Learning device, learning method, and recording medium

Abstract

The learning device (10) has an acquisition unit (131) that acquires a plurality of communication data for learning, a feature amount extraction unit (132) that extracts a feature amount of each of the plurality of communication data, a learning unit (1331) that causes a VAE model (121) to learn the feature amount of the communication data, a representative point extraction unit (1332) that extracts a representative point of the feature amount of the plurality of communication data using kernel herding, and an output unit that outputs the representative point extracted by the representative point extraction unit (1332).

Description

TECHNICAL FIELD

[0001] The present application relates to a learning device, a learning method, and a recording medium. BACKGROUND

[0002] With the advent of the Internet of Things (IoT) era, a variety of devices (IoT devices) are connected to the Internet and a variety of usage methods are performed. As a security countermeasure for these IoT devices, a traffic session anomaly detection system or an intrusion detection system (IDS) for IoT devices is under active research.

[0003] In such an anomaly detection system, for example, there is a system using a probability density estimator based on unsupervised learning such as a VAE (Variational Auto Encoder). In anomaly detection of the probability density estimator, learning-use high-dimensional data called traffic feature amounts is generated from actual communication, and the feature amounts are used to learn the characteristics of normal traffic, whereby the occurrence probability of the normal communication pattern can be estimated. Then, the occurrence probability of each communication is calculated using the learned model, and the communication with a small occurrence probability is detected as an anomaly. Therefore, anomaly detection can be performed even if all malicious states are not known, and further, it has the advantage that it can cope with unknown network attacks.

[0004] PRIOR ART DOCUMENTS

[0005] NON-PATENT DOCUMENTS

[0006] Non-Patent Document 1 Y. Chen, M. Welling and A. Smola, "Super-Samples from Kernel Herding", In Proceedings of the 26 th Conference on Uncertainty in Artificial Intelligence (UAI), pp. 109-116, (2010). SUMMARY

[0007] PROBLEMS TO BE SOLVED BY THE INVENTION

[0008] When an anomaly detection system using a probability density estimator is used in actual use, it is necessary to grasp the tendency of the anomaly detection system to regard which communication as normal. However, the communication of the IoT device, which is the learning object of the anomaly detection system, is diverse, and it is difficult to grasp the tendency.

[0009] Specifically, the IoT devices are various in the characteristics of the communication based on the use of a plurality of protocols for each category of the devices, even if the communication is focused on the 1 HTTP protocol communication, and there are long-lasting communications like WebSockets and instantaneous end communications like page reads. Therefore, the traffic feature quantities as the learning data generated from these communications are also various, and it is difficult to grasp the tendency of the learning traffic feature quantities by simple statistical processing such as the calculation of the average or median value. If the tendency of the learning traffic feature quantities cannot be grasped, it is not known how the abnormality detection system regards the communication of which feature as normal, and it is considered that the reason for the detection cannot be grasped even if the detection is performed in the abnormality detection system, and an obstacle is caused to the operation.

[0010] The present application has been achieved in view of the above-described circumstances, and an object thereof is to provide a learning device, a learning method, and a learning program capable of providing data for grasping the tendency of the learning traffic feature quantities.

[0011] Means for solving the problem

[0012] In order to solve the above-described problem and achieve the object, the learning device of the present application is characterized by having: an acquisition unit that acquires a plurality of communication data for learning; a feature quantity extraction unit that extracts a feature quantity of each of the plurality of communication data; a learning unit that causes a generative model to learn the feature quantity of the communication data; a first representative point extraction unit that extracts a representative point of the feature quantity of the plurality of communication data using kernel herding; and an output unit that outputs the representative point extracted by the first representative point extraction unit.

[0013] The learning method of the present application is executed by the learning device, and the learning method is characterized by including the steps of: acquiring a plurality of communication data for learning; extracting a feature quantity of each of the plurality of communication data; causing a generative model to learn the feature quantity of the communication data; extracting a representative point of the feature quantity of the plurality of communication data using kernel herding; and outputting the representative point.

[0014] In addition, the learning program of the present application is characterized by causing a computer to execute the steps of: acquiring a plurality of communication data for learning; extracting a feature quantity of each of the plurality of communication data; causing a generative model to learn the feature quantity of the communication data; extracting a representative point of the feature quantity of the plurality of communication data using kernel herding; and outputting the representative point.

[0015] Effects of the Invention

[0016] According to the present application, it is possible to provide data for grasping the tendency of the learning traffic feature quantities. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a graph showing results of a comparison experiment of a usual random sampling and a kernel herding-based sampling in a mixture Gaussian distribution.

[0018] Figure 2 is a block diagram showing an example of a structure of a communication system in an embodiment.

[0019] Figure 3 is a graph showing a processing flow of a detection system in an embodiment.

[0020] Figure 4 is a graph showing an example of a structure of a learning device.

[0021] Figure 5 is a graph showing an example of a structure of a detection device.

[0022] Figure 6 is a graph showing an example of a structure of an evaluation device.

[0023] Figure 7 is a flowchart showing a processing procedure of a learning processing in an embodiment.

[0024] Figure 8 is a flowchart showing a processing procedure of an evaluation processing performed by an evaluation device.

[0025] Figure 9 is a graph showing an example of an application of a detection system in an embodiment.

[0026] Figure 10 is a graph showing an example of a computer that realizes a detection system by executing a program. DETAILED DESCRIPTION

[0027] Hereinafter, an embodiment of the present application will be explained in detail with reference to the attached drawings. Note that the present application is not limited to this embodiment. Note also that in the description of the drawings, the same parts are denoted by the same symbols to represent. Further, hereinafter, for A that is a vector, a matrix, or a scalar, in the case where it is described as "^A", it is assumed to be equivalent to [a symbol marked with "^" directly above "A"] and the like.

[0028] [EMBODIMENT]

[0029] In the present embodiment, representative points of the traffic feature quantity for learning are extracted using a kernel method called kernel herding, and thus information for grasping the tendency of the traffic feature quantity for learning is provided. Furthermore, in the present embodiment, in a case where a generative model such as VAE is used as a probability density estimator, representative points of data generated by the generative model are extracted using kernel herding, and thus information for grasping what kind of communication the generative model actually regards as normal is provided.

[0030] [kernel herding]

[0031] First, kernel herding is explained. Kernel herding is proposed as an algorithm for obtaining a sampling sequence that efficiently utilizes kernel sampling average (1 / T)∑ t Φ(x t ) to approximate kernel average m x (see Non-Patent Literature 1). In kernel herding, a sampling sequence {x t} is sequentially obtained in accordance with an update formula shown in (1), (2).

[0032] [Equation 1]

[0033] x t+1 = arg max x <h t , Φ(x t )>... (1)

[0034] [Equation 2]

[0035] h t+1 = h t + m X - Φ(x t+1 )... (2)

[0036] Here, m x is a kernel average of a data set X shown in (3). Φ(·) is a characteristic map. <·, ·> represents an inner product on a reproducing kernel Hilbert space with a positive definite kernel.

[0037] [Equation 3]

[0038]

[0039] However, the kernel average m x cannot be directly obtained in general. Therefore, in an algorithm in which kernel herding is actually executed, the kernel average is replaced by a sample kernel average ^m = (1 / N)∑ n Φ(x n((4), (5) formula).

[0040] [Number 4]

[0041] x t+1 = argmax x <h t , Φ(x t )>…(4)

[0042] [Number 5]

[0043]

[0044] By experiment, it is known that even if this substitution is performed, an effective sample can be obtained by kernel herding (refer to Non-Patent Literature 1).

[0045] In the present embodiment, kernel herding is used as a technique for extracting representative points from a data set. When a positive definite kernel used for calculation has a feature, the kernel mean m x has complete information about the distribution of the data set X (refer to (3) formula).

[0046] Therefore, the kernel mean m x extracted by kernel herding is approximated by a small number of data points. Figure 1 A graph showing the results of a comparative experiment of performing usual random sampling and sampling based on kernel herding in a mixture Gaussian distribution is shown in (from Non-Patent Literature 1). As shown in Figure 1 , it is known that sampling based on kernel herding can qualitatively extract [representative data points] compared to random sampling.

[0047] In the present embodiment, a method of grasping the tendency of traffic considered normal by an anomaly detection system by extracting representative points of traffic feature amounts as learning targets by the anomaly detection system is proposed.

[0048] [Structure of anomaly detection system]

[0049] The communication system of the present embodiment will be described. Figure 2 is a block diagram showing an example of the structure of the communication system in the embodiment. As shown in Figure 2 , in the communication system 1 of the embodiment, a structure in which a plurality of NW devices 2 and a detection system 100 are connected via a network N is provided. The detection system 100 communicates with a user terminal 3 used by an NW administrator or the like.

[0050] The NW device 2 performs sampling of packets in the traffic that is an object of anomaly detection. The NW device 2 transmits the sampled packets to the detection system 100 via the network N.

[0051] The detection system 100 detects presence or absence of anomaly in communication based on the packets received from the NW device 2 using a generation model that learns a traffic feature quantity by unsupervised learning, and transmits a detection result to the user terminal 3 used by a system manager. The detection system 100 has a learning device 10, a detection device 20, and an evaluation device 30.

[0052] In addition, the generation model is a probability density estimator like VAE. VAE outputs an anomaly score (degree of anomaly) when a traffic feature quantity is input. VAE outputs an output distribution according to input noise when the noise is input to the middle layer.

[0053] The learning device 10 causes the generation model to learn a traffic feature quantity by unsupervised learning according to the packets received from the NW device 2. Then, the learning device 10 extracts representative points of the traffic feature quantity that is an object of learning using kernel herding, and outputs the extracted representative points to the user terminal 3 as evaluation data of the progress degree of the generation model.

[0054] The detection device 20 detects presence or absence of anomaly in communication in the traffic that is an object of anomaly detection using the generation model whose model parameters are optimized by the learning device 10.

[0055] The evaluation device 30 generates a plurality of data according to the generation model learned by the learning device 10, extracts representative points of the plurality of data using kernel herding, and outputs the extracted representative points to the user terminal 3 as evaluation data of the progress degree of the generation model. Specifically, the evaluation device 30 inputs noise to the middle layer of VAE, performs sampling according to an output distribution corresponding to the noise, and acquires data generated by the generation model. The data generated from the generation model corresponds to data considered normal when the generation model is used as a probability density estimator.

[0056] [Processing flow of detection system]

[0057] Next, a flow of explaining the principle will be described with reference to Figure 3 . Figure 3 is a diagram for explaining a processing flow of the detection system 100 in the embodiment.

[0058] As shown in Figure 3 , the learning device 10 extracts a traffic feature quantity for learning according to packets collected via an NW device that is an object of learning (see (1) of Figure 3 ), and causes a generation model such as VAE to learn the extracted traffic feature quantity (see Figure 3(2)). At the same time, the learning device 10 extracts representative points of the traffic feature quantity for learning based on kernel herding (refer to Figure 3 (3)).

[0059] It is assumed that the data set of the traffic feature quantity for learning contains only normal communications. In the learning device 10, using a probability density estimator (generative model) such as a VAE, the traffic feature quantity considered normal is learned from the data set. Therefore, the representative points of the traffic feature quantity for learning correspond to the traffic feature quantity considered normal by the detection system 100. In the learning device 10, by using kernel herding, the feature quantity of a representative communication can be automatically extracted, and the NW administrator can grasp the tendency of the network from the feature quantity.

[0060] Also, in the detection system 100, the evaluation device 30 generates a plurality of data from the learned generative model to create a data set. The evaluation device 30 extracts representative points using kernel herding from the data sampled from the VAE and the like (refer to Figure 3 (4)). Figure 3 (5)).

[0061] In this way, the evaluation device 30 can extract a representative communication learned by the VAE. The data generated from the generative model correspond to the data considered normal when the generative model is used as a probability density estimator. By using kernel herding, the evaluation device 30 can more directly grasp the traffic feature quantity considered normal by the detection system 100.

[0062] The NW administrator grasps the tendency of the traffic feature quantity for learning from the representative points extracted by the learning device 10. The kernel herding application method in the learning device 10 is useful when it is desired to grasp the tendency of the network from the representative points of the traffic feature quantity.

[0063] In addition, the NW administrator grasps what kind of communication the generative model actually considers normal from the representative points extracted by the evaluation device 30. In other words, the NW administrator grasps whether the generative model can generate normal data. The kernel herding application method in the evaluation device 30 is useful when it is desired to grasp the traffic feature quantity considered normal by the entire detection system 100 including the probability density estimator.

[0064] Then, the NW manager performs evaluation of the progress degree of the generation model using the difference between the representative point extracted by the learning device 10 and the representative point extracted by the evaluation device 30. For example, in a case where the difference between the representative point extracted by the learning device 10 and the representative point extracted by the evaluation device 30 is smaller than a prescribed value, it is considered that the learning of the generation model has been properly performed, whereas in a case where the difference is larger than the prescribed value, it is considered that the learning of the generation model has not been properly performed. Thereby, the NW manager can grasp whether the learning of the generation model has been properly performed or not by the feature amount level.

[0065] [Learning device]

[0066] Next, the structure of each device of the detection system 100 will be described. First, the learning device 10 will be described. Figure 4 is a diagram showing an example of the structure of the learning device 10. As shown in Figure 4 , the learning device 10 has a communication section 11, a storage section 12, and a control section 13.

[0067] The communication section 11 is a communication interface that transmits and receives various information between other devices connected via a network or the like. The communication section 11 is realized by a NIC (Network Interface Card), or the like, and performs communication between other devices (for example, the detection device 20 and the evaluation device 30) and the control section 13 (described later) via an electric communication line such as a LAN (Local Area Network), the Internet, or the like. The communication section 11 is connected to an external device via a network or the like, for example, and accepts input of a packet of a traffic to be learned.

[0068] The storage section 12 is realized by a semiconductor storage element such as a RAM (Random Access Memory), a Flash Memory, or the like, or a storage device such as a hard disk, an optical disk, or the like, and stores a processing program that causes the learning device 10 to operate, data used in execution of the processing program, and the like. The storage section 12 has a VAE model 1211.

[0069] The VAE model 121 is a generation model that learns a feature amount of communication data. The VAE model 121 learns a traffic feature amount for learning. The VAE model 121 is a probability density estimator, and learns a feature of a probability density of communication data for learning. When there is input of a certain data point x i , the VAE model 121 outputs an anomaly score corresponding to the data. If an estimated value of the probability density is set to p(x i ), the anomaly score becomes an approximate value of -log p(x i ). Therefore, the higher the value of the anomaly score output by the VAE, the higher the degree of abnormality of the communication data.

[0070] The control section 13 has an internal memory for storing programs that prescribe various processing sequences and the like, and necessary data, by which various processing is performed. The control section 13 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The control section 13 includes a retrieval section 131, a feature quantity extraction section 132, and a model learning section 133.

[0071] The retrieval section 131 retrieves a plurality of communication data for learning. Specifically, the retrieval section 131 retrieves a plurality of packets for learning via the NW device 2 that is the learning target.

[0072] The feature quantity extraction section 132 extracts a feature quantity of each of the plurality of communication data retrieved by the retrieval section 131. The feature quantity extraction section 132 performs statistical processing on the plurality of packets for learning, and generates a traffic feature quantity as high-dimensional data.

[0073] The model learning section 133 performs learning of the VAE model 121 using the traffic feature quantity extracted by the feature quantity extraction section 132. At this time, the model learning section 133 extracts a representative point of the feature quantity of the plurality of communication data for learning using kernel herding. The model learning section 133 includes a learning section 1331, a representative point extraction section 1332, and a presentation section 1344.

[0074] The learning section 1331 causes the VAE model 121 to learn the feature quantity of the communication data extracted by the feature quantity extraction section 132. The learning section 1331 causes the VAE model 121 to learn a feature of the probability density of the communication data. The learning section 1331 optimizes the parameters of the VAE model 121 using the traffic feature quantity generated by the feature quantity extraction section 132. The learning section 1331 outputs the VAE model 121 that has completed learning to the detection device 20 and the evaluation device 30 via the communication section 11.

[0075] The representative point extraction section 1332 extracts a representative point of the feature quantity of the plurality of communication data for learning using kernel herding. The representative point extraction section 1332 extracts a representative point from the data set of the traffic feature quantity of the learning target generated by the feature quantity extraction section 132 using kernel herding.

[0076] The presentation section 1333 outputs the representative point extracted by the representative point extraction section 1332 to the user terminal 3 via the communication section 11, thereby presenting the representative point of the feature quantity of the plurality of communication data for learning to the NW administrator.

[0077] [Detection Device]

[0078] Next, the detection device 20 will be described. Figure 5is a diagram showing an example of the structure of the detection device 20. As shown in Figure 5 The detection device 20 has a communication section 21, a storage section 22, and a control section 23.

[0079] The communication section 21 has the same functions as the communication section 11 shown in Figure 4 and performs input and output of information or communication with other devices (e.g., the learning device 10).

[0080] The storage section 22 has the same functions as the storage section 12 shown in Figure 4 The storage section 22 has a VAE model 121. The VAE model 121 is a model that has been learned by the learning device 10.

[0081] The control section 23 has the same functions as the control section 13 shown in Figure 4 and controls the entire detection device 20. The control section 23 functions as various processing sections by acting through various programs. The control section 23 has an acquisition section 231, a feature quantity extraction section 232, and a detection section 233.

[0082] The acquisition section 231 acquires communication data of a detection target. Specifically, the acquisition section 131 acquires packets of a detection target via the NW device 2 that captures packets of a flow of the detection target.

[0083] The feature quantity extraction section 232 has the same functions as the feature quantity extraction section 132 and generates a flow feature quantity from the packets of the detection target acquired by the acquisition section 231.

[0084] The detection section 233 detects the presence or absence of an anomaly in the flow of the detection target using the VAE model 121. The detection section 233 inputs the flow feature quantity generated by the feature quantity extraction section 232 into the VAE model 121 and acquires an output anomaly score. The detection section 233 detects that the communication data of the detection target is abnormal when the anomaly score is higher than a prescribed value. In addition, the detection section 233 detects that the communication data of the detection target is normal when the anomaly score is lower than or equal to the prescribed value.

[0085] [Evaluation Device]

[0086] Next, the structure of the evaluation device 30 will be described. Figure 6 is a diagram showing an example of the structure of the evaluation device 30. As shown in Figure 6 The evaluation device 30 has a communication section 31, a storage section 32, and a control section 33.

[0087] The communication section 31 has the same functions as the communication section 11 shown in Figure 4 and performs input and output of information or communication with other devices (e.g., the learning device 10).

[0088] Storage unit 32 has with Figure 4 The storage unit 12 shown has the same function. The storage unit 32 has a VAE model 121. The VAE model 121 is a model that has been learned by the learning device 10.

[0089] Control unit 33 has with Figure 4 The control unit 13 shown has the same function as the overall control evaluation device 30. The control unit 33 functions as a processing unit by operating through various programs. The control unit 33 includes a model evaluation unit 331.

[0090] The model evaluation unit 331 prompts the NW manager about which features of communication are actually considered normal data in the evaluation model. The model evaluation unit 331 includes a data generation unit 3311, a representative point extraction unit 3312, and a prompting unit 3313.

[0091] The data generation unit 3311 generates multiple data based on the VAE model 121, which serves as the generation model. The data generation unit 3311 inputs noise into the intermediate layer of the VAE model 121 and obtains the output distribution corresponding to the noise from the output of the VAE model 121.

[0092] The representative point extraction unit 3312 uses kernel herding to extract representative points from multiple data generated by the data generation unit 3311.

[0093] The prompting unit 3313 outputs the representative points extracted by the representative point extraction unit 3312 to the user terminal 3 through the communication unit 31, thereby prompting the NW manager with the representative points of the feature quantities of the data generated by the VAE model 121.

[0094] [Learning Processing]

[0095] Next, the learning method executed by the learning device 10 will be explained. Figure 7 This is a flowchart illustrating the learning process of the implementation method.

[0096] like Figure 7 As shown, the learning device 10 acquires multiple groups for learning (step S1), and extracts the flow characteristics of the acquired multiple groups respectively (step S2).

[0097] The learning device 10 performs learning processing to enable the VAE model 121 to learn flow characteristics (step S3), and outputs the learned VAE model 121 to the detection device 20 and the evaluation device 30 (step S4).

[0098] Then, the learning device 10 extracts representative points from the dataset of the traffic feature amounts of the learning target using kernel herding (step S5), and outputs the extracted representative points to the user terminal 3, whereby the representative points of the traffic feature amounts of the learning target are presented to the NW administrator (step S6).

[0099] [evaluation processing]

[0100] Next, an evaluation method performed by the evaluation device 30 will be described. Figure 8 is a flowchart showing the processing steps of the evaluation processing performed by the evaluation device 30.

[0101] The evaluation device 30 generates a plurality of data according to the VAE model 121 as the generation model (step S11). The evaluation device 30 extracts representative points of the plurality of data generated in step S11 using kernel herding (step S12).

[0102] The evaluation device 30 presents the representative points of the feature amounts of the data generated by the VAE model 121 to the NW administrator by outputting the representative points extracted in step S12 to the user terminal 3 (step S13).

[0103] [Embodiment]

[0104] For example, the detection system 100 in the present embodiment can be applied to anomaly detection of IoT devices. Figure 9 is a diagram illustrating an application example of the detection system 100 in the present embodiment. As shown in Figure 9 The detection system 100 is provided on a network 5 to which a plurality of IoT devices 4 are connected. At this time, the detection system 100 collects traffic session information transmitted and received by the IoT devices 4, and performs learning of the probability density of normal traffic sessions and detection of abnormal traffic sessions.

[0105] In the detection system 100, the model learning unit 133 receives a plurality of packets as a learning target, and outputs a VAE model that has learned traffic feature amounts of the received plurality of packets to the detection device 20 and the evaluation device 30.

[0106] [Experiment]

[0107] In fact, representative points were extracted from a dataset of traffic features for learning using kernel herding. Specifically, a dataset in which two types of communication (temperature information transmission (500 pieces) based on MQTT (Message Queue Telemetry Transport) and video distribution (300 pieces) based on RTMP (Real-Time Messaging Protocol)) were mixed was created, and representative point extraction based on kernel herding was performed. The results are shown in Table 1.

[0108] [Table 1]

[0109]

[0110] The first row of Table 1 shows the results of extracting representative points of communication based on MQTT. When the actual dataset was confirmed, about 90% was communication of 444 bytes or 445 bytes of uplink bytes, the number of packets was 7, and the average packet size was 0.04 x 1500 bytes, which was very consistent with the representative points extracted by hand.

[0111] The second row of Table 1 shows the results of extracting representative points of communication based on RTMP. If the actual data is confirmed by visual inspection, the deviation is quite large, but the average session duration is about 6500 seconds, the average uplink packet size is about 0.119 x 1500 bytes, etc., which is very consistent with the representative points extracted by hand.

[0112] In this way, it can be confirmed that the traffic features extracted by hand (specifically, a skilled person in system management) are very consistent with the traffic features automatically extracted using kernel herding.

[0113] [Effects of Embodiments]

[0114] In this way, the learning device 10 of the present embodiment extracts the feature amounts of a plurality of communication data respectively, and causes the generation model to learn the feature amounts of the communication data.

[0115] Meanwhile, the learning device 10 extracts representative points of the feature amounts of the plurality of communication data using kernel herding, and outputs the extracted representative points to the user terminal 3, whereby data for grasping the tendency of the traffic features for learning is provided to the NW administrator.

[0116] Thus, the NW administrator can grasp the feature amounts that the VAE model 121 considers normal from the representative points of the feature amounts of the communication data, and can also grasp the tendency of the network from the representative points of the feature amounts of the communication data.

[0117] Also, as shown in the experimental results described above, the flow feature quantity automatically extracted using the kernel herding of the present embodiment is very consistent with the flow feature quantity manually extracted. Therefore, according to the present embodiment, it is possible to appropriately extract representative points of flow feature quantities for learning using the kernel herding without using human labor, so it is possible to reduce the burden on the system manager. Also, according to the present embodiment, representative points of flow feature quantities for learning are appropriately extracted and output as data, so anyone can use the data, and it is possible to realize reduction of the operation of skilled persons by analyzing network feature quantities based on these feature quantities.

[0118] Further, the evaluation device 30 of the present embodiment generates a plurality of data based on the VAE model 121, extracts representative points of the generated plurality of data using the kernel herding, and outputs the extracted representative points to the user terminal 3.

[0119] Based on the representative points extracted by the evaluation device 30, the NW manager can grasp what kind of features of communication the VAE model 121 actually considers normal. In other words, the NW manager can grasp whether the VAE model 121 can generate normal data.

[0120] Therefore, according to the present embodiment, it is possible to qualitatively grasp the flow feature quantity that the entire detection system 100 including the VAE model 121 considers normal.

[0121] Also, the NW manager can grasp the evaluation of the progress of the VAE model 121 at the feature quantity level by using the difference between the representative points extracted by the learning device 10 and the representative points extracted by the evaluation device 30.

[0122] [System configuration, etc.]

[0123] Each of the constituent elements of each of the devices illustrated is a functional conceptual element, and does not necessarily need to be physically configured as illustrated. That is, the specific manner of dispersing / merging of each device is not limited to the manner illustrated, and all or a part thereof can be dispersed in any unit functionality or physically, and all or a part thereof can be merged to be configured. Also, all or any part of each processing function performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized by using hardware of a wiring logic.

[0124] Also, all or a part of the processing described as being performed automatically in each of the processes described in the present embodiment can be performed manually, or all or a part of the processing described as being performed manually can be performed automatically by a known method. Further, unless otherwise specified, information including processing procedures, control procedures, specific names, and various data and parameters can be arbitrarily changed.

[0125] [Program]

[0126] Figure 10 is a diagram showing an example of a computer that realizes the detection system 100 by executing a program. The computer 1000 has, for example, a memory 1010, a CPU 1020. In addition, the computer 1000 has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, a network interface 1070. These parts are connected by a bus 1080.

[0127] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110, a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0128] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, program data 1094. That is, programs that define each of the processes of the detection system 100 are installed as program modules 1093 in which codes executable by a computer are described. The program modules 1093 are stored in, for example, the hard disk drive 1090. For example, program modules 1093 for performing the same processes as the functional configuration of the detection system 100 are stored in the hard disk drive 1090. The hard disk drive 1090 can be replaced by an SSD (Solid State Drive).

[0129] The setting data used in the processes of the above-described embodiments is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program modules 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed and executes.

[0130] The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but can be stored in a removable storage medium, for example, and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 can be stored in another computer connected via a network (LAN, WAN (Wide Area Network), or the like). Then, the program module 1093 and the program data 1094 can also be read out by the CPU 1020 from the other computer via the network interface 1070.

[0131] The above describes embodiments to which the invention completed by the inventor is applied, but the invention is not limited to the description and the drawings constituting a part of the disclosure of the invention of the present embodiments. That is, other embodiments, examples, and application technologies based on the present embodiments made by those skilled in the art and the like are all included in the scope of the invention.

[0132] Symbol explanation

[0133] 1 Communication system

[0134] 2 NW device

[0135] 3 User terminal

[0136] 4 IoT device

[0137] 5 N network

[0138] 10 Learning device

[0139] 11, 21, 31 Communication section

[0140] 12, 22, 32 Storage section

[0141] 13, 23, 33 Control section

[0142] 20 Detection device

[0143] 30 Evaluation device

[0144] 100 Detection system

[0145] 121 VAE model

[0146] 131, 231 Acquisition section

[0147] 132, 232 Feature amount extraction section

[0148] 133 Model learning section

[0149] 233 Detection section

[0150] 331 Model evaluation section

[0151] 1331 learning unit

[0152] 1332, 3312 representative point extraction unit

[0153] 1333, 3313 prompting unit

[0154] 3311 data generation unit

Claims

1. A learning device, characterized in that, have: The acquisition department acquires multiple communication data for learning purposes; The feature extraction unit extracts the traffic features of the multiple communication data respectively; The learning unit enables the generative model to learn the traffic characteristics of the communication data; The first representative point extraction unit uses kernel herding to extract representative points of the traffic feature quantities of the multiple communication data. The output unit outputs representative points extracted by the first representative point extraction unit; A generation unit that generates multiple data points from the generation model; and The second representative point extraction unit uses the core cluster to extract representative points from the multiple data sets. The difference between the representative points extracted by the first representative point extraction unit and the representative points extracted by the second representative point extraction unit is used in evaluating the extent of the generative model's progress. The learning device can grasp the tendency of the traffic characteristics used for learning, so as to understand which characteristics of communication the anomaly detection system tends to regard as normal.

2. The learning device according to claim 1, characterized in that, The output unit outputs the representative points extracted by the second representative point extraction unit.

3. A learning method, executed by a learning device, characterized in that it includes the following steps: Obtain the process and acquire multiple communication data for learning purposes; The feature extraction process extracts the traffic features of the multiple communication data respectively; The learning process enables the generative model to learn the traffic characteristics of the communication data. The first representative point extraction process uses kernel herding to extract representative points of the traffic feature quantities of the multiple communication data. The output process outputs the representative points extracted through the first representative point extraction process. The generation process generates multiple data from the generation model; and The second representative point extraction step uses the core cluster to extract representative points from the multiple data sets. The difference between the representative points extracted through the first representative point extraction process and the representative points extracted through the second representative point extraction process is used in the evaluation of the extent of the generative model's progress. The learning method can grasp the tendency of the traffic characteristics used for learning, so as to understand which characteristics of communication the anomaly detection system tends to regard as normal.

4. A recording medium storing a learning program for causing a computer to perform the following steps: The steps involve acquiring multiple communication data for learning purposes. The feature extraction step extracts the traffic features of the multiple communication data respectively; The learning steps enable the generative model to learn the traffic characteristics of the communication data. The first representative point extraction step uses kernel herding to extract representative points of the traffic feature quantities of the multiple communication data. The output step outputs the representative points extracted through the first representative point extraction step. The generation step involves generating multiple data sets from the generation model; and The second representative point extraction step involves using the core cluster to extract representative points from the multiple data sets. The difference between the representative points extracted in the first representative point extraction step and the representative points extracted in the second representative point extraction step is used in evaluating the extent of the generative model's performance. The learning program can grasp the tendency of the traffic characteristics used for learning, so as to understand which characteristics of communication the anomaly detection system tends to regard as normal.

Images