Determining device, determining method, and recording medium

Abstract

The determination unit (332) determines whether or not relearning of the initial learning model is required, based on at least any one of information related to an initial learning model generated by learning initial learning data known to be normal, information related to over-detection data over-detected by an abnormality detection system using the initial learning model, and information related to an over-detection model generated based on the over-detection data. The notification unit (333) notifies a result of the determination by the determination unit (332).

Description

Technical Field

[0001] This invention relates to a determination device, a determination method, and a recording medium. Background Technology

[0002] With the advent of the IoT era, various devices are connecting to the internet in various ways. To address the security challenges of these IoT devices, research has recently focused on traffic session anomaly detection systems and intrusion detection systems (IDS) for IoT devices.

[0003] Such anomaly detection systems include those using probability density estimators based on unsupervised learning, such as Variational Auto Encoders (VAEs). These systems generate high-dimensional learning data, known as traffic features, based on actual communication. Using these features, they learn the characteristics of normal traffic flow, thereby estimating the probability of normal communication patterns occurring. Furthermore, in the following explanation, the probability density estimator will sometimes be referred to simply as a model.

[0004] Subsequently, the anomaly detection system uses the learned model to calculate the probability of occurrence for each communication, identifying communications with low probability of occurrence as anomalies. Therefore, an anomaly detection system using a probability density estimator has the following advantages: it can perform anomaly detection even without knowing all malicious states, and it can also cope with unknown network attacks. Furthermore, in anomaly detection systems, the aforementioned anomaly score, where a lower probability of occurrence results in a higher score, is sometimes used.

[0005] Anomaly detection systems using probability density estimators can detect anomalies based on the degree to which the monitored object deviates from its normal state. Therefore, when the tendency of the normal data of the monitored system changes, the probability density estimator needs to follow that change.

[0006] As methods for following changes in the normal state, over-detection feedback (FB) and relearning are known (e.g., see Patent Document 1). Over-detection feedback is a method for correcting small deviations from the learned model. Relearning, as its name suggests, is a method of discarding the currently learned model and relearning.

[0007] Prior art literature

[0008] Patent documents

[0009] Patent Document 1: Japanese Patent Application Publication No. 2019-220866 Summary of the Invention

[0010] The problem that the invention aims to solve

[0011] However, in previous technologies, there was a problem that it was sometimes difficult to properly choose a method to follow changes in the normal state.

[0012] For example, overdetection feedback is a powerful method and can be used in general when there is little change from the learned model. However, overdetection feedback sometimes fails to function well when feeding feedback on a large number of new normal patterns, or when there is a tendency for significant changes from the learned model.

[0013] On the other hand, in order to determine when over-detection feedback is not functioning properly, in-depth knowledge of machine learning is required. Therefore, not all users may be able to appropriately choose the method that follows changes in the normal state.

[0014] Methods for solving problems

[0015] To solve the aforementioned problems and achieve the objective, the determination device is characterized by comprising: a determination unit that determines whether relearning of the first model is required based on at least one of the following information: information related to the first model generated by learning initial learning data known to be normal; information related to data over-detected by an anomaly detection system using the first model; and information related to a second model generated based on the over-detected data; and a notification unit that notifies the determination unit of the determination result.

[0016] Invention Effects

[0017] According to the present invention, it is possible to appropriately select a method that follows changes in the normal state. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the relationship between the determination device and the detection system.

[0019] Figure 2 This is a diagram illustrating an example of the detection engine's actions.

[0020] Figure 3 This is a diagram illustrating an example of the detection engine's actions.

[0021] Figure 4 This is a diagram illustrating a structural example of the determination device of the first embodiment.

[0022] Figure 5 This is a flowchart illustrating the processing flow of the determination device in the first embodiment.

[0023] Figure 6 This is a diagram illustrating an example of a computer executing a decision-making procedure. Detailed Implementation

[0024] The following is a detailed description of the implementation of the determination device, determination method, and determination procedure involved in this application, based on the accompanying drawings. However, this invention is not limited to the embodiments described below.

[0025] [Structure of the First Embodiment]

[0026] Figure 1 This is a diagram illustrating the relationship between the determining device and the detection system. For example... Figure 1 As shown, the determination device 30 obtains information related to the over-detection data and detection results from the detection system 1, makes a determination based on the obtained information, and notifies the user of the determination result.

[0027] The detection system 1 includes a learning device 10 and a detection device 20. The learning device 10 uses initial learning data to learn a model and then transfers the information used to build the learned model, i.e., the initial learning model information, to the detection device 20. For example, the model is a VAE equal probability density estimator.

[0028] Furthermore, the learning device 10 uses the over-detection data to learn the model and then transfers the information used to build the learned model, i.e., the over-detection model information, to the detection device 20. The detection device 20 constructs various models based on the information received from the learning device 10 and performs anomaly detection on the target data.

[0029] The detection system 1 may also have the same structure and function as the evaluation device described in Patent Document 1. In this case, the learning device 10 corresponds to the generation unit in the evaluation device described in Patent Document 1. Furthermore, the detection device 20 corresponds to the evaluation unit in the evaluation device described in Patent Document 1.

[0030] Over-detection data refers to data that was judged as abnormal by an initial learning model that was trained using initial learning data, but which should have been normal. Additionally, a model trained solely using over-detection data is an over-detection model. Over-detection feedback is a method that uses both the initial learning model and the over-detection model simultaneously (see Patent Document 1 for details).

[0031] Here, the mechanism that simultaneously uses an initial learning model and an over-detection model is referred to as a detection engine. The detection engine calculates anomaly scores for the input evaluation data using both the initial learning model and the over-detection model. Furthermore, the detection engine considers the minimum of the two anomaly scores as the final anomaly score. Additionally, the detection engine can approximate the minimum value of the logsumexp of the two anomaly scores.

[0032] For example, such as Figure 2As shown, when the initial learning model calculates a low score and the over-detection model calculates a high score, the detection engine outputs the lower score as the final outlier score. Figure 2 This is a diagram representing an example of the detection engine's actions.

[0033] For example, such as Figure 3 As shown, when the initial learning model calculates a high score and the over-detection model calculates a low score, the detection engine outputs the lower score as the final outlier score. Figure 3 This is a diagram representing an example of the detection engine's actions.

[0034] The detection engine can use one or more over-detected models simultaneously with the initial learning model. When there are multiple over-detected models, for a single evaluation dataset, the engine calculates the number of over-detected models plus one anomaly score. Furthermore, the detection engine considers the lowest anomaly score among these as the final anomaly score.

[0035] There are two concerns regarding overdetection feedback. The first concern is that the overdetection model is smaller than the initial learning model, thus limiting the patterns it can learn from the data. Therefore, if a large number of patterns are to be fed back at once, the overdetection model cannot learn all the overdetected data well, and the feedback may not always be effective.

[0036] The second concern is that, while multiple overdetection models can be used simultaneously as mentioned above, an excessive increase in the number of overdetection models increases the risk of incorrectly identifying abnormal data as normal and missing detections. Essentially, the ideal relationship between the initial learning model and the overdetection models is as follows: the initial learning model accurately reflects the normal state, while the overdetection models absorb the subtle differences between the initial learning model and the normal state.

[0037] In this context, relearning requires collecting new learning data. Therefore, relearning can be considered a highly effective but extremely costly method. Thus, overtesting feedback is preferred when it can be used. On the other hand, due to the concerns mentioned above regarding overtesting feedback, there are also situations where it is better not to use it.

[0038] Therefore, in this embodiment, the determination device 30 automatically determines whether relearning or over-detection feedback should be used based on prescribed information, and notifies the user of the result. As a result, according to this embodiment, a method for following changes in the normal state can be appropriately selected.

[0039] use Figure 4 The determination device 30 will be described. Figure 4This is a diagram illustrating a structural example of the determination device according to the first embodiment. (See diagram for example.) Figure 4 As shown, the determination device 30 has an IF (interface) unit 31, a storage unit 32, and a control unit 33.

[0040] The IF section 31 is an interface for data input and output. For example, the IF section 31 is a NIC (Network Interface Card). Additionally, the IF section 31 can also be connected to input devices such as a mouse and keyboard, and output devices such as a monitor.

[0041] Storage unit 32 is a storage device such as HDD (Hard Disk Drive), SSD (Solid State Drive), or optical disc. Alternatively, storage unit 32 can also be a rewritable semiconductor memory such as RAM (Random Access Memory), flash memory, or NVSRAM (Non-Volatile Static Random Access Memory). Storage unit 32 stores the OS (Operating System) and various programs executed by the determination device 30.

[0042] The control unit 33 controls the entire determination device 30. The control unit 33 may be, for example, an electronic circuit such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), or GPU (Graphics Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). Furthermore, the control unit 33 has internal memory for storing programs and control data that define various processing steps, and uses the internal memory to execute each process. In addition, the control unit 33 functions as various processing units by causing various programs to operate. For example, the control unit 33 includes an acquisition unit 331, a determination unit 332, and a notification unit 333.

[0043] The acquisition unit 331 acquires information from the detection system 1 required for judgment. For example, the acquisition unit 331 acquires at least one of the following: information related to an initial learning model generated from initial learning data known to be normal; information related to over-detected data detected by the anomaly detection system using the initial learning model; and information related to an over-detection model generated based on the over-detection data. Furthermore, the initial learning model is an example of a first model. Additionally, the over-detection model is an example of a second model.

[0044] For example, the acquisition unit 331 acquires the number, category, and specific values ​​of the initial learning data and the over-detection data. Furthermore, the acquisition unit 331 obtains the value of the loss function and the calculated anomaly score for the initial learning model and the over-detection model.

[0045] The determination unit 332 determines whether relearning is needed based on the information acquired by the acquisition unit 331. That is, the determination unit 332 determines whether relearning of the initial learning model is needed based on at least one of the following: information related to the initial learning model generated by learning from the initial learning data known to be normal; information related to the over-detected data detected by the anomaly detection system using the initial learning model; and information related to the over-detection model generated based on the over-detected data.

[0046] The notification unit 333 notifies the determination unit 332 of the determination result. The notification unit 333 then informs the user whether further learning is required. For example, when selecting a method to make the model follow the normal state, the user can choose to relearn if the determination unit 332 determines that further learning is required, or choose over-detection feedback if the determination unit 332 does not determine that further learning is required.

[0047] The conditions under which the determination unit 332 determines whether relearning of the initial learning model is required will be explained below. The conditions are broadly divided into (1) conditions related to over-detection data and (2) conditions related to the initial learning model. In addition, each condition can be used individually or in combination. For example, the determination unit 332 determines that relearning is required if any of the following conditions are met.

[0048] (1) Conditions for over-detection data

[0049] If the ratio of the number of over-detected data items to the number of initial learning data items exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. For example, if the number of over-detected data items used in the learning of the over-detected model exceeds 30% of the number of initial learning data items, the determination unit 332 determines that the initial learning model needs to be relearned.

[0050] This is because overdetection feedback is intended to correct small deviations from the initial learning; if too much overdetection data is fed back, it will not function properly.

[0051] Furthermore, if the determination unit 332 determines that the initial learning model needs to be relearned when the number of categories when classifying over-detected data into multiple categories according to a predetermined benchmark exceeds a predetermined value relative to the number of categories when classifying the initial learning data according to the benchmark. For example, if the object's data is information about each packet or each stream generated in communication, the categories may differ based on communication protocols and port numbers.

[0052] For example, in the case of increased communication based on a communication protocol that did not exist when the initial learning model was learned, traffic may tend to change significantly, suggesting that the initial learning model needs to be relearned.

[0053] If the loss function of the over-detection model exceeds a predetermined value, the decision unit 332 determines that relearning of the initial learning model is necessary. This means that the loss function of the over-detection model cannot be sufficiently reduced using only over-detection data, and therefore the quality of the over-detection model will not improve. In such cases, relearning of the initial learning model is deemed necessary.

[0054] (2) Conditions related to the initial learning model

[0055] If the proportion of data in the data to be detected that has not been detected as abnormal by an anomaly detection system that has used a detection model exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. For example, if the number of data items that have been determined as normal by the detection model exceeds 40% of the number of data items to be detected, the determination unit 332 determines that the initial learning model needs to be relearned.

[0056] Furthermore, data deemed normal refers to data with low anomaly scores that were not detected as anomalies. This is likely due to an increase in data that is more suitable for the over-detection model compared to the initial learning model.

[0057] If the anomaly score, representing the degree of anomalousness, calculated by the initial learning model exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. This is because the tendency of normal data has changed, and the initial learning model has calculated a higher anomaly score for data that is actually normal.

[0058] Furthermore, the decision unit 332 can make decisions based on conditions related to the initial learning model, such as at fixed intervals. For example, the decision unit 332 makes decisions based on data from the most recent 4 hours.

[0059] [Processing of the First Embodiment]

[0060] Figure 5 This is a flowchart illustrating the processing flow of the determination device according to the first embodiment. First, the determination device 30 acquires information related to over-detection data, information related to the initial learning model, and information related to the over-detection model (step S101). The determination device 30 may acquire all of this information or only a portion of it.

[0061] Next, the determining device 30 determines, based on the acquired information, whether the conditions for needing relearning are met (step S102). If the conditions are met (step S103, Yes), the determining device 30 notifies that relearning is needed (step S104). If the conditions are not met (step S103, No), the determining device 30 does not notify that relearning is needed and ends the process.

[0062] [Effects of the First Embodiment]

[0063] As explained above, the determination unit 332 determines whether relearning of the initial learning model is necessary based on at least one of the following: information related to the initial learning model generated by learning from initial learning data known to be normal; information related to over-detected data detected by the anomaly detection system using the initial learning model; and information related to the over-detection model generated based on the over-detected data. The notification unit 333 then notifies the determination unit 332 of the determination result. In this way, the determination device 30 automatically determines and notifies whether relearning is necessary. As a result, according to this embodiment, a method for appropriately following changes in the normal state can be selected.

[0064] If the ratio of the number of over-detected data items to the number of initial learning data items exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. This prevents a large amount of over-detected data from being fed back, thus preventing the over-detection model from functioning properly.

[0065] If the number of categories when classifying over-detected data into multiple categories according to a predetermined benchmark exceeds a predetermined value relative to the number of categories when classifying initial learning data according to the benchmark, the determination unit 332 determines that the initial learning model needs to be relearned. This allows the detection of situations where the data's tendency changes significantly, resulting in a relative decrease in the accuracy of the initial learning model.

[0066] If the loss function of the over-detected model exceeds a predetermined value, the decision unit 332 determines that the initial learning model needs to be relearned. This allows the detection of situations where the quality of the over-detected model no longer improves.

[0067] If the proportion of data in the data to be detected that has not been detected as abnormal by an anomaly detection system exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. This allows the system to detect changes in the data's tendency, making it unsuitable for the initial learning model but suitable for the over-detection model.

[0068] If the score representing the degree of anomaly calculated by the initial learning model exceeds a predetermined value, the determination unit 332 determines that the initial learning model needs to be relearned. This allows for the detection of situations where the data's trend changes significantly, resulting in a relative decrease in the accuracy of the initial learning model.

[0069] [Example]

[0070] The detection system 1 and determination device 30 of this embodiment can be applied to anomaly detection of IoT devices. For example, the detection system 1 performs statistical processing on packets captured by network sensors installed in the IoT network to generate traffic features. Then, the detection system 1 uses the traffic features to learn a generative model (probability density estimator) to generate an initial learning model.

[0071] Then, the detection system 1 uses the initial learned model to continuously perform anomaly detection within a fixed period, storing the over-detection data. The determination device 30 obtains information related to the stored over-detection data and each model from the detection system 1, determines whether relearning is needed, and recommends relearning as needed.

[0072] [System architecture, etc.]

[0073] Furthermore, the constituent elements of the devices illustrated are functional conceptual elements and do not necessarily need to be physically configured as shown in the illustrations. That is, the specific methods of distributing and integrating the devices are not limited to those shown in the illustrations; they can be configured by distributing or integrating all or part of them functionally or physically, depending on various loads and usage conditions. Moreover, all or any part of the processing functions performed by each device can be implemented by a CPU (Central Processing Unit) and the program executed by that CPU, or it can be implemented as hardware based on wiring logic. Furthermore, the program can be executed not only by the CPU but also by other processors such as a GPU.

[0074] Furthermore, in each of the processes described in this embodiment, all or part of the processes described as automatically performed can be performed manually, or all or part of the processes described as manually performed can be performed automatically using known methods. In addition, the processing steps, control steps, specific names, and information containing various data or parameters shown in the above documents or drawings can be arbitrarily changed, except where specifically stated.

[0075] [program]

[0076] As one implementation, the determination device 30 can be installed by installing the determination program that performs the above-described determination process as packaged software or online software into a desired computer. For example, by having an information processing device execute the above-described determination program, the information processing device can function as the determination device 30. The information processing device mentioned here includes desktop or laptop personal computers. In addition, the scope of information processing devices includes mobile communication terminals such as smartphones, mobile phones or PHS (Personal Handyphone System), and tablet terminals such as PDA (Personal Digital Assistant).

[0077] Furthermore, the determination device 30 can also be installed by using a user's terminal device as a client and the determination device 30 as a determination server device that provides services related to the determination process described above to that client. For example, the determination server device can be installed as a server device that takes information related to over-detection data as input and outputs whether relearning is needed as output. In this case, the determination server device can be installed as a web server or as a cloud service that provides services related to the determination process described above through outsourcing.

[0078] Figure 6 This diagram illustrates an example of a computer executing a decision-making procedure. Computer 1000, for example, includes a memory 1010 and a CPU 1020. Computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected via a bus 1080.

[0079] The memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, boot programs such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, removable storage media such as disks or optical discs are inserted into disk drive 1100. Serial port interface 1050 is connected, for example, to mouse 1110 and keyboard 1120. Video adapter 1060 is connected, for example, to monitor 1130.

[0080] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program defining each process of the determination device 30 is installed as a program module 1093 containing code executable by a computer. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for performing processes with the same functional structure as those in the determination device 30 is stored in the hard disk drive 1090. Alternatively, the hard disk drive 1090 can be replaced by an SSD (Solid State Drive).

[0081] Furthermore, the setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed, and executes the processing of the above-described embodiment.

[0082] Furthermore, program module 1093 and program data 1094 are not limited to being stored in hard disk drive 1090; for example, they can also be stored in removable storage media and read by CPU 1020 via disk drive 1100, etc. Alternatively, program module 1093 and program data 1094 can also be stored in other computers connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Moreover, program module 1093 and program data 1094 can also be read from other computers by CPU 1020 via network interface 1070.

[0083] Label Explanation

[0084] 1. Detection System

[0085] 10 learning devices

[0086] 20 detection devices

[0087] 30 Judgment Device

[0088] 31IF Department

[0089] 32 Storage Unit

[0090] 33 Control Department

[0091] 331 Acquisition Department

[0092] 332 Judgment Department

[0093] 333 Notification Department

Claims

1. A determining device, characterized in that, have: The determination unit determines whether the first model, which was generated by learning from initial learning data known to be normal, needs to be relearned based on the following information: information related to the second model generated based on over-detection data detected by the anomaly detection system that used the first model. as well as The notification department notifies the determination department of the determination result. The over-detected data refers to data that was judged as abnormal by the first model but should have been normal in the first place. If the proportion of data in the data to be detected that was not detected as abnormal by the anomaly detection system using the second model exceeds a predetermined value, the determination unit determines that the first model needs to be relearned.

2. The determining device according to claim 1, characterized in that, If the ratio of the number of over-detected data items to the number of initial learning data items exceeds a predetermined value, the determination unit determines that the first model needs to be relearned.

3. The determining device according to claim 1, characterized in that, If the number of categories when the over-detected data is classified into multiple categories according to a specified benchmark exceeds a specified value relative to the number of categories when the initial learning data is classified according to the benchmark, the determination unit determines that the first model needs to be relearned.

4. The determining device according to claim 1, characterized in that, If the loss function of the second model exceeds a predetermined value, the decision unit determines that the first model needs to be relearned.

5. The determining device according to claim 1, characterized in that, If the score representing the degree of anomaly calculated by the first model exceeds a predetermined value, the determination unit determines that the first model needs to be relearned.

6. A determination method, executed by a determination device, the determination method comprising the following steps: The determination process, based on the following information, determines whether the first model, generated by learning from initial learning data known to be normal, needs to be relearned: this information relates to information about the second model generated based on over-detection data detected by the anomaly detection system that used the first model; and The notification process notifies the determination process of its determination result. The over-detected data refers to data that was judged as abnormal by the first model but should have been normal in the first place. If the proportion of data in the data to be detected that was not detected as abnormal by the anomaly detection system using the second model exceeds a predetermined value, it is determined in the determination process that the first model needs to be relearned.

7. A recording medium storing a determination program that causes a computer to perform the following steps: The determination step, based on the following information, determines whether the first model, generated by learning from initial learning data known to be normal, needs to be relearned: this information relates to information about the second model generated based on over-detected data detected by an anomaly detection system that used the first model; and The notification step informs the user of the determination result from the determination step. The over-detected data refers to data that was judged as abnormal by the first model but should have been normal in the first place. If the proportion of data in the data to be detected that was not detected as abnormal by the anomaly detection system using the second model exceeds a predetermined value, it is determined in the determination step that the first model needs to be relearned.

Images