Detection system, detection method, and recording medium

Abstract

The detection device (20) has: an encoding section (252) that transforms one group serving as a detection target into one fixed-length vector using a natural language processing technique; and a detection section (253) that detects the presence or absence of an abnormality in the group serving as the detection target based on the fixed-length vector obtained by the transformation by the encoding section (252) using a detection model.

Description

TECHNICAL FIELD

[0001] The present application relates to a detection system, a detection method, and a recording medium. BACKGROUND

[0002] An abnormality detection system, an intrusion detection system (OT-IDS: Operational Technology-Intrusion Detection System) for communication used in a network control system of an industrial system and a building system is attracting attention.

[0003] For the communication of a control system, for example, even if a set value of temperature is changed by one order of magnitude, it can lead to a major accident, and thus even if 1 byte of an improper rewriting of a communication content (net load) is missed, it is necessary to detect it. Therefore, in an abnormality detection system that targets a network control system of an industrial system and a building system, a fine analysis of the content of the net load is essential.

[0004] PRIOR ART DOCUMENTS

[0005] NON-PATENT LITERATURE

[0006] Non-Patent Literature 1: Wireshark, [Retrieved on August 3, Heisei 2], Internet <URL: https: / / www.wireshark.org / download.html>

[0007] Non-Patent Literature 2: zeek, [Retrieved on August 3, Heisei 2], Internet <URL: http: / / www.3gpp.org / ftp / / Specs / archive / 29_series / 29.165 / 29165-f60.zip> SUMMARY OF THE INVENTION

[0008] PROBLEMS TO BE SOLVED BY THE INVENTION

[0009] However, in a network of an industrial system and a building system, various communication protocols are used, and sometimes a proprietary protocol of a non-public specification is used. Therefore, in analysis using existing knowledge such as a frame format of a communication packet, a parser, and the like of the related art, there are many cases where analysis is not smooth.

[0010] The present application was made in view of the above circumstances, and an object thereof is to provide a detection device, a learning device, a detection method, a learning method, a detection program, and a learning program capable of detecting an abnormality generated in the content of a packet without depending on a communication protocol.

[0011] MEANS FOR SOLVING THE PROBLEMS

[0012] To solve the above problems and achieve the object, the detection device of the present application is characterized by having: a first conversion section that converts a group of one detection object into one fixed-length vector using a natural language processing technique; and a first detection section that detects whether the group of the detection object is abnormal or not based on the fixed-length vector obtained by the conversion by the first conversion section using a detection model.

[0013] In addition, the learning device of the present application is characterized by having: a second conversion section that converts a group of one normal state into one fixed-length vector using a natural language processing technique; a second detection section that detects whether the group of the normal state is abnormal or not based on the fixed-length vector obtained by the conversion by the second conversion section using a detection model; and a learning control section that causes the detection model to learn a pattern of the fixed-length vector corresponding to the group of the normal state.

[0014] Effects of Invention

[0015] According to the present application, it is possible to detect an abnormality occurring in the content of a group without depending on a communication protocol. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a diagram showing an example of the configuration of a detection system to which the embodiment relates.

[0017] Figure 2 is a diagram showing Figure 1 an example of the structure of the learning device shown in FIG. 1.

[0018] Figure 3 is a diagram showing Figure 2 the flow of the learning processing performed by the learning device shown in FIG. 1.

[0019] Figure 4 is a diagram showing an example of learning of an article.

[0020] Figure 5 is a diagram showing Figure 1 an example of the structure of the detection device shown in FIG. 1.

[0021] Figure 6 is a diagram showing Figure 5 the flow of the detection processing performed by the detection device shown in FIG. 1.

[0022] Figure 7 is a flowchart showing processing steps of the learning method of the embodiment.

[0023] Figure 8 is a flowchart showing processing steps of the detection method of the embodiment.

[0024] Figure 9 is a diagram showing an outline of a control system in which an evaluation experiment was performed.

[0025] Figure 10 This is a graph showing the results of the evaluation experiment.

[0026] Figure 11 This diagram illustrates an example of a computer that implements a learning device and a testing device by executing a program. Detailed Implementation

[0027] Hereinafter, one embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to this embodiment. Furthermore, in the accompanying drawings, the same reference numerals are used to denote the same parts.

[0028] [Implementation Method]

[0029] Embodiments of the present invention will be described. In this embodiment, each protocol is treated as a different language, and a packet is encoded into a fixed-length vector by applying natural language processing techniques. Furthermore, in this embodiment, anomaly detection is performed by extracting normal patterns from the encoded vectors and detecting vectors that differ from them. Thus, in this embodiment, anomalies occurring in the content of packets can be detected without relying on communication protocols.

[0030] [Detection System]

[0031] Figure 1 This is a diagram illustrating an example of the structure of the detection system according to an implementation method. For example... Figure 1 As shown, the detection system 1 of this embodiment includes a learning device 10 and a detection device 20. The learning device 10 and the detection device 20 are connected, for example, via a network. Furthermore, the learning device 10 and the detection device 20 are connected to external devices, for example, via a network.

[0032] The learning device 10 is based on a fixed-length vector obtained by transforming a group of data in the normal state using natural language processing technology, so that the detection model learns the pattern of the fixed-length vector corresponding to the group in the normal state.

[0033] Then, the detection device 20 uses natural language processing technology to transform the grouping as the detection object into a fixed-length vector, and uses the detection model learned in the learning device 10 to detect whether there are any abnormalities in the grouping as the detection object based on the transformed fixed-length vector.

[0034] [Structure of the learning device]

[0035] Next, the structure of the learning device 10 will be explained. Figure 2 It means Figure 1 A diagram illustrating an example of the structure of the learning device 10. (As shown) Figure 2As shown, the learning device 10 includes an input unit 11, an output unit 12, a communication unit 13, a storage unit 14, and a control unit 15. Furthermore, Figure 3 This is an explanation Figure 2 A diagram illustrating the learning process performed by the learning device 10 shown.

[0036] The input unit 11 is an input interface that accepts various operations from the operator of the learning device 10. For example, the input unit 11 may consist of input devices such as a touch panel, a voice input device, a keyboard, or a mouse.

[0037] The output unit 12 is realized, for example, through a display device such as a liquid crystal display, a printing device such as a printer, or an information communication device.

[0038] The communication unit 13 is a communication interface for sending and receiving various information with other devices connected via a network or the like. The communication unit 13 is implemented using a NIC (Network Interface Card) or similar device, and facilitates communication between other devices and the control unit 15 (described later) via electrical communication lines such as a LAN (Local Area Network) or the Internet. For example, the communication unit 13 receives packets of data that are being studied under normal conditions via the network and outputs them to the control unit 15. Furthermore, the communication unit 13 outputs the learned detection model and the encoder parameters, which have learned the transformation rules for transforming to a fixed-length vector, to the detection device 20 via the network.

[0039] Storage unit 14 is a storage device such as HDD (Hard Disk Drive), SSD (Solid State Drive), or optical disc. Alternatively, storage unit 14 can be a rewritable semiconductor memory such as RAM (Random Access Memory), flash memory, or NVSRAM (Non-Volatile Static Random Access Memory). Storage unit 14 stores the OS (Operating System) and various programs executed by learning device 10. Furthermore, storage unit 14 stores various information used during program execution.

[0040] The control unit 15 controls the entire learning device 10. The control unit 15 may be an electronic circuit such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an ASIC (Application Specific Integrated Circuit), or a FPGA (Field Programmable Gate Array). Furthermore, the control unit 15 has internal memory for storing programs and control data that define various processing steps, and uses the internal memory to execute each process. In addition, the control unit 15 functions as various processing units by executing various programs. The control unit 15 includes a processing unit 150 and a learning control unit 154.

[0041] The processing unit 150 encodes the groups of data under normal conditions, which are the learning objects. After encoding, it uses a detection model to detect whether there are any anomalies in the groups. The processing unit 150 includes a collection unit 151, an encoding unit 152 (second transformation unit), and a detection unit 153 (second detection unit).

[0042] The learning control unit 154 enables the detection model to learn patterns in fixed-length vectors corresponding to groups under normal conditions. The learning control unit 154 also enables the encoding unit 152 to learn group transformation rules using groups under normal conditions.

[0043] The collection unit 151 collects groups as learning objects. The collection unit 151 acquires multiple groups (variable length) in normal states as learning objects. Figure 3 (1)).

[0044] Encoding unit 152 uses natural language processing techniques to transform a block in a normal state into a fixed-length vector. Learning control unit 154 causes encoding unit 152 to learn the rules for transforming a block into a fixed-length vector using blocks in a normal state. That is, under the control of learning control unit 154, encoding unit 152 uses blocks in a normal state to learn the rules for transforming a block into a fixed-length vector. Learning control unit 154 causes encoding unit 152 to learn frequent patterns in the arrangement of byte columns within blocks in a normal state. Figure 3 (2)). In other words, the encoding unit 152 learns the frequent patterns of the arrangement of the internal byte columns in the group under normal conditions, under the control of the learning control unit 154.

[0045] The encoding unit 152 uses pre-training models from natural language processing systems such as Word2Vec (see reference 1), Doc2Vec (see reference 2), and ELMo (see reference 3) to treat each group as a single article and learn the rules for transforming it into a fixed-length vector. Furthermore, the learning method varies depending on the algorithm employed by the encoding unit 152.

[0046] Reference 1: Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean, “Efficient Estimation of Word Representations in Vector Space”, [accessed September 8, 2005], Internet URL: https: / / arxiv.org / abs / 1301.3781

[0047] Reference 2: Quoc V. Le, and Tomas Mikolov, “Distributed Representations of Sentences and Documents”, [accessed September 8, 2005], Internet <URL: https: / / arxiv.org / abs / 1405.4053>

[0048] Reference 3: Matthew E. Peters, Mark Neumann, Mohit Iyyer, Matt Gardner, Christopher Clark, Kenton Lee, and Luke Zettlemoyer, “Deep contextualized word representations”, [accessed September 8, 2002], Internet <URL: https: / / arxiv.org / abs / 1802.05365>

[0049] For example, in Word2Vec, distributed representations of words are learned through auxiliary tasks such as Skip-Gram and CBOW. Skip-Gram is a task that predicts the surrounding words of a given word. CBOW, on the other hand, is a task that predicts the central word based on its surrounding words. Since an article is composed of clusters of words, its distributed representation can be indirectly obtained by averaging all the words in the article as a vector.

[0050] Figure 4This diagram illustrates an example of text learning. In Word2Vec (Skip-Gram), the goal is to obtain good intermediate representations by solving the task of "predicting surrounding words based on a focused word." For example, in learning a text like "I like an apple," in step 1, focusing on "I" predicts "like." In step 2, focusing on "like" → predicts "I" "an." In step 3, focusing on "an," predicts "like" "apple." Then, in step 4, focusing on "apple," predicts "an."

[0051] In models such as Doc2Vec and ELMo, a distributed representation of a document can be directly obtained by learning the auxiliary tasks corresponding to each model. In this case, during the preprocessing required for learning the pre-training model, such as the partitioning, the groups are represented as hexadecimal numbers, and the data is divided into 1-byte segments. Position information (such as the byte number of the group) is assigned according to the pre-training model used.

[0052] Then, the encoding unit 152 uses the pre-training model of the natural language processing system to transform each group into a fixed-length vector reflecting the features of each group. Figure 3 (3)).

[0053] The detection unit 153 uses a detection model to detect whether there are any abnormalities in the normal state groups based on a fixed-length vector transformed by the encoding unit 152. The learning control unit 154 enables the detection model to learn the pattern of the fixed-length vector corresponding to the groups in the normal state.

[0054] In the detection unit 153, anomaly detection models based on unsupervised learning, such as VAE (Variational Auto Encoder), AE (Auto Encoder), and LoF (Local Outlier Factor), are used as detection models. For example, in VAE, after learning the probability density of normal communication packets, communication packets with low probability density are detected as anomalies. Therefore, as long as normal communication packets are known, anomaly detection can be performed even without learning all malicious data.

[0055] The detection unit 153 obtains the anomaly level (frequency of occurrence of abnormal groups) of the fixed-length vector transformed by the encoding unit 152 using a detection model, and learns the anomaly level based on the fixed-length vector corresponding to the groups in the normal state. Figure 3 (4)). The detection unit 153 uses a detection model, for example, to obtain an anomaly score as the degree of anomaly ( Figure 3(5)). The learning control unit 154 adjusts the parameters of the detection model in a way that minimizes the degree of anomaly obtained by the detection unit 153.

[0056] The learning device 10 outputs the detection model and its parameters, such as VAE, which are learned under the control of the learning control unit 154, the rules in the encoding unit 152 that transform a group into a fixed-length vector, and the rules adjusted by the learning control unit 154, to the detection device 20.

[0057] [Structure of the detection device]

[0058] Next, the structure of the detection device 20 will be explained. Figure 5 It means Figure 1 A diagram illustrating an example of the structure of the detection device 20. (As shown) Figure 5 As shown, the detection device 20 includes an input unit 21, an output unit 22, a communication unit 23, a storage unit 24, and a control unit 25. Furthermore, Figure 6 This is an explanation Figure 5 A diagram showing the flow of the detection process performed by the detection device 20.

[0059] The input unit 21 is an input interface that accepts various operations from the operator of the detection device 20, and consists of input devices such as a touch panel, a voice input device, a keyboard, and a mouse.

[0060] The output unit 22 is realized, for example, through a display device such as a liquid crystal display, a printing device such as a printer, or an information communication device.

[0061] The communication unit 23 is a communication interface for sending and receiving various information with other devices connected via a network, etc., and facilitates communication between other devices and the control unit 25 (described later) via electrical communication lines such as NICs and the Internet. For example, the communication unit 23 receives packets that are to be detected via the network and outputs them to the control unit 25. In addition, the communication unit 23 outputs information to the detection device 20 via the network to check whether the packets that are to be detected are abnormal.

[0062] Storage unit 24 is a storage device such as HDD, SSD, or optical disc. Alternatively, storage unit 24 can be a semiconductor memory capable of rewriting data, such as RAM, flash memory, or NVSRAM. Storage unit 24 stores the OS and various programs executed by detection device 20. Furthermore, storage unit 24 stores various information used in program execution.

[0063] The control unit 25 controls the entire detection device 20. The control unit 25 may be an electronic circuit such as a CPU or MPU, or an integrated circuit such as an ASIC or FPGA. Furthermore, the control unit 25 has an internal memory for storing programs and control data that define various processing steps, and uses the internal memory to execute each process. In addition, the control unit 25 functions as a processing unit by executing various programs. The control unit 25 includes a collection unit 251, an encoding unit 252 (first conversion unit), and a detection unit 253 (first detection unit).

[0064] The collection unit 251 collects packets that are the targets of detection. The collection unit 251 acquires multiple packets of variable length and uses them as the targets of detection. Figure 6 (1)).

[0065] Encoding unit 252 uses natural language processing techniques to transform a detection object, i.e., a group, into a fixed-length vector. Encoding unit 252 uses the pre-training model of natural language processing systems such as Word2Vec, Doc2Vec, and ELMo to treat a group as a single article and transform it into a fixed-length vector. Encoding unit 252 uses the rules output from learning device 10 that transform a group into a fixed-length vector to transform a detection object, i.e., a group, into a fixed-length vector. In this way, encoding unit 152 uses the pre-training model of a natural language processing system to transform variable-length groups into fixed-length vectors reflecting the characteristics of each group. Figure 6 (2)).

[0066] The detection unit 253 uses a detection model to detect whether there are any abnormalities in the groups to be detected, based on a fixed-length vector transformed by the encoding unit 252. If the pattern of the fixed-length vector transformed by the encoding unit 252 is different from the pattern of the fixed-length vector corresponding to the groups in the normal state, the detection unit 253 detects an abnormality in the groups to be detected.

[0067] The detection unit 253 uses anomaly detection models based on teacherless learning, such as VAE, AE, and LoF, which are detection models whose parameters have been adjusted through the learning process in the learning device 10. By using the detection model, the detection unit 253 obtains the anomaly degree (e.g., anomaly score) of a fixed-length vector transformed by the encoding unit 252. Figure 6 (3)). Then, if the abnormal score exceeds the specified threshold, the detection unit 253 detects the abnormality of the group being detected and generates an alarm. Figure 6 (4)). The threshold is set, for example, based on the required detection accuracy, the resources of the detection device 20, etc.

[0068] [Learning Processing]

[0069] Next, the learning process of the implementation method will be explained. Figure 7 This is a flowchart illustrating the processing steps of the learning method in the implementation method.

[0070] like Figure 7 As shown, in the learning device 10, the collection unit 151 collects groups (variable length) of learning objects (step S1). Next, the encoding unit 152, under the control of the learning control unit 154, uses the groups in the normal state to learn the rule of transforming one group into one fixed-length vector (step S2).

[0071] The encoding unit 152 uses natural language processing technology to transform the groups of learning objects into fixed-length vectors (step S3). Then, the detection unit 153, based on the control of the learning control unit 154, enables the detection model to learn the pattern of fixed-length vectors corresponding to the groups in the normal state (step S4). Then, the learning device 10 outputs the rules for transforming one group into one fixed-length vector, the detection model such as VAE adjusted by the learning control unit 154, and its parameters to the detection device 20, and ends the learning process.

[0072] [Detection and Processing]

[0073] Next, the detection process of the implementation method will be explained. Figure 8 This is a flowchart illustrating the processing steps of the detection method in the implementation method.

[0074] like Figure 8 As shown, in the detection device 20, groups (variable length) that are the objects to be detected are collected (step S11). The encoding unit 252 uses natural language processing technology to transform one detection object, i.e., a group, into a fixed-length vector (step S12).

[0075] Then, the detection unit 253 uses the detection model to obtain anomaly scores of a fixed-length vector transformed by the encoding unit 252 (step S13). The detection unit 253 determines whether the obtained anomaly score exceeds a predetermined threshold (step S14).

[0076] If the abnormal score exceeds a predetermined threshold (step S14: Yes), the detection unit 253 detects an abnormality in the group being detected and generates an alarm (step S15). Conversely, if the abnormal score is below the predetermined threshold (step S14: No), the detection device 20 terminates the detection process for that group.

[0077] [Evaluation Experiment]

[0078] An evaluation experiment was conducted to assess the detection performance using the detection processing described in this embodiment. In the evaluation experiment, a simple control system was built using a virtual environment to control a square-shaped belt conveyor, etc., using a PLC (Programmable Logic Controller). Factory.io and Codesys were used as the virtual environment. Figure 9 This is a diagram showing the outline of the control system that underwent the evaluation experiment.

[0079] The PLC uses the Modbus / TCP protocol to control the speed of the belt conveyor C and the ON / OFF operation of the push rods located at the four corners, based on information from the object sensors positioned at the four corners. Additionally, the speed of the belt conveyor C can also be manually changed from the belt conveyor's control panel within the virtual environment.

[0080] The belt conveyor speed is monitored by a PLC and rotates at a constant speed (normal system). When the belt conveyor speed exceeds a certain speed (abnormal system), an emergency stop command is issued from the PLC to the entire system. In such a system, packets from the normal system and packets from the abnormal system when the speed is manually set to an abnormal value are collected, and experiments are conducted to confirm whether packets generated during the abnormal system can be detected.

[0081] Figure 10 This is a graph representing the results of the evaluation experiment. Two ROC (Receiver Operating Characteristic) curves are shown as the results of the evaluation experiment. Figure 10 (1) is the result of the packet sent from the PLC. Figure 10 (2) is the result of the packets received by the PLC. In both transmission and reception, the area under the curve (AUC) of the ROC curve exceeds 0.95. Therefore, the detection method of this embodiment can effectively detect the occurrence of anomalies, demonstrating good results.

[0082] [Effects of the Implementation Method]

[0083] Thus, in the implementation, a method is proposed to apply natural language processing techniques to grouped vectors, which can be applied to anomaly detection based on unsupervised learning for arbitrary groups.

[0084] In this embodiment, each protocol is treated as an unknown language, and a packet (variable length) is encoded into a fixed-length vector using natural language processing techniques. This fixed-length vector is expected to reflect the characteristics of the packet. Then, normal patterns are extracted from the encoded vectors, and vectors that differ from these patterns are detected, thereby performing anomaly detection. Control system protocol packets typically consist of control commands and multiple parameters. In this embodiment, by using natural language processing techniques, patterns of normal instructions, parameters, etc., can be extracted from the binary representation of the packets, and an abstracted normal state can be learned.

[0085] As a result, according to this embodiment, high-precision anomaly detection can be performed on packets of any protocol, taking into account the content of the packets. That is, according to this embodiment, by combining natural language processing technologies such as Word2Vec and ELMo, and teacherless anomaly detection technologies such as VAE and LOF, an anomaly detection system that can detect anomalies occurring in the content of packets without relying on communication protocols is realized.

[0086] [Example]

[0087] The detection method described in this embodiment can be applied to anomaly detection systems for IoT devices.

[0088] Network sensors are configured in the IoT network to capture packets. In the learning device 10, the captured packets are used for learning by the encoding unit 152 and the detection unit 153.

[0089] After learning is complete, the groups acquired by the network sensor are input to the detection device 20. In the detection device 20, after the encoding unit 252 encodes the groups into fixed-length vectors, the detection unit 253 calculates anomaly scores for each group. The detection unit 253 uses these anomaly scores to determine whether the group being evaluated is similar to the group acquired during learning (i.e., whether it is a normal group).

[0090] [System architecture, etc.]

[0091] The constituent elements of the devices illustrated are functional conceptual elements and do not necessarily need to be physically configured as shown in the illustration. That is, the specific methods of distributing or combining the devices are not limited to those shown in the illustration. They can be configured by distributing or combining all or part of them in any functional or physical manner, depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be implemented by a CPU and the program parsed and executed by that CPU, or can be implemented as hardware based on wiring logic.

[0092] Furthermore, in each of the processes described in this embodiment, all or part of the processes described as automatically performed may be performed manually, or all or part of the processes described as manually performed may be performed automatically using known methods. In addition, the processing steps, control steps, specific names, and information containing various data or parameters shown in the above text or figures can be arbitrarily changed, unless specifically stated otherwise.

[0093] [program]

[0094] Figure 11 This diagram illustrates an example of a computer that implements the learning device 10 and the detection device 20 by executing a program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected via a bus 1080.

[0095] Memory 1010 includes ROM 1011 and RAM 1012. ROM 1011 stores, for example, boot programs such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, removable storage media such as disks or optical discs are inserted into disk drive 1100. Serial port interface 1050 is connected, for example, to mouse 1110 and keyboard 1120. Video adapter 1060 is connected, for example, to monitor 1130.

[0096] The hard disk drive 1090 stores, for example, an operating system (OS) 1091, application programs 1092, program modules 1093, and program data 1094. That is, programs defining the processing of the learning device 10 and the testing device 20 are installed as program modules 1093, which contain code executable by a computer. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, program modules 1093 for performing processing with the same functional structure as in the learning device 10 and the testing device 20 are stored in the hard disk drive 1090. Alternatively, the hard disk drive 1090 can be replaced by an SSD (Solid State Drive).

[0097] Furthermore, the setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. Moreover, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 and executes them as needed.

[0098] Furthermore, program module 1093 and program data 1094 are not limited to being stored in hard disk drive 1090; for example, they can also be stored in removable storage media and read by CPU 1020 via disk drive 1100, etc. Alternatively, program module 1093 and program data 1094 can also be stored in other computers connected via a network (LAN, WAN, etc.). Moreover, program module 1093 and program data 1094 can also be read by CPU 1020 from other computers via network interface 1070.

[0099] The embodiments of the invention made by the inventors have been described above, but the present invention is not limited to the descriptions and drawings that constitute a part of the present invention. That is, all other embodiments, examples, and techniques applied based on the present invention are included within the scope of the present invention.

[0100] Label Explanation

[0101] 1. Detection System

[0102] 10 Learning Devices

[0103] Input section 11, 21

[0104] Output sections 12 and 22

[0105] 13,23 Ministry of Communications

[0106] Storage Units 14 and 24

[0107] 15, 25 Control Department

[0108] 20 Detection devices

[0109] 150 Processing Department

[0110] Collection Department 151, 251

[0111] 152,252 encoding section

[0112] 153, 253 Testing Department

[0113] 154 Learning Control Department

Claims

1. A detection system, characterized in that, having: a learning device that has a second conversion section that converts a plurality of variable-length groupings in a normal state into fixed-length vectors respectively using a natural language processing technique, a second detection section that detects whether or not the plurality of variable-length groupings in the normal state are abnormal based on the plurality of fixed-length vectors obtained by the conversion by the second conversion section using a detection model that is one of a VAE that is a variational autoencoder, an AE that is an autoencoder, and a LoF that is a local outlier factor algorithm, and a learning control section that causes the detection model to learn a pattern of the plurality of fixed-length vectors corresponding to the plurality of variable-length groupings in the normal state, acquires an abnormality degree of the plurality of fixed-length vectors obtained by the conversion by the second conversion section, and adjusts a plurality of parameters of the detection model in such a manner that the abnormality degree acquired by the second detection section is minimized; and a detection device that has a first conversion section that converts one variable-length grouping that is a detection target into one fixed-length vector using the natural language processing technique, and a first detection section that detects whether or not the variable-length grouping that is the detection target is abnormal based on the fixed-length vector obtained by the conversion by the first conversion section using the detection model.

2. The detection system according to claim 1, wherein the first detection section detects an abnormality of the variable-length grouping that is the detection target in a case where a pattern of the fixed-length vector obtained by the conversion by the first conversion section is different from a pattern of the plurality of fixed-length vectors corresponding to the plurality of variable-length groupings in the normal state.

3. The detection system according to claim 1 or 2, wherein the first detection section acquires an abnormality degree of the fixed-length vector obtained by the conversion by the first conversion section, and detects an abnormality of the variable-length grouping that is the detection target in a case where the abnormality degree exceeds a prescribed threshold value.

4. The detection system according to claim 1 or 2, wherein the learning control section causes the second conversion section to learn a rule of converting one grouping into one fixed-length vector using the plurality of variable-length groupings in the normal state.

5. The detection system according to claim 3, wherein the learning control section causes the second conversion section to learn a rule of converting one grouping into one fixed-length vector using the plurality of variable-length groupings in the normal state.

6. The detection system according to claim 4, wherein the learning control section causes the second conversion section to learn a frequent pattern of an arrangement of byte columns inside the plurality of variable-length groupings in the normal state.

7. A detection method executed by a detection device, characterized by, including: a second conversion process of converting a plurality of variable-length groupings in a normal state into fixed-length vectors using a natural language processing technique; the second detection process, using a detection model, detects whether the plurality of variable-length packets in the normal state are abnormal based on the plurality of fixed-length vectors obtained by the second conversion process, the detection model being one of a VAE, an AE, and a LoF, the VAE being a variational autoencoder, the AE being an autoencoder, and the LoF being a local outlier factor algorithm; and the learning control process causes the detection model to learn a pattern of the plurality of fixed-length vectors corresponding to the plurality of variable-length packets in the normal state, wherein in the second detection process, an abnormality degree of the plurality of fixed-length vectors obtained by the second conversion process is acquired, in the learning control process, a plurality of parameters of the detection model are adjusted in such a manner that the abnormality degree acquired by the second detection process is minimized, the detection method further includes: the first conversion process converts one variable-length packet as a detection target into one fixed-length vector using the natural language processing technique; and the first detection process, using the detection model, detects whether the variable-length packet as the detection target is abnormal based on the fixed-length vector obtained by the first conversion process.

8. A recording medium storing a detection program for causing a computer to execute the steps of: the second conversion step converts a plurality of variable-length packets in a normal state into fixed-length vectors respectively using a natural language processing technique; the second detection step, using a detection model, detects whether the plurality of variable-length packets in the normal state are abnormal based on the plurality of fixed-length vectors obtained by the second conversion step, the detection model being one of a VAE, an AE, and a LoF, the VAE being a variational autoencoder, the AE being an autoencoder, and the LoF being a local outlier factor algorithm; and the learning control step causes the detection model to learn a pattern of the plurality of fixed-length vectors corresponding to the plurality of variable-length packets in the normal state, wherein in the second detection step, an abnormality degree of the plurality of fixed-length vectors obtained by the second conversion step is acquired, in the learning control step, a plurality of parameters of the detection model are adjusted in such a manner that the abnormality degree acquired by the second detection step is minimized, the detection program further causes the computer to execute the steps of: the first conversion step converts one variable-length packet as a detection target into one fixed-length vector using the natural language processing technique; and the first detection step, using the detection model, detects whether the variable-length packet as the detection target is abnormal based on the fixed-length vector obtained by the first conversion step.

Images