Unsupervised application identification device, unsupervised application identification method, and program

Abstract

To improve the accuracy of assigning the same application to the same cluster and different applications to different clusters.SOLUTION: An unsupervised application identification device is configured to: receive communication data of m dimensions ((m≥2) and create a dataset S, which is a set of points arranged in an m-dimensional space corresponding to a plurality of data items to be clustered; create a dataset Sp, which is a set of points arranged in a plurality of different spaces by expanding or compressing the space in which the points included in S are arranged using a plurality of expansion ratios; acquire a k-nearest-neighbor sphere in each point contained in Sp; calculate a local outlier score of each point contained in Sp; identify the expanded / compressed space with the highest peripheral density using a plurality of local outlier scores calculated in a plurality of expanded / compressed spaces for each point contained in S, acquire an optimal neighbor sphere, which is the k-nearest-neighbor sphere in the space having the highest peripheral density, and calculate an optimal local outlier score; and cluster each point contained in S on the basis of the optimal neighbor sphere and the optimal local outlier score.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an unsupervised application identification device, an unsupervised application identification method, and a program for identifying applications by taking into account differences in the scale and distribution of the applications. [Background technology]

[0002] In recent years, the number of IoT devices, including connected cars, has been increasing, making security measures for these devices increasingly important. Generally, security measures include entry measures such as intrusion detection systems (IDS) and anti-malware applications, and exit measures such as detecting abnormal communications from devices. To implement robust security measures, it is effective to use both types of measures in a multi-layered manner.

[0003] Since anomalous communication detection uses communication data, there are cases where scalability in the amount of communication processed by the anomalous communication detection and solutions to privacy concerns regarding the content of the communication data are required. As a solution to these issues, research and development is being conducted on anomalous communication detection using flow data. Flow data is data that aggregates communication packets into statistics such as the number of communication packets and communication data size on a session or time basis, so it can significantly reduce the amount of data.

[0004] However, because flow data is aggregated information from multiple communication packets, the information obtained from it is less than that from communication packets, which is an issue. Furthermore, depending on the location (server or network device) from which the flow data is acquired, the information that can be obtained may be even more limited. For example, when flow data is acquired on a reverse proxy, information such as destination information (destination IP address) and destination port number may be set to specific values ​​and become unusable. This not only affects the accuracy of detecting anomalous communication, but also affects the identification of the application (application server) that is the destination of the anomalous communication.

[0005] Therefore, it is necessary to reduce the load during inspection by assigning labels that infer destination applications from flow data. For application identification, clustering methods with a fixed number of clusters, such as K-means (Non-Patent Document 1), are commonly used. However, since the number of clusters (≒ number of applications) is sometimes unknown, clustering methods that do not fix the number of clusters, such as DBSCAN (Non-Patent Document 2), are also used. However, using DBSCAN presents the following challenges:

[0006] (1) Differences in dispersion and density for each application The variance and density of each statistical quantity differ depending on the type of application. For example, the "engine start function" always occurs at least once while driving, and the same communication is performed each time, so there is almost no variance in the statistical quantity. On the other hand, the "car navigation setting function" does not necessarily occur every time, and various information such as location information is exchanged, so the variance in the statistical quantity is large. In such cases, DBSCAN, a clustering method that uses an ε-neighborhood sphere (a neighborhood sphere with a fixed radius), does not perform clustering properly.

[0007] Local outlier factor (LOF) (Non-Patent Document 3) is one method for dealing with differences in variance and density. This method calculates the marginal density by using the k-nearest neighbor sphere of each point and the points inside it, and addresses the issue by correcting the definition of the metric space. However, because the k-nearest neighbor sphere used in LOF is also generated based on Euclidean distance, clustering will not be performed properly if the scales of each statistic are significantly different.

[0008] (2) Differences in scale for each statistical quantity When performing clustering, in order to align the scales of each statistic, it is necessary to correct each statistic using methods such as compression / expansion, Min-Max, normal distribution, etc. However, since there is no upper limit to the number of packets or bytes, and normal distribution cannot be assumed, it is difficult to select an appropriate correction method.

[0009] To address these two challenges, we further explore existing clustering methods. (Issue (1) Differences in distribution and density for each application) LDBSCAN (Non-Patent Document 4) is a method that addresses sparsity in density-based clustering. LDBSCAN uses a local outlier factor (LOF) calculated from the k-nearest neighbor distance of each point to correct the distance between the core point and each point, thereby addressing the sparsity of the surrounding neighborhood. This method requires that the density in all directions around each point be uniform, but this is not necessarily uniform in the application identification in this case, so this method cannot be used.

[0010] (Issue (2) Differences in scale for each statistical quantity) Generally, scale correction such as normalization is performed before clustering, but since there is no upper limit on the number of packets or bytes and normal distribution cannot be assumed, it is difficult to select an appropriate correction method. As a solution to this issue, some clustering methods perform scale correction at the same time. Here, we consider two methods.

[0011] The first is horizontal elliptical LDBSCAN (Non-Patent Document 5). This is a method in which the neighborhood sphere created by LDBSCAN is expanded to an elliptical shape. Non-Patent Document 5 takes advantage of the fact that the distribution of light particles used in this paper has a high density in the horizontal direction and a low density in the vertical direction, and addresses sparsity by narrowing the radius in the vertical direction and using a neighborhood elliptical sphere with a fixed ratio between the vertical radius and the horizontal radius. In addition, Non-Patent Document 6 expands on the method proposed in Non-Patent Document 5, and performs clustering by rotating the created ellipsoidal sphere by 30 degrees and using the angle at which the LOF value is optimized as the neighboring sphere.

[0012] The second one is polar coordinate transformation Grid - Base DBSCAN (Non - Patent Document 7). This method aims at clustering the detection points by a radially - fired radar, and solves the problem that "the distance between points is close near the radar emission point, while the distance between points is far at locations away from the emission point" by replacing the horizontal axis x and vertical axis y of the two - dimensional rectangular coordinate system with the distance r and angle Θ from the emission point to correct the distance relationship.

Prior Art Documents

Non - Patent Documents

[0013]

Non - Patent Document 1

Non - Patent Document 2

Non - Patent Document 3

Non-Patent Document 7

Non-Patent Document 8

Summary of the Invention

Problems to be Solved by the Invention

[0014] Existing density-based clustering methods address differences in variance and density by using LOF calculated using the k-nearest neighbor sphere rather than the ε-nearest neighbor sphere (fixed radius). However, because the k-nearest neighbor sphere also depends on a distance function (such as Euclidean distance), if the scale differs for each statistic, some statistics must be corrected (compressed / expanded, MinMax / normalized). However, because statistics such as the number of packets and packet size do not have upper limits and cannot be assumed to follow a normal distribution, selecting an appropriate correction method is difficult. Furthermore, the variance and density of each statistic varies depending on the application, meaning that the appropriate scale correction method differs for each point, resulting in a high number of misclassifications in clustering using existing methods.

[0015] The present invention aims to solve the above problems and improve the classification accuracy of density-based clustering, that is, to improve the accuracy of assigning the same application to the same cluster and different applications to different clusters. [Means for solving the problem]

[0016] An application identification device according to the present invention includes: a dataset creation unit that receives m-dimensional (m≧2) communication data acquired from a communication network, and creates a dataset S, which is a set of points in an m-dimensional space where multiple pieces of data to be clustered are arranged; an expanded / compressed space creation unit that creates a dataset Sp, which is a set of points arranged in multiple m-dimensional spaces by expanding or compressing the m-dimensional space in which the points included in the dataset S are arranged using multiple expansion rates; a proximity sphere acquisition unit that acquires a k-nearest neighbor sphere for each point included in the dataset Sp; a local outlier calculation unit that calculates a local outlier for each point included in the dataset Sp; an optimal proximity sphere acquisition unit that, for each point included in the dataset S, identifies the expanded or compressed space with the highest marginal density using multiple local outliers calculated in the multiple expanded or compressed spaces, acquires an optimal proximity sphere, which is the k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculates an optimal local outlier; and a cluster generation unit that clusters the points included in the dataset S based on the optimal proximity sphere and the optimal local outlier.

[0017] The communication data may be communication data sent from an IoT device to an application via a communication network.

[0018] The cluster generation unit may also define a core point or a point equivalent thereto, and generate the cluster using a clustering method that determines a cluster based on a reachable distance or a distance equivalent thereto defined by the core point and the optimal neighborhood sphere.

[0019] Furthermore, the local outlier calculation unit may calculate the local outlier based on the k-nearest neighbor sphere acquired by the neighborhood sphere acquisition unit, and the optimal neighborhood sphere acquisition unit may calculate the optimal local outlier based on the acquired optimal neighborhood sphere.

[0020] In addition, for each generated cluster, the system may further include an anomaly detection unit that uses an arbitrary anomaly detection model to detect anomalies in the set of expansion rates associated with the optimal neighborhood sphere at each point within the cluster, and excludes points associated with expansion rates determined to be abnormal from the cluster.

[0021] Furthermore, the application identification method of the present invention includes a dataset creation step of receiving m-dimensional (m≧2) communication data acquired from a communication network and creating dataset S, which is a set of points in an m-dimensional space where multiple pieces of data to be clustered are arranged; an expanded / compressed space creation step of creating dataset Sp, which is a set of points arranged in multiple m-dimensional spaces by expanding or compressing the m-dimensional space in which the points included in dataset S are arranged using multiple expansion rates; a proximity sphere acquisition step of acquiring a k-nearest neighbor sphere for each point included in dataset Sp; a local outlier calculation step of calculating a local outlier for each point included in dataset Sp; an optimal proximity sphere acquisition step of identifying, for each point included in dataset S, the expanded or compressed space with the highest marginal density using the multiple local outliers calculated in the multiple expanded or compressed spaces, acquiring an optimal proximity sphere, which is the k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculating an optimal local outlier; and a cluster generation step of clustering each point included in dataset S based on the optimal proximity sphere and the optimal local outlier.

[0022] Furthermore, the computer program of the present invention causes one or more computer devices to function as an application identification device including: a dataset creation unit that receives m-dimensional (m≧2) communication data acquired from a communication network and creates dataset S, which is a set of points in an m-dimensional space where multiple pieces of data to be clustered are arranged; an expanded / compressed space creation unit that creates dataset Sp, which is a set of points arranged in multiple m-dimensional spaces by expanding or compressing the m-dimensional space in which the points included in dataset S are arranged using multiple expansion rates; a proximity sphere acquisition unit that acquires a k-nearest neighbor sphere for each point included in dataset Sp; a local outlier calculation unit that calculates a local outlier for each point included in dataset Sp; an optimal proximity sphere acquisition unit that identifies, for each point included in dataset S, the expanded or compressed space with the highest marginal density using the multiple local outliers calculated in the multiple expanded or compressed spaces, acquires an optimal proximity sphere, which is the k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculates the optimal local outlier; and a cluster generation unit that clusters each point included in dataset S based on the optimal proximity sphere and the optimal local outlier. [Effects of the Invention]

[0023] In this invention, when performing density-based clustering, a neighborhood sphere is created for each point in the optimal expanded / compressed space with the lowest local outlier, and this is used for clustering. This allows clusters to be generated that automatically take into account the marginal density and marginal scale, and even when the scale of each statistic and the variance and density of the statistic vary greatly depending on the destination application, the classification accuracy of clustering can be improved compared to conventional methods. In addition, while in the past, a certain amount of domain knowledge was required for normalization before clustering, the present invention makes it possible to define the expansion rate broadly, making it possible to perform clustering that does not depend on domain knowledge. [Brief explanation of the drawings]

[0024] [Figure 1] 1 is a diagram illustrating an example of the configuration of an application identification system including an application identification device according to the prior art and the present invention. [Figure 2] 1 is a flowchart showing an outline of a processing flow in an application identification device, an application identification method, and a program according to an embodiment of the present invention. [Figure 3] FIG. 1 is a diagram showing an example of a scatter plot of two-dimensional data and the LOF value of each point. [Figure 4] 1 is a diagram showing an example of a scatter plot of the number of packets and packet sizes in certain communication data, and an example of a k-nearest neighbor sphere at point X. [Figure 5] FIG. 10 is a diagram illustrating the concept of excluding abnormal expansion rate points, which is an option of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0025] Fig. 1 is a diagram showing an example of the configuration of an application identification system including an application identification device according to the prior art and the present invention. In Fig. 1, 1 denotes an application identification system, 2 denotes an IoT device such as a connected car, 3 denotes an information processing device such as a server, a personal computer, or a smartphone, 4 denotes a router or a network switch, 10 denotes an application identification device, 20 denotes a flow data generation device, and 30 denotes a packet data extraction device.

[0026] The application identification device 10 processes the flow data received from the flow data generating device 20 to specify (identify) the destination application. However, the application identification device 10 of the present invention differs from the conventional technology in that it executes a processing flow to be described later. The application identification device 10 may be realized by one or more information processing devices (computers) including, for example, a processor (CPU), memory (ROM, RAM, etc.), storage device (HDD, SSD, etc.), input / output interface, transmission / reception port, etc., connected to a common bus. In this case, flow data can be received via the transmission / reception port.

[0027] The flow data generating device 20 receives the extracted data transmission packets sent from the packet data extracting device 30, and generates flow data that aggregates the communication packets on a session basis or a time basis, for example, into the number of communication packets or communication data size.

[0028] The packet data extraction device 30 acquires multiple communication packets passing between routers or network switches 4 on a network path from an IoT device 2 such as a connected car to a server 3, etc., on a session basis or a time basis, and, for example, extracts individual headers and extracted data for each packet, edits the packets for transmitting the extracted data by adding a common header to the extracted sets of multiple individual headers and extracted data, and transmits them to the flow data generation device 20.

[0029] The flow data generator 20 and the packet data extractor 30 may utilize existing devices or may be independently constructed and operated, but are not components of the present invention. In other words, it should be noted that the present invention is not limited by the source of flow data (communication data). 1 merely shows an example of the configuration of the application identification system, and other configurations are also possible. For example, the flow data generator 20 and the packet data extractor 30 may be integrated into one device. Furthermore, packets may be acquired not on a network device such as a router or a network switch 4 but on the server 3.

[0030] The processing flow of the application identification device, application identification method, and program according to one embodiment of the present invention will be described below with reference to the flowchart of FIG. The application identification device 10 of one embodiment of the present invention can be considered as a device equipped with means for executing each step of the processing flow, namely, a data set creation unit, an expanded / compressed space creation unit, a neighborhood sphere acquisition unit, a local outlier calculation unit, an optimal neighborhood sphere acquisition unit, and a cluster generation unit.

[0031] (Preliminary step) At the beginning of the processing flow of one embodiment, a data set S to be clustered is

number

[0032] (Step 1: Creating multiple expanded or compressed spaces) Let the data set S be a set of any positive vectors P

number

number

[0033] Here, the expansion rate is, for example, in an environment of m=2,

number

[0034] (Step 2: Obtain the neighborhood sphere for each point) Each dataset S created in step 1 p At each point in the k-nearest neighbors ball

number

[0035] (Step 3: Calculating local outliers for each point) Dataset S p The local outlier is calculated for each point in the image. The local outlier is a value that indicates how low the density of a point is compared to the density of neighboring points (i.e., an abnormal value that deviates from the surrounding points) by using the "density calculated based on the distance relationship between the point itself and its surrounding points" at each point. For example, the local outlier is the LOF value in Non-Patent Document 3.

[0036] The LOF value is calculated using the density (local reachability density) calculated based on the distance relationship between the node itself and its k-nearest neighbors. If the node's density is higher than the average density of each k-nearest neighbor, it is considered to be "high density," and if it is lower, it is considered to be "low density." Figure 3 shows a scatter plot of some two-dimensional data and the LOF value of each point. In general, if the radius of the k-nearest neighbor sphere "at the k-nearest neighbors of point X" is small compared to the radius of the k-nearest neighbor sphere at point X, point X can be said to have low density.

[0037] Besides the LOF value, the LoOP value in Non-Patent Document 8 can also be cited as a candidate for a local outlier. In the following, we will use the LOF value as an example. p LOF value at LOF x,p It is written as follows.

[0038] (Step 4: Obtaining the best neighborhood sphere for the data set S) Select the best neighborhood sphere for x∈S. Specifically, the best neighborhood sphere for x is B x When

number

number

[0039] A specific example is shown in Figure 4. Communications addressed to two types of applications, A and B, occur multiple times, and each communication data has two-dimensional characteristics: the number of packets and packet size. Figure 4(a) is a scatter plot with the number of packets on the horizontal axis and the packet size on the vertical axis. The group of circles on the left represents communication data addressed to application A, and the group of circles on the right represents communication data addressed to application B. In this case, we focus on point X, which has the largest packet size among the communication data addressed to application B. The group of circles for application B, including point X, has significantly different variances in the number of packets and packet size. Therefore, when Euclidean distance is used as the criterion, the three circles belonging to the group of circles for application A become the k-nearest neighbors (k=3) of point X.

[0040] On the other hand, as shown in Figure 4(b), if the expansion rate on the vertical axis (packet size) is set to 1 / 2, the three circular points belonging to the group of circular points of application B become the k-nearest neighbors (k=3) of point X. Here, if we calculate the LOF value of point X in each of Figures 4(a) and 4(b), in Figure 4(a), point X is not included in the nearest sphere of point X's k-neighborhood points (k=3), but in Figure 4(b), one of point X's k-neighborhood points (k=3) includes point X within that k-neighborhood sphere (k=3). Therefore, the LOF value of point X in Figure 4(b) can be said to be lower (= denser) than the LOF value in Figure 4(a). In this example, the LOF value in Figure 4(b) is the OLOF value at point X.

[0041] (Step 5: Clustering based on the optimal neighborhood sphere) Here, clustering using LDBSCAN is used as an example. First, OLOF x If x is less than a certain threshold, then point x is a "core point." If point x is a core point, then S px The local reach density LRD is defined as x Using (z),

number

[0042] (Supplementary explanation 1) “Local Reach Density LRD x (z)" is S px The reachable distance RD between point z and a point in the k-nearest neighbors sphere of point z x (y,z)

number

[0043] LRD is a concept proposed in an existing method (LRDBSCAN) that indicates the density of the area around each point (the higher the value, the more other points there are near that point). By using this value, it becomes possible to evaluate the relative difference in the density of points x and y, and points with roughly the same density can be considered to be in the same cluster. Also, "S px Reachable distance RD at point y and point z x "(y,z)" is the distance defined as "the radius of the k-nearest neighbor sphere" if z is included in the k-nearest neighbor sphere of y, and "the absolute distance between y and z" if z is not included.

[0044] (Supplementary explanation 2) In addition to LDBSCAN, "clustering methods that define core points or similar points and determine clusters based on the reachable distance or similar distance from the core points" and "clustering methods that use local outlier factors" can be applied without significantly changing the original clustering method.

[0045] (Variation 1) (Optional Step 1: Rule out abnormal expansion rates) In the operation of step 5, points with optimal neighborhood spheres with significantly different expansion rates may be classified into the same cluster, as shown in Figure 5(a). Therefore, as shown in Figure 5(b), the expansion rate p x The set of points x is subjected to anomaly detection using an arbitrary anomaly detection model, and points x associated with a significantly different expansion rate from others are excluded from the cluster.

[0046] (Variation 2) (Optional Step 2: Rule out abnormal expansion rates) In the optional step 1 operation, the expansion rate p of the optimal neighborhood at point x in each cluster is x When an anomaly detection model (such as DBSCAN) that can also perform clustering is used to detect anomalies in a set of data, multiple clusters may be created. x If it can be visually confirmed that the clusters of the set of are clearly separated on the corresponding set S, the original clusters created in step 5 may be separated.

[0047] Although one example of an embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment. Furthermore, the effects described in the above-described embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiment.

[0048] Furthermore, the present invention can improve the classification accuracy of density-based clustering in, for example, an anomaly communication detection system, i.e., improve the accuracy of assigning the same application to the same cluster and different applications to different clusters, thereby improving the accuracy of application identification, which can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs) to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation." [Explanation of symbols]

[0049] 1 Application Identification System 2 IoT devices such as connected cars 3 Servers, PCs, smartphones, etc. 4. Routers / Network Switches 10 Application Identification Device 20 Flow data generator 30 Packet data extraction device

Claims

1. a dataset creation unit that receives m-dimensional (m≧2) communication data acquired from a communication network and creates a dataset S that is a set of points in an m-dimensional space where a plurality of data to be clustered are arranged; A data set S is a set of points arranged in a plurality of m-dimensional spaces by expanding or compressing the m-dimensional space in which the points included in the data set S are arranged by a plurality of expansion ratios. ｐ an expansion / compression space creation unit that creates an expansion / compression space; The data set S ｐ a neighborhood sphere acquisition unit that acquires a k-neighborhood sphere at each point included in The data set S ｐ a local outlier calculation unit for calculating a local outlier for each point included in an optimal neighborhood sphere acquisition unit that uses a plurality of local outliers calculated in the plurality of expanded or compressed spaces for each point included in the data set S to identify the expanded or compressed space with the highest marginal density, acquires an optimal neighborhood sphere that is a k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculates the optimal local outlier; a cluster generation unit that clusters each point included in the data set S based on the optimal neighborhood sphere and the optimal local outlier; An application identification device comprising:

2. The application identification device according to claim 1 , wherein the communication data is communication data sent from an IoT device to an application via a communication network.

3. 3. The application identification device according to claim 1, wherein the cluster generation unit defines core points or points equivalent thereto, and generates the clusters using a clustering method that determines clusters based on a reachable distance or a distance equivalent thereto defined by the core points and the optimal neighborhood sphere.

4. 3. The application identification device according to claim 1, wherein the local outlier calculation unit calculates the local outlier based on the k-nearest neighbor sphere acquired by the near sphere acquisition unit, and the optimal near sphere acquisition unit calculates the optimal local outlier based on the acquired optimal near sphere.

5. 3. The application identification device according to claim 1, further comprising an anomaly detection unit that, for each generated cluster, detects an anomaly in a set of expansion rates associated with the optimal neighborhood sphere at each point within the cluster using an arbitrary anomaly detection model, and excludes points associated with expansion rates determined to be anomalous from the cluster.

6. a dataset creation step of receiving m-dimensional (m≧2) communication data acquired from a communication network and creating a dataset S which is a set of points in an m-dimensional space where a plurality of data to be clustered are arranged; an expanded / compressed space creation step of creating a data set Sp, which is a set of points arranged in a plurality of other m-dimensional spaces, by expanding or compressing the m-dimensional space in which the points included in the data set S are arranged by a plurality of expansion rates; a neighborhood sphere acquisition step of acquiring a k-nearest neighbor sphere for each point included in the data set Sp; a local outlier calculation step of calculating a local outlier for each point included in the data set Sp; an optimal neighborhood sphere acquisition step of identifying the expanded or compressed space with the highest marginal density for each point included in the data set S using the multiple local outliers calculated in the multiple expanded or compressed spaces, acquiring an optimal neighborhood sphere, which is a k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculating the optimal local outlier; a cluster generation step of clustering each point included in the data set S based on the optimal neighborhood sphere and the optimal local outlier; An application identification method comprising:

7. one or more computing devices, a dataset creation unit that receives m-dimensional (m≧2) communication data acquired from a communication network and creates a dataset S that is a set of points in an m-dimensional space where a plurality of data to be clustered are arranged; an expanded / compressed space creation unit that creates a data set Sp, which is a set of points arranged in a plurality of other m-dimensional spaces, by expanding or compressing an m-dimensional space in which points included in the data set S are arranged, using a plurality of expansion rates; a neighborhood sphere acquisition unit that acquires a k-neighborhood sphere for each point included in the data set Sp; a local outlier calculation unit that calculates a local outlier for each point included in the data set Sp; an optimal neighborhood sphere acquisition unit that uses a plurality of local outliers calculated in the plurality of expanded or compressed spaces for each point included in the data set S to identify the expanded or compressed space with the highest marginal density, acquires an optimal neighborhood sphere that is a k-nearest neighbor sphere in the expanded or compressed space identified as having the highest marginal density, and calculates the optimal local outlier; a cluster generation unit that clusters each point included in the data set S based on the optimal neighborhood sphere and the optimal local outlier; A computer program for causing the device to function as an application identification device comprising:

Images