Packet analysis device and computer program for packet analysis

Abstract

To reduce a burden on a user when analyzing packets.SOLUTION: A packet analysis device includes: a packet acquisition unit that acquires a packet to be transmitted and received; an image generation unit that generates a character string image representing a character string included in header information of the packet; a first machine learning model that is configured to select a character string corresponding to one or more target items among a plurality of items of the header information from the character string image generated on the basis of the acquired packet; a second machine learning model that is configured to determine whether or not the character string of the target item selected by the first machine learning model has a normal parameter value in the character string image generated on the basis of the acquired packet; and a display unit that displays a selection result by the first machine learning model and a determination result by the second machine learning model.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a packet analysis device and a computer program for packet analysis. [Background technology]

[0002] There are known tools called packet capture and LAN analyzers that have the function of collecting and displaying packets flowing through a network (see, for example, Patent Document 1 and Non-Patent Document 1). By using these tools, it is possible to analyze the causes of communication failures and other problems that occur in a network. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-193832 [Non-patent literature]

[0004] [Non-Patent Document 1] "LAN Analyzer", [online], [searched June 26, 2023], Internet<https: / / ja.wikipedia.org / wiki / LAN%E3%82%A2%E3%83%8A%E3%83%A9%E3%82%A4%E3%82%B6> Summary of the Invention [Problem to be solved by the invention]

[0005] However, packet header information contains a huge number of items, and extremely advanced specialized knowledge of various communication protocols is required to correctly determine whether the values ​​set for each item are appropriate. Therefore, there is a need to reduce the burden on users when analyzing packets. [Means for solving the problem]

[0006] According to one aspect of the present invention, there is provided a packet analysis device including: a packet acquisition unit that acquires a transmitted and received packet; an image generation unit that generates a string image representing a string included in header information of the packet, the string image being an image that displays each item of the header information in a distinguishable manner; a first machine learning model configured to select a string corresponding to one or more target items among a plurality of items of the header information from the string image generated based on the acquired packet; a second machine learning model configured to determine whether or not the string of the target item selected by the first machine learning model in the string image generated based on the acquired packet has a normal parameter value; and a display unit that displays a selection result by the first machine learning model and a determination result by the second machine learning model.

[0007] Furthermore, according to one aspect of the present invention, the first machine learning model may be configured to receive as input partial images of the character string image corresponding to each item of the header information, and output identification information indicating whether each of the items is a target item.

[0008] According to one aspect of the present invention, the second machine learning model may be configured to receive as input a partial image of the character string image corresponding to the target item, and to output identification information indicating whether a parameter value in the target item is normal or not.

[0009] According to another aspect of the present invention, the character string image includes a first group of partial images corresponding to a plurality of items at a first level in the header information, a second group of partial images corresponding to a plurality of items at a second level, which is a level lower than the first level in the header information, that are subordinate to a target item at the first level, and a third group of partial images corresponding to a plurality of items at the second level in the header information that are subordinate to an item other than the target item at the first level, and the first machine learning model may be a learning model pre-trained using teacher data that includes the first group of partial images and the second group of partial images but does not include the third group of partial images.

[0010] According to another aspect of the present invention, the character string may be expressed using one or more of letters, numbers, and symbols.

[0011] According to another aspect of the present invention, the character string image may be an image in which each item of the header information is displayed on a single line.

[0012] According to another aspect of the present invention, the target item may be an item that is determined in advance as one that requires a user to check the parameter value.

[0013] According to one aspect of the present invention, there is provided a computer program for packet analysis, configured to cause a computer to function as: a packet acquisition unit that acquires a transmitted and received packet; an image generation unit that generates a string image representing a string included in header information of the packet, where the string image is an image that displays each item of the header information in a distinguishable manner; a first machine learning model configured to select, from the string image generated based on the acquired packet, a string corresponding to one or more target items among a plurality of items of the header information; a second machine learning model configured to determine whether or not, in the string image generated based on the acquired packet, the string of the target item selected by the first machine learning model has a normal parameter value; and a display unit that displays a selection result by the first machine learning model and a determination result by the second machine learning model. Effect of the Invention

[0014] According to the present invention, it is possible to reduce the burden on a user when analyzing packets. [Brief description of the drawings]

[0015] [Figure 1] 1 is a diagram illustrating an exemplary configuration of a packet analysis device according to an embodiment of the present invention. [Diagram 2] 13 is an example of a character string image displaying a list of a plurality of packets acquired by a packet acquisition unit. [Diagram 3] 3 is an example of a character string image displaying details of one packet selected from the multiple packets in the character string image of FIG. 2. [Figure 4] 4 is an example of a character string image displaying further details of one or more items selected from the multiple items in the character string image of FIG. 3. [Diagram 5] 1 shows an example of implementation of a first machine learning model in a packet analysis device according to an embodiment of the present invention. [Figure 6]13 illustrates an example of implementation of a second machine learning model in a packet analysis device according to an embodiment of the present invention. [Figure 7] 4 is a flowchart showing an example of an operation of the packet analysis device according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0017] FIG. 1 is a diagram showing an exemplary configuration of a packet analysis device 100 according to an embodiment of the present invention. As shown in FIG. 1, the packet analysis device 100 forms a LAN 10 together with, for example, a router 20 and a communication node 30. In the LAN 10, the packet analysis device 100 and the communication node 30 are communicably connected to the router 20. The communication node 30 may be a computer (for example, a PC or a server device) equipped with a network communication function, and transmits and receives packets to and from other communication nodes 50 on an external network 40 (for example, the Internet, etc.) via the router 20. The packet analysis device 100 has a function of acquiring and analyzing packets transmitted and received by the communication node 30.

[0018] The packet analysis device 100 includes a packet acquisition unit 110, a character string image generation unit 120, a partial image extraction unit 130, a machine learning unit 140, and a display unit 150. The machine learning unit 140 also includes a first machine learning model 142 and a second machine learning model 144. The packet analysis device 100 is configured as a computer including a processor and a memory, and the functions of each of the packet acquisition unit 110, the character string image generation unit 120, the partial image extraction unit 130, and the machine learning unit 140 may be realized by the processor reading and executing a program (i.e., computer-executable instructions) stored in the memory.

[0019] 1, the packet analysis device 100 is depicted as a device separate from the communication node 30, but the functions of each unit of the packet analysis device 100 may be incorporated into the communication node 30 (i.e., the packet analysis device 100 is configured integrally with the communication node 30). For example, a program for realizing the functions of each unit of the packet analysis device 100 may be provided as application software, and this application software may be installed in the communication node 30 (i.e., a PC or a server device).

[0020] The packet acquisition unit 110 acquires packets transmitted and received by the communication node 30. For example, the packet acquisition unit 110 can be configured to acquire, from the router 20, copies of packets passing through the router 20. In an embodiment in which the packet analysis device 100 is configured integrally with the communication node 30, the packet acquisition unit 110 may be configured to acquire copies of transmitted packets and received packets from a wired / wireless communication module of the communication node 30.

[0021] The character string image generating unit 120 is configured to extract header information from the packet acquired by the packet acquiring unit 110, and generate a character string image representing a character string included in the extracted header information. The header information of a packet is composed of many different items, and the character string image is an image in which each item of the header information is represented in a form in which each item can be distinguished from the others, and the content of each item is represented by a character string whose meaning can be identified by a human (i.e., not in hexadecimal notation, etc.). Note that the character string here may be any of letters, numbers, and symbols. The character string image generated by the character string image generating unit 120 can be displayed on the display unit 150 (display) of the packet analyzing device 100 so that the user of the packet analyzing device 100 can check the content of the header information of the packet.

[0022] 2 to 4 show some examples of character string images generated by the character string image generating unit 120. FIG. 2 shows an example of a character string image 200 displaying a list of a plurality of packets acquired by the packet acquiring unit 110. In the character string image 200, each packet 202 is represented by one line of character string, and a plurality of packets acquired by the packet acquiring unit 110 are shown in a list format by a plurality of lines arranged from the top in the order of acquisition. The character string in each line may be, for example, a character string summarizing the contents of the header information of the packet in that line. The character string image 200 may be updated, for example, every time a packet analysis process is started in the packet analyzing device 100 and a new packet is acquired by the packet acquiring unit 110, and the updated character string image 200 may be displayed in sequence on the display unit 150 of the packet analyzing device 100.

[0023] FIG. 3 is an example of a character string image 300 displaying details of one packet selected from among the multiple packets in the character string image 200 in FIG. 2. For example, in response to a user of the packet analysis device 100 providing an input (e.g., a click of a mouse, which is an input device) to the packet analysis device 100 to select one packet in the character string image 200 displayed on the display unit 150, the character string image 300 in FIG. 3 may be generated and displayed on the display unit 150 (e.g., the character string image 300 may be additionally displayed at the bottom of the screen of the display unit 150 on which the character string image 200 is displayed). In the character string image 300, among multiple items included in the header information of the selected packet, multiple items belonging to the first layer are represented by one line of character string for each item. In the example of FIG. 3, the character string image 300 has five items 301 to 305 in the first layer. For example, item 303 is an item related to the Internet Protocol (IP) header of the selected packet, item 304 is an item related to the Stream Control Transmission Protocol (SCTP) header, and item 305 is an item related to the Diameter protocol header. As with the character string image 200 in Fig. 2, the character strings in each line of the character string image 300 may be character strings summarizing the contents of the header information corresponding to each item.

[0024] Fig. 4 is an example of a character string image 400 that displays further details of one or more items selected from the multiple items in the character string image 300 in Fig. 3. For example, in response to an input to the packet analysis device 100 that selects one or more items in the character string image 300 in Fig. 3 displayed on the display unit 150 of the packet analysis device 100, the character string image 400 in Fig. 4 may be generated and the screen of the display unit 150 may transition from the character string image 300 to the character string image 400. The character string image 400 is an image that displays information of an item that belongs to the next lower layer (second layer) of the item selected from the multiple items included in the character string image 300 (i.e., the items in the first layer). The example of Fig. 4 shows a character string image 400 when item 304 (SCTP header) and item 305 (Diameter protocol header) are selected in the character string image 300 of the example of Fig. 3, and character string image 400 has, below the string of item 304, the strings of each item 401 in the second hierarchy included in item 304, and below the string of item 305, the strings of each item 402 in the second hierarchy included in item 305. In character string image 400, the character strings in each line in the second hierarchy correspond to one item in the second hierarchy, similar to the character strings in the first hierarchy.

[0025] In this way, when one or more items (items in the first layer) are selected while character string image 300 is displayed on display unit 150, items in the second layer subordinate to the selected items are expanded and displayed. By deselecting an item in the first layer, it may be possible to collapse the item in the second layer that was once expanded and make it invisible again (i.e., to return to display of character string image 300). In addition, when the header information of a packet includes items in layers lower than the second layer (third, fourth layers, etc.), character string image generating unit 120 may be capable of generating a similar character string image having items in those lower layers.

[0026] In the above, it has been explained that when one packet is selected in character string image 200 in FIG. 2, character string image 300 in FIG. 3 is generated and displayed, and further, when an item in the first hierarchical level of header information is selected in character string image 300 in FIG. 3, character string image 400 in FIG. 4 is generated and displayed. However, in response to the selection of one packet in character string image 200 in FIG. 2, a character string image in which items belonging to the second hierarchical level and below (e.g. items in all hierarchical levels) are expanded may be generated and displayed immediately.

[0027] Returning to FIG. 1, the partial image cutting unit 130 cuts out partial images corresponding to each item of the header information in the character string image generated by the character string image generating unit 120. For example, in the character string image 300 illustrated in FIG. 3, five partial images corresponding to each of the items 301 to 305 are cut out. Also, in the character string image 400 illustrated in FIG. 4, partial images corresponding to each of the items 402 in the second layer subordinate to the item 305 (header of the Diameter protocol) are cut out. Here, since there are 23 items 402 in the second layer (23 rows) under the item 305, 23 partial images corresponding to each row are cut out. Note that in the character string image 400 illustrated in FIG. 4, the partial image cutting unit 130 does not cut out partial images for each item 401 in the second layer subordinate to the item 304 (SCTP header), the reason for which will be explained later.

[0028] The first machine learning model 142 of the machine learning unit 140 is configured to select, from the character string image generated by the character string image generating unit 120, character strings corresponding to one or more target items among the multiple items of the header information. As described above, the character string image (for example, the character string images 300 and 400) has character strings corresponding to each of the multiple items (for example, the items 301 to 305, 401, and 402) included in the header information of the packet acquired by the packet acquiring unit 110. Among these multiple items, the "target item" refers to an item that is predetermined as one that requires the user of the packet analysis device 100 to check the parameter value set in the corresponding item of the header information (for example, by visually checking the value displayed on the display unit 150). For example, in the example of the character string image 300 in FIG. 3, only the item 305 corresponding to the header of the Diameter protocol is set as a target item in advance, while the other items 301 to 304 may be set as non-target items (i.e., items that do not need to be checked by the user) in advance. Similarly, in the example of the character string image 400 in Fig. 4, among the multiple items 402 in the second layer subordinate to the Diameter protocol (item 305), the items in the first to ninth lines may be set in advance as non-target items, and the items in the tenth to 23rd lines may be set in advance as target items. Note that the number of target items in each character string image is arbitrary.

[0029] The first machine learning model 142 is trained (learned) in advance by the machine learning unit 140 so as to be able to identify whether or not an item of header information corresponding to a character string in each line in a character string image is a target item. Specifically, an implementation example of the first machine learning model 142 is shown in FIG. 5. The first machine learning model 142 can be configured by a neural network 500 including an input layer 502 having a plurality of input nodes 501, an intermediate layer 504 consisting of one or more layers each having a plurality of nodes 503, and an output layer 506 having a plurality of output nodes 505. Each node is connected to a plurality of nodes in a layer adjacent to the layer to which the node belongs, with a strength characterized by a weighting parameter. A partial image created by the partial image cutting unit 130 is input to the input layer 502. The output layer 506 is composed of two output nodes 505, one of which outputs identification information 507 indicating that the partial image input to the input layer 502 corresponds to the target item of the header information, and the other output node outputs identification information 508 indicating that the partial image input to the input layer 502 does not correspond to the target item of the header information. In order to train the first machine learning model 142 (neural network 500), a label indicating correct information on whether the partial image input to the input layer 502 is a target item of the header information is given to the machine learning unit 140 by, for example, an administrator or a trainer of the packet analysis device 100. A large number of sets of partial images and labels are used as training data to adjust weighting parameters between each node of the neural network 500 so that the two output nodes 505 of the output layer 506 output identification information 507, 508 that match the labels. In this way, the first machine learning model 142 is trained.

[0030] For example, the character string image 300 in the example of FIG. 3 has character strings corresponding to five items 301 to 305 in the first layer of the header information, and the first machine learning model 142 is trained using a large number of teacher data sets each consisting of a partial image representing the character string of each of these items and a label assigned to the partial image. In addition, in the character string image 400 in the example of FIG. 4, the second layer of the header information includes a plurality of items 402 subordinate to the Diameter protocol (item 305) that is a target item among the items in the first layer, and a plurality of items 401 subordinate to an item (item 304) that is not a target item. For the second layer of the header information, the first machine learning model 142 is further trained using a large number of teacher data sets each consisting of a partial image representing each character string of the item 402 subordinate to the target item in the first layer and a label assigned to the partial image.

[0031] Here, if an item in the first layer is not a target item, an item in the second layer (e.g., item 401) subordinate to that item is also not a target item, so in the example of FIG. 4, partial images corresponding to the character strings of each item 401 in the second layer that is not subordinate to the target item in the first layer are not used for training the first machine learning model 142. That is, in the example of the character string image 300 illustrated in FIG. 3 and the character string image 400 illustrated in FIG. 4, the first machine learning model 142 is trained by teacher data that includes a first group of partial images corresponding to the character strings of each item 301 to 305 in the first layer of the header information, and a second group of partial images corresponding to each character string of the item 402 in the second layer that is subordinate to the target item (item 305) in the first layer, but does not include a third group of partial images corresponding to each character string of the item 401 in the second layer that is not subordinate to the target item (item 305) in the first layer. Therefore, the scale of the first machine learning model 142 can be reduced, and the learning time can also be reduced.

[0032] The second machine learning model 144 of the machine learning unit 140 is configured to determine whether or not the character string of the target item selected by the first machine learning model 142 has a normal parameter value. As described above, for example, in the example of the character string image 400 in FIG. 4, the items in the 10th to 23rd lines of the items 402 in the second layer subordinate to the Diameter protocol (item 305) in the first layer are set as target items, and each of these target items includes a character string of a parameter value representing the content of the item. For example, referring to FIG. 4, the item in the 10th line of the items 402 includes a parameter value of "Vendor-Specific-Application-Id(260) l=32 f=-M-". A parameter value being "normal" may mean, for example, that the parameter value matches a value that is required or recommended to be set in a predetermined communication specification.

[0033] The second machine learning model 144 is trained (learned) in advance by the machine learning unit 140 so as to be able to identify whether the parameter value of the target item in the character string image is normal or not. Specifically, an implementation example of the second machine learning model 144 is shown in FIG. 6. Like the first machine learning model 142, the second machine learning model 144 can be configured by a neural network 600 including an input layer 602 having a plurality of input nodes 601, an intermediate layer 604 consisting of one or more layers each having a plurality of nodes 603, and an output layer 606 having a plurality of output nodes 605, and each node is connected to a plurality of nodes in a layer adjacent to the layer to which the node belongs, with a strength characterized by a weighting parameter. A partial image of the target item created by the partial image cutting unit 130 is input to the input layer 602. The output layer 606 is composed of two output nodes 605, one of which outputs identification information 607 indicating that the parameter value in the partial image of the target item input to the input layer 602 is a normal value, and the other output node outputs identification information 608 indicating that the parameter value in the partial image of the target item input to the input layer 602 is an abnormal value. In order to train the second machine learning model 144 (neural network 600), a label indicating correct information on whether the parameter value in the partial image input to the input layer 602 is a normal value is given to the machine learning unit 140 by, for example, an administrator or a trainer of the packet analysis device 100. A weighting parameter between each node of the neural network 600 is adjusted using a large number of sets of partial images of the target item and their corresponding labels as teacher data so that the two output nodes 605 of the output layer 606 output the identification information 607, 608 that match the labels. In this way, the second machine learning model 144 is trained.

[0034] 7 is a flowchart showing an example of the operation of the packet analysis device 100 according to an embodiment of the present invention. The packet analysis device 100 operates using the trained first and second machine learning models 142, 144. The operation starts from step 702.

[0035] In step 702, the packet acquisition unit 110 acquires a packet from the router 20 or the communication node 30. In step 704, the character string image generation unit 120 generates a character string image 200 (see FIG. 2) that displays a list of the acquired packets, and the character string image 200 is displayed on the display unit 150. In step 706, it is determined (for example, by the processor of the packet analysis device 100) whether or not one packet has been selected by the user from the list displayed on the display unit 150, and if such selection has been made, the process proceeds to step 708. In step 708, the character string image generation unit 120 generates a character string image 300 (see FIG. 3) that shows details of the selected packet, and the character string image 300 is displayed on the display unit 150.

[0036] In the following step 710, the partial image cutting unit 130 cuts out partial images corresponding to each item (items 301 to 305) of the header information from the generated character string image 300. In step 712, the machine learning unit 140 inputs the partial images of each item of the header information cut out in step 710 to the input layer 502 of the first machine learning model 142, and upon receiving this input, the first machine learning model 142 outputs, from the output layer 506, identification information 507 or 508 indicating whether the item of the partial image is a target item for each input partial image. In step 714, the identification result by the first machine learning model 142 is displayed on the display unit 150. For example, next to the character string of the item 305, which is the target item in the character string image 300 (the character string written as "Diameter Protocol"), additional information (for example, an icon or character indicating "check required") may be displayed to inform the user that the item is a target item that needs to be checked by the user.

[0037] Next, in step 716, it is determined (e.g., by the processor of packet analysis device 100) whether one or more items have been selected by the user from character string image 300 on display unit 150, and if such a selection has been made, the process proceeds to step 718. In step 718, character string image generation unit 120 generates character string image 400 (see FIG. 4) showing further details of the selected item, and character string image 400 is displayed on display unit 150 (e.g., the display of character string image 300 is switched to the display of character string image 400).

[0038] In the following step 720, the partial image extraction unit 130 extracts partial images corresponding to each item (e.g., each line of the item 402) in the second layer subordinate to the target item in the first layer of the header information from the character string image 400 generated in step 718. In step 722, the machine learning unit 140 inputs the partial images of the items in the second layer of the header information extracted in step 720 to the input layer 502 of the first machine learning model 142, and upon receiving this input, the first machine learning model 142 outputs, from the output layer 506, identification information 507 or 508 indicating whether the item of the partial image is a target item for each input partial image. In step 724, the identification result by the first machine learning model 142 is displayed on the display unit 150. For example, additional information (e.g., an icon or text indicating "check required") may be displayed next to each of the character strings in lines 10 to 23 of item 402, which is the target item in character string image 400, informing the user that each of the items in lines 10 to 23 is a target item that the user needs to check.

[0039] Furthermore, in step 726, the machine learning unit 140 inputs the partial images corresponding to the target items of the second hierarchy of the header information from among the partial images cut out in step 720 to the input layer 602 of the second machine learning model 144, and upon receiving this input, the second machine learning model 144 outputs, from the output layer 606, identification information 607 or 608 indicating whether the parameter value in the partial image is a normal value or not for each input partial image. In step 728, the identification result by the second machine learning model 144 is displayed on the display unit 150. For example, next to the additional information displayed in the above step 724, additional information informing whether the parameter value of the target item is a normal value or an abnormal value (for example, an icon or characters of "normal value" or "abnormal value") may be displayed.

[0040] In the above flowchart in FIG. 7, when one packet is selected in step 706, character string image 300 including only items in the first layer is generated and displayed, and then character string image 400 including the second item is generated and displayed. However, instead of such processing, the flowchart may be modified so that, immediately after a packet is selected in step 706, a character string image similar to character string image 400 in which all items in the second layer are expanded is generated and displayed, partial images of each item (each line) of this character string image are input to first and second machine learning models 142, 144, and identification information 507, 508, 607, 608 indicating whether or not each item is a target item and whether or not the parameter value is normal is output for each item, and these are displayed on display unit 150.

[0041] As described above, the packet analysis device 100 according to one embodiment of the present invention can automatically determine, from among the many items contained in the header information of a packet, items (target items) whose contents require checking by the user, and can also automatically determine whether the settings (parameter values) of those target items are correct.

[0042] Although the embodiment of the present invention has been described above, the present invention is not limited to this, and various modifications are possible without departing from the spirit and scope of the present invention. [Explanation of symbols]

[0043] 10 LAN 20 Router 30 Communication Nodes 40 External Network 50 communication nodes 100 Packet Analysis Device 110 Packet acquisition unit 120 Character string image generator 130 Partial image extraction section 140 Machine Learning Department 142 The first machine learning model 144 Second Machine Learning Model 150 Display section

Claims

1. A packet acquisition unit that acquires transmitted and received packets; an image generating unit that generates a character string image representing a character string included in header information of the packet, the character string image being an image that displays each item of the header information in a distinguishable manner; A first machine learning model configured to select character strings corresponding to one or more target items among a plurality of items of the header information from the character string image generated based on the acquired packet; a second machine learning model configured to determine whether or not a character string of a target item selected by the first machine learning model in the character string image generated based on the acquired packet has a normal parameter value; and a display unit that displays a selection result based on the first machine learning model and a determination result based on the second machine learning model; A packet analysis device comprising:

2. 2. The packet analysis device according to claim 1, wherein the first machine learning model is configured to receive as input a partial image of the string image corresponding to each item of the header information, and to output identification information indicating whether each item is a target item.

3. The packet analysis device according to claim 1 , wherein the second machine learning model is configured to receive as input a partial image of the character string image corresponding to the target item, and to output identification information indicating whether a parameter value in the target item is normal or not.

4. The character string image is a first group of partial images corresponding to a plurality of items in a first hierarchy in the header information; a second group of partial images corresponding to a plurality of items subordinate to a target item in the first hierarchy among a plurality of items in a second hierarchy that is a hierarchy lower than the first hierarchy in the header information; and a third group of partial images corresponding to a plurality of items subordinate to an item other than the target item in the first layer among the plurality of items in the second layer in the header information, The first machine learning model is a learning model that is pre-trained using teacher data that includes the first group of partial images and the second group of partial images but does not include the third group of partial images. The packet analysis device according to any one of claims 1 to 3.

5. The packet analysis device according to claim 1 , wherein the character string is expressed using one or more of letters, numbers, and symbols.

6. The packet analysis device according to claim 1 , wherein the character string image is an image in which each item of the header information is displayed on a single line.

7. 2. The packet analysis device according to claim 1, wherein the target items are predetermined items whose parameter values ​​require checking by a user.

8. Computer, a packet acquisition unit that acquires transmitted and received packets; an image generating unit that generates a character string image representing a character string included in header information of the packet, the character string image being an image that displays each item of the header information in a distinguishable manner; a first machine learning model configured to select, from the character string image generated based on the acquired packet, a character string corresponding to one or more target items among a plurality of items of the header information; a second machine learning model configured to determine whether or not a character string of a target item selected by the first machine learning model in the character string image generated based on the acquired packet has a normal parameter value; and a display unit that displays a selection result based on the first machine learning model and a determination result based on the second machine learning model; 23. A computer program for packet analysis configured to function as:

Images