Abnormal communication detection apparatus, and abnormal communication detection program

Abstract

To provide an abnormal communication detection apparatus and an abnormal communication detection program which can efficiently detect abnormal communication resulting from cyber attack which does not give much influence on a statistic amount.SOLUTION: An abnormal communication detection apparatus 1 according to the present invention has a co-occurrence pattern extracting unit 11 for extracting a co-occurrence pattern from time-series data of a flow transmitted from a plurality of devices, an occurrence probability calculating unit 12 for calculating an occurrence probability of the extracted co-occurrence pattern, and an abnormality determination unit 13 for, if a difference between the number of actual occurrence of the co-occurrence patterns and an expectation value of the number of occurrence calculated based on the occurrence probability of the co-occurrence patterns exceeds a threshold value, determining that there is an abnormality.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an apparatus and a program for detecting anomalous communication in a communication network. [Background technology]

[0002] Conventionally, communication data in the form of packets or flows is mainly used in detecting anomalies in communication. Packet-based techniques enable detailed analysis of communication content, making them highly efficient at detection; however, data volumes tend to be large, making processing speeds an issue in environments with high volumes of communication. In addition, a flow is data that aggregates multiple packets, and has a smaller data size than a packet, so it has the advantage of being easy to handle even in an environment where a large amount of communication takes place.For example, Non-Patent Document 1 proposes a method of learning an anomaly communication detection model using a Deep Neural Network (DNN) with the quantitative variables of a single flow as input. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] TA Tang, L. Mhamdi, D. McLernon, SAR Zaidi and M. Ghogho, "Deep learning approach for Network Intrusion Detection in Software Defined Networking," 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco, 2016, pp. 258-263. [Non-Patent Document 2] H. Qiao, T. Wang, P. Wang, S. Qiao and L. Zhang, "A Time-Distributed Spatiotemporal Feature Learning Method for Machine Health Monitoring with Multi-Sensor Time Series," Sensors 18, no. 9: 2932, 2018. [Non-Patent Document 3] J. Li, S. Chen, K. Zhang, G. Andrienko and N. Andrienko, "COPE: Interactive Exploration of Co-Occurrence Patterns in Spatial Time Series," in IEEE Transactions on Visualization and Computer Graphics, vol. 25, no. 8, pp. 2554-2567, 2019. [Non-Patent Document 4] C. Faloutsos, Y. Sakurai and M. Yamamuro, "Stream Processing under the Dynamic Time Warping Distance," Computer Science, 2007. [Non-Patent Document 5] A. Muscariello, G. Gravier and F. Bimbot, "Variability tolerant audio motif discovery," in International Conference on Multimedia Modeling, Springer, 2009, pp. 275-286. [Non-Patent Document 6] B. Rajchel, JV Monaco, G. Singh, A. Hu, J. Shingleton and T. Anderson, "Temporal Behavior in Network Traffic as a Basis for Insider Threat Detection," 2020 IEEE Symposium Series on Computational Intelligence (SSCI), 2020, pp. 1427-1434. Summary of the Invention [Problem to be solved by the invention]

[0004] When considering cyber attacks as a target for detecting anomalous communications, cyber attacks such as DDoS and port scans that are likely to cause changes in flow statistics compared to normal communications can often be detected using classical machine learning methods (e.g., k-nearest neighbor algorithm, One-Class SVM, etc.). On the other hand, when using flows, anomaly detection is performed using statistical information that aggregates information from multiple packets, so the detection accuracy may be lower than when using packets. For example, it is difficult to detect attacks that are difficult to distinguish from normal communications using statistics alone, such as attacks that target vulnerabilities in the web, and there is a demand for an anomaly detection method that can detect cyber attacks with such characteristics.

[0005] In such cyber attacks, for example, if the same malware or the same attack method is used, a fixed flow chain is generated and damage is caused to multiple IoT devices. Therefore, anomaly detection using multiple time series data is required. Here, a flow chain is a set of flows that is made up of a plurality of consecutive flows.

[0006] For example, Non-Patent Document 2 proposes a method to detect abnormalities such as breakdowns using multiple sensors. This method uses a model called convLSTM, which applies the convolution processing used in image analysis to LSTM used in time series analysis. This allows comprehensive abnormality detection based on data from multiple sensors. However, this method is based on the assumption that all sensors detect anomalies at the same time, making it difficult to use for detecting anomalous communications, as the timing of cyber-attacks often varies from IoT device to IoT device.

[0007] The present invention aims to provide an anomalous communication detection device and an anomalous communication detection program that can efficiently detect anomalous communication caused by cyber attacks that are unlikely to cause changes in statistics. [Means for solving the problem]

[0008] The anomalous communication detection device of the present invention includes a co-occurrence pattern extraction unit that extracts co-occurrence patterns from time series data of flows transmitted from multiple devices, an occurrence probability calculation unit that calculates the occurrence probability of the extracted co-occurrence patterns, and an anomaly determination unit that determines that an anomaly has occurred when the difference between the actual number of occurrences of the co-occurrence patterns and the expected number of occurrences calculated from the occurrence probability of the co-occurrence patterns exceeds a threshold value.

[0009] The plurality of devices may be vehicles, and the flow of vehicle communication may be targeted with a common server as a communication destination.

[0010] The co-occurrence pattern extraction unit may extract a submatrix in which elements less than a threshold are continuous from among elements of a distance matrix in DTW (Dynamic Time Warping), and apply DTW to the submatrix.

[0011] The co-occurrence pattern extraction unit may be configured to extract a submatrix by ignoring a predetermined number of rows or columns consisting of elements equal to or greater than the threshold at a location in the distance matrix where elements less than the threshold are discontinuous, where the elements less than the threshold are continuous, by deleting the rows or columns.

[0012] The co-occurrence pattern extraction unit may take a point in a distance matrix in DTW (Dynamic Time Warping) where elements less than a threshold are consecutive in all paths calculated by DTW as a starting point, and extract adjacent elements less than the threshold as the co-occurrence pattern.

[0013] The co-occurrence pattern extraction unit may extract a co-occurrence pattern from time series data of some of the multiple devices, and then search for the co-occurrence pattern in time series data of other devices using a predetermined algorithm.

[0014] The co-occurrence pattern extraction unit may use SPRING as the predetermined algorithm.

[0015] The occurrence probability calculation unit may calculate the occurrence probability from the occurrence probability of a label assigned to the first element of a co-occurrence pattern, the probability that a predetermined parameter falls within a predetermined range within each label, and a transition probability between labels.

[0016] The occurrence probability calculation unit may calculate, as the transition probability between the labels, a transition probability from a sequence of a plurality of labels in a time series to one label.

[0017] The occurrence probability calculation unit may set a predicted value of one label by a deep learning model using a sequence of multiple labels in a time series as an input as the transition probability between the labels.

[0018] The occurrence probability calculation unit may calculate the transition probability between the labels by a first-order Markov process using time series data in which a specific flow chain is aggregated and treated as one element.

[0019] The occurrence probability calculation unit may create a graph in which the labels of each flow are nodes and the transitions from label to label are edges, thereby extracting a time-series chain from the graph and defining it as the specific flow chain.

[0020] The occurrence probability calculation unit may treat the edges as directed edges, extract a chain in which an order of labels is specified, and define the chain as the specific flow chain.

[0021] The anomalous communication detection program according to the present invention causes a computer to function as the anomalous communication detection device. Effect of the Invention

[0022] According to the present invention, it is possible to efficiently detect anomalous communications caused by cyber attacks that are unlikely to cause changes in statistics. [Brief description of the drawings]

[0023] [Figure 1] FIG. 1 is a diagram illustrating a communication network configuration of an IoT device to which an embodiment is applied. [Diagram 2] FIG. 1 is a conceptual diagram quoted from Non-Patent Document 4 to explain DTW, which is the basis of the co-occurrence pattern extraction method in the embodiment. [Diagram 3] 1 is a block diagram showing a functional configuration of an anomalous communication detection device according to an embodiment. [Figure 4] FIG. 1 is a diagram showing an outline of a trimming method according to an embodiment. [Diagram 5] FIG. 1 is a diagram showing an outline of a mutation detection method according to an embodiment. [Figure 6] FIG. 13 is a diagram showing an overview of an extended trimming method in an embodiment. [Figure 7] FIG. 13 is a diagram illustrating components of the occurrence probability of a flow chain in an embodiment. [Figure 8] FIG. 2 is a conceptual diagram showing a method for creating an undirected graph in an embodiment. [Figure 9]FIG. 1 is a conceptual diagram showing a method for extracting a flow chain from an undirected graph in an embodiment. [Figure 10] FIG. 13 is a conceptual diagram illustrating a calculation order of a transition matrix that aggregates flow chains in an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0024] An example of an embodiment of the present invention will now be described. The anomalous communication detection method of this embodiment is a technique for detecting anomalous communication by utilizing the communication patterns of a cyber attack when multiple IoT devices are exposed to a cyber attack at the same time or when a group of IoT devices infected with malware launch attacks on a specific server at the same time. In this embodiment, anomalous communication is detected in the following procedure: (1) extracting co-occurrence patterns between devices, (2) calculating anomaly degrees of the extracted co-occurrence patterns, and (3) detecting anomalies using the anomaly degrees.

[0025] FIG. 1 is a diagram illustrating a communication network configuration of an IoT device to which the present embodiment is applied. In the illustrated vehicle communication network, the proxy server captures data of communications from multiple devices (vehicles) connected to the Internet that connect to the proxy server through some action. It is assumed that all access information from the vehicle to the proxy server can be acquired, and that the acquired packet data is converted into flow data such as IPFIX (IP Flow Information Export).

[0026] Flow data stores statistical information such as the number of communication packets, the amount of communication data, and the communication time, in addition to the source and destination IP addresses and port numbers. Each flow is also labeled in some way, such as a label indicating which application it communicated with, or a cluster number obtained by clustering using flow variables.

[0027] This embodiment can also be applied to a general communication network that has, in whole or in part, a structure in which communication occurs from multiple source devices (corresponding to the group of vehicles in Figure 1) to one specific destination device (corresponding to the proxy server in Figure 1). For example, there is communication to access a specific application (Internet service) from a terminal such as a PC or a smartphone, which is the same as the vehicle group in the vehicular communication network of Figure 1, but with the group of terminals replaced.

[0028] Among the cyber attacks to be detected in this embodiment, for example, attacks that aim to obtain personal information will use the same method to invade many IoT devices, causing widespread damage. In addition, for example, in the construction of a botnet, since a large number of terminals are required, similar attacks are carried out simultaneously on multiple IoT devices. Therefore, it is believed that the detection performance of abnormal communications can be improved by extracting co-occurring flow chains from the communication data of multiple IoT devices. Here, co-occurrence refers to a state in which similar waveforms occur in a given period of time for multiple pieces of time-series data.

[0029] Extracting co-occurrence patterns in multiple time series data is an important task in various fields. For example, as a means of extracting co-occurrence patterns using logical operations, there is COPE (Co-Occurrence Pattern Exploration), a type of visualization tool for co-occurrence patterns developed for the fields of economic statistics and environmental science (see, for example, Non-Patent Document 3). With this tool, when time series data X is input, it is possible to extract parts similar to X from other time series data using logical operations. However, this method requires specifying the time range of the time series data to be compared, and is therefore not suitable for detecting anomalous communication where the time range of co-occurring flow chains is not self-evident.In addition, this method uses labels, which are categorical data, to compare data points, and is therefore not suitable for detecting anomalous communication that handles continuous quantities such as communication volume or communication time.

[0030] In addition, when it comes to communications between IoT devices, the timing, frequency, and number of flows vary from device to device, and the frequency of anomalous communications also varies from device to device, making it impossible to make simple comparisons over time. Therefore, in this embodiment, a co-occurrence pattern extraction method that applies DTW (Dynamic Time Warping) is used. DTW is a useful technique for comparing waveforms with different sampling numbers or sampling timings.

[0031] FIG. 2 is a conceptual diagram quoted from Non-Patent Document 4 to explain DTW, which is the basis of the co-occurrence pattern extraction method in this embodiment. Here, the waveform X=[x 1 ,…,x n ] and waveform Y=[y 1 ,…,y m ]Consider the comparison with

[0032] First, distance d is calculated for all data points in X and Y. t,i =|x t -y i |(1≦t≦n, 1≦i≦m) is calculated. Next, find the distance (x 1 ,y 1 ) to (x n ,y m The distance calculated at this time is called the time warping distance, and its value is defined as the similarity of the waveforms.

[0033] The figure on the left shows the combinations of data points compared in X and Y. The figure on the right shows a distance matrix with n × m distances as elements, and the route shaded in black is the route with the smallest sum of distances.

[0034] In addition, there are methods such as SPRING, which extends this DTW to extract portions similar to any short time-series data from long time-series data, and SLN-DTW (Segmental Locally Normalized DTW), which extracts similar portions from two long time-series data.

[0035] In DTW, the starting point was fixed at (x 1 , y 1 ), whereas in SPRING, it is extended to efficiently calculate from various positions on (x t , y 1 ). As a result, multiple portions similar to waveform Y are extracted in waveform X. However, in this method, since it is necessary to specify waveform Y to be extracted in advance, it cannot be applied to anomaly communication detection where the shape of the waveform is not obvious.

[0036] Also, a method has been proposed to comprehensively extract co-occurring portions by applying SPRING to each segment obtained by extracting a part of Y (see, for example, Non-Patent Document 4). Specifically, assuming that Y has m data and X has n data, consider the case of executing SPRIN with segment Y[s, e] (1 ≤ s < e ≤ m) of Y. Since the pattern of the segment is the number of combinations of s and e, which is (m 2 - m) / 2, and considering that the average computational complexity of the time-warping distance in each segment is (m / 2) × n, the overall computational complexity is O(m 3 n). When extracting co-occurrence patterns among multiple devices, since this calculation is performed between each device, if the number of devices is N, the total computational complexity is N C 2 × O(m 3 n). In this way, while SPRING can extract similar portions without omission, the computational complexity becomes extremely large and it cannot achieve a realistic execution time.

[0037] SLN-DTW is a method for extracting similar segments in regions sliced ​​in the Y-axis direction, and finally extracting similar continuous regions by combining these segments (see, for example, non-patent document 5). Three consecutive slices are divided from the top into a start point search region, a path construction region, and an end point search region, and these three regions are slid from the top to the bottom to obtain segments in the entire region. The start and end points of a segment are defined by the standardized time warping distance W ij The distance d of point (i,j) is used. ij W ij Starting from a point smaller than W ij The end point is the point where the increase rate exceeds 10%.

[0038] Consider the computational complexity of each slice in this method. Here, the width of a slice is L(< <m)とする。 The computational complexity of the starting point search is n×L in terms of the calculation of the standardized time warping distance. The computational complexity of path construction is that it is necessary to recalculate the time warping distance for each starting point (the number of starting points, n s ) × (remaining squares on the X axis) × L. Considering that the starting point of (remaining squares on the X axis) is generated randomly, the average is 0.5n, so n s × 0.5n × L. The computational complexity of the end point search is also calculated for each starting point, so n s ×(remaining x-axis mass)×L=n s × 0.5n × L.

[0039] Finally, since the number of slices is m / L, the total computational complexity is (m / L)×{(n×L)+(n s ×0.5n×L)+(n s ×0.5n×L)}=(m×n)+(m×n s × 0.5n × 2). In IoT device communication, the distance d ijThe value of can be extremely small or large depending on the content of the communication. In this method, a large number of starting points are generated, and the order of n s =O(n). Therefore, the order of the total computation time is O(mn 2 ) In this way, SLN-DTW can reduce the amount of calculations compared to SPRING, but this is still not sufficient and there is a high possibility of oversights.

[0040] In this embodiment, a method that applies DTW, which will be described later, is used to comprehensively extract co-occurrence patterns while further reducing the amount of calculations.

[0041] Next, in calculating the degree of anomaly of the extracted co-occurrence patterns, it is possible to calculate the transition probability of the label assigned to the communication content, that is, the flow, and use this transition probability in calculating the degree of anomaly. For example, Non-Patent Document 6 proposes a method of classifying the states of hosts such as web servers using the k-Means method and detecting anomalies from the cluster transition probability. In this method, the calculation of the transition probability is premised on a Markov process. In the Markov process, it is assumed that the state at time t+1 depends only on time t and does not depend on information prior to that time, and is expressed by the following equation (hereinafter referred to as a first-order Markov process). P(X t+1 |X t ,X t-1 ,…,X 1 )=P(X t+1 |X t )

[0042] By using this transition probability, it is possible to determine that transition patterns with lower probabilities have a higher degree of anomaly. However, this method cannot correctly calculate the degree of anomaly when it includes communication patterns that do not satisfy the first-order Markov process. In other words, to calculate the degree of anomaly of an extracted co-occurrence pattern, it is necessary to correctly evaluate whether the co-occurrence pattern is a pattern that is often seen in normal communications, or a pattern that is rarely seen. However, communications from IoT devices include a fixed flow chain based on application specifications, etc., and parts of this flow chain do not satisfy a first-order Markov process. As a result, problems occur in which the transition probability cannot be calculated correctly, and the degree of anomaly cannot be calculated correctly either. Therefore, in this embodiment, the transition probability is calculated more accurately using a method described below.

[0043] FIG. 3 is a block diagram showing a functional configuration of the anomalous communication detection device 1 in this embodiment. The anomalous communication detection device 1 is an information processing device equipped with a control unit 10 and a memory unit 20, as well as various data input / output devices and communication devices, and detects unauthorized access (anomalous communication) to an application server via a proxy server using flow data acquired from a communication network as input.

[0044] The control unit 10 is a part that controls the entire anomalous communication detection device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU. Specifically, the control unit 10 includes a co-occurrence pattern extraction unit 11, an occurrence probability calculation unit 12, and an abnormality determination unit 13.

[0045] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the anomalous communication detection device 1, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), etc. Specifically, the storage unit 20 stores a program (anomalous communication detection program) for causing the control unit 10 to execute each function of this embodiment, and further stores flow data received as a processing target, parameters constituting various learning models for anomalous communication detection, and the like.

[0046] The co-occurrence pattern extraction unit 11 extracts co-occurrence patterns from time-series data of flows transmitted from a plurality of devices. Specifically, the co-occurrence pattern extraction section 11 can use either of two methods for extracting co-occurrence patterns: a trimming method and a mutation point detection method.

[0047] [Method 1 for extracting co-occurrence patterns: Trimming method] In the trimming method, the co-occurrence pattern extraction unit 11 extracts a partial distance matrix in which elements less than a threshold are continuous from among elements of the distance matrix in DTW, and applies DTW to this partial distance matrix, by the following procedure.

[0048] Step 1: The co-occurrence pattern extraction unit 11 selects two IoT devices from the flow data of a plurality of IoT devices. That is, the co-occurrence pattern extraction unit 11 acquires time-series flow data for any two pairs of flow data between devices or between a device and a server, which are distinguished by a pair of source IP address and destination IP address. However, the same pair of flow data may be used as the two pairs, and in this case, co-occurrence patterns at different times are searched for.

[0049] In this case, the set of flow data for each pair of source IP address and destination IP address in an arbitrary time span is called F 1 ,F 2 Let each flow be f i α ∈F α Let (α∈{1,2}), then F 1 =(f 1 1 ,f 2 1 ,…,f n 1 ), and F 1 The number of flows in |F 1 Then, |F 1 |=n.

[0050] Step 2: The co-occurrence pattern extraction unit 11 extracts F 1 ,F2 Using the variables of each flow, F 1 ,F 2 Calculate the distance between all flows between That is, the computational complexity is |F 1 |×|F 2 |, and the distance can be any distance that satisfies the axioms of distance, such as Euclidean distance, Manhattan distance, or Mahalanobis distance. For example, if the number of packets in the flow data is f i,packet α , the amount of communication data is f i,byte α Then, the Euclidean distance d i,j α,β is expressed as follows:

number

[0051] In addition, the co-occurrence pattern extraction unit 11 may use standardized or normalized variables in order to reduce differences in scale of each variable, or may use the calculated distance as an argument of a sigmoid function to reduce the influence of elements with extremely large distances. The calculated |F 1 |×|F 2 |The matrix is ​​called the distance matrix.

[0052] Step 3: The co-occurrence pattern extraction unit 11 extracts start point candidates and end point candidates of the co-occurrence pattern. That is, based on the distance calculated in step 2, the co-occurrence pattern extraction unit 11 extracts data points that are candidates for the start point and end point of the co-occurrence pattern in the following procedure.

[0053] FIG. 4 is a diagram showing an outline of the trimming method in this embodiment. Here, the grid diagram represents a distance matrix, with each square representing an element of the matrix (the distance between flows).

[0054] (1) The co-occurrence pattern extraction unit 11 extracts, from among the matrix elements, matrix elements whose distance is smaller than a predetermined threshold value. (2) The co-occurrence pattern extraction unit 11 removes matrix elements below the threshold that have no surrounding matrix elements below the threshold (isolated cells marked with an x ​​in the figure). (3) The co-occurrence pattern extraction unit 11 projects the results of (2) in the column and row directions of the matrix. At this time, each projection element is regarded as satisfying the condition if it has even one element less than the threshold. (4) The co-occurrence pattern extraction unit 11 divides the distance matrix at the boundary between elements that satisfy the condition and elements that do not satisfy the condition among the projected components. (5) The co-occurrence pattern extraction unit 11 extracts partial distance matrices that include matrix elements less than the threshold from the divided distance matrices (hereinafter referred to as partial distance matrices). This allows the extraction of submatrices with consecutive elements less than the threshold. (6) The co-occurrence pattern extraction unit 11 repeats (3) to (5) until all the projected components are less than the threshold value. (7) The co-occurrence pattern extraction unit 11 takes, of the remaining partial distance matrices, the elements in the leftmost column or bottommost row that are less than the threshold as candidates for the starting point, and the elements in the rightmost column or topmost row that are less than the threshold as candidates for the end point. However, if the elements in the upper left corner and the lower right corner are taken as the starting point or end point, only routes that do not move through columns or rows can be taken, so these are excluded from the candidates for the starting point and end point.

[0055] Step 4: The co-occurrence pattern extraction unit 11 calculates the time warping distance for the partial distance matrix extracted in step 3. The time warping distance is defined as: f i,j =d i,j +min(f i,j-1 ,f i-1,j ,f i-1 , j-1 ) f 0,0 =0 f i,0 =f 0,j =∞ Here, i,j is an element of the distance matrix in the partial distance matrix, and the coordinates of the starting point are (i,j)=(1,1).

[0056] This time warping distance is calculated between each combination of the start point candidate and the end point candidate. The representative path is the most likely path for which the time warping distance from the start point to the end point divided by the number of squares on the path is the smallest, i.e., the average distance of each element on the path is the smallest. In addition, the representative value of the time warping distance for the pair of start and end points is determined by dividing the time warping distance of the representative path by the number of squares on the representative path. However, when forming a combination of start and end points, it is required that they are separated by a specified number of squares in both the row and column directions.

[0057] The co-occurrence pattern extraction unit 11 performs steps 1 to 4 between each IoT device and extracts a representative path for each IoT device. The co-occurrence pattern extraction unit 11 then compares the representative paths and regards the representative paths confirmed between a certain number of IoT devices or more as a flow chain, which is a co-occurrence pattern.

[0058] [Method 2 for extracting co-occurrence patterns: Mutation point detection method] In the mutation point detection method, the co-occurrence pattern extraction unit 11 uses the point in the distance matrix where elements less than the threshold are consecutive among all paths calculated by DTW as the starting point, and extracts adjacent elements less than the threshold as a co-occurrence pattern, using the following procedure.

[0059] Step 1: The co-occurrence pattern extraction unit 11 extracts candidate paths of co-occurrence patterns by DTW.

[0060] FIG. 5 is a diagram showing an outline of the mutation detection method according to this embodiment. Here, the grid diagram represents a distance matrix, and each square represents an element of the matrix (the distance between flows). Also, the shaded squares represent elements that correspond to co-occurrence patterns.

[0061] In DTW, when calculating the time warping distance between two time series data, the time warping distance is calculated for all squares by branching from the bottom left to the top right of the matrix. In this case, if a path reaches an element of a co-occurrence pattern, there is a high possibility that the path will be constructed along the corresponding part of the co-occurrence pattern. In this case, the distance d i,j is considered to be sufficiently small, the increase in the cumulative sum of distances is small on the path of the co-occurrence pattern (path 2 in FIG. 5B, the shaded area). Therefore, the co-occurrence pattern extraction unit 11 can extract a section in which the increase in the cumulative sum of distances is smaller than the threshold as a candidate path of the co-occurrence pattern.

[0062] Step 2: The co-occurrence pattern extraction unit 11 searches for the starting point of the entire route including the candidate route. Since the starting point of the extracted candidate route does not necessarily match the starting point of the co-occurrence pattern, the co-occurrence pattern extraction unit 11 finds the starting point by tracing the candidate route in the reverse direction (to the lower left). Specifically, starting from the end point of the candidate route, the co-occurrence pattern extraction unit 11 searches for the starting point of the candidate route that is closest to the left, the lower left, and the bottom. i,j Then, select the smallest square and construct a route. i,j becomes equal to or larger than the threshold, the co-occurrence pattern extraction unit 11 determines the previous point as the starting point of the co-occurrence pattern.

[0063] The co-occurrence pattern extraction unit 11 performs steps 1 and 2 between each IoT device and extracts a path for each IoT device. The co-occurrence pattern extraction unit 11 then compares the paths and regards paths confirmed between a certain number of IoT devices or more as a flow chain, which is a co-occurrence pattern.

[0064] Although the trimming method or the mutation point detection method can efficiently extract co-occurrence patterns, there is a possibility that some co-occurrence patterns may be missing or that unrelated communications may be mixed in. In addition, the large number of devices may require a huge amount of calculations. To alleviate these problems, the co-occurrence pattern extraction unit 11 may use either of the following approaches (options 1 and 2).

[0065] [Option 1: Dealing with partial loss of co-occurrence patterns or inclusion of unrelated communications] Depending on the communication environment, a co-occurrence pattern that should be continuously connected may be broken up. For example, in a system where a load balancer is interposed between multiple proxy servers to distribute communications, if data from only one proxy server is captured, the communications content assigned to other proxy servers will be lost.In addition, it is possible that unrelated communications occur in the middle of a flow chain of co-occurrence patterns. In such a case, the co-occurrence pattern is divided, and therefore, in the above-mentioned trimming method, one co-occurrence pattern is divided into two or more.

[0066] Therefore, the co-occurrence pattern extraction unit 11 may extend the trimming method to extract a partial distance matrix in which elements less than the threshold are discontinuous in the distance matrix by ignoring a predetermined number of rows or columns consisting of elements equal to or greater than the threshold, where elements less than the threshold are continuous.

[0067] FIG. 6 is a diagram showing an overview of the extended trimming method in this embodiment. Unrelated communications are mixed into the original co-occurrence patterns, and in this example, rows containing only elements whose distance is equal to or greater than a threshold are inserted. In the above-mentioned trimming method, the partial distance matrix is ​​divided by these irrelevant rows, and only a part of the original co-occurrence patterns is extracted.

[0068] To address this problem, the co-occurrence pattern extraction unit 11 extracts co-occurrence patterns using a distance matrix after deleting a predetermined number of rows or columns (e.g., one row) from which there are no rows or columns with squares less than the threshold. This makes it possible to extract co-occurrences correctly, but since there is a possibility that unrelated co-occurrence patterns may be combined, this method is suitable for cases where the frequency of co-occurrence is low.

[0069] [Option 2: Dealing with the enormous amount of calculations required due to the large number of devices] When the number of target IoT devices is large, the amount of calculation required may become enormous even when using the trimming method or the mutation point detection method.

[0070] Therefore, the co-occurrence pattern extraction unit 11 may extract co-occurrence patterns from the time series data of some of the multiple devices by the following procedure, which limits the scope of application of the trimming method or the mutation point detection method, and then search for the extracted co-occurrence patterns in the time series data of other devices using a predetermined algorithm (e.g., SPRING).

[0071] (1) The co-occurrence pattern extraction unit 11 randomly selects several IoT devices. (2) The co-occurrence pattern extraction unit 11 comprehensively extracts co-occurrence patterns between the selected IoT devices using a trimming method or a mutation point detection method. (3) The co-occurrence pattern extraction unit 11 searches for the co-occurrence patterns extracted in (2) in other IoT devices, for example, using SPRING.

[0072] This co-occurrence pattern search procedure consists of two major steps: (1) to (2) extract co-occurrence patterns from a small number of IoT devices, and (3) search for the extracted co-occurrence patterns in other IoT devices. In addition, SPRING used in (3) can process with a relatively small amount of calculation if the co-occurrence pattern to be searched is specified, and the overall amount of calculation can be reduced.

[0073] With this method, there is a possibility that co-occurrence patterns that were not extracted in (2) may be overlooked. However, for the co-occurrence patterns extracted in (2), the statistical error is reduced by increasing the number of IoT devices, and therefore the accuracy of normal / abnormal determination can be improved.

[0074] The occurrence probability calculation unit 12 calculates the occurrence probability of the flow chain of the co-occurrence pattern extracted by the co-occurrence pattern extraction unit 11. Here, it can be said that the lower the occurrence probability, the higher the abnormality degree of the corresponding flow chain.

[0075] The occurrence probability of the extracted flow chain is determined by the following three elements. · The occurrence probability of the label of the first flow of the flow chain · The probability that, within each label, the parameter x is in the range k - Δk < x < k + Δk · The transition probability between labels Here, it is assumed that the flow is identified by a label such as an application name or a clustering number.

[0076] FIG. 7 is a diagram showing the components of the occurrence probability of the flow chain in the present embodiment. P(X) is the occurrence probability of the flow with label X, P(x|X) is the probability that, among the flows with label X, the parameter x falls within a certain width range, and P(X→Y) is the probability that the next flow of the flow with label X is a flow with label Y.

[0077] The occurrence probability P(X) of the label of the first flow of the flow chain is calculated by the ratio of the flow with the corresponding label in the total data using the data obtained in advance.

[0078] As calculation methods for P(x|X), there are two methods: calculating as a ratio and calculating by assuming a distribution such as a Gaussian distribution or a Poisson distribution. In the method of calculating as a ratio, the occurrence probability calculation unit 12 calculates the ratio when the number of flows with label X is the denominator and the number of flows in which the parameter x falls within a predetermined width is the numerator. In the calculation method assuming a distribution, the occurrence probability calculation unit 12 approximates the actual distribution of the parameter x in label X with a predetermined distribution and calculates the probability that x is in a predetermined range.

[0079] Regarding the transition probability P(X→Y) between labels, the following three calculation methods are available, and the occurrence probability calculation unit 12 may appropriately select any of the calculation methods.

[0080] [Calculation method 1 of transition probability: Calculation based on an Nth-order Markov process] Generally, the transition matrix based on a first-order Markov process represents the probability of transitioning from the state at time t-1 to the state at time t as a two-dimensional matrix. Here, this is referred to as the transition matrix of the first-order Markov process. However, there are cases where the transition probability to the state at time t cannot be correctly calculated only based on the information at time t-1. For example, considering the communication of the engine start notification in a vehicle application, when the communication of the engine start notification occurs at time t-1, various communications such as navigation, weather, and audio-related communications are possible at time t. Here, assuming that the communication for obtaining the parking position of the vehicle or the communication for remote operations such as flashing the hazard lamp several times occurred at time t-2 before the engine start notification, it is possible that the user is in a large parking lot in an unfamiliar area far away. In this case, since the probability of using navigation becomes higher than usual, P(navigation communication at time t|engine start notification at time t-1) < P(navigation communication at time t|engine start notification at time t-1, remote operation at time t-2), so it does not satisfy the first-order Markov process.

[0081] To handle such cases, the occurrence probability calculation unit 12 adopts an Nth-order Markov process that calculates the probability of transitioning from the state at time t-1 to the state at time t based on the states from time t-N to time t-1, as represented by the following formula. P(X t |X t-1 ,…,X 1 )=P(X t |X t-1 ): first order P(X t |X t-1 ,…,X 1 )=P(X t |X t-1 ,X t-2 ): second order P(X t |X t-1 ,…,X 1 )=P(X t |X t-1 ,···,X t-N ): Nth floor

[0082] In this case, it is necessary to prepare a transition matrix for each label from time t-2 to time tN. That is, (number of types of labels) N-1 Since transition matrices must be calculated, this method is used when a sufficient amount of time series data is available.

[0083] [Transition probability calculation method 2: Calculation using preprocessing that aggregates known flow chains] In order to solve the problem that a calculation method using an N-th order Markov process requires a large amount of data, the occurrence probability calculation unit 12 may, as a preprocessing step, aggregate all flow chains in advance regardless of whether the first order Markov process holds, and treat the flow chains as equivalent to simplex flows. As a result, sufficient accuracy can be achieved even with a transition matrix that assumes a first-order Markov process. Specifically, this method consists of the following two steps (1) and (2).

[0084] (1) Extraction of known flow chains contained in normal communications The occurrence probability calculation unit 12 extracts a specific flow chain that is generated according to the application specifications or the like. Specifically, first, the occurrence probability calculation unit 12 uses an undirected graph to investigate whether the transition of each flow is a transition that occurs by chance or a transition that occurs due to some kind of relationship.

[0085] FIG. 8 is a conceptual diagram showing a method for creating an undirected graph in this embodiment. First, the occurrence probability calculation unit 12 classifies flows for each source IP address (i). Next, the occurrence probability calculation unit 12 creates a graph with the labels of each flow as nodes and the transitions from one label to another as undirected edges (ii). Furthermore, the occurrence probability calculation unit 12 integrates graphs that have at least some labels in common among the multiple graphs created for each source IP (iii). Next, the occurrence probability calculation unit 12 determines a threshold value X, and deletes edges (flow transitions) that have an occurrence count of X times or less (iv). Next, the occurrence probability calculation unit 12 deletes isolated nodes that do not include edges.

[0086] FIG. 9 is a conceptual diagram showing a method for extracting a flow chain from an undirected graph in this embodiment. The occurrence probability calculation unit 12 uses the undirected graph created as shown in FIG. 8 to extract a flow chain in the following procedure.

[0087] First, the occurrence probability calculation unit 12 selects a source IP and a corresponding graph one by one. Next, the occurrence probability calculation unit 12 extracts only flows having a label included in the selected graph from the multiple flows in time series of the selected source IP (i). The occurrence probability calculation unit 12 determines, from among the extracted flows, consecutive flows as candidates for a meaningful flow chain that occurs due to the specifications of the application or the like (ii). Furthermore, when the occurrence probability calculation unit 12 extracts candidates for meaningful flow chains from all source IPs and graphs, it treats flow chains among these candidates that appear N times or more per unit time as known specific flow chains.

[0088] Although the method of extracting a flow chain using an undirected graph has been described here, the occurrence probability calculation unit 12 may extract a chain in which the order of labels is specified using directed edges.

[0089] (2) Calculation of the transition matrix The occurrence probability calculation unit 12 calculates a transition matrix using the information of the known flow chain extracted in (1).

[0090] FIG. 10 is a conceptual diagram showing the calculation order of a transition matrix that aggregates flow chains in this embodiment. Each alphabetic character in the figure is used as a label for each flow. For example, assume that "aca" is a known flow chain that does not satisfy the first-order Markov process. The occurrence probability calculation unit 12 groups "aca" together and assigns a new label "A" that does not overlap with other labels.

[0091] After performing this process for all known flow chains, the occurrence probability calculation unit 12 calculates a transition matrix including the newly assigned labels. Using this transition matrix, for example, the transition probability of "bacag" cannot be calculated correctly because the "aca" part does not satisfy a first-order Markov process, but the transition probability of "bAg" can be calculated correctly because it satisfies a first-order Markov process.

[0092] Here, the transition matrix of this method has the number of elements as (number of label types + number of newly assigned label types). 2 On the other hand, in the transition probability matrix based on the N-th order Markov process mentioned above, (number of label types) 2 A transition matrix with elements is (number of label types). N-1 are required, and the number of matrix elements increases exponentially with N. In order to calculate the transition probability with high accuracy for all elements, the more elements there are, the more data volume is required. Therefore, this method reduces the number of elements, making it possible to calculate the transition probability with high accuracy using a smaller amount of data.

[0093] [Transition probability calculation method 3: Calculation using a deep learning model that handles time series] The occurrence probability calculation unit 12 may calculate the transition probability using deep learning. Among deep learning models, transformer, LSTM, RNN, GRU, etc. are known as models that handle time series data. The occurrence probability calculation unit 12 uses these methods for handling time series to learn a model that solves the task of predicting the label of a flow at time t from the labels of flows from time 1 to time t-1. The output of the model is the transition probability of the label. This method does not assume a first-order Markov process, so it can calculate transition probabilities with high accuracy if there is a sufficient amount of data for learning.

[0094] The abnormality determination unit 13 detects abnormal communication using the occurrence probability of the flow chain calculated by the occurrence probability calculation unit 12. When anomalous communication occurs in a given period, the number of flow chains observed is greater than the expected number of flow chains. Therefore, the anomaly determination unit 13 compares the actual number of occurrences of flow chains of co-occurrence patterns with the expected number of occurrences calculated from the occurrence probability of this co-occurrence pattern, and determines that anomalous communication is occurring when the actual number of occurrences is significantly greater than the expected value.

[0095] The expected number of occurrences is the total number of flow chains in the analysis period multiplied by the occurrence probability, but the total number of flow chains may be substituted with the total number of flows.

[0096] According to this embodiment, the anomalous communication detection device 1 extracts co-occurrence patterns from time series data of flows transmitted from multiple devices, calculates the occurrence probability of the extracted co-occurrence patterns, and determines that anomalous communication is occurring when the difference between the actual number of occurrences of the co-occurrence patterns and the expected number of occurrences calculated from the occurrence probability of the co-occurrence patterns exceeds a threshold value. Co-occurring flow chains observed in multiple IoT devices are considered to be specific flow chains determined by app specifications, or flow chains caused by cyber attacks. In addition, the occurrence probability of a flow chain caused by a cyber attack becomes higher than normal due to the inclusion of a flow chain caused by a cyber attack. Therefore, by extracting the co-occurring parts, it is possible to efficiently identify flow chains caused by cyber attacks. In other words, the anomalous communication detection device 1 can extract co-occurrence patterns of multiple IoT devices and efficiently detect the occurrence of anomalous communication from changes in the frequency of occurrence of those co-occurrence patterns, in order to combat cyber attacks that are difficult to detect in the past because they do not tend to cause changes in statistics.

[0097] The anomalous communication detection device 1 can detect anomalous communication even for flow chains that are not determined to be anomalous on a label-by-label basis by extracting co-occurrence patterns of flow chains and calculating the occurrence probability while restricting parameter values. For example, even if A→B→D is a flow chain with a high occurrence probability even in normal communication, if an arbitrary parameter x is included, for example, A(x=50-51)→B(x=120-121)→D(x=50-51), the occurrence probability becomes significantly lower. In this case, if most of the abnormal communications can be captured even if the value of parameter x is restricted, the ratio of abnormal communications to normal communications will be high. Therefore, by appropriately setting a limit on the parameter x, the anomalous communication detection device 1 can detect anomalous communication with high accuracy.

[0098] The anomalous communication detection device 1 uses a trimming method or a mutation point detection method to search for co-occurrence patterns without making assumptions about patterns. Conventional methods require a huge amount of calculation to search all possible patterns in a brute force manner when extracting co-occurrence patterns, but the anomalous communication detection device 1 can extract co-occurrence patterns with a smaller amount of calculation.

[0099] Specifically, in the case of the trimming method, if we consider for simplicity the extraction of co-occurrence patterns in a time series X with n data points and a time series Y with n data points, the amount of calculations required to calculate the distances of all matrix elements is n x n. Furthermore, if bit operations (OR operations) are used for the projection calculations, n operations are required in both the row and column directions. In addition, if the trimmed area is, for example, 50% each time and this is repeated N times, the total amount of calculations is n×n+2n+2(n×0.5)+2(n×0.5 2 )+… The order is O(n 2 ). Conventional SPRING is O(n 4 ), SLN-DTW is O(n 3 ), so each is O(n 2 ), it is possible to reduce the amount of calculation by O(n).

[0100] In addition, in the case of mutation point detection, the computational complexity of the time warping distance is n × n, which is of the order O(n 2 ) The amount of calculation required for searching for the starting point depends on the length of the co-occurrences, and is approximately O(length of the co-occurrences). Considering that there are generally few co-occurrences, the calculation time is O(length of the co-occurrences)< <O(n 2 ), so the total computational complexity is O(n 2 ) Therefore, compared with the computational complexity of SPRING and SLN-DTW, 2 ), it is possible to reduce the amount of calculation by O(n).

[0101] The anomalous communication detection device 1 calculates the transition probability in the flow chain by extending it to an N-order Markov process, by preprocessing to convert the flow chain into an approximately first-order Markov process by aggregating parts that are not first-order Markov processes, or by using a model that handles time series using deep learning that does not assume a first-order Markov process. As a result, while conventional methods were based on the assumption of a first-order Markov process and were unable to properly handle communication patterns that are not first-order Markov processes, the anomaly communication detection device 1 can more accurately calculate transition probabilities.

[0102] In addition, according to this embodiment, for example, anomalous communication in a communication network can be accurately detected, which makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0103] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0104] The anomalous communication detection method by the anomalous communication detection device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0105] 1. Abnormal communication detection device 10 Control section 11 Co-occurrence pattern extraction unit 12 Probability of Occurrence Calculation Section 13 Abnormality determination section 20 Memory section

Claims

1. a co-occurrence pattern extraction unit that extracts co-occurrence patterns from time series data of flows transmitted from a plurality of devices; an occurrence probability calculation unit that calculates the occurrence probability of the extracted co-occurrence pattern; An anomaly detection device comprising an anomaly determination unit that determines that an anomaly has occurred when the difference between the actual number of occurrences of a co-occurrence pattern and the expected number of occurrences calculated from the occurrence probability of the co-occurrence pattern exceeds a threshold value.

2. The abnormal communication detection device according to claim 1 , wherein the plurality of devices are vehicles, and the abnormal communication detection device targets a flow of vehicle communication with a common server as a communication destination.

3. The anomalous communication detection device according to claim 1 , wherein the co-occurrence pattern extraction unit extracts a submatrix in which elements less than a threshold are continuous from among elements of a distance matrix in DTW (Dynamic Time Warping), and applies DTW to the submatrix.

4. The anomalous communication detection device of claim 3, wherein the co-occurrence pattern extraction unit, in a portion of the distance matrix where elements less than the threshold are discontinuous, extracts a submatrix in which a predetermined number of rows or columns consisting of elements equal to or greater than the threshold are ignored when elements less than the threshold are continuous.

5. 2. The anomalous communication detection device according to claim 1, wherein the co-occurrence pattern extraction unit extracts, as the co-occurrence pattern, a point in a distance matrix in Dynamic Time Warping (DTW) where elements less than a threshold value are consecutive in all paths calculated by DTW, including adjacent elements less than the threshold value.

6. 6. The anomalous communication detection device according to claim 1, wherein the co-occurrence pattern extraction unit extracts a co-occurrence pattern from the time series data of some of the multiple devices, and then searches for the co-occurrence pattern in the time series data of other devices using a predetermined algorithm.

7. The anomalous communication detection device according to claim 6 , wherein the co-occurrence pattern extraction unit uses SPRING as the predetermined algorithm.

8. 6. The anomaly detection device according to claim 1, wherein the occurrence probability calculation unit calculates the occurrence probability from an occurrence probability of a label assigned to a leading element of a co-occurrence pattern, a probability that a predetermined parameter falls within a predetermined range within each label, and a transition probability between labels.

9. The anomaly communication detection device according to claim 8 , wherein the occurrence probability calculation unit calculates a transition probability from a sequence of a plurality of labels in a time series to one label as the transition probability between the labels.

10. The anomalous communication detection device according to claim 8 , wherein the occurrence probability calculation unit sets a predicted value of one label by a deep learning model using a sequence of a plurality of labels in a time series as an input as a transition probability between the labels.

11. 9. The anomaly communication detection device according to claim 8, wherein the occurrence probability calculation unit calculates the transition probability between the labels by a first-order Markov process using time series data in which a specific flow chain is aggregated and treated as one element.

12. The anomalous communication detection device according to claim 11, wherein the occurrence probability calculation unit creates a graph in which the labels of each flow are nodes and the transitions from label to label are edges, extracts a time series chain from the graph, and defines the chain as the specific flow chain.

13. The anomalous communication detection device according to claim 12 , wherein the occurrence probability calculation unit extracts a chain in which the edges are directed edges and an order of labels is specified, and defines the chain as the specific flow chain.

14. An anomalous communication detection program for causing a computer to function as the anomalous communication detection device according to any one of claims 1 to 5.

Images