Estimation device, estimation method, and recording medium

Abstract

The present invention provides an estimation device, an estimation method, and a recording medium. An estimation unit (15b) estimates normal data having the greatest similarity to abnormal data determined to be abnormal among a plurality of normal data determined to be normal. An extraction unit (15c) compares the abnormal data with the normal data estimated to have the greatest similarity, and extracts a portion of the abnormal data where the portion corresponding to the normal data does not exist as a cause of the abnormality.

Description

Technical Field

[0001] The present invention relates to an estimation device, an estimation method, and a recording medium. Background Art

[0002] In recent years, efforts to optimize factories by effectively utilizing communication data from control devices within factories, known as smart factories, have been advancing. Meanwhile, concerns about new types of cyberattacks targeting smart factories have led to an urgent need for security measures. Defending against these new types of cyberattacks is difficult, and technologies are needed to detect them. In particular, anomaly detection, which utilizes deep learning to automatically learn normal features from input data, is highly anticipated as it can accurately detect these new types of cyberattacks.

[0003] However, the deep learning judgment process is a black box. If it is actually used, the reason for detecting an anomaly cannot be explained, making it difficult for security personnel to determine the cause of the anomaly. Therefore, in recent years, a technology called interpretable AI has been disclosed that uses deep learning to explain the cause of anomalies (see Non-Patent Document 1).

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-Patent Literature 1: William Briguglio and Sherif Saad, “Interpreting Machine Learning Malware Detectors Which Leverage N-gram Analysis,” [online], [retrieved April 14, 2021], website <URL: https: / / arxiv.org / abs / 2001.10916.pdf>

[0007] Non-Patent Literature 2: Xiao Zhang, Manish Marwah, I-ta Lee, Martin Arlitt, Dan Goldwasser, “ACE - An Anomaly Contribution Explainer for Cyber-Security Applications”, [online], [retrieved April 14, 2021], website <URL: https: / / arxiv.org / pdf / 1912.00314.pdf> Summary of the Invention

[0008] Problems to be solved by the invention

[0009] However, in conventional technologies, fixed-length communication data is used as the target of abnormality detection to identify the cause of the abnormality, and variable-length communication data cannot be used as the target of abnormality detection to identify the cause of the abnormality.

[0010] The present invention has been made in view of the above circumstances, and an object of the present invention is to be able to identify the cause of an abnormality by using communication data of variable length as a target of abnormality detection.

[0011] Means for solving problems

[0012] In order to solve the above-mentioned problems and achieve the purpose, the estimation device of the present invention is characterized by comprising: an estimation unit, which estimates normal data having the greatest similarity with abnormal data determined to be abnormal among multiple normal data determined to be normal; and an extraction unit, which compares the abnormal data with the normal data estimated to have the greatest similarity, and extracts a portion of the abnormal data in which the portion corresponding to the normal data does not exist as a cause of the abnormality.

[0013] Effects of the Invention

[0014] According to the present invention, it is possible to identify the cause of abnormality by using communication data of variable length as a target for abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram for explaining the outline of an estimation device.

[0016] Figure 2 It is a schematic diagram illustrating a schematic configuration of an estimation device.

[0017] Figure 3 It is a diagram illustrating the extraction processing results.

[0018] Figure 4 is a flowchart showing the estimation process steps.

[0019] Figure 5 It is a figure for explaining an embodiment.

[0020] Figure 6 This is a diagram illustrating a computer that executes an estimation program. DETAILED DESCRIPTION

[0021] Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to this embodiment. In the description of the accompanying drawings, the same reference numerals are used to indicate the same parts.

[0022] [Overview of Estimation Device]

[0023] Figure 1 is a diagram for explaining the outline of the estimation device. Figure 1 As shown in FIG. 1 , the estimation device of this embodiment uses variable-length communication data as the target of abnormality detection and identifies the byte portion estimated to be the cause of the abnormality in the communication data. Specifically, Figure 1 As shown in (a), for a pair of communication data determined to be abnormal (abnormal determination data) and a plurality of communication data determined to be normal (normal determination data), as shown in (a), Figure 1 As shown in (b), the normal judgment data that is most similar to the abnormal judgment data is determined. At this time, the estimation device applies a dynamic programming method that records the calculation results of the divided parts and obtains the overall calculation results at the same time, and calculates the similarity between the abnormal judgment data and each normal judgment data. Figure 1 As shown in (c), the location where the gap exists is identified and estimated to be an abnormal byte that causes abnormality determination.

[0024] [Structure of Estimation Device]

[0025] Figure 2 Schematic diagram showing the schematic structure of the estimation device. Figure 2 As illustrated, the estimation device 10 is implemented by a general-purpose computer such as a personal computer, and includes an input unit 11 , an output unit 12 , a communication control unit 13 , and a control unit 15 .

[0026] The input unit 11 is implemented using input devices such as a keyboard and a mouse, and inputs various instruction information such as starting a process to the control unit 15 in response to input operations by the operator. The output unit 12 is implemented by a display device such as a liquid crystal display, a printing device such as a printer, and the like.

[0027] The communication control unit 13 is implemented by a NIC (Network Interface Card) or the like, and controls communication between the control unit 15 and external devices such as servers via the network. For example, the communication control unit 13 controls communication between the control unit 15 and a management device that manages data sets and parameters that are the subject of estimation processing, which will be described later.

[0028] The control unit 15 is implemented using a CPU (Central Processing Unit) and the like, and executes a processing program stored in a memory. Figure 2As illustrated, the control unit 15 functions as an acquisition unit 15a, an estimation unit 15b, and an extraction unit 15c. Furthermore, these functional units may be implemented separately or partially on separate hardware. For example, the estimation unit 15b and the extraction unit 15c may be implemented on separate hardware. Furthermore, the control unit 15 may include other functional units.

[0029] The acquisition unit 15a acquires data determined to be abnormal and multiple data determined to be normal. For example, the acquisition unit 15a acquires abnormal data, which is the subject of estimation processing (described later), a dataset of normal data used in the estimation processing, and parameters used in the estimation processing, via the input unit 11 or from a management device that manages deep learning results, etc., via the communication control unit 13.

[0030] Furthermore, the acquisition unit 15a may store the acquired data in a storage unit (not shown) implemented by a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk. Alternatively, the acquisition unit 15a may not store this information in the storage unit but instead forward it to the estimation unit 15b described below.

[0031] The estimation unit 15b estimates the normal data that has the greatest similarity to the abnormal data determined to be abnormal, among the plurality of normal data determined to be normal. Specifically, the estimation unit 15b uses the acquired data to evaluate the similarity between the payloads of the packets determined to be abnormal and the set of payloads of the packets determined to be normal, thereby estimating the payload that is most similar to the payload of the packets determined to be abnormal.

[0032] For example, the estimation unit 15b applies dynamic programming to calculate the similarity between abnormal data and normal data. Here, the estimation device 10 processes the payload of a data packet containing, for example, one piece of abnormal data and a plurality of pieces of normal data, such as 100 or more, from among the data determined to be abnormal / normal by deep learning-based anomaly detection. The payload is a variable-length data string of at least 1, represented by a hexadecimal string such as [00 00 10FF 10], for example.

[0033] The estimation unit 15b calculates the similarity between the abnormal data and the normal data, assuming that the characters appearing in the abnormal data and the normal data are in a continuous cycle. That is, the estimation unit 15b assumes that the byte characters (00 to FF) appearing in the data are cyclical, and for example, sets the similarity between the byte characters "00" and "FF" and the similarity between "00" and "01" to the same value.

[0034] In addition, the estimation unit 15b calculates an abnormal data string X=[x1, x2, ..., x n ] and multiple normal data strings Y 1 , Y 2 ,…,Y k ,…,Y l A normal data string Y=[y1,y2,…,y m ] The similarity S between them. At this time, the estimation unit 15b uses the dynamic programming method to calculate the Y with the highest similarity to X. target .

[0035] The dynamic programming method can be expressed as shown in the following equations (1) and (2).

[0036] [Mathematical formula 1]

[0037]

[0038] [Mathematical formula 2]

[0039]

[0040] The above formula (1) uses one character x in the abnormal data string X i With the 1 character y in the normal data string Y j The similarity between s(x i ,y j ), quantify the similarity S(i, j) between X and Y.

[0041] In addition, in the first line of the above formula (1), as shown in the above formula (2), in x i with y j In the case of consistency, as s(x i ,y j ) + 10, in case of inconsistency, subtract x i with y j distance.

[0042] Alternatively, for example, in the case of comparison with the byte character "00" of abnormal data, the estimation unit 15b can also be pre-set to: the similarity s of the character with the byte character "00" of normal data as the comparison target is +10, the similarity s with the characters "01", "02", "03", "FF", "FE", and "FD" is +5, and the similarity s with other byte characters is -5.

[0043] In this manner, the estimation unit 15 b calculates the similarity between the abnormal data and the normal data, setting the similarity s between the characters of the abnormal data and the characters of the normal data to a value within a predetermined range.

[0044] In addition, after evaluating the abnormal data string X and the kth normal data string Yk After the similarity between the abnormal data string X and the k+1th normal data string Y is determined, the estimation unit 15b repeatedly performs the k+1 The similarity between them is evaluated until the lth normal data string Y l .

[0045] In this way, the estimation unit 15 b can compare variable-length data using dynamic programming.

[0046] Afterwards, the estimation unit 15b calculates the similarity between the abnormal data string X and each normal data string Y by performing a correction using anomaly scores (anomaly score). That is, the estimation unit 15b calculates the following value as the similarity between the abnormal data string X and each normal data string Y, wherein the value is obtained by multiplying the result of the deep learning-based anomaly detection of each normal data string Y, i.e., the AI ​​anomaly score (anomaly score), by the above-mentioned S(i, j) as a bias. For example, the estimation unit 15b applies a bias so that the similarity score between the normal data with a low anomaly score and the abnormal data becomes higher. Then, the estimation unit 15b determines the normal data string Y with the highest calculated similarity as Y target .

[0047] The extraction unit 15c compares the abnormal data with the normal data estimated to have the greatest similarity, and extracts the portion of the abnormal data where the portion corresponding to the normal data is absent as the cause of the abnormality. Specifically, the extraction unit 15c extracts the portion of the payload of the packet determined to be abnormal where there is a gap between the payload and the estimated payload as the abnormal portion.

[0048] For example, if the payload of the abnormal data serving as the comparison source is "00 11FF FD" and the payload of the normal data serving as the comparison target is "00FF FD," the portion corresponding to the second byte "11" of the comparison source does not exist in the normal data, so the extraction unit 15c determines that portion as an abnormal portion. In this case, the extraction unit 15c replaces the second byte of the normal data with a space character.

[0049] In addition, when the second byte of the normal data is not "11", the second bytes of the abnormal data and the normal data may be extracted as a portion where a gap exists.

[0050] Furthermore, the extraction unit 15c outputs the extracted abnormal areas via the output unit 12. For example, the extraction unit 15c outputs a payload consisting of pairs of abnormal data and normal data to the output unit 12, such as a display, highlighting the areas with gaps that are determined to be abnormal areas. Furthermore, the extraction unit 15c may output information about the extracted abnormal areas to other information processing devices via the communication control unit 13.

[0051] Here, Figure 3 is a diagram illustrating the extraction processing results. Figure 3 In FIG, the normal data having the greatest similarity to the abnormal data and the portion of the abnormal data where there is a gap between the normal data and the abnormal data are shown. Figure 3 In the example, as shown in bold, "0X86 0X8C 0X5F" is displayed as an abnormal location where a gap exists.

[0052] [Estimated processing]

[0053] Next, refer to Figure 4 , the estimation process performed by the estimation device 10 of this embodiment will be described. Figure 4 is a flowchart showing the estimation process steps. Figure 4 The process starts, for example, at the timing of an operation input instructing to start the estimation process.

[0054] First, the acquisition unit 15a acquires abnormal data determined to be abnormal and a plurality of normal data determined to be normal (step S1).

[0055] Next, the estimation unit 15b generates pairs of abnormal data and normal data (step S2). Furthermore, the estimation unit 15b estimates the pair having the highest similarity between the abnormal data and the normal data among the generated pairs (step S3).

[0056] For example, the estimation unit 15b uses dynamic programming to calculate the similarity of each pair. In this case, the estimation unit 15b calculates the similarity of each pair under the assumption that the characters appearing in the abnormal data and the normal data are in a continuous cycle. Furthermore, the estimation unit 15b calculates the similarity of each pair using the similarity between the characters in the abnormal data and the characters in the normal data as a value within a specified range. Furthermore, the estimation unit 15b calculates the similarity of each pair by performing correction using anomaly scores.

[0057] Furthermore, the extraction unit 15c compares the abnormal data with the normal data estimated to have the highest similarity, and extracts a portion of the abnormal data where there is no portion corresponding to the normal data but a gap as a cause of the abnormality (step S4).

[0058] Then, the extraction unit 15c highlights the portion with a gap determined to be an abnormal portion, and outputs the portion to the output unit 12 (step S5). Thus, a series of estimation processes are completed.

[0059] As described above, in the estimation device 10, the estimation unit 15b estimates the normal data that has the greatest similarity to the abnormal data determined to be abnormal, among the plurality of normal data determined to be normal. The extraction unit 15c compares the abnormal data with the normal data with the estimated greatest similarity, and extracts the portion of the abnormal data where the portion corresponding to the normal data is absent as the cause of the abnormality.

[0060] In this way, the estimation device 10 can identify the portion of the abnormal data that is most similar to the normal data and differs from the normal data as the cause of the abnormality, regardless of the length of the normal data and the abnormal data. Thus, the estimation device 10 can use variable-length communication data as the target of abnormality detection to identify the cause of the abnormality.

[0061] In addition, the estimation unit 15b applies dynamic programming to calculate the similarity between abnormal data and normal data. In this way, the estimation device 10 can accurately determine the cause of the abnormality by specifically calculating the similarity between abnormal data and normal data using variable-length communication data as the target of abnormality detection.

[0062] In addition, the estimation unit 15b calculates the similarity between the abnormal data and the normal data assuming that the characters appearing in the abnormal data and the normal data are continuous cycles. In this way, the estimation device 10 can identify the cause of the abnormality by specifically and efficiently calculating the similarity.

[0063] Furthermore, the estimation unit 15b calculates the similarity between the abnormal data and the normal data, setting the similarity between the characters of the abnormal data and the characters of the normal data to a value within a predetermined range.

[0064] Furthermore, the estimation unit 15b calculates the similarity between the abnormal data and the normal data by performing correction using the abnormality score. In this way, the estimation device 10 can identify the cause of the abnormality by specifically and accurately calculating the similarity.

[0065] [Example]

[0066] Figure 5 1 is a diagram for explaining an embodiment. In this embodiment, the estimation accuracy of the byte portion of abnormal communication data generated in a network attack scenario assumed as follows was measured.

[0067] As a cyberattack scenario, a malicious person can insert code for executing a malicious program into a portion of a normal communication to perform illegal operations. The byte portion where the malicious code is inserted is estimated to be an abnormal portion.

[0068] For example, when normal communication is "00 01 00 00 00 41 6b" and abnormal communication is "00 01 00 00 541bFF FF 31 00 41 6b", the inserted malicious code "54 1b FF FF 31" is determined to be an abnormal portion.

[0069] Using 2133 normal data and 100 abnormal data of each type (1 to 3) according to the length of the inserted malicious code in the data packets that were assigned normal labels or abnormal labels through deep learning, a byte string of malicious code was inserted into a random position of the normal data.

[0070] The abnormal location is determined for each data packet. In order to obtain a data format that can be used in the dynamic programming method, each byte is converted from a hexadecimal number (0x00 to 0xff) to a numerical value (0 to 255).

[0071] Figure 5 The evaluation results of the embodiment are shown as an example. In the evaluation, for each data packet, it is checked whether the estimated byte string of the abnormal part is completely consistent. If it is completely consistent, it is considered correct, and if it is not completely consistent, it is considered incorrect.

[0072] like Figure 5 As shown, the following results were confirmed: when the abnormal byte string was inserted into one location, the abnormal location was estimated in all data packets; when the abnormal byte string was inserted into two locations, the abnormal location was not correctly estimated in two data packets; when the abnormal byte string was inserted into three locations, the abnormal location was not correctly estimated in six data packets, but overall it was possible to estimate the abnormal location with an accuracy of more than 90%.

[0073] [program]

[0074] It is also possible to generate a program that describes the processing performed by the estimation device 10 of the above embodiment in a computer-executable language. As an embodiment, the estimation device 10 can be implemented by installing the estimation program that performs the above estimation processing as packaged software or online software on a desired computer. For example, by causing an information processing device to execute the above estimation program, the information processing device can function as the estimation device 10. In addition, information processing devices also include mobile communication terminals such as smartphones, mobile phones, PHS (Personal Handyphone System), and tablet terminals such as PDA (Personal Digital Assistant). In addition, the functions of the estimation device 10 can also be implemented on a cloud server.

[0075] Figure 6 The computer 1000 includes, for example, a memory 1010 , a CPU 1020 , a hard disk drive interface 1030 , a disk drive interface 1040 , a serial port interface 1050 , a video adapter 1060 , and a network interface 1070 . These components are connected via a bus 1080 .

[0076] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. Removable storage media such as magnetic disks and optical disks are inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, a display 1061.

[0077] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each information described in the above embodiment is stored in the hard disk drive 1031 and the memory 1010, for example.

[0078] The estimation program is stored in the hard disk drive 1031 as, for example, a program module 1093 describing instructions executed by the computer 1000. Specifically, the program module 1093 describing each process executed by the estimation device 10 described in the above embodiment is stored in the hard disk drive 1031.

[0079] Data used in information processing by the estimation program is stored as program data 1094 in, for example, hard disk drive 1031. CPU 1020 then reads program module 1093 and program data 1094 stored in hard disk drive 1031 to RAM 1012 as needed to execute the above steps.

[0080] Furthermore, the program modules 1093 and program data 1094 involved in the estimation program are not limited to being stored in the hard disk drive 1031. For example, they may be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program modules 1093 and program data 1094 involved in the estimation program may be stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network) and read by the CPU 1020 via the network interface 1070.

[0081] While the embodiments of the invention developed by the present inventors have been described above, the present invention is not limited to the description and drawings that constitute part of the disclosure of the present invention based on these embodiments. In other words, other embodiments, examples, and application technologies developed by those skilled in the art based on these embodiments are all within the scope of the present invention.

[0082] Description of labels

[0083] 10 Estimation device

[0084] 11 Input section

[0085] 12 Output section

[0086] 13 Communication Control Unit

[0087] 15 Control Unit

[0088] 15a Acquisition

[0089] 15b Estimation Department

[0090] 15c Extraction Department

Claims

1. An estimation device, characterized in that have: an estimating unit that estimates normal data having the greatest similarity to abnormal data determined to be abnormal among a plurality of normal data determined to be normal; as well as an extraction unit that compares the abnormal data with the normal data estimated to have the greatest similarity, and extracts a portion of the abnormal data where the portion corresponding to the normal data does not exist as a cause of the abnormality, The estimation unit calculates the similarity by applying a dynamic programming method and assuming that characters appearing in the abnormal data and the normal data are in a continuous cycle.

2. The estimation device according to claim 1, characterized in that The estimation unit calculates the similarity by setting the similarity between characters of abnormal data and characters of normal data to a value within a predetermined range.

3. The estimation device according to claim 1, wherein The estimation section calculates the similarity by performing correction using anomaly scores.

4. An estimation method, which is performed by an estimation device, characterized in that: The estimation method includes: an estimating step of estimating normal data having the greatest similarity to abnormal data determined to be abnormal among a plurality of normal data determined to be normal; and The extraction step compares the abnormal data with the normal data estimated to have the greatest similarity, and extracts the portion of the abnormal data where the portion corresponding to the normal data does not exist as the cause of the abnormality. In the estimation step, a dynamic programming method is applied to calculate similarity assuming that characters appearing in abnormal data and normal data are in a continuous cycle.

5. A recording medium, characterized in that The recording medium stores an estimation program that causes a computer to execute the following steps: an estimating step of estimating normal data having the greatest similarity to the abnormal data determined to be abnormal among the plurality of normal data determined to be normal; as well as an extraction step of comparing the abnormal data with the normal data estimated to have the greatest similarity, and extracting a portion of the abnormal data where the portion corresponding to the normal data does not exist as a cause of the abnormality, The computer is caused to apply a dynamic programming method to calculate similarity assuming that the characters appearing in the abnormal data and the normal data are in a continuous cycle.

Images