Abnormal communication detecting apparatus, and abnormal communication detecting program

Abstract

To provide an abnormal communication detecting apparatus and an abnormal communication detecting program which cam improve detection accuracy in detection of abnormal communication based on time-serial flow data.SOLUTION: An abnormal communication detecting apparatus according to the present invention has a clustering unit 11 for classifying flow data accumulated in a communication network into a plurality of clusters based on similarity of a feature amount to give a label to each of the clusters, a sequence generating unit 13 for generating a sequence in which labels are arranged with respect to each of transmission origin devices of the flow data in an order of communication time, a feature extracting unit 14 for allocating multidimensional vectors different from one another to the plurality of clusters based on the sequence, an advanced learning unit 16 for generating an order model based on the sequence and the multidimensional vector, and an abnormality detection unit 17 for calculating an abnormal degree of a new sequence based on the order model to detect abnormality of the new sequence based on the abnormal degree.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an apparatus and a program for detecting anomalous communication in a communication network. [Background technology]

[0002] Generally, the format of communication data used for detecting anomalous communication in a communication network can be roughly divided into two types: packets and flows. Packets have a large data size because they contain a payload, and this poses a problem in terms of the processing speed of anomalous communication detection. On the other hand, flows are data in which multiple packets are aggregated on a session basis, and since their data size is smaller than that of packets, they are expected to improve the processing speed of anomalous communication detection.

[0003] For example, Non-Patent Document 1 proposes a method of learning an anomaly communication detection model using a Deep Neural Network (DNN) with the quantitative variables of a single flow as input. However, since flow data is an aggregate of multiple packets, it may not be possible to distinguish between normal flows and unauthorized flows using only the quantitative variables of a single flow.

[0004] Therefore, a learning method that utilizes the relationships between multiple flows has been proposed. For example, Non-Patent Document 2 proposes an anomaly detection method using a Gated Recurrent Unit (GRU). The GRU is a time series model that can simultaneously learn the relationship between consecutive flows, and can perform classification that takes into account temporal features that could not be used with a single flow alone. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] TA Tang, L. Mhamdi, D. McLernon, SAR Zaidi and M. Ghogho, "Deep learning approach for Network Intrusion Detection in Software Defined Networking," 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco, 2016, pp. 258-263. [Non-Patent Document 2] TA Tang, L. Mhamdi, D. McLernon, SAR Zaidi and M. Ghogho, "Deep Recurrent Neural Network for Intrusion Detection in SDN-based Networks," 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada, 2018, pp. 202-206. Summary of the Invention [Problem to be solved by the invention]

[0006] In detecting anomalous communication taking into account the sequential relationship between flows, for example, in Non-Patent Document 2, the quantitative variables of the flows are treated as time-series data arranged in the order in which the communications occurred, and the accuracy of anomaly detection is improved by using GRU, a deep learning method capable of learning time series. However, time series learning using quantitative variables may not be able to detect anomalous communications when it is important to distinguish between sequential relationships (A→B and B→A).

[0007] For example, suppose that the target flow data is obtained from a vehicle communication network in which communication occurs from a vehicle via a proxy server to an application, and only the IP addresses of the vehicle and the proxy server, the time the communication occurred, and the number of packets sent can be used as variables. Here, there are four destination applications, A, B, C, and D, and the number of packets sent is 10, 20, 40, and 100, respectively. Also, the order in which communications to applications occur is fixed, and they usually only occur in the order B→A, A→A, A→C, A→D, and C→D.

[0008] In this case, the transitions in the number of transmitted packets for two normal flow time series data (B→A→C→D, B→A→A→D) and one abnormal flow time series data (B→A→B→D) are shown in, for example, Figure 8. Anomaly detection models often learn without a teacher using only normal data, so if a certain number of transitions between normal 1 and normal 2 occur, the packet count transition of "20 → 10 → 10 → 100" for normal 1 and the packet count transition of "20 → 10 → 40 → 100" for normal 2 will be predicted as normal. Therefore, it is difficult to correctly determine that only the packet count transition "20 → 10 → 20 → 100" of abnormality 1, which is sandwiched between these normal transitions and has no difference in Euclidean distance space, is locally abnormal.

[0009] To solve this problem, it is conceivable to detect anomalies by first clustering the flow data and then creating a transition probability matrix from the order in which the clusters occur. However, the transition probability matrix has a significant effect on the accuracy of clustering. For example, if a point cloud that should be assigned to the same cluster is assigned to two separate clusters, the transition probability to each cluster is also calculated separately. In general, an anomaly is often determined when a transition occurs with an occurrence probability below a certain threshold, so separation of clusters leads to false positives of anomalous communication.

[0010] The present invention aims to provide an anomalous communication detection device and an anomalous communication detection program that can improve the detection accuracy in anomalous communication detection based on time-series flow data. [Means for solving the problem]

[0011] The anomalous communication detection device of the present invention includes a clustering unit that classifies flow data accumulated in a communication network into multiple clusters based on similarities in features and assigns a label to each of the multiple clusters; a sequence generation unit that generates a sequence in which the labels are arranged in order of communication time for each device that sent the flow data; a feature extraction unit that assigns different multidimensional vectors to each of the multiple clusters based on the sequence; a pre-learning unit that creates a sequence model based on the sequence and the multidimensional vector; and an anomaly detection unit that calculates the degree of anomaly of a new sequence using the sequence model and detects an anomaly in the new sequence based on the degree of anomaly.

[0012] The communications network may be at least partially structured so that one or more source devices and one destination device communicate with each other.

[0013] The communication network may be a vehicle communication network having at least a portion thereof configured to allow one or more source vehicles and one destination device to communicate with each other.

[0014] The anomalous communication detection device may further include an unknown cluster conversion unit that replaces flow data classified into any of the plurality of clusters by the clustering unit, the flow data having a feature value that corresponds to an outlier, with an unknown cluster.

[0015] The unknown cluster conversion unit may replace flow data determined to be anomalous by a predetermined anomaly detection method based on characteristics of the flow data alone with the unknown cluster.

[0016] The unknown cluster conversion unit may replace new flow data that is not included in a set of neighborhood spheres of each point in the feature space corresponding to each of the flow data belonging to each cluster with the unknown cluster.

[0017] The feature extraction unit may obtain, as the multidimensional vector, a distributed representation based on an order relationship of the sequence.

[0018] The anomalous communication detection device may include a cluster integration unit that integrates, from among the plurality of clusters, combinations of the multidimensional vectors having a similarity equal to or greater than a predetermined level into one cluster.

[0019] The clustering unit may classify the flow data using a clustering method that can be implemented without fixing the number of clusters.

[0020] The anomaly detection unit may calculate the degree of anomaly by inputting a feature vector of the new sequence or a cluster constituting the new sequence, obtained by the ordinal model, into a predetermined anomaly detection model.

[0021] The anomaly detection unit may further input variables of flow data constituting the new sequence to the anomaly detection model.

[0022] The clustering unit may label the new sequence by learning a multi-class classifier using the labels as ground truth data and variables of the flow data as input data.

[0023] The anomalous communication detection program according to the present invention causes a computer to function as the anomalous communication detection device. Effect of the Invention

[0024] According to the present invention, the detection accuracy of anomalous communication based on time-series flow data is improved. [Brief description of the drawings]

[0025] [Figure 1] 1 is a diagram illustrating an example of a configuration of a communication network to which an embodiment is applied; [Diagram 2] 1 is a block diagram showing a functional configuration of an anomalous communication detection device according to an embodiment. [Diagram 3] FIG. 2 is a diagram illustrating a first method for determining an unknown cluster in the embodiment. [Figure 4] 11A to 11C are diagrams illustrating a second method for determining an unknown cluster in the embodiment. [Diagram 5] 11A and 11B are diagrams illustrating a correction process of a clustering result in the embodiment. [Figure 6] FIG. 10 is a diagram illustrating a learning procedure of an order model in an embodiment. [Figure 7] 1 is a diagram illustrating an example of an implementation of an anomaly detection unit in an embodiment. [Figure 8] FIG. 1 is a diagram illustrating a transition in the number of packets used in the prior art. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] An example of an embodiment of the present invention will now be described. The anomalous communication detection device of this embodiment detects anomalous communication, such as malware, occurring in a communication network, by using a cluster sequence of flow data.

[0027] FIG. 1 is a diagram illustrating an example of the configuration of a communication network to which this embodiment is applied. In the example vehicle communication network, only communication data occurring between the vehicle group and the proxy server can be acquired. In addition, there is no information that can be one-to-one associated with an application, such as a label such as a URL that can explicitly determine which application each vehicle is accessing, or an IP address of an application server.

[0028] This embodiment can also be applied to a general communication network that has, in whole or in part, a structure in which communication occurs from multiple source devices (corresponding to the group of vehicles in Figure 1) to one specific destination device (corresponding to the proxy server in Figure 1). For example, there is communication to access a specific application (Internet service) from a terminal such as a PC or a smartphone, which is the same as the vehicle group in the vehicular communication network of Figure 1, but with the group of terminals replaced.

[0029] In the following, a vehicle communication network will be taken as an example for explanation. It is assumed that all access information from the vehicle to the proxy server can be acquired, and the acquired packet data is converted into flow data such as IPFIX (IP Flow Information Export).

[0030] FIG. 2 is a block diagram showing a functional configuration of the anomalous communication detection device 1 in this embodiment. The anomalous communication detection device 1 is an information processing device equipped with a control unit 10 and a memory unit 20, as well as various data input / output devices and communication devices, and detects unauthorized access (anomalous communication) to an application server via a proxy server using flow data acquired from a communication network as input.

[0031] The control unit 10 is a part that controls the entire anomalous communication detection device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU. Specifically, the control unit 10 includes a clustering unit 11, an unknown cluster conversion unit 12, a sequence generation unit 13, a feature extraction unit 14, a cluster integration unit 15, a pre-learning unit 16, and an anomaly detection unit 17.

[0032] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the anomalous communication detection device 1, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), etc. Specifically, the storage unit 20 stores a program (anomalous communication detection program) for causing the control unit 10 to execute each function of this embodiment, and further stores flow data received as a processing target, parameters constituting various learning models for anomalous communication detection, and the like.

[0033] The clustering unit 11 uses an unsupervised learning device A to classify each flow data accumulated in the communication network into a plurality of clusters based on the similarity of its features (quantitative variables), and assigns a label to each of the plurality of clusters. At this time, qualitative variables such as TCP flags may be converted into quantitative variables, for example, by one-hot encoding.

[0034] Flow data that can be obtained from a vehicle communication network is a statistic regarding communication sent from a certain vehicle to a certain function of a certain application. Since the content of communication from an in-vehicle system is roughly determined for each application, each cluster classified by unsupervised learning machine A is an estimate of the destination application. In addition, in vehicle communication networks, there are also communications that are not addressed to applications, such as KEEP-ALIVE communications, but since the content of these communications is determined by general communication standards such as TCP / IP, they can be classified in the same way.

[0035] The unsupervised learner A can be a statistically-based method such as k-means or DBSCAN, or a deep learning-based method such as Deep k-Means. Furthermore, instead of directly clustering the flow data, the clustering unit 11 may compress the variables of the flow data into a lower dimensional space using a dimensionality compressor B such as a Stacked Auto Encoder, and then perform clustering using the unsupervised learning device A. The dimensionality compressor B may be a deep learning-based method as described above, or a statistical-based method such as t-SNE.

[0036] Here, clustering by the clustering unit 11 needs to be performed on the flow data to be analyzed when the anomalous communication detection device 1 is in operation, but some of the unsupervised learning devices A and dimension reduction devices B cannot reuse trained models, and in this case, new flow data cannot be classified. For example, this applies to unsupervised learning devices such as DBSCAN and dimension reduction devices such as t-SNE. In this case, the clustering unit 11 uses the labels assigned to each flow data as correct answer data and performs learning using a supervised multi-class learning device C with the variables of the flow data as input data. This makes it possible to assign labels to flow data both during learning and during operation using any clustering method, particularly a clustering method that can be executed without fixing the number of clusters, such as density-based clustering.

[0037] The unknown cluster conversion unit 12 replaces, among the flow data classified into any of the multiple clusters by the clustering unit 11, those whose feature amounts correspond to outliers with unknown (UNK) clusters.

[0038] During learning and operation, flows that are significantly different from the normal distribution (hereafter referred to as outlier flows) appear in communication data. Outlier flows may be, for example, flows generated by cyber attacks or retransmission flows due to communication failures. When the clustering unit 11 clusters the flow data, the outlier flow is assigned to the cluster that is closest to it. However, since this outlier flow is not a flow that should be assigned to that cluster, it may cause erroneous learning and erroneous detection in anomaly detection. Therefore, the unknown cluster conversion unit 12 assigns outlier flows to unknown clusters by performing one of the following two determination methods during learning and operation, thereby suppressing erroneous learning and erroneous detection.

[0039] FIG. 3 is a diagram for explaining a first method for determining an unknown cluster in this embodiment. The unknown cluster conversion unit 12 can detect some of the flows generated by the above-mentioned cyber attacks and retransmission flows due to communication failures by using an existing anomaly detection method D based on the characteristics of the flow data alone. The anomaly detection method D may be, for example, the DNN-based method of Non-Patent Document 1 or a machine learning-based method such as OC-SVM.

[0040] In the figure, A to E indicate clusters classified in the feature space. Also, the boundary between normal and abnormal for a single flow is indicated by a dashed line (abnormal line). In this case, the flow data indicated by black circles are outside the boundary and are determined to be abnormal by anomaly detection method D, so the unknown cluster conversion unit 12 assigns these flow data to an unknown cluster. On the other hand, the flow data (x) inside the boundary is determined to be normal, so it is classified into one of the clusters (for example, E).

[0041] FIG. 4 is a diagram for explaining a second method for determining an unknown cluster in this embodiment. The unknown cluster conversion unit 12 utilizes the result of clustering by the unsupervised learning device A and assigns the outlier flows to unknown clusters during operation.

[0042] A to E in the figure indicate clusters classified in the feature space, and the learning data are given cluster labels. At this time, a neighborhood sphere is created for each point (feature of flow data) of each cluster, and the set of these neighborhood spheres is the cluster neighborhood set. The unknown cluster conversion unit 12 assigns new flow data that is a point not included in any cluster neighborhood set to an unknown cluster.

[0043] The sequence generating unit 13 generates a cluster sequence in which the labels assigned to the flow data are arranged in the order of communication time for each IP address of the source device of the flow data.

[0044] The feature extraction unit 14 assigns different multi-dimensional feature vectors to the multiple clusters based on the generated cluster sequence. This multidimensional vector may be a distributed representation expressing the order relationship of the clusters (hereinafter, referred to as an ordinal distributed representation). The feature extraction unit 14 may acquire the ordinal distributed representation by an ordinal distributed representation acquirer E such as Word2Vec, or may acquire the ordinal distributed representation at the same time as creating an ordinal model, which will be described later.

[0045] The ordinal distributed representation acquirer E sequentially learns to predict the neighboring clusters of each cluster based on the input cluster sequence, thereby acquiring the ordinal distributed representation of each cluster from the hidden layer in the neural network. The ordered distributed representation obtained by this process has the property that clusters that occur before and after each other and have similar types of clusters are similar to each other.

[0046] As a result, in clustering, even if the same application has slightly different statistical distributions that result in separate clusters, the order relationships between the previous and next clusters in the cluster sequence are similar, so the order distributed representations of the separated clusters will be similar to each other.

[0047] Based on this property, the cluster integration unit 15 integrates clusters whose obtained ordered distributed representations have a similarity (for example, cosine similarity) equal to or greater than a predetermined value, and corrects the clustering result and the cluster sequence.

[0048] FIG. 5 is a diagram illustrating a correction process for the clustering result in this embodiment. In this example, the flow data is classified into six clusters, A, B, B', C, D, and E, as a result of clustering. However, the distribution of ordered distributed representations obtained from these clusters shows that the similarity between B and B' is very high. Therefore, the cluster integration unit 15 integrates B and B', and corrects the clustering result to five clusters.

[0049] The pre-learning unit 16 creates an order model F based on the cluster sequence and the multidimensional vector. The sequence model F is a model that is trained so that, for a sequence in which multiple types of tokens are lined up, the occurrence probability of the i-th token in the sequence can be estimated from all or some of the tokens in the sequence excluding the i-th token. For example, the order model F may be an RNNLM or LSTMLM, which are used as language models in natural language processing in general, or a model such as Transformer or Bert that converts sentences into token sequences and has a structure that can be extended into a language model.

[0050] FIG. 6 is a diagram illustrating a learning procedure of the order model F in this embodiment. This example shows the procedure when using RNNLM. A cluster sequence is input, and the input cluster sequence shifted one position to the left is output (correct data), and an order model F that predicts the next cluster is trained.

[0051] Here, the order model F includes the following three functions: The embedding layer performs a process of replacing each cluster with a multidimensional vector (for example, 1 → [0.1, 0, 0, ..., 0]). Note that the above-mentioned distributed representation acquirer E may be used for the conversion to the multidimensional vector. The time series layer inputs a matrix of vectors x sequence lengths generated in the embedding section into a deep learning model such as an RNN. The output layer outputs the transition probability (dimension of the number of types) to each cluster label for the length of the sequence through a Softmax function.

[0052] Using the created order model F, the anomaly detection unit 17 determines that a cluster sequence is abnormal if the occurrence probability of the cluster sequence is less than a predetermined value. For example, the anomaly detection unit 17 detects cluster sequences c1, . . . , c i-1 Given c i The probability of occurrence of the label P(X i =c i |X1=c1,…,X i-1 =c i-1 ) from the sequence model F. The anomaly detection unit 17 multiplies these together to calculate the sequence occurrence probability Π i=1 n P(X i =c i |X1=c1,…,X i-1 =c i-1 )=P(X1=c1,…,X n =c n ) is calculated, and if it is less than a predetermined value, it is determined that the cluster sequence is abnormal. Furthermore, the anomaly detection unit 17 may obtain the occurrence probability of a cluster sequence by using a transition probability matrix, which is easier to interpret.

[0053] As mentioned above, it is possible to calculate the degree of anomaly using only the ordinal model F. However, because it uses uncertain cluster labels that are not necessarily correct, there is a possibility that an anomaly will be unintentionally determined. For example, a flow immediately before a KEEP-ALIVE communication intended to continue communication from a vehicle may have different statistics than normal because only a part of the communication that should have been performed has been performed. Such a flow is assigned to an unintended or unknown cluster. Therefore, the anomaly detection unit 17 may improve the accuracy of anomaly detection by combining a part of the order model F with a deep learning-based anomaly detection model G as follows.

[0054] FIG. 7 is a diagram illustrating an example of an implementation of the anomaly detection unit 17 in this embodiment. Here, the sequence vector obtained from the order model F or the feature vector of each flow constituting the sequence is input to the anomaly detection model G, and the degree of anomaly of the sequence or flow is calculated.

[0055] Here, as described above, the ordinal model F is composed of an embedding layer that inputs each cluster, a time-series layer that connects previous and next clusters, and an output layer that predicts the correct cluster. Of these, the anomaly detection unit 17 uses the embedding layer and the time-series layer, and performs anomaly detection by, for example, inputting one sequence vector obtained by averaging, for each element, a plurality of feature vectors for each cluster, which are the output of the time-series layer, to the anomaly detection model G. At this time, the anomaly detection unit 17 may also input, in addition to the sequence vector, a feature vector (cluster vector) for each cluster constituting the sequence, thereby increasing the number of items of learning data. Furthermore, the anomaly detection unit 17 may add quantitative variables of the original flow data as input elements to increase the number of dimensions.

[0056] According to this embodiment, the anomalous communication detection device 1 classifies flows into multiple clusters based on quantitative variables included in the flow data, and creates a sequence in which the clusters are arranged in the order in which the flows occurred for each source device. The anomalous communication detection device 1 applies the arrangement of the created sequence to an ordinal model, thereby detecting the presence or absence of anomalous communication such as unauthorized access using the context anomaly degree. While the original flow data only allowed separation in a Euclidean distance space based on quantitative variables, flow clustering, i.e., converting to qualitative variables, made it possible to create a distance space defined by the order relationship of the clusters, making classification by multiple distances possible. As a result, compared to conventional methods, the anomalous communication detection device 1 can explicitly learn the order relationship of flows composed only of quantitative variables, improving the detection accuracy in anomalous communication detection based on time-series flow data.

[0057] Furthermore, the anomaly communication detection device 1 acquires ordered distributed representations of the clusters, and integrates clusters having similar ordered distributed representations. In clustering, which is unsupervised learning, even when communications to the same application should be in the same cluster, they may be separated into multiple clusters, but by acquiring an ordered distributed representation, it is possible to acquire nearly identical distributed representations for each of the separated clusters. In a state where the communications are separated into multiple clusters, the occurrence probability of a sequence is dispersed, and there is a possibility that it may be unintentionally determined to be an anomaly, but the anomaly communication detection device 1 can regard these as the same, so it can integrate and add up the probabilities and calculate the intended occurrence probability.

[0058] Furthermore, the anomaly communication detection device 1 classifies outlier flows whose feature amounts deviate significantly into an unknown cluster. Depending on the clustering method used, outlier flows may also be assigned to known clusters, but in the process of calculating the occurrence probability, assignment to unexpected clusters leads to erroneous learning. Regardless of the type of clustering, the anomalous communication detection device 1 can prevent erroneous learning by preparing unknown clusters, eliminating classification into unintended clusters. As a result, it becomes possible to extend the method to any clustering method, and a clustering method with good accuracy can be appropriately selected depending on the data set.

[0059] In addition, according to this embodiment, for example, anomalous communication in a communication network can be accurately detected, which makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0060] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0061] The anomalous communication detection method by the anomalous communication detection device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0062] 1. Abnormal communication detection device 10 Control section 11 Clustering Department 12 Unknown cluster conversion part 13 Sequence Generation Unit 14 Feature Extraction Unit 15 Cluster Integration Department 16 Pre-learning section 17 Anomaly detection section 20 Memory section

Claims

1. a clustering unit that classifies flow data accumulated in a communication network into a plurality of clusters based on similarities in features and assigns a label to each of the plurality of clusters; a sequence generating unit that generates a sequence in which the labels are arranged in order of communication time for each source device of the flow data; a feature extractor that assigns different multidimensional vectors to the plurality of clusters based on the sequence; A pre-training unit for generating an order model based on the sequence and the multi-dimensional vector; and an anomaly detection unit that calculates an anomaly degree of a new sequence using the sequence model and detects an anomaly of the new sequence based on the anomaly degree.

2. The anomalous communication detection device according to claim 1 , wherein the communication network at least partially has a structure in which one or more source devices and one destination device communicate with each other.

3. The abnormal communication detection device according to claim 1 , wherein the communication network is a vehicle communication network having, at least in a part thereof, a structure in which one or more source vehicles and one destination device communicate with each other.

4. The anomalous communication detection device according to claim 1 , further comprising an unknown cluster conversion unit that replaces, among the flow data classified into any of the plurality of clusters by the clustering unit, any flow data whose feature corresponds to an outlier with an unknown cluster.

5. The anomalous communication detection device according to claim 4 , wherein the unknown cluster conversion unit replaces flow data determined to be anomalous by a predetermined anomaly detection method based on characteristics of the flow data alone with the unknown cluster.

6. The anomalous communication detection device according to claim 4 , wherein the unknown cluster conversion unit replaces new flow data that is not included in a set of neighborhood spheres of each point in the feature space corresponding to each of the flow data belonging to each cluster with the unknown cluster.

7. The anomalous communication detection device according to claim 1 , wherein the feature extraction unit acquires, as the multidimensional vector, a distributed representation based on an order relationship of the sequences.

8. The anomalous communication detection device according to claim 7 , further comprising a cluster integration unit that integrates, among the plurality of clusters, combinations of the multidimensional vectors having a similarity of a predetermined level or higher into one cluster.

9. The anomalous communication detection device according to claim 1 , wherein the clustering unit classifies the flow data by a clustering method that can be implemented without fixing the number of clusters.

10. 7. The anomalous communication detection device according to claim 1, wherein the anomaly detection unit calculates the degree of anomaly by inputting a feature vector of the new sequence or a cluster constituting the new sequence, obtained by the order model, into a predetermined anomaly detection model.

11. The anomalous communication detection device according to claim 10 , wherein the anomaly detection unit further inputs variables of flow data constituting the new sequence to the anomaly detection model.

12. 7. The anomalous communication detection device according to claim 1, wherein the clustering unit labels the new sequence by learning a multi-class classifier using the labels as correct answer data and variables of flow data as input data.

13. An anomalous communication detection program for causing a computer to function as the anomalous communication detection device according to any one of claims 1 to 6.

Images