit 16, a second profile determination unit 21, a second extraction unit 22, a detection target packet data string storage unit 23, a detection target packet data inter-distance calculation unit 24, a feature extraction unit 25, a feature storage unit 26, an auxiliary information calculation unit 27, an information calculation unit 28, and a determination unit 29.

[0058] The anomaly detection device 1 is implemented, for example, by a computer device including a memory and a processor that executes the program stored in the memory. In this case, the various functions implemented by the anomaly detection device 1 are implemented by the processor constituting the anomaly detection device 1 executing the program stored in the memory constituting the anomaly detection device 1.

[0059] The first configuration decision unit 11 acquires a group of packet strings consisting of normal packet strings, that is, a reference packet string group 10 that does not contain abnormal packet strings. Furthermore, for each packet contained in each reference packet string constituting the acquired reference packet string group 10, the first configuration decision unit 11 determines the corresponding profile based on its attribute information. The attribute information includes the source IP address, destination IP address, source port, destination port, protocol, etc., and also includes combinations thereof. The first configuration decision unit 11 may, for example, store configuration information and determine the corresponding profile based on the stored configuration information.

[0060] Figure 2 This is a schematic diagram showing an example of the configuration information stored in the first configuration decision unit 11.

[0061] First configuration decision unit 11, for example, storage Figure 2 The configuration information shown determines the configuration identified by the configuration ID of the line that matches the object command for each package.

[0062] Figure 3 This is a schematic diagram representing the data structure of a packet in the Modbus / TCP protocol.

[0063] The first configuration decision unit 11, for example, in the case where the packet is a Modbus / TCP protocol, will... Figure 3 A packet whose bit string stored in the Data field matches the bit string corresponding to the object command is considered a packet that matches the object command.

[0064] Figure 4 This is a schematic diagram representing the data structure of a packet in the BACnet / IP protocol.

[0065] The first configuration decision unit 11, for example, in the case where the packet is a BACnet / IP protocol, will... Figure 4 A packet whose bit string stored in the APDU Type field and the Service Choice field match the bit string corresponding to the object command is considered a packet that matches the object command.

[0066] The first profile decision unit 11 may, for example, determine the protocol of a packet when the packet to be configured does not match the stored configuration information, by executing an application with Deep Packet Inspection functionality, and then determine the configuration for that packet based on the determined protocol.

[0067] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0068] The first extraction unit 12 extracts the bit string stored in the payload field of each packet as packet data for each packet whose configuration has been determined by the first configuration determination unit 11.

[0069] The first extraction unit 12, for example, extracts packets that are Modbus / TCP protocol packets. Figure 3 The TCP Payload shown is the bit string stored in the TCP payload field, which serves as the packet data.

[0070] The first extraction unit 12 extracts, for example, a packet of the BACnet / IP protocol that is the target of extraction. Figure 4 The UDP payload shown is the bit string stored in the UDP payload, which serves as the packet data.

[0071] When extracting packet data from each packet, the first extraction unit 12 outputs a reference packet data string consisting of packet data with the same configuration, according to each reference packet string obtained by the first configuration determination unit 11.

[0072] Figure 5 This is a schematic diagram showing an example of a reference packet data string output by the first extraction unit 12.

[0073] For example, the first extraction unit 12 outputs... Figure 5 The following are reference packet data strings arranged in sequence: the packet data corresponding to the write command meaning "power on the device identified by ID=1", the packet data corresponding to the write command meaning "power on the device identified by ID=2", the packet data corresponding to the write command meaning "power on the device identified by ID=3", the packet data corresponding to the write command meaning "power on the device identified by ID=4", the packet data corresponding to the write command meaning "change the temperature setting of the device identified by ID=1 to 27.0℃", the packet data corresponding to the write command meaning "change the airflow setting of the device identified by ID=1 to strong", the packet data corresponding to the write command meaning "change the temperature setting of the device identified by ID=2 to 27.0℃", and the packet data corresponding to the write command meaning "change the airflow setting of the device identified by ID=2 to strong".

[0074] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0075] The reference packet data string group storage unit 13 stores the reference packet data string group consisting of one or more reference packet data strings output from the first extraction unit 12.

[0076] The reference packet data distance calculation unit 14 calculates multiple reference distances between multiple reference packet data that constitute the reference packet data string for each of the reference packet data strings stored in the reference packet data string group storage unit 13.

[0077] The reference packet data distance calculation unit 14 processes the packet data as a byte string selected byte by byte, and calculates the reference distance between the reference packet data by calculating the distance between the byte strings between the reference packet data.

[0078] Figure 6 This is a schematic diagram illustrating an example of how the distance calculation unit 14 selects packet data byte by byte.

[0079] Furthermore, while the method of selecting packet data byte by byte by the reference packet data distance calculation unit 14 is described here, the unit of selection is not necessarily limited to the example of 1 byte. The selected unit can be, for example, a bit string of any length between 1 bit and 16 bits, or any other bit string of any length. Additionally, it is not necessary to limit the reference packet data distance calculation unit 14 to selecting packet data in consecutive bit units. For example, the reference packet data distance calculation unit 14 can also select a bit string by repeatedly selecting x bits and skipping y bits.

[0080] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0081] The reference packet data distance calculation unit 14 calculates the reference distance using the Levenstein distance between the packet data.

[0082] Levenstein distance is the distance that can be specified between two strings or byte strings. Levenstein distance is defined as the minimum number of times it takes to transform one string or byte string into the other string or byte string by inserting, deleting, or replacing a single character or byte.

[0083] Figure 7 This is a schematic diagram illustrating an example of how the Levinstein distance between two strings (in this case, the strings “ELEPHANT” and “RELEVANT”) is calculated by the distance calculation unit 14 between reference packet data.

[0084] like Figure 7 As shown, the minimum number of insertions, deletions, and substitutions required to transform "ELEPHANT" into "RELEVANT" is 3. Therefore, referring to the packet data distance calculation unit 14, the Levenstein distance between "ELEPHANT" and "RELEVANT" is calculated to be "3".

[0085] Figure 8 This is a schematic diagram illustrating an example of how the Levenstein distance between two byte strings is calculated by the distance calculation unit 14 between reference packet data.

[0086] like Figure 8 As shown, the minimum number of insertions, deletions, and substitutions required to transform one byte string into the other is 3. Therefore, referring to the packet data distance calculation unit 14, Figure 8 The Levenstein distance between the byte strings shown in the figure is calculated to be "3".

[0087] The distance calculation unit 14 calculates multiple reference distances between multiple reference packets that constitute the reference packet data string for each of the P (P is an integer greater than or equal to 1) separate reference packets.

[0088] Figure 9 This is a schematic diagram illustrating an example of how the distance calculation unit 14 calculates multiple reference distances based on the reference packet data string when P is 1. Here, the explanation assumes P is 1, but it is not limited to the case where P is 1.

[0089] like Figure 9As shown, when the reference packet data distance calculation unit 14 is composed of 9 consecutive reference packet data, it calculates 8 reference distances between reference packet data that are separated from each other by 1 reference packet data, that is, between adjacent reference packet data strings.

[0090] Furthermore, the Lewinstein distance between packets is calculated by referring to at least a portion of the bit string constituting the packet data as the object, and is not necessarily limited to the case where the entire bit string constituting the packet data is considered as the object.

[0091] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0092] The reference feature extraction unit 15 extracts reference features for each of the reference packet data strings stored in the reference packet data string group storage unit 13, using each of the multiple reference distances calculated by the reference packet data distance calculation unit 14. More specifically, for each of the reference packet data strings stored in the reference packet data string group storage unit 13, the reference feature extraction unit 15 calculates a reference distance string consisting of L reference distances for each of the L+1 consecutive reference packet data strings (where L is the length of the auxiliary information calculation object window, which is an integer of 2 or more) of one or more auxiliary information calculation object windows, and extracts each of the calculated reference distance strings as each of the reference features.

[0093] Figure 10 This is a schematic diagram illustrating an example of how the reference feature extraction unit 15 extracts reference features from a reference packet data string. Figure 10 L is 2, and the distance between reference packet data is calculated by the 14th part for each reference packet data string. Figure 9 The diagram illustrates the scenario with multiple reference distances.

[0094] like Figure 10As shown, the reference distance calculated for the reference packet data belonging to the first auxiliary information calculation object window is "1" and "1". Therefore, the reference feature extraction unit 15 extracts the feature value from the first auxiliary information calculation object window as a 2D vector A1 (1, 1). Similarly, the reference distance calculated for the reference packet data belonging to the second auxiliary information calculation object window is "1" and "1". Therefore, the reference feature extraction unit 15 extracts the feature value from the second auxiliary information calculation object window as a 2D vector B1 (1, 1). Furthermore, the reference distance calculated for the reference packet data belonging to the third auxiliary information calculation object window is "1" and "3". Therefore, the reference feature extraction unit 15 extracts the feature value from the third auxiliary information calculation object window as a 2D vector C1 (1, 3). Finally, the reference distance calculated for the reference packet data belonging to the fourth auxiliary information calculation object window is "3" and "7". Therefore, the reference feature extraction unit 15 extracts the feature value from the fourth auxiliary information calculation object window as a 2D vector D1 (3, 7). Furthermore, the reference feature extraction unit 15 extracts the calculated vectors A1, B1, C1, and D1 as reference features.

[0095] Here, since vectors A1 and B1 are the same, it is also possible to extract only one of them, such as vector A1, as a reference feature.

[0096] Similarly, the reference feature extraction unit 15 extracts the fifth auxiliary information to calculate the vector E1(7,2) in the object window, the sixth auxiliary information to calculate the vector F1(2,1) in the object window, and the vector G1(1,7) in the seventh window as reference features.

[0097] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0098] The reference feature storage unit 16 stores the reference feature quantities extracted by the reference feature quantity extraction unit 15.

[0099] The second configuration decision unit 21 acquires the detection object packet string 20, which contains detected abnormal objects. Furthermore, for each packet included in the acquired detection object packet string 20, it determines the corresponding configuration based on its attribute information. The attribute information includes the source IP, destination IP, source port, destination port, protocol, and combinations thereof. The second configuration decision unit 21 performs the configuration decision using the same algorithm as the configuration decision performed by the first configuration decision unit 11.

[0100] The second extraction unit 22 extracts the bit string stored in the payload field of each of the multiple packets whose configuration has been determined by the second configuration determination unit 21, and uses it as packet data. The second extraction unit 22 extracts the packet data using the same algorithm as the packet data extraction performed by the first extraction unit 12.

[0101] When extracting packet data, the second extraction unit 22 outputs a detection target packet data string consisting of packet data with the same configuration.

[0102] The detection object packet data string storage unit 23 stores the detection object packet data string output from the second extraction unit 22.

[0103] The distance calculation unit 24 calculates multiple distances between multiple detection object packet data that constitute the detection object packet data string from the detection object packet data string storage unit 23.

[0104] The distance calculation unit 24 between the detection object packet data calculates the reference distance for the reference packet data between the reference packet data between the reference packet data calculation unit 14 by replacing the reference packet with the detection object packet, replacing the reference packet data with the detection object packet data, replacing the reference packet data string with the detection object packet data string, and replacing the reference distance with the distance calculation algorithm, and performing the distance calculation by the same algorithm.

[0105] Figure 11 This is a schematic diagram illustrating an example where, when P is 1, the distance calculation unit 24 calculates multiple distances based on the target packet data string. Here, the explanation assumes P is 1, but it is not necessarily limited to the case where P is 1.

[0106] like Figure 11 As shown, when the target packet data string consists of 9 consecutive target packet data strings, the distance calculation unit 24 calculates 8 distances between adjacent target packet data strings based on the target packet data string.

[0107] Furthermore, the distance calculation unit 24 between the detected packet data can calculate the Lewinstein distance between the packet data by taking at least a portion of the bit string constituting the packet data as the object, and is not necessarily limited to taking the entire bit string constituting the packet data as the object.

[0108] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0109] The feature extraction unit 25 extracts features from the detection object packet data string stored in the detection object packet data string storage unit 23 using multiple distances calculated by the distance calculation unit 24 between detection object packet data. More specifically, the feature extraction unit 25 calculates each object window from the detection object packet data string stored in the detection object packet data string storage unit 23 using one or more auxiliary information consisting of L+1 consecutive detection object packet data, calculates a distance string consisting of L distances calculated for the detection object packet data belonging to the object window calculated by the auxiliary information, and extracts each of the calculated distance strings as a feature.

[0110] Figure 12 This is a schematic diagram illustrating an example of how the feature extraction unit 25 extracts features from the detection object packet data string. Figure 12 L is 2, and the distance calculation unit 24 calculates the distance between the data packets of the detected objects. Figure 11 The diagram illustrates the various distance scenarios.

[0111] like Figure 12 As shown, the distances calculated for the detection object packet data belonging to the first auxiliary information calculation object window are "1" and "5". Therefore, the feature extraction unit 25 extracts the feature values ​​from the first auxiliary information calculation object window as a 2D vector A2 (1, 5). Similarly, the distances calculated for the detection object packet data belonging to the second window are "5" and "1". Therefore, the feature extraction unit 25 extracts the feature values ​​from the second auxiliary information calculation object window as a 2D vector B2 (5, 1). Furthermore, the distances calculated for the detection object packet data belonging to the third auxiliary information calculation object window are "1" and "1". Therefore, the feature extraction unit 25 extracts the feature values ​​from the third auxiliary information calculation object window as a 2D vector C2 (1, 1). Finally, the distances calculated for the detection object packet data belonging to the fourth auxiliary information calculation object window are "1" and "3". Therefore, the feature extraction unit 25 extracts the feature values ​​from the fourth auxiliary information calculation object window as a 2D vector D2 (1, 3). Furthermore, the feature extraction unit 25 extracts the calculated vectors A2, B2, C2, and D2 as features.

[0112] Similarly, the feature extraction unit 25 extracts the fifth auxiliary information to calculate the vector E2(3,7) in the object window, the sixth auxiliary information to calculate the vector F2(7,6) in the object window, and the vector G2(6,5) in the seventh window as features.

[0113] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0114] The feature quantity storage unit 26 stores the feature quantities extracted by the feature quantity extraction unit 25.

[0115] For each feature stored in the feature storage unit 26, the auxiliary information calculation unit 27 calculates the Lp distance between the feature and each feature stored in the reference feature storage unit 16, and uses the K nearest neighbor algorithm applied to each calculated Lp distance to calculate the K nearest neighbor distance with the reference feature stored in the reference feature storage unit 16 as auxiliary information.

[0116] The Lp distance is the distance defined between two vectors consisting of real values ​​of the same dimension, and is obtained by calculating the p-norm of the difference between the two vectors.

[0117] The formulas for calculating the p-normal form (p>0) of vector x are shown in Equation 1 and Equation 2 below.

[0118] When p≧1

[0119]

Number 1

[0120]

[0121] When 0 < p < 1

[0122]

Number 2

[0123] ||x|| p =|x1| p +|x2| p +...+|x n | p (Equation 2)

[0124] As shown in Equations (1) and (2), for the p-normative form (p > 0) of vector x, the calculated formula is different when p is greater than 1 and when p is less than 1.

[0125] As shown in Equation 1, when p is greater than or equal to 1, the p-normal form of vector x is obtained by taking the p-root of the sum of the values ​​obtained by multiplying the absolute values ​​of each component of x by p. Furthermore, as shown in Equation 2, when p is less than 1, the p-normal form of vector x is obtained by multiplying the absolute values ​​of each component of x by p.

[0126] The formula for calculating the Lp distance between two vectors x and y with the same dimension is shown in Equation 3 below.

[0127]

Number 3

[0128] L p (x, y) = ||xy|| p (Equation 3)

[0129] As shown in Equation 3, the Lp distance between two vectors x and y with the same dimension is obtained by using the p-normal form of vectors (x and y).

[0130] Figure 13 This is a schematic diagram illustrating an example where the auxiliary information calculation unit 27 calculates the Lp distance between each feature stored in the feature storage unit 26 and each feature stored in the reference feature storage unit 16 for each feature stored in the feature storage unit 26, and uses the K-nearest neighbor algorithm applied to each of the calculated Lp distances to calculate the K-nearest neighbor distance with the feature stored in the reference feature storage unit 16 as auxiliary information.

[0131] Figure 13 The diagram shows the following: when the length L of the object window is 2 and p is 1, the feature quantity stored in the feature quantity storage unit 26 as a distance string is (1,5), (5,1), (1,1), (1,3), (3,7), (7,6), (6,5), and the reference feature quantity stored in the reference feature quantity storage unit 16 as a reference distance string is (1,1), (1,3), (1,7), (2,1), (3,7), (7,2).

[0132] like Figure 13 As shown, the auxiliary information calculation unit 27 calculates the L1 distance between distance string (1,5) and distance string (1,1) as 4, the L1 distance between distance string (1,5) and distance string (1,3) as 2, the L1 distance between distance string (1,5) and distance string (1,7) as 2, the L1 distance between distance string (1,5) and distance string (2,1) as 5, the L1 distance between distance string (1,5) and distance string (3,7) as 4, and the L1 distance between distance string (1,5) and distance string (7,2) as 9.

[0133] Furthermore, the auxiliary information calculation unit 27 uses the K-nearest neighbor algorithm with K=1 to calculate the K-nearest neighbor distance "2" between the feature quantity of the distance string (1, 5) and the reference feature quantity stored in the reference feature quantity storage unit 16, and uses it as auxiliary information. That is, the auxiliary information calculation unit 27 calculates the auxiliary information as the feature quantity of the distance string (1, 5) as "2".

[0134] Similarly, the auxiliary information calculation unit 27 calculates the auxiliary information as a feature quantity of the distance string (5,1) as "3", the auxiliary information as a feature quantity of the distance string (1,1) as "0", the auxiliary information as a feature quantity of the distance string (1,3) as "0", the auxiliary information as a feature quantity of the distance string (3,7) as "0", the auxiliary information as a feature quantity of the distance string (7,6) as "4", and the auxiliary information as a feature quantity of the distance string (6,5) as "4".

[0135] Return Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0136] The information calculation unit 28 calculates anomaly information related to the degree of anomaly of the detected object packet string 20 by using all of the W (W = N - L + 1) auxiliary information calculated based on the N detected object packet data for each of the information calculation object window consisting of one or more detected object packet data. More specifically, the information calculation unit 28 calculates the anomaly information by calculating the sum of all W consecutive auxiliary information.

[0137] exist Figure 13 In the example shown in the schematic diagram, when N is 5, W becomes W = 5 - 2 + 1 = 4. Therefore, the information calculation unit 28 calculates the sum of four auxiliary information as the anomaly information. That is, the information calculation unit 28 calculates anomaly information that is 2 + 3 + 0 + 0 = 5, anomaly information that is 3 + 0 + 0 + 0 = 3, anomaly information that is 0 + 0 + 0 + 4 = 4, and anomaly information that is 0 + 0 + 4 + 4 = 8.

[0138] Return again Figure 1 Continuing with the explanation of the anomaly detection device 1.

[0139] The determination unit 29 determines whether the detection target packet string 20 is abnormal based on the anomaly information of the detection target packet string 20 calculated by the information calculation unit 28. Furthermore, the determination unit 29 outputs the determination result to the outside. For example, the determination unit 29 may store thresholds; if any one of the anomaly information of the detection target packet string 20 is above the threshold, the detection target packet string 20 is determined to be abnormal; if any one of the anomaly information of the detection target packet string 20 is below the threshold, the detection target packet string 20 is determined not to be abnormal. Alternatively, the determination unit 29 may store thresholds that are independent values ​​for each configuration that is the decision object of the first configuration determination unit 11 and the second configuration determination unit 21, and perform the above determination using the threshold corresponding to the configuration of the detection target packet string 20 extracted from the detection target packet string 20.

[0140] [2. Action]

[0141] The anomaly detection device 1 described above performs reference feature extraction and anomaly detection processing. These processes will be described in sequence with reference to the accompanying drawings below.

[0142] First, the process of extracting reference features will be explained.

[0143] The reference feature extraction process is the process of extracting reference features from the reference packet group 10. The reference feature extraction process is initiated, for example, by a user of the anomaly detection device 1 performing an operation to indicate that the reference feature extraction process should begin.

[0144] Figure 14 This is a flowchart of the reference feature extraction process.

[0145] When the reference feature extraction process begins, the first configuration decision unit 11 obtains the reference packet group 10 (step S5).

[0146] When the first configuration decision unit 11 obtains the reference packet string group 10, it selects one unselected reference packet string from the reference packet strings included in the reference packet string group 10 (step S10). Here, an unselected reference packet string refers to a reference packet string that has not been selected by the previous step S10 process in the loop process formed by the process of step S10 to step S55: yes process (described later).

[0147] When selecting an unselected reference packet string, the first configuration decision unit 11 selects an unselected packet from the packets contained in the selected reference packet string (step S15). Here, selecting an unselected packet means that in the loop process formed by the process of step S15 to step S35: yes process (described later), there is no packet that has been selected by the previous process of step S15.

[0148] When selecting a package, the first configuration decision unit 11 uses stored configuration information to investigate whether the configuration of the selected package can be determined (step S20).

[0149] In the process of step S20, if the configuration of the selected package can be determined using the stored configuration information (step S20: Yes), the first configuration determination unit 11 uses the stored configuration information to determine the configuration of the selected package (step S30).

[0150] In step S20, if the configuration of the selected packet cannot be determined using the stored configuration information (step S20: No), the first configuration determination unit 11 determines the protocol of the selected packet by executing an application with Deep Packet Inspection functionality (step S25). Then, the first configuration determination unit 11 determines the configuration of the selected packet based on the determined protocol (step S30).

[0151] When deciding the configuration of the selected packet, the first configuration decision unit 11 investigates whether there are any unselected packets among the packets contained in the selected reference packet string (step S35).

[0152] In the process of step S35, if there is an unselected package (step S35: Yes), the first reference feature extraction process re-enters the process of step S15.

[0153] In step S35, if no unselected packets exist (step S35: No), the first extraction unit 12 extracts the bit string stored in the payload field of each packet whose configuration has been determined by the first configuration determination unit 11, as packet data. Then, the first extraction unit 12 extracts a reference packet data string composed of packet data of the same configuration (step S40). Then, the reference packet data string group storage unit 13 stores the reference packet data string extracted by the first extraction unit 12.

[0154] When extracting the reference packet data string, the reference packet data distance calculation unit 14 calculates multiple reference distances between multiple reference packet data that constitute the reference packet data string (step S45).

[0155] When multiple reference distances are calculated, the reference feature extraction unit 15 calculates an object window for each auxiliary information based on the calculated multiple reference distances and extracts the reference distance string as a reference feature (step S50). Then, the reference feature storage unit 16 stores the reference distance string extracted by the reference feature extraction unit 15 as a reference feature.

[0156] When extracting the reference distance string, the first configuration decision unit 11 investigates whether there is an unselected reference packet string in the obtained reference packet string group 10 (step S55).

[0157] In the process of step S55, if there is an unselected reference packet string (step S55: Yes), the reference feature extraction process re-enters the process of step S10.

[0158] In step S55, if there is no unselected reference packet string (step S55: No), the reference feature extraction process ends.

[0159] Next, the abnormal detection and handling process will be explained.

[0160] Anomaly detection processing is the process of detecting anomalies in the target packet string 20. Anomaly detection processing is initiated, for example, by a user of the anomaly detection device 1 performing an operation to initiate anomaly detection processing on the anomaly detection device 1.

[0161] Figure 15 This is a flowchart of the anomaly detection and processing.

[0162] When the anomaly detection process begins, the second configuration decision unit 21 obtains the detection target packet string 20 (step S105).

[0163] When the second configuration decision unit 21 acquires the target packet string 20, it selects one unselected packet from the packets contained in the acquired target packet string 20 (step S115). Here, selecting an unselected packet means that in the loop process formed by the process of step S115 to the process of step S135: yes (described later), there is no packet that has been selected by the previous process of step S115.

[0164] When selecting a package, the second configuration decision unit 21 uses stored configuration information to investigate whether the configuration of the selected package can be determined (step S120).

[0165] In the process of step S120, if the configuration of the selected package can be determined using the stored configuration information (step S120: Yes), the second configuration determination unit 21 uses the stored configuration information to determine the configuration of the selected package (step S130).

[0166] In step S120, if the configuration of the selected packet cannot be determined using the stored configuration information (step S120: No), the second configuration determination unit 21 determines the protocol of the selected packet by executing an application with Deep Packet Inspection functionality (step S125). Then, the second configuration determination unit 21 determines the configuration of the selected packet based on the determined protocol (step S130).

[0167] When deciding the configuration of the selected packet, the second configuration decision unit 21 investigates whether there are any unselected packets among the packets contained in the obtained detection target packet string 20 (step S135).

[0168] In the process of step S135, if there is an unselected packet (step S135: Yes), the first anomaly detection process re-enters the process of step S115.

[0169] In step S135, if no unselected packets exist (step S135: No), the second extraction unit 22 extracts the bit string stored in the payload field of each packet whose configuration has been determined by the second configuration determination unit 21, as packet data. Then, the second extraction unit 22 extracts a detection target packet data string composed of packet data from the same configuration (step S140). Then, the detection target packet data string storage unit 23 stores the detection target packet data string extracted by the second extraction unit 22.

[0170] When extracting the detection object packet data string, the detection object packet data distance calculation unit 24 calculates multiple distances between multiple detection object packet data that constitute the detection object packet data string (step S145).

[0171] When multiple distances are calculated, the feature extraction unit 25 calculates an object window based on each auxiliary information according to the calculated multiple distances and extracts the distance string as a feature (step S150). Then, the feature storage unit 26 stores the distance string extracted by the feature extraction unit 25 as a feature.

[0172] When extracting distance strings, the auxiliary information calculation unit 27 calculates the K nearest neighbor distance as auxiliary information for each extracted distance string and each reference distance string stored in the reference feature storage unit 16 as a reference feature quantity (step S155) using the K nearest neighbor algorithm applied to the calculated Lp distance (step S160).

[0173] When the auxiliary information is calculated, the information calculation unit 28 calculates the sum of W consecutive auxiliary information items according to each information calculation object window to use as the anomaly information (step S165).

[0174] When each anomaly information is calculated, the determination unit 29 investigates whether each calculated anomaly information is above the stored threshold (step S170).

[0175] In the processing of step S170, if any of the calculated anomaly information is above the stored threshold (step S170: Yes), the determination unit 29 determines that the detection object packet string 20 is abnormal (step S175) and outputs a signal indicating that the detection object packet string 20 is abnormal to the outside.

[0176] In the processing of step S170, if none of the calculated anomaly information is above the stored threshold (step S170: No), the determination unit 29 determines that the detected object packet string 20 is not abnormal (step S180) and outputs a signal indicating that the detected object packet string 20 is not abnormal to the outside.

[0177] The anomaly detection process ends when the processing in step S175 and step S180 are completed.

[0178] [3. Site Visit]

[0179] The anomaly detection device 1 described above performs a reference feature extraction process to extract the context features of normal packet strings from a group of reference packet strings 10 composed of normal packet strings and stores them as reference features. Furthermore, the anomaly detection device 1 performs a first anomaly detection process to extract the context features of the target packet string 20 from the target packet string 20 and calculate anomaly degree information representing the degree to which the extracted features deviate from the stored reference features. Based on the calculated anomaly degree information, it determines whether the target packet string 20 is abnormal. Thus, the anomaly detection device 1 can detect anomalies in the target packet string 20.

[0180] Furthermore, by using the aforementioned auxiliary information to calculate the anomaly information, the following effects can be obtained, for example.

[0181] That is, the following effects can be achieved: (A) When the detected object packet string 20 undergoes the same transformation as the reference packet data string group 10, the score of the anomaly information becomes lower; (B) Even when a transformation with low probability but which actually occurs in the detected object packet string 20 occurs, the score of the anomaly information also becomes lower; (C) In the detected object packet string 20, when a transformation that does not occur in the reference packet data string group 10 occurs, the anomaly can be quantified by the Lp distance, and the score of the anomaly information becomes higher.

[0182] (Replenish)

[0183] The above description of embodiments is provided as examples of the disclosed technology in this application. However, the technology disclosed herein is not limited to this and can be applied to embodiments with appropriate modifications, substitutions, additions, omissions, etc.

[0184] The following is an example of a variation of this disclosure.

[0185] (1) In this embodiment, the anomaly detection device 1 is configured such that the determination unit 29 determines whether the target packet string 20 is abnormal and outputs the determination result to the outside. Alternatively, as another configuration, the anomaly detection device 1 may be configured such that the information calculation unit 28 calculates an anomaly degree representing the degree of abnormality of the target packet string 20 and outputs the calculated anomaly degree to the outside. In this case, the anomaly detection device 1 may also be configured without the determination unit 29.

[0186] (2) In this embodiment, the anomaly detection device 1 is configured in such a way that reference features are extracted by performing a reference feature extraction process, and the extracted reference features are stored in the reference feature extraction unit 15. Alternatively, as another configuration, the anomaly detection device 1 may be configured to obtain reference features extracted by an external device or the like from an external source, and store the obtained reference features in advance in the reference feature storage unit 16. In this case, the anomaly detection device 1 may be configured without performing the reference feature extraction process and without including the first configuration determination unit 11, the first extraction unit 12, the reference packet data string group storage unit 13, the reference packet data inter-distance calculation unit 14, and the reference feature extraction unit 15. Furthermore, as another configuration, the anomaly detection device 1 may be manufactured with the reference features pre-stored in the reference feature storage unit 16. In this case, the anomaly detection device 1 may not need to perform reference feature extraction processing and may not include the configuration of the first configuration determination unit 11, the first extraction unit 12, the reference packet data string group storage unit 13, the reference packet data distance calculation unit 14, and the reference feature extraction unit 15.

[0187] (3) In the implementation, although the object detected by the anomaly detection device 1 is a packet string, it does not necessarily have to be a packet string; it can also be composed of a data string. For example, in... Figure 16 In the data string of the detection log of the intrusion detection system shown, the series of strings appearing in the Description column can also be regarded as the data string of the object to be detected and the anomaly detection method of this disclosure can be applied. Alternatively, the syslog message text can also be regarded as the data string of the object to be detected and the anomaly detection method of this disclosure can be applied. Furthermore, appropriate columns can be extracted from the control device or control-related log information, and the data in those columns can be regarded as the data string of the object to be detected and the anomaly detection method of this disclosure can be applied.

[0188] (4) It is explained that the sum of W consecutive auxiliary information calculated by the auxiliary information calculation unit 27 is used as the anomaly information by the information calculation unit 28. However, the function for calculating the anomaly information is not necessarily the sum of W consecutive auxiliary information. It can also be a function that takes the W consecutive dimensions of auxiliary information calculated by the auxiliary information calculation unit 27 as input and returns the anomaly information.

[0189] (5) In the embodiments, each component of the anomaly detection device 1 can be individually monolithically manufactured using semiconductor devices such as ICs (Integrated Circuits) and LSIs (Large Scale Integrations), or monolithically manufactured in a manner that includes some or all of them. Furthermore, the method of integrated circuit manufacturing is not limited to LSIs; it can also be implemented using dedicated circuits or general-purpose processors. After LSI manufacturing, programmable FPGAs (Field Programmable Gate Arrays) and / or reconfigurable processors capable of reconfiguring the connections and settings of circuit units within the LSI can also be used. Moreover, if advancements in semiconductor technology or other derived technologies lead to integrated circuit manufacturing technologies that replace LSIs, these technologies can also be used for functional block integration. Biotechnology, etc., may also be applied.

[0190] Industrial availability

[0191] This disclosure can be widely used for anomaly detection in systems that utilize data strings.

[0192] Label Explanation

[0193] 1. Anomaly Detection Device

[0194] 10 Reference Packet Data String Group

[0195] 11 First Configuration Decision Department

[0196] 12 First Extraction Section

[0197] 13 Reference Packet Data Serial Group Storage Department

[0198] 14. Calculation of distance between reference package data.

[0199] 15. Reference Feature Extraction Section

[0200] 16. Reference Feature Storage Unit

[0201] 20 Detection object packet string

[0202] 21. Second Configuration Decision Department

[0203] 22. Second Extraction Section

[0204] 23. Detection object packet data string storage unit

[0205] 24. Distance Calculation Unit for Detecting Object Packets

[0206] 25 Feature Extraction Section

[0207] 26 Feature storage unit

[0208] 27. Auxiliary Information Calculation Department

[0209] 28 Information Calculation Department

[0210] 29 Judgment Department

Claims

1. An anomaly detection method, calculating a plurality of distances between a plurality of detection object data using Levenshtein distances between the plurality of detection object data for a detection object data string constituted by the plurality of detection object data in succession, extracting a plurality of feature amounts of the detection object data string using the plurality of distances calculated, In the extraction of the plurality of characteristic amounts, the plurality of characteristic amounts each constituted by L consecutive distances out of the plurality of distances are extracted, and calculating anomaly degree information relating to a degree of anomaly of the detection object data string using the plurality of feature amounts extracted, L is an integer of 2 or more, in the calculation of the anomaly degree information, calculating, for each of the plurality of feature amounts extracted, auxiliary information for calculating the anomaly degree information using a difference relating to the feature amount, the difference is an Lp distance, in the calculation of the auxiliary information, for each of the plurality of feature amounts extracted, an Lp distance from each of a plurality of reference feature amounts stored in advance is calculated, and a K nearest neighbor distance from the plurality of reference feature amounts stored in advance is calculated as the auxiliary information using a K nearest neighbor algorithm using each of the Lp distances calculated, calculating the anomaly degree information using all of a plurality of auxiliary information calculated from N detection object data for each information calculation object window of one or more information calculation object windows constituted by the N detection object data, where N is an integer of L+1 or more.

2. The anomaly detection method according to claim 1, in the calculation of the plurality of distances, the plurality of distances are calculated using data sections of packets as the detection object data. As for the Levenshtein distance between the plurality of detection object data, for each of P separate detection object data in the detection object data string, at least a part of the bit string constituting the data section is taken as the object, and Q bits are calculated as the unit, wherein, 3. The anomaly detection method according to claim 2, P is an integer of 1 or more, and Q is an integer of 1 or more and 16 or less, in the calculation of the plurality of distances, the plurality of distances are calculated by calculating a distance between each of P separate detection object data in the detection object data string.

4. The anomaly detection method according to claim 1 or 2, in the calculation of the plurality of distances, the plurality of distances are calculated between detection object data of the same category among the plurality of detection object data.

5. The anomaly detection method according to claim 1 or 2, in the calculation of the anomaly degree information, the anomaly degree information is calculated by calculating a sum of all of a plurality of auxiliary information calculated from the N detection object data for each information calculation object window of the one or more information calculation object windows.

6. The anomaly detection method according to claim 1 or 2, further, calculating a plurality of reference distances of a plurality of reference data for each of one or more reference data strings constituted by the plurality of reference data in succession, extracting a plurality of reference feature amounts of the one or more reference data strings using each of the plurality of reference distances calculated, in the calculation of the anomaly degree information relating to a degree of anomaly of the detection object data string, the anomaly degree information is also calculated further using each of the reference feature amounts extracted.

7. The anomaly detection method according to claim 6, In the calculation of the plurality of reference distances, the plurality of reference distances are calculated using the Levenshtein distances between the plurality of reference data.

8. The abnormality detection method according to claim 7, For each of the P separate reference variable length data in each of the one or more reference data strings, at least a portion of a bit string constituting a data portion of a packet that is the reference data is taken as a target, and is calculated in units of Q bits, where, P is an integer of 1 or more, and Q is an integer of 1 or more and 16 or less, In the calculation of the plurality of reference distances, the plurality of reference distances are calculated by calculating a reference distance between each of P separate reference data in each of the one or more reference data strings.

9. The abnormality detection method according to claim 1, further comprising: a plurality of reference distances of the plurality of reference data are calculated for each of the one or more reference data strings composed of a plurality of continuous reference data, a plurality of reference feature amounts of the one or more reference data strings are extracted using each of the plurality of reference distances calculated, each of the plurality of reference feature amounts extracted is stored as each of the plurality of reference feature amounts stored in advance.

10. The abnormality detection method according to claim 6, In the calculation of the plurality of reference distances, each of the reference distances is calculated between reference data of the same category among the plurality of reference data.

11. An abnormality detection device comprising: a distance calculation unit that calculates a plurality of distances between a plurality of detection target data using Levenshtein distances between the plurality of detection target data for a detection target data string composed of a plurality of continuous detection target data; a feature amount extraction unit that extracts a plurality of feature amounts of the detection target data string using the plurality of distances calculated by the distance calculation unit between the detection target data; and an information calculation unit that calculates abnormality degree information related to a degree of abnormality of the detection target data string using the plurality of feature amounts extracted by the feature amount extraction unit, the feature amount extraction unit extracts the plurality of feature amounts composed of L consecutive distances among the plurality of distances, where L is an integer of 2 or more, the information calculation unit, for each of the plurality of feature amounts extracted by the feature amount extraction unit, calculates auxiliary information for calculating the abnormality degree information using a difference related to the feature amount, the difference is an Lp distance, in the calculation of the auxiliary information, for each of the plurality of feature amounts extracted, an Lp distance from each of a plurality of reference feature amounts stored in advance is calculated, and a K-nearest neighbor distance from the plurality of reference feature amounts stored in advance is calculated as the auxiliary information using a K-nearest neighbor algorithm using each of the Lp distances calculated, for each of one or more information calculation target windows composed of N detection target data, where N is an integer of L+1 or more, the abnormality degree information is calculated using all of a plurality of auxiliary information calculated from the N detection target data.

12. The abnormality detection device according to claim 11, further comprising: a reference data distance calculation unit that calculates a plurality of reference distances of a plurality of reference data for each of one or more reference data strings composed of a plurality of continuous reference data; and The reference feature amount extraction section extracts a plurality of reference feature amounts of the one or more reference data strings, using each of the plurality of reference distances calculated by the reference data distance calculation section. The information calculation section further calculates the abnormality degree information using each of the reference feature amounts extracted by the reference feature amount extraction section.

Images