Abnormal communication detection device by dynamic graph, abnormal communication detection method, and abnormal communication detection program

Abstract

To provide an abnormal communication detection device capable of detecting abnormal communication by solving a problem of concept drift in vehicle communication and IoT communication.SOLUTION: An abnormal communication detection device 1 includes: a flow data classification unit 11 that classifies flow data by function based on a function of the flow data; a continuous graph generation unit 12 that arranges the flow data in chronological order, aggregates one or a plurality of flow data classified into the same function into the same node, and when adjacent flow data is classified into a different function, extends an edge between nodes corresponding to two different functions; a weight assignment unit 13 that assigns a weight to the edge; a snapshot creation unit 14 that cuts out, from a continuous graph, a plurality of snapshots that are a static graph obtained by cutting out a specific period of the continuous graph; and an abnormal communication detection unit 15 that inputs the plurality of snapshots to a GNN model to detect abnormal communication.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a device for detecting anomalous communication using a dynamic graph. [Background technology]

[0002] Conventionally, static graphs have been used to detect abnormal communications. Patent Document 1 proposes a method for constructing graphs and detecting anomalous communications that focus on communication behavior such as communication order and function transitions using flow data such as IPFIX (IP Flow Information Export). Application identification is applied in advance to a set of IPFIX records to assign labels, and the communication order and function transitions are expressed by graphing the label transitions in IPFIX chronological order.

[0003] In Non-Patent Document 1, an anomaly communication detection system using a GNN (Graph Neural Network) was constructed based on the technology in Patent Document 1, and its accuracy was verified. Functions were expressed as a combination of source, destination, and destination port, and IPFIX was classified and aggregated by function. IP addresses were used as information on source and destination. By expressing the transition of functions in chronological order of IPFIX as a graph, a graph that can be processed by a GNN was constructed.

[0004] According to Non-Patent Document 2, there are two main types of methods for handling dynamic graphs. The first is a method that uses a discrete graph, in which the graph is divided into fixed time periods, and the second is a method that uses a continuous graph, in which a timestamp is assigned to each element of the graph (i.e., each node and edge) and the graph structure changes continuously. Most of the previous research has used the former, discrete graph. It is known that while discrete graphs can be processed by GNNs, continuous graphs cannot be processed by GNNs as they are. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2023-150851 [Non-patent literature]

[0006] [Non-Patent Document 1] Okui, N., Akimoto, Y., Kubota, A., and Yoshida, T.: A Graph Construction Method for Anomalous Traffic Detection with Graph Neural Networks Using Sets of Flow Data, in 2023 IEEE 47th Annual Computers, Software, and Applications Conference (COMPSAC), pp. 1017-1018 (2023) [Non-patent document 2] Barros, CD, Mendoncza, MR, Vieira, AB, & Ziviani, A. (2021). A survey on embedding dynamic graphs. ACM Computing Surveys (CSUR), 55(1), 1-37 Summary of the Invention [Problem to be solved by the invention]

[0007] The methods in Patent Document 1 and Non-Patent Document 1 are techniques that extract communication data over a certain period of time, generate flow data from the communication data, and analyze the flow data. In graph theory, this technique is classified as an analysis technique that targets static graphs. However, in real-world communication anomaly detection, it is necessary to handle communication data that fluctuates over time, and therefore models that can only handle static graphs are often not applicable to business operations.

[0008] Specific challenges include the following: In vehicle communications and IoT communications, devices are specialized for specific applications, and therefore there is a large difference in communication volume between periods when communication occurs frequently and periods when it does not. Therefore, in methods that perform learning over a specific period, it is expected that detection accuracy will decrease significantly if communication characteristics change. In the field of machine learning, this deterioration in detection accuracy due to changes in the distribution of target data over time is called "concept drift," and is an issue that needs to be addressed as described in Patent Document 1 and Non-Patent Document 1.

[0009] Concept drift in vehicle and IoT communications has two aspects. The first aspect is that, because the content of communication data changes over time, a model trained over a specific period of time will be specialized in detecting anomalies related to the communication content observed during that specific period, and it can be predicted that the detection accuracy will drop significantly if the communication content changes.

[0010] The second aspect is that in vehicle and IoT communications, there is a large difference between periods when communication occurs frequently and periods when it does not, so methods that extract communication data for a certain period will result in either an overcrowded graph with an extremely large number of nodes and edges, or a sparse graph with almost no nodes or edges. Therefore, both of these (periods when communication occurs frequently and periods when it does not) must be handled in the same model, which makes development difficult.

[0011] The present invention aims to solve the above-mentioned problem of concept drift. [Means for solving the problem]

[0012] (1) The anomalous communication detection device of the present invention includes a flow data classification unit that classifies flow data in a set of flow data by function based on the function of the flow data; a continuous graph generation unit that arranges the flow data in the set of flow data in chronological order, aggregates one or more flow data classified into the same function into the same node, and, if adjacent flow data are classified into different functions, creates an edge between the nodes corresponding to the two different functions and assigns timestamps to the node and the edge; a weight assignment unit that assigns weights to the edge; a snapshot creation unit that extracts multiple snapshots from the generated continuous graph, which are static graphs that capture specific periods of the continuous graph; and an anomalous communication detection unit that inputs the multiple snapshots into a GNN model to detect anomalous communication.

[0013] (2) The weighting unit may assign a weight based on start and end times of two pieces of flow data related to the edge.

[0014] (3) The weighting unit may assign a weight based on a probability of a function transition between the nodes at both ends of the edge.

[0015] (4) The continuous graph generation unit may delete a node or an edge when a certain period of time has elapsed since the node or the edge was generated.

[0016] (5) The snapshot creation unit may create a second predetermined number of static graphs from the continuous graph, each static graph including only nodes and edges assigned a first predetermined number of consecutive timestamps, while changing the consecutive timestamps.

[0017] (6) An anomalous communication detection method according to the present invention includes a flow data classification step of classifying flow data of a set of flow data by function based on the function of the flow data; a continuous graph generation step of chronologically arranging the flow data of the set of flow data, aggregating one or more flow data classified into the same function into the same node, and if adjacent flow data are classified into different functions, establishing an edge between the nodes corresponding to the two different functions and assigning timestamps to the node and the edge; a weighting step of assigning weights to the edge; a snapshot creation step of extracting from the generated continuous graph a plurality of snapshots, which are static graphs capturing specific periods of the continuous graph; and an anomalous communication detection step of inputting the plurality of snapshots into a GNN model to detect anomalous communication. The computer executes the following.

[0018] (7) An anomalous communication detection program according to the present invention causes a computer to function as the anomalous communication detection device. [Effects of the Invention]

[0019] According to the anomalous communication detection device of this embodiment, the problem of concept drift in vehicle communication and IoT communication can be solved and anomalous communication can be detected. [Brief explanation of the drawings]

[0020] [Figure 1] 1 is a diagram illustrating an example of an outline of a vehicle communication network according to an embodiment of the present invention; [Figure 2] FIG. 2 is a diagram illustrating a functional configuration of the anomalous communication detection device according to the present embodiment. [Figure 3] FIG. 10 is a diagram illustrating aggregation of flow data into nodes in this embodiment. [Figure 4] FIG. 10 is a diagram illustrating edge generation in this embodiment. [Figure 5] FIG. 10 is a diagram illustrating generation of a continuous graph in this embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of edge weights in this embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of edge weights in this embodiment. [Figure 8] FIG. 2 is a diagram illustrating the creation of a snapshot in this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0021] Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings. The communication network that is the target of abnormal communication detection in this embodiment is a vehicle communication network. FIG. 1 is a diagram illustrating an example of an outline of a vehicle communication network according to this embodiment. Each of the multiple vehicles communicates with a corresponding in-vehicle application server via a vehicle communication network using an in-vehicle application installed in the vehicle. All communication data is assumed to reach the vehicle or the in-vehicle application server via a specific point on the vehicle communication network. The specific point is, for example, a router, and all communication data within the network is assumed to be captured at that specific point.

[0022] The captured data is then converted into flow data, typically represented by IPFIX (IP Flow Information Export). In flow data, multiple packets are aggregated as statistical information, so the overall data volume can be compressed, which results in faster anomaly detection processing.

[0023] IPFIX is a flow technology used to monitor and analyze network traffic. It captures information from the data link layer, network layer, and transport layer. It generates flow data by collecting traffic breakdown information from packets with common attributes flowing on the network. In addition to input interface information, IPFIX flow data includes the following information:

[0024] (1) Source IP address, destination IP address (2) Source port number, destination port number (3) Communication volume or number of packets (4) Communication time

[0025] This information can be used to identify the communications that are causing network congestion on an IP address basis.In addition to the statistical data including the communication source and destination as described above, the flow data includes information indicating which application function each vehicle communicated with.

[0026] The anomalous communication detection method of this embodiment uses a continuous graph among dynamic graphs in order to solve the problem of concept drift described above.

[0027] FIG. 2 is a diagram showing the functional configuration of the anomalous communication detection device 1 in this embodiment. The anomalous communication detection device 1 is an information processing device that includes a control unit 10, a storage unit 20, as well as input / output devices for various data and communication devices. The control unit 10 is a part that controls the entire anomalous communication detection device 1, and realizes each function of this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU. Specifically, the control unit 10 includes a flow data classifying unit 11, a continuous graph generating unit 12, a weighting unit 13, a snapshot creating unit 14, and an anomalous communication detecting unit 15.

[0028] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the anomalous communication detection device 1, and may be a ROM, RAM, flash memory, hard disk drive (HDD), etc. Specifically, the storage unit 20 stores a program (anomalous communication detection program) for causing the control unit 10 to execute each function of this embodiment, and further stores flow data, graph data, anomaly detection models, various parameters, etc. received as processing targets.

[0029] The anomalous communication detection method of this embodiment is configured as follows. (Step 1) Classify the flow data in the flow data set by function. (Step 2) Aggregate the flow data into nodes and create a continuous graph in chronological order. (Step 3) Weight the edges. (Step 4) The continuous graph is extracted into a format that can be handled by a GNN (Graph Neural Network) model. (Step 5) Detect abnormal communications using the GNN × time series model.

[0030] In the anomalous communication detection device 1 of this embodiment, the flow data classification unit 11, the continuous graph generation unit 12, the weighting unit 13, the snapshot creation unit 14, and the anomalous communication detection unit 15 each share the tasks of executing steps 1 to 5.

[0031] [Step 1] Classify flow data by function The flow data classifying unit 11 classifies the flow data of the set of flow data by function. Let D be the set of all captured flow data. The flow data classifying unit 11 classifies the flow data by its function using any means. If the set of all functions is F, classifying the flow data by its function is a mapping D→F.

[0032] As a classification means, an existing application identification method or a combination of (source IP address, destination IP address, destination port number) as in Non-Patent Document 1 can be used. Hereinafter, flow data classified into a certain function f belonging to F will be referred to as "d f " will be written as "d f belongs to D.

[0033] [Step 2] Aggregate flow data into nodes and generate a continuous graph in chronological order The continuous graph generation unit 12 aggregates the flow data into nodes and generates a continuous graph in chronological order. Note that aggregating the flow data into nodes is sometimes expressed as "linking the flow data to a node." With function f as a node and function transitions as edges, construct a continuous graph G(V,E,X) using the following procedure, where V is a set of nodes, E is a set of edges, and X is a set of node features.

[0034] (Step 2-1) D is rearranged in chronological order, and f Let the timestamp be T(t).

[0035] (Step 2-2) At a certain time t, when the flow data is classified into function f, this flow data is t,f It is expressed as: Figure 3 shows how flow data classified into the same function are aggregated into one node. In Figure 3, Flow Data 1, Flow Data 2, and Flow Data 4 are all related to the same function f i Since it is classified as fi Flow data 3 is aggregated into function f i A different function f j Since it is classified as fi In this way, a plurality of flow data are generally aggregated at one node.

[0036] Figure 4 shows that when adjacent flow data are classified into different functions, edges are drawn between nodes. Adjacent flow data 1 and flow data 2 are classified into function f i and f j Flow data 1 is classified into node v fi Flow data 2 is linked to node v fj is linked to. In this case, node v fi to node v fj Towards the Edge fi,fj At this time, node v fi , node v fj , edge e fi,fj , are given timestamps T(t), T(t+1), and T(t+1), respectively.

[0037] Node V fi By aggregating the features of all flow data linked to node v using aggregation function A, fi Feature quantity x fi =A(d all,fi ) is calculated. However, "d all,fi " is the node v fi Represents all flow data associated with the Similarly, node v fj By aggregating the features of all flow data linked to node v using aggregation function A, fj Feature quantity x fj =A(d all,fj ) is calculated.

[0038] If the feature of the flow data is n-dimensional and the number of flow data aggregated in the node is N, the aggregation function A can be any function that converts an n-by-N matrix with real numbers as elements, such as the average or sum, into an n-by-1 matrix with real numbers as elements.

[0039] (Step 2-3) Since the communication state changes over time, it is not preferable to keep the influence of old flow data on the graph forever. Therefore, old nodes and edges are deleted by using the timestamps attached to the nodes and edges. A threshold τ for the remaining period k regarding the timestamp is determined, and nodes and edges having timestamps that satisfy τ < T(t) - T(t - k) are deleted.

[0040] Fig. 5 shows an example of creating a continuous graph by executing Procedure 2. In Fig. 5, flow data 1, 2, and 4 are classified into the same function f i Node A is a node of function f i , that is, v fi . Therefore, flow data 1, 2, and 4 are aggregated to node A. In Fig. 5, flow data 3 and 5 are classified into the same function f j Node B is a node of function f j , that is, v fj . Therefore, flow data 3 and 5 are aggregated to node B. In Fig. 5, flow data 6 and 7 are classified into the same function f l Node C is a node of function f l , that is, v fl . Therefore, flow data 6 and 7 are aggregated to node C. The timestamp of a node uses the timestamp of the flow data that first arrives at that node.

[0041] The first flow data to arrive at node A is flow data 1, and since the timestamp of flow data 1 is t, the timestamp of node A is t. The first flow data to arrive at node B is flow data 3, and since the timestamp of flow data 3 is t + 2, the timestamp of node B is t + 2. The flow data that arrives at node C first is flow data 6, and the timestamp of flow data 6 is t+5, so the timestamp of node C is t+5.

[0042] When flow data 2 changes to flow data 3, the function i From f j Therefore, an edge is established from node A to node B. The timestamp of an edge is the timestamp when the edge is generated. The edge from node A to node B is created by the arrival of flow data 3, and the timestamp of flow data 3 is t+2, so the timestamp of the edge from node A to node B is t+2. When flow data 3 changes to flow data 4, the function f j From f i Therefore, an edge is established from node B to node A. The edge between node A and node B maintains the timestamp when the edge was created, so the timestamp of the edge between node A and node B remains t+2.

[0043] When flow data 4 changes to flow data 5, the function f i From f j Therefore, an edge is established from node A to node B. When flow data 5 changes to flow data 6, the function f j From f l Therefore, an edge is established from node B to node C. At this time, the timestamp of flow data 6 is t+5, so the timestamp of the edge from node B to node C becomes t+5.

[0044] In the continuous graph G thus generated, each node and edge has a timestamp. A node also has a feature that is an aggregate of the features of one or more flow data items linked to the node. For example, the feature of node A is an aggregate of the features of flow data items 1, 2, and 4.

[0045] [Step 3] Add weights to edges A weighting unit 13 assigns weights to the edges. The weighting unit 13 assigns weights to the edges of the continuous graph G generated by executing the procedure 2, according to one of the three methods described below.

[0046] [Weighting method 1] As is clear from the above explanation, when flow data are arranged in chronological order, an edge is generated when two adjacent flow data are classified into different functions. In Figure 6, the preceding flow data 1 is the function f i The subsequent flow data 2 is classified as function f j The situation is assumed to be classified as follows. The end time of the preceding flow data 1, flowEndMilliseconds(d t ) is considered. Also, the start time of the following flow data 2, flowStartMilliseconds(d t+1 ) Consider. In weighting method 1, the difference between the two, flowStartMilliseconds(d t+1 )-flowEndMilliseconds(d t ) is the weight of the edge.

[0047] [Weighting method 2] In Figure 7, the preceding flow data 1 is the function f i The subsequent flow data 2 is classified as function f j The situation is assumed to be classified as follows. The start time of the preceding flow data 1 is flowStartMilliseconds(d t) is considered. Also, the end time of the following flow data 2, flowEndMilliseconds(d t+1 ) Consider. In weighting method 2, the difference between the two, flowEndMilliseconds(d t+1 )-flowStartMilliseconds(d t ) is the weight of the edge.

[0048] [Weighting method 3] Node V fi to node v fj The probability that the function transitions to fj |v fi ) is the weight of the edge.

[0049] [Step 4] Extract the continuous graph into a format that can be handled by GNN The snapshot creation unit 14 extracts the continuous graph into a format that can be handled by the GNN. Many GNN models handle static graphs (hereinafter referred to as "snapshots") that are cut out over a specific period of time. Therefore, in order to input this data into a GNN model, which is an anomaly detection model, the continuous graph constructed in step 3 must be converted into multiple snapshots. For conversion, three parameter values ​​are set in advance. These are the following three parameter values:

[0050] (1) tw_length, which determines how many consecutive timestamps of graph elements are included in one snapshot. (2) tw_step, which determines the timestamp interval between adjacent snapshots (3) Number of snapshots to extract at one time seq_length

[0051] Figure 8 shows an example of extracting a continuous graph into a format that can be handled by a GNN. In Figure 8, since tw_length is "3", graph elements with three consecutive timestamps are included in one snapshot. For example, assuming the graph in Figure 5, snapshot g0 includes graph elements with timestamps t, t+1, and t+2, i.e., node A, node B, edge e, fi,fj It includes the following three elements: Similarly, assuming the graph in FIG. 5, snapshot g1 contains graph elements with timestamps t+1, t+2, and t+3, i.e., node B, edge e, fi,fj Include two elements: In Figure 8, five snapshots are extracted by shifting the timestamp one by one. Ultimately, five graphs {g0, g1, g2, g3, g4} are input to the anomaly detection model.

[0052] The processing in step 4 allows the density of the graph input to the anomaly detection model to be kept constant, making it possible to deal with changes in graph density, which was an issue in Patent Document 1 and Non-Patent Document 1. Furthermore, in this embodiment, flow data that changes over time is treated as a dynamic graph, without extracting only a specific period of time, so that an anomalous communication detection model that is robust against changes in communication content can be constructed compared to Patent Document 1 and Non-Patent Document 1.

[0053] [Step 5] Detecting abnormal communication using GNN × time series model The anomalous communication detection unit 15 detects anomalous communication using the created snapshot and the GNN model. The architecture of existing GNN models can be applied to models without modifying the data if it is a discrete graph. However, the continuous graph used in this embodiment cannot be input directly into existing GNN models.

[0054] However, in this embodiment, multiple snapshots are extracted from the continuous graph in step 4, and any snapshot output from step 4 can be input to an existing GNN model. For example, Graph Convolutional Network (GCN) and GraphSAGE can be used as GNN models, and LSTM (Long short-term memory) and Transformer can be used as time series models.

[0055] To solve the problem of concept drift, the anomalous communication detection device of this embodiment generates a continuous graph in which a timestamp is assigned to each element of the graph and the graph structure changes continuously in step 2. Then, in the subsequent step 4, snapshots are extracted, making it possible to detect anomalous communication using an existing GNN model.

[0056] This will enable, for example, solving the issue of concept drift in vehicle and IoT communications and detecting anomalous communications, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0057] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0058] The anomalous communication detection method by the anomalous communication detection device 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0059] 1. Abnormal communication detection device 10 Control Unit 11 Flow Data Classification Unit 12 Continuous graph generation unit 13 Weighting section 14 Snapshot Creation Section 15. Abnormal communication detection unit 20 Memory section

Claims

1. a flow data classification unit that classifies the flow data of the set of flow data by function based on the function of the flow data; a continuous graph generation unit that arranges the flow data of the set of flow data in chronological order, aggregates one or more flow data classified into the same function into the same node, and when adjacent flow data are classified into different functions, creates an edge between the nodes corresponding to the two different functions and assigns timestamps to the node and the edge; a weighting unit that assigns weights to the edges; a snapshot creation unit that extracts, from the generated continuous graph, a plurality of snapshots, each of which is a static graph obtained by extracting a specific period of the continuous graph; an anomalous communication detection unit that inputs the plurality of snapshots into a GNN model to detect anomalous communication; An abnormal communication detection device comprising:

2. The anomalous communication detection device according to claim 1 , wherein the weighting unit assigns a weight based on start and end times of two pieces of flow data related to the edge.

3. The anomalous communication detection device according to claim 1 , wherein the weighting unit assigns a weight based on a probability of a function transition between the nodes at both ends of the edge.

4. The anomalous communication detection device according to claim 1 , wherein the continuous graph generation unit deletes a node or an edge when a certain period of time has elapsed since the node or the edge was generated.

5. 2. The anomalous communication detection device according to claim 1, wherein the snapshot creation unit creates a second predetermined number of static graphs from the continuous graph, each static graph including only nodes and edges to which a first predetermined number of consecutive timestamps have been assigned, while changing the consecutive timestamps.

6. a flow data classification step of functionally classifying the flow data of the set of flow data based on the function of the flow data; a continuous graph generation step of arranging the flow data of the set of flow data in chronological order, aggregating one or more flow data classified into the same function into the same node, and when adjacent flow data are classified into different functions, drawing an edge between the nodes corresponding to the two different functions and assigning timestamps to the node and the edge; a weighting step of assigning weights to the edges; a snapshot creation step of extracting, from the generated continuous graph, a plurality of snapshots, which are static graphs obtained by extracting specific periods of the continuous graph; an anomalous communication detection step of inputting the plurality of snapshots into a GNN model to detect anomalous communication; The abnormal communication detection method is executed by a computer.

7. An anomalous communication detection program for causing a computer to function as the anomalous communication detection device according to any one of claims 1 to 5.

Images