Learning device, learning method, and learning program

Abstract

The learning device acquires an over-detection alarm in the abnormality detector. The learning device then clusters the acquired over-detection alarms into a plurality of clusters using a Gaussian mixture model. Next, for each cluster, the learning device ranks the over-detection alarms belonging to the cluster in a time sequence, and determines the period of the ranked over-detection alarms. The learning device then samples the over-detection alerts from the cluster at the determined period. The learning device then performs over-detection feedback on the anomaly detector using the over-detection alarms sampled from the respective clusters.

Description

Technical Field

[0001] The present invention relates to a learning device, a learning method and a learning program. Background Art

[0002] Anomaly detection technology using untrained machine learning can also detect new types of cyber attacks with high accuracy, so the social introduction of technology is expected to be promoted. Here, in anomaly detectors using untrained machine learning, alarms are sometimes generated for communications that are actually normal but are detected as abnormal (overdetection alarms). This overdetection alarm makes the investigation of the alarm difficult and hinders the use of the anomaly detector. Therefore, in order to reduce the overdetection of the anomaly detector, additional learning (overdetection feedback) is required to detect situations where the communication that is the subject of the overdetection alarm is actually normal communication.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2019-220866 Summary of the invention

[0006] Problems to be solved by the invention

[0007] However, if multiple over-detection alarms are used for over-detection feedback, the learning time of the anomaly detector becomes longer, or over-learning occurs, and the operation of the anomaly detector may become unstable. Therefore, it is important to select an over-detection alarm for over-detection feedback so that the operation of the anomaly detector does not become unstable. However, in the prior art, there is no research on selecting an over-detection alarm for over-detection feedback so that the operation of the anomaly detector does not become unstable.

[0008] Therefore, an object of the present invention is to solve the above-mentioned problem and select an over-detection alarm for over-detection feedback so that the operation of the abnormality detector does not become unstable.

[0009] Means for solving problems

[0010] In order to solve the above-mentioned problems, the present invention is characterized in that it comprises: an acquisition unit, which acquires communication characteristics of communications that are over-detected in an anomaly detector that detects anomalies in communications; a clustering unit, which clusters the acquired communication characteristics into multiple clusters; a sampling unit, which, for each of the clusters, sorts the communication characteristics belonging to the cluster in time series, determines a period of the sorted communication characteristics, and samples the communication characteristics with the determined period; and a learning unit, which uses the communication characteristics sampled respectively from the clusters to perform additional learning on the anomaly detector for over-detection feedback.

[0011] Effects of the Invention

[0012] According to the present invention, the over-detection alarm for over-detection feedback can be selected so that the operation of the abnormality detector does not become unstable. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a diagram for explaining the outline of a learning device.

[0014] Figure 2 It is a diagram showing a configuration example of a learning device.

[0015] Figure 3 This is a diagram showing examples of feature quantity names constituting communication feature quantities associated with an over-detection alarm.

[0016] Figure 4 This is a flowchart showing an example of a processing procedure executed by the learning device.

[0017] Figure 5 It is a diagram showing the AUC result of the anomaly detector of the comparative example and the AUC result of the anomaly detector that has performed over-detection feedback by the learning device.

[0018] Figure 6 It is a graph showing the accuracy (AUC score) and learning time of the anomaly detector of the comparative example and the anomaly detector that has been subjected to overdetection feedback by the learning device.

[0019] Figure 7 is a diagram showing a computer that executes a learning program. DETAILED DESCRIPTION

[0020] Hereinafter, a mode (embodiment) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to the embodiment described below.

[0021] [summary]

[0022] First, use Figure 1 The outline of the learning device of the present embodiment will be described. The learning device performs over-detection feedback of an anomaly detector (a device that detects anomalies in communication based on a machine learning model learned in advance).

[0023] First, the learning device obtains the over-detection alarm group of the anomaly detector. Then, the learning device clusters similar over-detection alarm groups. For example, when the learning device obtains 3,000 over-detection alarm groups, they are clustered into cluster A (300 items) and cluster B (2,700 items) based on the mixed Gaussian model.

[0024] Next, the learning device sorts the over-detection alarm groups in time series for each cluster to determine the periodicity of the over-detection alarms. Then, the learning device samples the over-detection alarms in units of the determined period for each cluster.

[0025] For example, the learning device samples 100 over-detection alarms from cluster A and 100 over-detection alarms from cluster B. Then, the learning device uses the sampled over-detection alarm group to perform learning of over-detection feedback for the anomaly detector.

[0026] In this way, after clustering the over-detection alarm groups, the learning device samples the over-detection alarms based on the periodicity of the over-detection alarms in each cluster and performs over-detection feedback. As a result, the learning device can use comprehensive and unbiased over-detection alarms to perform over-detection feedback of the anomaly detector. As a result, the learning device does not reduce the accuracy of the anomaly detector and can perform over-detection feedback in a short time.

[0027] [Structure example]

[0028] Next, use Figure 2 A configuration example of the learning device 10 will be described. The learning device 10 includes an input / output unit 11 , a storage unit 12 , and a control unit 13 .

[0029] [Input and output section]

[0030] The input / output unit 11 serves as an interface for the learning device 10 to receive input of various information or output various information. For example, the input / output unit 11 receives input of an over-detection alarm, a communication feature quantity associated with the over-detection alarm, and associated information of the communication feature quantity (for example, the ID of the communication feature quantity, the reception time, etc.) from an external database. In addition, the input / output unit 11 outputs the processing result of the control unit 13. For example, the input / output unit 11 outputs the number of communication feature quantities used for over-detection feedback in the control unit 13, the ID of the communication feature quantity, etc.

[0031] [Storage Department]

[0032] The storage unit 12 stores various information and programs used by the control unit 13 when operating, and various information obtained as a result of the operation of the control unit 13. Here, the storage unit 12 is, for example, a RAM (Random Access Memory), a semiconductor memory element such as a flash memory, or a storage device such as a hard disk or an optical disk.

[0033] The storage unit 12 stores, for example, an over-detection alarm inputted via the input / output unit 11, a communication feature quantity associated with the over-detection alarm, and associated information of the communication feature quantity (collectively referred to as over-detection alarm information). In addition, the storage unit 12 stores parameters of a machine learning model used by an anomaly detector that is the subject of over-detection feedback. The machine learning model is, for example, a model that determines whether the input communication is abnormal and outputs a determination result. The parameters of the machine learning model are updated by executing learning for over-detection feedback through the control unit 13.

[0034] [Control Department]

[0035] The control unit 13 is responsible for overall control of the learning device 10. The control unit 13 includes an acquisition unit 131, a clustering unit 132, a sampling unit 133, a learning unit 134, and an output processing unit 135. The functions of each unit of the control unit 13 are realized by the CPU equipped in the learning device 10 executing a program stored in the storage unit 12.

[0036] [Acquisition Department]

[0037] The acquisition unit 131 acquires the over-detection alarm group of the anomaly detector. For example, the acquisition unit 131 acquires the over-detection alarm group issued from the same device (anomaly detector) from an external database. The device is identified by, for example, the source IP address or source MAC address of the over-detection alarm.

[0038] The acquisition unit 131 also acquires the communication characteristic quantity associated with the overdetection alarm and the associated information of the communication characteristic quantity (eg, the communication characteristic quantity ID, reception time, etc.) from the database. The communication characteristic quantity is the characteristic quantity of the traffic communication data of the overdetection alarm.

[0039] The communication characteristic quantity includes, for example, Figure 3 That is, the communication characteristic quantities include the duration of the communication session, the total number of forward bytes, the total number of forward packets, the average forward packet size, the total number of reverse bytes, the total number of reverse packets, the average reverse packet size, the session destination port number, the judgment score of the anomaly detector, and other characteristic quantities.

[0040] [Clustering Department]

[0041] return Figure 2 The clustering unit 132 clusters the communication feature quantities associated with the over-detection alarm acquired by the acquisition unit 131 into a plurality of clusters.

[0042] For example, the clustering section 132 clusters the communication feature quantities acquired by the acquisition section 131 using a Gaussian mixture model so that similar communication feature quantities belong to the same cluster.

[0043] At this time, for example, in order to determine the number of clusters, the clustering unit 132 first performs clustering in a manner of generating 1 to 10 clusters. Then, the clustering unit 132 determines the best number of clusters from 1 to 10 clusters based on the Bayesian information criterion. In addition, the variance type of the parameters of the above-mentioned mixed Gaussian model is set to be the same variance type for each cluster.

[0044] In addition, the clustering method may be any method that makes the data (communication feature quantities) belonging to each cluster similar to each other and minimizes the deviation of the data within the cluster, and is not limited to the method using the above-mentioned Gaussian mixture model.

[0045] [Sampling Department]

[0046] The sampling unit 133 samples the communication feature quantity from each cluster. For example, the sampling unit 133 sorts the communication feature quantity group belonging to the cluster in time series for each cluster. Then, the sampling unit 133 determines the period of the communication feature quantity group belonging to the cluster for each cluster, and samples the communication feature quantity with the determined period. In addition, when the sampling unit 133 cannot determine the period of the communication feature quantity group belonging to the cluster, the communication feature quantity is randomly sampled from the cluster.

[0047] As a specific example, the sampling unit 133 acquires data (communication feature values) belonging to each cluster and its associated information for each cluster. Then, the sampling unit 133 sorts the communication feature values ​​belonging to each cluster in time series according to the reception time indicated by the acquired associated information.

[0048] Next, the sampling unit 133 calculates the autocorrelation coefficient based on the sorted communication characteristic quantities in the cluster. In addition, the lag as a parameter of the autocorrelation coefficient is set to a value from 1 to the number of data belonging to the cluster. Then, the sampling unit 133 determines the lag that makes the autocorrelation coefficient maximum among the above-mentioned lags as the period (number of periodic data) of the data of the cluster. Then, the sampling unit 133 samples the communication characteristic quantities from the sorted communication characteristic quantities in the cluster according to each determined period. The sampling unit 133 performs the above-mentioned processing on each cluster.

[0049] For example, the sampling unit 133 receives an input of the sampling number N of each cluster from the user of the learning device 10. Then, for each cluster, the sampling unit 133 samples the communication feature quantity from the earliest communication feature quantity in each of the above cycles (number of cycle data) until the above sampling number N is satisfied. Then, the sampling unit 133 records the ID of the sampled communication feature quantity in the learning list.

[0050] In addition, when the maximum value of the autocorrelation coefficient of the communication feature quantity in the cluster does not reach the predetermined threshold value, the sampling unit 133 determines that the period of the communication feature quantity of the cluster cannot be determined (there is no periodicity). Then, the sampling unit 133 randomly samples N data communication feature quantities from the cluster. Then, the sampling unit 133 records the ID of the randomly sampled communication feature quantity in the learning list.

[0051] The learning unit 134 performs learning of over-detection feedback for the abnormality detector using the communication feature amount sampled by the sampling unit 133 .

[0052] For example, based on the ID of the communication feature quantity shown in the above-mentioned learning list, the learning unit 134 obtains the communication feature quantity associated with the over-detection alarm from the storage unit 12. Then, the learning unit 134 uses the acquired communication feature quantity as learning data of normal communication, performs additional learning of the machine learning model used by the anomaly detector, and updates the parameters of the machine learning model.

[0053] The output processing unit 135 outputs the processing result of the control unit 13 via the input / output unit 11. For example, the output processing unit 135 outputs the number of communication feature quantities used for over-detection feedback of the abnormality detector, the ID of the communication feature quantity, the time required for over-detection feedback, and the like.

[0054] According to such a learning device 10, overdetection feedback can be performed in a short time without reducing the accuracy of the anomaly detector. As a result, the learning device 10 can operate the anomaly detector stably.

[0055] [Processing example]

[0056] Next, use Figure 4 An example of the processing procedure of the learning device 10 is described. For example, the learning device 10 receives an input of an over-detection alarm ID and the required number of data N (the number of sampled data for each cluster) (S1). Then, the acquisition unit 131 acquires the communication feature quantity and related information (for example, the reception time of the communication feature quantity) associated with the over-detection alarm ID received in S1 from the database (S2). Then, the clustering unit 132 clusters the communication feature quantity acquired in S2 (S3).

[0057] After that, the sampling unit 133 performs the following processing of S4 to S9 for each cluster generated in the clustering of S3. First, the sampling unit 133 determines whether the number of data (communication characteristics) of the cluster generated in S3 exceeds N (S4). If it is determined to exceed N ("Yes" in S4), the communication characteristics in the cluster are sorted according to the reception time (S6).

[0058] After S6, the sampling unit 133 determines whether the communication feature quantity in the cluster has periodicity (S7). If it is determined to have periodicity (S7: Yes), the sampling unit 133 adds the periodic data satisfying the number N above to the learning list (S9). For example, when the sampling unit 133 determines the period of the sorted communication feature quantity group in the cluster, the sampling unit 133 samples the communication feature quantity according to each determined period. Then, the sampling unit 133 adds the ID of the sampled communication feature quantity to the learning list.

[0059] In S4, when the sampling unit 133 determines that the number of data of the cluster generated in S3 does not exceed N (S4: No), it adds the IDs of all communication feature quantities of the cluster to the learning list (S5: Add all to the learning list), and then moves to the processing of the next cluster.

[0060] In addition, in S7, when the sampling unit 133 determines that the communication feature quantity in the cluster has no periodicity (S7: No), it adds the ID of the communication feature quantity randomly sampled from the communication feature quantity of the cluster to the learning list (S8: adding to the learning list by random sampling). Then, it transfers to the processing of the next cluster.

[0061] After the sampling unit 133 performs the processing of S4 to S9 on all clusters, the learning unit 134 uses the communication feature quantity of the ID recorded in the learning list to perform over-detection feedback on the anomaly detector (S10). For example, the learning unit 134 uses the communication feature quantity of the ID recorded in the learning list to perform additional learning for over-detection feedback on the machine learning model used by the anomaly detector. After that, the output processing unit 135 outputs the ID, number, etc. of the communication feature quantity used for over-detection feedback (S11).

[0062] By executing the above-mentioned processing, the accuracy of the abnormality detector can be not reduced and over-detection feedback can be performed in a short time. As a result, the learning device 10 can operate the abnormality detector stably.

[0063] In addition, the learning device 10 may only sample the communication feature quantity for over-detection feedback, and another device may perform over-detection feedback using the communication feature quantity. In this case, the learning device 10 outputs the sampled communication feature quantity to the device. Then, the device uses the communication feature quantity output from the learning device 10 to perform over-detection feedback.

[0064] In addition, the learning device 10 may further include a detection unit that detects abnormality in input communication using a machine learning model after detection feedback.

[0065] [Evaluation results]

[0066] Next, the results of an evaluation experiment of the accuracy and learning time of an anomaly detector (machine learning model) using detection feedback performed by the learning device 10 of the present embodiment will be described.

[0067] [Experimental conditions]

[0068] The experimental conditions were as follows.

[0069] · This is performed after the initial learning of the anomaly detector has been fully completed.

[0070] A new communication is input to the abnormality detector, so that an over-detection alarm is generated. In addition, the new communication input is a communication of two communication protocols.

[0071] The comparative example is an abnormality detector that has used detection alarms (2,000 cases) for detection feedback.

[0072] The learning device 10 of the present embodiment performs over-detection feedback of the abnormality detector using over-detection alarms (600 cases) sampled from the above-mentioned over-detection alarms (2000 cases).

[0073] The evaluation data is normal communication data (350 pieces) and abnormal communication data (350 pieces). Using this evaluation data, the accuracy (AUC score) and learning time of the anomaly detector of the comparative example and the anomaly detector that performed over-detection feedback in the learning device 10 of this embodiment were evaluated.

[0074] The machine used for the anomaly detector is a terminal on VMware Esxi, with CPU: 16vCPU, memory: 32GB.

[0075] The AUC results of the anomaly detector of the comparative example and the anomaly detector that has been subjected to over-detection feedback in the learning device 10 of this embodiment are shown in FIG. Figure 5 shown.

[0076] like Figure 6 As shown, the accuracy (AUC score) of the anomaly detector that performs over-detection feedback in the learning device 10 of the present embodiment is 0.011 higher than that of the anomaly detector of the comparative example. In addition, it can be confirmed that according to the learning device 10 of the present embodiment, the time required for over-detection feedback (learning time) is shortened by 7 minutes and 54 seconds compared with the comparative example. In other words, it can be confirmed that according to the learning device 10 of the present embodiment, the accuracy of the anomaly detector is not reduced and over-detection feedback can be performed at a high speed.

[0077] [System structure, etc.]

[0078] In addition, the components of each part shown in the figure are functional conceptual elements and do not necessarily need to be physically configured as shown in the figure. That is, the specific method of distributing / integrating each device is not limited to the method shown in the figure, and all or part of it can be functionally or physically distributed / integrated in arbitrary units according to various loads, usage conditions, etc. Furthermore, all or any part of each processing function performed by each device can be implemented by a CPU and a program executed by the CPU, or as hardware based on wired logic.

[0079] In addition, all or part of the processing described in the above-mentioned embodiments as automatically performed processing can also be performed manually, or all or part of the processing described as manually performed processing can also be performed automatically by a known method. In addition, the processing process, control process, specific name, and information including various data and parameters shown in the above-mentioned documents and drawings can be changed arbitrarily unless otherwise specified.

[0080] [program]

[0081] The above-mentioned learning device 10 can be realized by installing a program (learning program) as packaged software or online software on a desired computer. For example, by making an information processing device execute the above-mentioned program, the information processing device can function as the learning device 10. The information processing device mentioned here includes mobile communication terminals such as smart phones, mobile phones or PHS (Personal Handyphone System), and terminals such as PDA (Personal Digital Assistant).

[0082] Figure 7 1000 is a diagram showing an example of a computer that executes a learning program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. In addition, the computer 1000 includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected via a bus 1080.

[0083] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0084] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that specifies each process executed by the above-mentioned learning device 10 is implemented as a program module 1093 in which a code that can be executed by a computer is described. The program module 1093 is stored in, for example, the hard disk drive 1090. For example, the program module 1093 for executing the same process as the functional structure in the learning device 10 is stored in the hard disk drive 1090. In addition, the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0085] The data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. CPU 1020 reads program modules 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 to RAM 1012 as necessary and executes them.

[0086] In addition, the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, and may be stored in a removable storage medium, for example, and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and the program data 1094 may be read from another computer by the CPU 1020 via the network interface 1070.

[0087] Description of Reference Numerals

[0088] 10 Learning Device

[0089] 11 Input and output section

[0090] 12 Storage

[0091] 13. Control Unit

[0092] 131 Acquisition Department

[0093] 132 Clustering Department

[0094] 133 Sampling Department

[0095] 134 Learning Department

[0096] 135 Output Processing Unit

Claims

1. A learning device, characterized in that: have: an acquisition unit that acquires a communication feature quantity of a communication that is over-detected in an abnormality detector that detects abnormality in the communication; A clustering unit, which clusters the acquired communication feature quantities into a plurality of clusters; a sampling unit, which, for each of the clusters, sorts the communication feature quantities belonging to the cluster in time series, determines a period of the sorted communication feature quantities, and samples the communication feature quantities at the determined period; as well as A learning unit performs additional learning for over-detection feedback on the abnormality detector using the communication feature quantities sampled from the clusters.

2. The learning device according to claim 1, characterized in that The clustering unit clusters the communication feature quantities into a plurality of clusters using a Gaussian mixture model.

3. The learning device according to claim 1, characterized in that: The sampling unit randomly samples the communication characteristic amount from the communication characteristic amounts belonging to the cluster when the period of the communication characteristic amount belonging to the cluster cannot be determined.

4. The learning device according to claim 1, characterized in that: The sampling unit calculates an autocorrelation coefficient of each of the sorted communication feature quantities, and determines a period of the communication feature quantity based on the calculated autocorrelation coefficient.

5. The learning device according to claim 1, characterized in that: The learning device further includes a detection unit that detects abnormality in input communication using the additionally learned abnormality detector.

6. A learning method, performed by a learning device, characterized in that: The learning method includes the following process: acquiring a communication feature quantity of a communication that is over-detected in an anomaly detector for detecting an anomaly in the communication; Clustering the acquired communication feature quantities into a plurality of clusters; For each of the clusters, the communication characteristic quantities belonging to the cluster are sorted according to a time series, a period of the sorted communication characteristic quantities is determined, and the communication characteristic quantities are sampled at the determined period; as well as Using the communication feature quantities sampled from the clusters, additional learning for over-detection feedback is performed on the abnormality detector.

7. A learning program, the learning program is used to make a computer execute the following steps: acquiring a communication feature quantity of a communication that is over-detected in an anomaly detector for detecting an anomaly in the communication; Clustering the acquired communication feature quantities into a plurality of clusters; For each of the clusters, sorting the communication characteristic quantities belonging to the cluster according to a time series, determining a period of the sorted communication characteristic quantities, and sampling the communication characteristic quantities at the determined period; and Using the communication feature quantities sampled from the clusters, additional learning for over-detection feedback is performed on the abnormality detector.

Images