Communication monitoring apparatus and communication monitoring method

Abstract

To more reliably detect unauthorized communications.SOLUTION: A communication monitoring apparatus 1 comprises: a generation unit 12 that generates pseudo history data similar to history data of communications of a user terminal 2 identified by a subscriber identifier, by using a trained generator 111'; a collection unit 10 that collects history data of communications of the user terminal 2 identified by a monitoring target subscriber identifier; a determination unit 13 that is configured to determine whether or not the history data of the communications of the user terminal 2 identified by the monitoring target subscriber identifier matches the pseudo history data generated by the generation unit 12; and a presentation unit 15 that is configured to present a result of the determination by the determination unit 13.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a communication monitoring device and a communication monitoring method, and more particularly to a technology for monitoring unauthorized communications in a mobile communication network. [Background technology]

[0002] In recent years, generative AI has been attracting worldwide attention. One known model of generative AI is the Generative Adversarial Network (GAN). GAN is a generative model that can learn features from prepared data and generate pseudo-data, such as generating image data of a fictional character that closely resembles image data of a real person.

[0003] While it is said that generative AI will be increasingly used in mobile communication networks, there are concerns that attackers will use generative AI in the future to improve the security of mobile communication networks. In particular, in recent years, there has been an issue of so-called cloned SIMs (Subscriber Identity Modules), in which an attacker illegally obtains the subscriber identifier (International Mobile Subscriber Identity: IMSI) of a legitimate user and illegally accesses a mobile IP network, impersonating the legitimate user to send a location registration request signal and intercepting the legitimate user's communications (see Non-Patent Documents 1 and 2).

[0004] A known technique for detecting such fraudulent location registration requests is to check the base station number and AMF (Access and Mobility Management Function) number included in the location registration request to a control device on the mobile communications carrier network side, and detect it as fraudulent access when location registration requests with the same IMSI are made at almost the same time from distant locations, such as in Japan and a foreign country (see Non-Patent Document 1).

[0005] However, when a fraudulent location registration request is received relatively close to the legitimate user's location (for example, within Japan), it is difficult to distinguish whether it is from a legitimate user or a fraudulent request from an attacker. This has made it difficult to detect cloned SIMs. In particular, in the future, it is desirable to develop defenses in advance against threats when attackers use generation AI to generate fraudulent location registration requests that are difficult to distinguish from those from legitimate users. Furthermore, even in cases where attackers use generation AI, it is difficult to distinguish between communications from a legitimate user's device and fraudulent communications using conventional fraud detection technologies, so it is desirable to more reliably detect fraudulent communications. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] GSM Association, “FS.19 Diameter Interconnect Security Version 4.0”, 04 May 2018. [Non-patent document 2] GSM Association, “FS.11-SS7 Interconnect Security Monitoring and Firewall Guidelines 4.0”, 04 May 2018. Summary of the Invention [Problem to be solved by the invention]

[0007] As described above, it has been difficult to reliably detect unauthorized communications with conventional techniques.

[0008] The present invention has been made to solve the above-mentioned problems, and has an object to more reliably detect unauthorized communications. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems, the communication monitoring device of the present invention comprises a generation unit configured to generate pseudo-history data similar to communication history data of a user terminal identified by a subscriber identifier using a learned generator; a collection unit configured to collect communication history data of a user terminal identified by a subscriber identifier of a monitored target; a determination unit configured to determine whether the communication history data of the user terminal identified by the subscriber identifier of the monitored target matches the pseudo-history data generated by the generation unit; and a presentation unit configured to present the determination result by the determination unit.

[0010] In addition, in the communication monitoring device according to the present invention, the trained generator used by the generation unit may be constructed by training a generative adversarial network.

[0011] In the communication monitoring device according to the present invention, the communication history data may be a history of transmission intervals of location registration request signals transmitted from a user terminal identified by a subscriber identifier.

[0012] In the communication monitoring device according to the present invention, the communication history data may be a history of transmission intervals of requests for access to a data network transmitted from a user terminal identified by a subscriber identifier.

[0013] In addition, in the communication monitoring device of the present invention, the judgment unit may identify a subscriber identifier that may be involved in fraudulent communication based on the judgment result, and the presentation unit may present information regarding the identified subscriber identifier.

[0014] In order to solve the above-mentioned problems, the communication monitoring method of the present invention comprises a generation step of generating pseudo-history data similar to communication history data of a user terminal identified by a subscriber identifier using a trained generator; a collection step of collecting communication history data of the user terminal identified by the subscriber identifier of the monitored target; a determination step of determining whether the communication history data of the user terminal identified by the subscriber identifier of the monitored target matches the pseudo-history data generated in the generation step; and a presentation step of presenting the determination result in the determination step.

[0015] In addition, in the communication monitoring method according to the present invention, the trained generator used in the generating step may be constructed by training a generative adversarial network.

[0016] In the communication monitoring method according to the present invention, the communication history data may be a history of transmission intervals of location registration request signals transmitted from a user terminal identified by a subscriber identifier.

[0017] In the communication monitoring method according to the present invention, the communication history data may be a history of transmission intervals of requests for access to a data network transmitted from a user terminal identified by a subscriber identifier.

[0018] In addition, in the communication monitoring method of the present invention, the determination step may identify a subscriber identifier that may be involved in fraudulent communication based on the determination result, and the presentation step may present information regarding the identified subscriber identifier. [Effects of the Invention]

[0019] According to the present invention, it is determined whether the communication history data of the user terminal identified by the subscriber identifier to be monitored matches the pseudo-history data generated by the generation unit, thereby making it possible to more reliably detect fraudulent communications. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 is a block diagram showing the configuration of a communication monitoring system including a communication monitoring device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining communication history data collected by a collection unit included in the communication monitoring device according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining communication history data collected by a collection unit included in the communication monitoring device according to this embodiment. [Figure 4] FIG. 4 is a block diagram showing the configuration of a learning unit included in the communication monitoring device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the learning unit included in the communication monitoring device according to this embodiment. [Figure 6] FIG. 6 is a diagram for explaining the learning unit included in the communication monitoring device according to this embodiment. [Figure 7] FIG. 7 is a block diagram showing the hardware configuration of the communication monitoring device according to this embodiment. [Figure 8] FIG. 8 is a diagram for explaining the pseudo history data generated by the generating unit included in the communication monitoring device according to this embodiment. [Figure 9] FIG. 9 is a sequence diagram showing an outline of the operation of the communication monitoring system according to this embodiment. [Figure 10] FIG. 10 is a flowchart showing the learning process performed by the communication monitoring device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0021] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0022] [Configuration of communication monitoring system] First, an outline of a communication monitoring system including a communication monitoring device 1 according to an embodiment of the present invention will be described. Fig. 1 is a block diagram showing the configuration of a communication monitoring system including a communication monitoring device 1 according to an embodiment of the present invention.

[0023] A communication monitoring system according to this embodiment is provided in, for example, a mobile communication network compatible with the 5G communication standard. The communication monitoring system includes a communication monitoring device 1, a user terminal 2, a base station 3, a core network 4, and a data network 5. The communication monitoring system monitors unauthorized communication using IMSIs in the mobile communication network.

[0024] The user terminal 2 includes a SIM 20 and is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, etc. In this embodiment, a plurality of user terminals 2 exist.

[0025] The SIM 20 installed in the user terminal 2 stores a user contract profile. The contract profile of the SIM 20 stores the user's subscriber identification information, and includes identification information such as the IMSI, which is a subscriber identifier assigned to a mobile phone line contract, the subscriber's telephone number (MSISDN: Mobile Subscriber International Subscriber Directory Number), and the SIM card number (ICCID: Integrated Circuit Card Identifier). The user terminal 2 is uniquely identified by the assigned IMSI. Note that a user who is an actual subscriber is called a legitimate user, and the term "fraud" refers to an act in which an attacker or other non-legitimate user communicates using the legitimate user's IMSI.

[0026] The base station 3 is configured as a wireless base station compatible with the 5G communication standard, and relays communication between a user terminal 2 located within the communication area and the core network 4. The base station 3 is connected to the core network 4 via a network L such as a backhaul link.

[0027] The core network 4 is connected to the communication monitoring device 1 via a network NW such as a LAN or WAN. The core network 4 includes an AMF 40, a UDM (Unified Data Management) 41, and a UDR 42, which are nodes in the control plane (C-plane), and a UPF (User Plane Function) 43 in the user plane (U-plane). In this embodiment, the communication monitoring system includes multiple UDRs 42 and multiple UPFs 43. Note that other functions included in the core network 4 are not shown in the figure.

[0028] The AMF 40 is a node that provides a mobility control function and performs mobility control such as location registration, paging, handover, etc. The UDM 41 is a node that manages user contract information and authentication information.

[0029] The UDR 42 is a node that stores a subscriber profile that holds the IMSI and location information of the user terminal 2. The UDR 42 includes a communication interface 42a for communicating with the communication monitoring device 1. The UDR 42 also stores, as a transmission history, the timestamp of the location registration request signal transmitted for each IMSI of the user terminal 2.

[0030] 2 shows a table 420 stored in the UDR 42 and containing communication history data included in a subscriber profile. As shown in the table 420, the subscriber profile associates the IMSI, the transmission timestamp of a location registration request signal, and the address of the AMF 41 as in-service area information. The subscriber profile also records, as history, the transmission interval [ms] of the location registration request signal based on the transmission timestamp of the location registration request signal for each IMSI.

[0031] Returning to FIG. 1, the UPF 43 is a user plane function that processes data packets between a radio access network (RAN) including the base station 3 and a data network (DN) 5 such as the Internet. The UPF 43 includes a communication interface 43a for communicating with the communication monitoring device 1. The UPF 43 stores, as communication history data, a timestamp of an access request to the data network 5 sent from the user equipment 2 identified by the IMSI.

[0032] 3 shows a table 430 in which a data communication log is stored, which is provided in the UPF 43. As shown in the table 430, the data communication log associates the IMSI, the session ID, and the timestamp of the access request to the data network 5. The data communication log also records the transmission interval [ms] of the access request based on the timestamp as history.

[0033] The data network 5 is a network such as the Internet that is provided outside the core network 4. The user terminal 2 accesses the data network 5 via the UPF 43 of the core network 4 to perform data communication.

[0034] [Communication monitoring device function block] 1, the communication monitoring device 1 includes a collection unit 10, a learning unit 11, a generation unit 12, a determination unit 13, a storage unit 14, and a presentation unit 15. The communication monitoring device 1 monitors fraudulent communications by determining whether or not historical data of communications using an IMSI by a legitimate user, which has been generated in advance by a learned generator 111′, i.e., pseudo historical data similar to true historical data, matches historical data of communications using an IMSI that is a target of monitoring for fraudulent communications.

[0035] The collection unit 10 collects communication history data of the user terminal 2 identified by the IMSI to be monitored. More specifically, the collection unit 10 collects the history of timestamps of location registration request signals included in the subscriber profile for each IMSI from the UDR 42 of the core network 4. Specifically, the collection unit 10 collects the history of the transmission intervals [ms] of location registration request signals indicated in the timestamps of the location registration request signals associated with each IMSI from the table 420 stored in the UDR 42.

[0036] The collection unit 10 can collect, from multiple UDRs 42 included in the entire core network 4 managed by the mobile communications carrier, the history of transmission intervals of location registration request signals transmitted from user terminals 2 associated with the IMSIs of multiple subscribers. Note that the communication history data of the user terminal 2 identified by the IMSI to be monitored is communication history data that may include the history of fraudulent location registration requests made using IMSIs fraudulently obtained by an attacker, or the history of fraudulent access requests to the data network 5 described below.

[0037] Furthermore, the collection unit 10 can collect history data indicated by timestamps of access requests to the data network 5 for each IMSI from the UPF 43 of the core network 4. More specifically, the collection unit 10 can collect a history of the transmission interval [ms] of access requests for each IMSI from a table 430 included in the UPF 43. The collection unit 10 can collect a history of the transmission intervals of access requests by user terminals 2 associated with the IMSIs of multiple subscribers from multiple UPFs 43 included in the core network 4 managed by the mobile communications operator.

[0038] The collection unit 10 can collect communication history data as training data used by the learning unit 11 described below, separately from the communication history data of the user terminal 2 identified by the IMSI to be monitored.

[0039] As shown in Fig. 4, the learning unit 11 adversarially trains a GAN having a generator 111 and a classifier 112. A trained generator 111' is constructed by the learning of the learning unit 11. More specifically, the learning unit 11 trains a GAN having the generator 111 that generates communication history data of a user terminal 2 identified by an IMSI, i.e., pseudo-historical data that is similar to true historical data, and the classifier 112 that distinguishes between the pseudo-historical data generated by the generator 111 and the true historical data.

[0040] 5 and 6 are diagrams schematically illustrating the neural network configuration of the generator 111 and the classifier 112 of the GAN used by the learning unit 11. As shown in FIG. 5, the generator 111 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 111 is a model that generates pseudo-history data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m The generator 111 performs a multiplication and accumulation operation on the input and weight parameters and performs threshold processing using an activation function to generate outputs G(z1) to G(z n ) is output.

[0041] In this embodiment, generator 111 includes generator 111A that generates pseudo-history data similar to the history of the transmission interval of the location registration request signal for each IMSI included in the subscriber profile stored in UDR42, and generator 111B that generates pseudo-history data similar to the history of the transmission interval of the access request to data network 5 for each IMSI included in the data communication log stored in UPF43.

[0042] 6 is configured as a neural network having an input layer, a hidden layer, and an output layer. In the example of FIG. 6, m pieces of sampled historical data x1 to x2 of training data are used as input. mis given. In this embodiment, the discriminator 112 includes a discriminator 112A corresponding to the generator 111A that generates pseudo history data similar to the history of transmission intervals of location registration request signals. Furthermore, the discriminator 112 includes a discriminator 112B corresponding to the generator 111B that generates pseudo history data similar to the history of transmission intervals of access requests to the data network 5. Therefore, in this embodiment, two models are prepared: a GAN that handles history data related to location registration requests processed in the C-plane, and a GAN that handles history data related to access requests processed in the U-plane.

[0043] Specifically, the historical data x1 to x2 used as input by the classifier 112A are m is history data of the transmission interval of the location registration request signal transmitted from the user terminal 2 identified by the IMSI, which is collected in advance by the collection unit 10 from the UDR 42 of the core network 4. One set of history data x1 to x m is history data of the transmission interval of a location registration request signal by a user terminal 2 identified by one IMSI. To explain using the example of table 420 shown in Fig. 2, history data x1 of the transmission interval of a location registration request signal related to IMSI_1 is 20 [ms], history data x2 is 30 [ms], history data x3 is 40 [ms], ... Furthermore, the training data is true history data, and it is assumed that the location registration request is made by a legitimate user.

[0044] The historical data x1 to x2 used as input by the classifier 112B m is history data of the transmission interval of an access request to the data network 5 transmitted from a user terminal 2 identified by an IMSI, which the collection unit 10 has collected in advance from the UPF 43 of the core network 4. To explain using the example of table 430 shown in Fig. 3, history data x1 of the transmission interval of an access request related to IMSI_1 is 23 [ms], history data x2 is 40 [ms], history data x3 is 30 [ms], ...

[0045] The classifier 112 performs a product-sum operation on the input and weight parameters and threshold processing using an activation function, and outputs, for example, 1 or 0. When the classifier 112 correctly identifies the training data related to the input true history data as true history data, it outputs an output y=1. On the other hand, when the classifier 112 correctly identifies the training data related to the input pseudo history data as pseudo history data, it outputs an output y=0. In this way, the classifier 112 is a model that distinguishes the model distribution generated by the generator 111 from the data distribution of the training data, which is the true distribution. Therefore, the classifier 112 constructed by learning can correctly distinguish between communication history data of the user terminal 2 identified by the IMSI of a legitimate user and pseudo history data that is similar to it.

[0046] FIG. 4 is a block diagram for explaining the adversarial learning of GAN by the learning unit 11. The generator 111 of the GAN adopted by the learning unit 11 is represented as a function G, and the discriminator 112 is represented as a function D. Furthermore, the true historical data is represented as x, the predicted value output by the discriminator 112 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for the true historical data and 0 for the pseudo historical data generated by the generator 111. In this case, the discriminator 112 calculates the cross entropy E CE It can be expressed as:

[0047]

number

[0048] The first term in the brace of the above equation (1) represents t n lny n In this case, the predicted value y n is the correct label of the true historical data t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0049] Here, the generator 111 constituting the GAN has parameters w G ,θ G and the function G(w G ,θ G ) The classifier 112 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (1) CE The objective function E of the GAN including the generator 111 and the discriminator 112 based on the above can be expressed by the following equation (2).

number

[0050] The first term of the above equation (2) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 112 classifies true historical data as true historical data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 112 classifies the pseudo history data generated by the generator 111 as pseudo history data. In GAN training, the generator 111 and the classifier 112 are trained in an adversarial manner through min-max optimization of the objective function E. Therefore, the generator 111 is trained so that it can generate pseudo history data that can fool the classifier 112, and the classifier 112 is trained so that it can classify the pseudo history data generated by the generator 111 as pseudo history data.

[0051] In learning of the classifier 112, when true historical data is given, the classifier 112 outputs an output close to y=1, thereby maximizing the first term of the objective function E in the above equation (2). On the other hand, when pseudo historical data is given, the classifier 112 learns to output an output close to y=0, thereby maximizing the second term of the objective function E.

[0052] In the learning of the generator 111, D(G(w G ,θ G ),w D ,θ D ) (D(G(z)) in Figure 4) is close to 1. G ,θ G ) (G(z) in FIG. 4) to minimize the objective function E. The learning unit 11 uses a learning procedure that alternately updates the parameters of the generator 111 and the parameters of the classifier 112. Details of the learning procedure of the generator 111 and the classifier 112 by the learning unit 11 will be described later.

[0053] When the objective function E of the GAN is optimized, the learning unit 11 passes the trained generator 111′ to the generation unit 12.

[0054] The generation unit 12 includes a trained generator 111′ constructed by GAN learning. The generation unit 12 uses the trained generator 111′ to generate pseudo history data similar to history data of communications by a user terminal 2 identified by an IMSI.

[0055] 8 is a diagram illustrating the pseudo history data generated by the generation unit 12 using the trained generator 111′. As shown in table 120 in FIG. 8, the pseudo history data is generated by combining the pseudo history data G(z1), G(z2), G(z3), ..., G(z n ) and an identification number ID. In this embodiment, two tables 120 are provided to store pseudo history data generated by the learned generator 111A' related to the location registration request signal and the learned generator 111B' related to the access request to the data network 5, respectively.

[0056] The determination unit 13 determines whether or not the communication history data of the user terminal 2 identified by the IMSI of the monitoring target, collected by the collection unit 10, matches the pseudo history data generated by the generation unit 12. More specifically, the determination unit 13 compares the communication history data associated with the IMSI of the target of monitoring for unauthorized communication, for example, the history data in which 20 [ms], 30 [ms], 40 [ms], ... are associated with "IMSI_1" in the example of table 420 in FIG. 2, with the pseudo history data G(z1), G(z2), G(z3), ..., G(z n ) and compare.

[0057] Specifically, before the determination process, the determination unit 13 extracts historical data with overlapping IMSIs from the historical data of communications for each IMSI to be monitored, and determines whether or not there is a match with the pseudo historical data only for the historical data with overlapping IMSIs.

[0058] Furthermore, the determination unit 13 identifies an IMSI for which unauthorized communication may have been performed based on the determination result. Specifically, when communication history data related to the IMSI to be monitored, collected by the collection unit 10, matches the pseudo history data, the determination unit 13 can identify the corresponding IMSI as an IMSI for which unauthorized communication may have been performed.

[0059] The storage unit 14 stores the learned generator 111' and the pseudo history data generated by the learned generator 111'.

[0060] The presenting unit 15 presents the determination result by the determining unit 13. More specifically, the presenting unit 15 can notify the UDR 42 and the UPF 43 of information on the IMSI that has been identified as possibly having been used for fraudulent communication.

[0061] [Hardware configuration of communication monitoring device] Next, an example of a hardware configuration for realizing the communication monitoring device 1 having the above-described functions will be described with reference to FIG.

[0062] 7, the communication monitoring device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106, all of which are connected via a bus 101, and a program that controls these hardware resources. The communication monitoring device 1 can also include a display device 107 connected via the bus 101.

[0063] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the communication monitoring device 1, such as the collection unit 10, learning unit 11, generation unit 12, and determination unit 13 shown in FIG.

[0064] The communication interface 104 is an interface circuit for connecting the communication monitoring device 1 to various external electronic devices via a network.

[0065] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0066] The auxiliary storage device 105 has a program storage area for storing the GAN learning program and communication monitoring program executed by the communication monitoring device 1. The auxiliary storage device 105 also has a storage area for a table 120 in which the pseudo-history data generated by the generation unit 12 is stored. The auxiliary storage device 105 realizes the storage unit 14 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0067] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0068] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can also realize the presentation unit 15.

[0069] [Communication monitoring device operation] Next, the operation of the communication monitoring device 1 having the above-described configuration will be described with reference to the sequence diagram of FIG. 9 and the flowchart of FIG.

[0070] 9 is an operation sequence showing an outline of the operation of a communication monitoring system including the communication monitoring device 1. First, the UDR 42 transmits a subscriber profile including communication history data relating to the history of the transmission interval of a location registration request signal for each IMSI to the communication monitoring device 1 (step S1). The collection unit 10 of the communication monitoring device 1 collects, from the subscriber profile, the history of the transmission interval of a location registration request signal transmitted from a user terminal 2 identified by the IMSI as communication history data to be used as training data (step S2). Note that the history data collected in step S2 is true history data.

[0071] Meanwhile, the UPF 43 transmits a data communication log including a history of transmission intervals of access requests to the data network 5 for each IMSI as communication history data to the communication monitoring device 1 (step S3). The collection unit 10 of the communication monitoring device 1 collects, from the data communication log, a history of transmission intervals of access requests transmitted from the user terminal 2 identified by the IMSI as communication history data to be used as training data (step S4). Note that the history data collected in step S4 is true history data.

[0072] Next, the learning unit 11 of the communication monitoring device 1 performs a learning process for a GAN including the generator 111 and the classifier 112 (step S5).

[0073] FIG. 10 is a flowchart showing the GAN learning process performed by the learning unit 11 included in the communication monitoring device 1. First, as described in steps S2 and S4 of FIG. 9, the collection unit 10 collects communication history data of the user terminal 2 identified by the IMSI as true history data to be used as training data (step S50). If there are N IMSIs, N sets of true history data are collected. As described above, N sets of history data related to the transmission intervals of location registration request signals collected from the UDR 42 and N sets of history data related to access requests to the data network 5 collected from the UPF 43 are prepared. The true history data is history related to legitimate location registration requests and access requests made by the user terminal 2 identified by the IMSI of a legitimate user.

[0074] Here, as shown in the GAN learning process by the learning unit 11 in FIG. 4, the true history data collected in step S1 is used as training data 114 to be input when the classifier 112 is trained.

[0075] Next, the learning unit 11 inputs the true historical data to the classifier 112 as training data 114, and sets the parameter w of the classifier 112 so that the true historical data is distinguished from the true historical data (y=1). D ,θ D (Step S51). In Step S51, the learning unit 11 can cause the classifier 112 to learn true historical data using, for example, an error backpropagation method. In Step S51, the classifier 112 that can distinguish true historical data from other true historical data is constructed in advance.

[0076] Next, the learning unit 11 generates Gaussian noise 110 and provides a random vector of the generated Gaussian noise 110 as an input to the generator 111 (step S52). Subsequently, the generator 111 generates a random vector of the generated Gaussian noise 110 based on the input z and the weight parameter w G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo history data G(z) (step S53).

[0077] Next, the classifier 112 is trained. The training of the classifier 112 is performed by using the parameter w D ,θ D First, the learning unit 11 provides the training data 114 of the true historical data collected in step S50 as input to the classifier 112, and calculates the gradient dE / dw so that the objective function E of the above formula (2) is maximized. D ,dE / dθ D Calculate the parameter w by backpropagation etc. D ,θ D (Step S54). The label of the training data 114 is set to 1 (true historical data).

[0078] Next, in step S53, the learning unit 11 provides the pseudo history data generated by the generator 111 to the discriminator 112 as an input, and calculates the gradient dE / dw so that the objective function E in the above equation (2) is maximized. D ,dE / dθ D Calculate the parameter w by backpropagation etc. D ,θ D (Step S55). That is, in Steps S54 and S55, in order to maximize the objective function E in the above equation (2), the first term is updated as D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D )=0. Note that the label 0 (pseudo-history data) is set for the training data 114.

[0079] As shown in FIG. 4, the learning of the classifier 112 in steps S54 and S55 corresponds to the dashed arrows indicating that a classifier error is calculated in block 115 of the objective function E based on the output 113 from the classifier 112, and then the error is backpropagated to the classifier 112.

[0080] Next, the generator 111 is trained. In the training of the generator 111, the parameters of the discriminator 112 are fixed. The training unit 11 trains the generator 111 so that pseudo-history data is generated when random Gaussian noise 110 is given to the generator 111. Specifically, the training unit 11 trains the generator 111 by using the gradient -dE / dw G ,-dE / dθ G Calculate the parameter w by backpropagation etc. G ,θ G is updated (step S56).

[0081] The learning in step S56 corresponds to the dashed arrow shown in Fig. 4, which indicates backpropagation of error to generator 111. That is, step S56 corresponds to the dashed arrow shown in Fig. 4, in which pseudo history data generated by generator 111 is input to discriminator 112, a generator error is calculated from output 113 in block 115 of objective function E, and the error is further backpropagated to generator 111.

[0082] Thereafter, learning of the discriminator 112 and the generator 111 from step S53 to step S56 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S57: NO). On the other hand, if the value of the objective function E has converged (step S57: YES), the processes from step S51 to step S57 are repeated using the remaining N-1 true history data out of the N true history data until learning of the generator 111 and the discriminator 112 is performed (step S58: NO). Note that in steps S51 to S57, the generator 111A and the discriminator 112A that handle history data of location registration request signals, and the generator 111B and the discriminator 112B that handle history data of requests for access to the data network 5, are trained, respectively.

[0083] Thereafter, when the generator 111 and the discriminator 112 have been trained using the remaining N-1 pieces of true history data (step S58: YES), the learning unit 11 stores the trained generator 111' in the storage unit 14 (step S59). Specifically, the learning unit 11 stores the trained generator 111A' that handles the history data of location registration request signals and the trained generator 111B' that handles the history data of access requests to the data network 5 in the storage unit 14. The trained generator 111' is constructed by the above-described processing from step S50 to step S59.

[0084] 9, the generation unit 12 uses the trained generator 111' obtained in step S5 related to the learning process to generate pseudo history data similar to the history data of communication by the user terminal 2 identified by the IMSI (step S6). In step S6, the generation unit 12 generates pseudo history data using each of the trained generators 111A' and 111B'.

[0085] Next, the storage unit 14 stores the pseudo history data generated in step S6 (step S7). The storage unit 14 can store table 120 in which the pseudo history data in Fig. 8 is associated with the identification number ID. Furthermore, tables 120 of the pseudo history data generated by the learned generator 111A' and the learned generator 111B' are stored in the storage unit 14.

[0086] After a set period has elapsed since the learned generator 111' was stored in the storage unit 14 in step S7, the UDR 42 transmits a subscriber profile including history data of location registration request signals for each IMSI to be monitored to the communication monitoring device 1 (step S8). The collection unit 10 of the communication monitoring device 1 collects, from the subscriber profile stored in the UDR 42, the history of transmission intervals of location registration request signals for each IMSI to be monitored as communication history data (step S9).

[0087] Similarly, after a set period of time has elapsed since the learned generator 111' was stored in the memory unit 14 in step S7, the UPF 43 transmits a data communication log including communication history data, which is a history of transmission intervals of access requests to the data network 5 for each IMSI of the monitoring target, to the communication monitoring device 1 (step S10). The collection unit 10 of the communication monitoring device 1 collects, from the data communication log, the history of transmission intervals of access requests for each IMSI of the monitoring target as communication history data (step S11). The set period can be any period of time, such as one month or one year. Alternatively, the communication history data of the monitoring target can be collected periodically, such as monthly or yearly, after a certain period of time has elapsed since the learned generator 111' was constructed.

[0088] Next, the judgment unit 13 judges whether the communication history data of the user terminal 2 identified by the IMSI of the monitored device collected in steps S9 and S11, respectively, matches the pseudo-history data generated by the learned generator 111' and stored in the memory unit 14 in step S7 (step S12).

[0089] More specifically, in step S12, if there is history data of overlapping IMSIs in the history data of communications for the IMSIs to be monitored collected in steps S9 and S11, the determination unit 13 can extract in advance the history data of communications related to such overlapping IMSIs. Furthermore, the determination unit 13 can determine whether or not the extracted history data of communications related to the overlapping IMSIs matches the pseudo history data.

[0090] Furthermore, the determination unit 13 determines whether or not there is a match between the communication history data relating to the location registration request signal by the IMSI of the monitoring target collected in step S9 and the pseudo history data generated by the learned generator 111A' stored in the storage unit 14. The determination unit 13 also determines whether or not there is a match between the communication history data relating to the access request to the data network 5 by the IMSI of the monitoring target collected in step S11 and the pseudo history data generated by the learned generator 111B' stored in the storage unit 14.

[0091] Thereafter, the determination unit 13 identifies the IMSI associated with the history data of the communication that is determined to match in the determination result of step S12 as an IMSI that may have been used for fraudulent communication (step S13). Specifically, in step S12, if the history data of the transmission interval of the location registration request signal transmitted by the user terminal 2 identified by the IMSI to be monitored (for example, IMSI_1) matches the pseudo history data generated by the learned generator 111A' stored in the storage unit 14, the determination unit 13 identifies the IMSI_1 to be monitored as an IMSI that may have made a fraudulent location registration request.

[0092] Similarly, in step S12, if the historical data of the transmission interval of access requests to the data network 5 by the user terminal 2 identified by the monitored IMSI (e.g., IMSI_1) matches the pseudo-historical data generated by the learned generator 111B' stored in the memory unit 14, the judgment unit 13 identifies the monitored IMSI_1 as an IMSI that may have made an unauthorized access request to the data network 5.

[0093] In steps 12 and 13, the IMSI that is extremely close to the transmission timing of the location registration request signal or access request indicated by the pseudo history data is identified as the IMSI that made the fraudulent location registration request or access request.

[0094] Thereafter, the presenting unit 15 notifies information related to the IMSI identified in step S13 (step S14). For example, the presenting unit 15 notifies the UDR 42 via the network NW of information about IMSI_1 identified in step S13 as an IMSI that may have made a fraudulent location registration request. Furthermore, the presenting unit 15 notifies the UPF 43 via the network NW of information about IMSI_1 identified in step S13 as an IMSI that may have made a fraudulent access request.

[0095] Subsequently, upon receiving the notification, the UDR 42 rejects the location registration request for IMSI_1 (step S15). Meanwhile, upon receiving the notification, the UPF 43 performs communication disconnection processing for IMSI_1 (step S16).

[0096] As described above, the communication monitoring device 1 according to this embodiment uses the pre-constructed learned generator 111′ to generate pseudo-history data similar to history data of communications by a user terminal 2 identified by an IMSI, and determines whether or not the pseudo-history data matches history data of communications by a user terminal 2 identified by an IMSI that is the monitoring target. This makes it possible to more reliably detect unauthorized communications.

[0097] Furthermore, the communication monitoring device 1 according to this embodiment determines whether or not there is a match between history data of the transmission intervals of location registration request signals transmitted from a user terminal 2 identified by the IMSI to be monitored and the pseudo history data generated by the learned generator 111′. Therefore, even if a location registration request is made at the same time using the same IMSI, it is possible to detect a fraudulent location registration request. In particular, it is possible to detect a fraudulent location registration request when a location registration request using the same IMSI is made at a relatively short distance from the location of a legitimate user in Japan.

[0098] Furthermore, according to the communication monitoring device 1 according to the present embodiment, GAN learning is performed based on communication history data associated with IMSIs recorded in each of the UDR 42 and the UPF 43. This makes it possible to detect unauthorized communications in both the C-plane and the U-plane.

[0099] Furthermore, according to the communication monitoring device 1 of this embodiment, a trained generator 111' that learns the characteristics of history data of communications by legitimate users and generates pseudo history data is constructed in advance and stored in the storage unit 14. This makes it possible to take proactive defensive measures against future threats in which an attacker uses a generation AI to conduct unauthorized communications at transmission timings that are difficult to distinguish from the transmission timings of legitimate location registration request signals or access requests. Furthermore, it is possible to more efficiently defend against DDoS attacks on the core network 4 by unauthorized communications that mimic the transmission intervals of communications by legitimate users, and spoofing using clone SIMs and the like.

[0100] In the above-described embodiment, a communication monitoring system that complies with 5G has been exemplified, but the communication monitoring system may also be one that complies with 4G / LTE, 6G, etc.

[0101] The above describes embodiments of the communication monitoring device and communication monitoring method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can imagine are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0102] 1...Communication monitoring device, 10...Collection unit, 11...Learning unit, 12...Generation unit, 13...Determination unit, 14...Memory unit, 15...Presentation unit, 2...User terminal, 20...SIM, 3...Base station, 4...Core network, 40...AMF, 41...UDM, 42...UDR, 43...UPF, 5...Data network, 101...Bus, 102...Processor, 103...Main memory device, 42a, 43a, 104...Communication interface Interface, 105...auxiliary storage device, 106...input / output I / O, 107...display device, 110...noise, 111, 111A, 111B...generator, 112, 112A, 112B...discriminator, 111', 111A', 111B'...trained generator, 113...output, 114...training data, 115...objective function E block, 420, 430, 120...table, L, NW...network.

Claims

1. a generating unit configured to generate pseudo-history data similar to communication history data of a user terminal identified by a subscriber identifier using a trained generator; a collection unit configured to collect communication history data of a user terminal identified by a monitored subscriber identifier; a determination unit configured to determine whether communication history data of a user terminal identified by the subscriber identifier of the monitoring target matches the pseudo history data generated by the generation unit; a presentation unit configured to present a determination result by the determination unit; A communication monitoring device comprising:

2. 2. The communication monitoring device according to claim 1, The trained generator used by the generation unit is constructed by training a generative adversarial network. A communication monitoring device characterized by:

3. 2. The communication monitoring device according to claim 1, The communication history data is a history of transmission intervals of location registration request signals transmitted from a user terminal identified by a subscriber identifier. A communication monitoring device characterized by:

4. 2. The communication monitoring device according to claim 1, The communication history data is a history of transmission intervals of requests for access to a data network sent from a user terminal identified by a subscriber identifier. A communication monitoring device characterized by:

5. 2. The communication monitoring device according to claim 1, The determination unit identifies a subscriber identifier that may be involved in unauthorized communication based on the determination result, The presenting unit presents information related to the identified subscriber identifier. A communication monitoring device characterized by:

6. a generating step of generating pseudo-history data similar to communication history data of a user terminal identified by a subscriber identifier using a trained generator; a collection step of collecting communication history data of a user terminal identified by a monitored subscriber identifier; a determination step of determining whether or not communication history data of the user terminal identified by the subscriber identifier of the monitored target matches the pseudo history data generated in the generation step; a presentation step of presenting the determination result in the determination step; A communication monitoring method comprising:

7. 7. The communication monitoring method according to claim 6, The trained generator used in the generation step is constructed by training a generative adversarial network. A communication monitoring method comprising:

8. 7. The communication monitoring method according to claim 6, The communication history data is a history of transmission intervals of location registration request signals transmitted from a user terminal identified by a subscriber identifier. A communication monitoring method comprising:

9. 7. The communication monitoring method according to claim 6, The communication history data is a history of transmission intervals of requests for access to a data network sent from a user terminal identified by a subscriber identifier. A communication monitoring method comprising:

10. 7. The communication monitoring method according to claim 6, The determining step includes identifying a subscriber identifier that may be involved in unauthorized communication based on the determination result, The presenting step presents information related to the identified subscriber identifier. A communication monitoring method comprising:

Images