Communication monitoring device and communication monitoring method

Abstract

To more surely monitor abnormal use of a network bandwidth.SOLUTION: The communication monitoring device 1 performs adversarial training of the generative model including the generator 121 configured to generate pseudo-abnormal traffic similar to the true abnormal data-which is the trained recurrent neural network constructed by the training of the first training unit 11-and the discriminator 122 configured to discriminate between the pseudo-abnormal data-which is generated by the generator 121 - and the true abnormal data-which is the time series data-which is obtained for each time section-of the user terminal 2 that abnormally uses the network bandwidth.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a communication monitoring device and a communication monitoring method. [Background technology]

[0002] In recent years, the number of mobile and fixed line terminals connecting to the Internet has increased dramatically, resulting in a surge in Internet traffic. User terminals, such as mobile and fixed line terminals, have predetermined bandwidth limits for data communication and Internet connection based on service contracts and network management. However, some user terminals communicate beyond the available bandwidth limit, causing traffic anomalies such as congestion and burst traffic in the network equipment that processes packets from such user terminals.

[0003] For example, there are terminals that maliciously send traffic exceeding the available bandwidth, generating burst traffic, as in DoS attacks. Meanwhile, in DDoS attacks, user terminals used as springboards may unintentionally exceed the bandwidth limit. There are also a variety of abnormal communication patterns that exceed the set bandwidth. For example, while there are user terminals that communicate far beyond the set bandwidth limit, there are also user terminals that slightly exceed the bandwidth limit or that intermittently exceed the bandwidth limit. Given these various patterns of abnormal bandwidth usage that can cause network traffic abnormalities, it has been difficult to identify user terminals that are abnormally using bandwidth by monitoring the communication volume status of individual user terminals across the entire network.

[0004] Therefore, Patent Document 1 discloses a technique for monitoring the communication volume of user terminals based on a database of past traffic information. However, with the technique disclosed in Patent Document 1, it is difficult to identify user terminals that are making abnormal bandwidth usage that differs from past traffic patterns. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2020-108029 Summary of the Invention [Problem to be solved by the invention]

[0006] Conventional techniques have made it difficult to reliably monitor abnormal network bandwidth usage.

[0007] The present invention has been made to solve the above-mentioned problems, and has as its object to more reliably monitor abnormal usage of network bandwidth. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, a communication monitoring device according to the present invention includes a first learning unit configured to learn a recurrent neural network that outputs the communication volume of a user terminal for each time interval when the time intervals are sequentially input, using time series data of the communication volume for each time interval of a user terminal that abnormally uses the network bandwidth as training data; a generator that generates pseudo-anomalous data similar to true anomalous data, using the trained recurrent neural network constructed by the training by the first learning unit as true anomalous data for the time series data of the communication volume for each time interval of a user terminal that abnormally uses the network bandwidth; the pseudo-anomalous data generated by the generation unit matches time series data of communication volume for each time interval of the user terminal to be monitored, and a notification unit configured to notify the determination result by the determination unit.

[0009] In addition, the communication monitoring device of the present invention further includes a first acquisition unit configured to acquire time series data of communication volume for each time interval of a user terminal that makes abnormal use of the network bandwidth, which is used as the teacher data, and the abnormal use of the network bandwidth may include use that exceeds the upper limit of the network bandwidth that the user terminal can use.

[0010] Furthermore, in the communication monitoring device of the present invention, the judgment unit may further judge that the user terminal to be monitored is a user terminal that is making the abnormal use of the network bandwidth when the time series data of the communication volume for each time interval of the user terminal to be monitored matches the true abnormal data.

[0011] Furthermore, the communication monitoring device according to the present invention may further include a second acquisition unit configured to acquire, from a core network, time series data on the communication volume of the user terminal to be monitored for each time interval.

[0012] In the communication monitoring device according to the present invention, the pseudo-abnormal data may have a data distribution that minimizes the statistical distance from the data distribution of the true abnormal data.

[0013] In order to solve the above-mentioned problems, the communication monitoring method of the present invention includes a first learning step of training a recurrent neural network that outputs the communication volume of a user terminal for each time interval when the time intervals are sequentially input, using time series data of the communication volume for each time interval of a user terminal that abnormally uses a network bandwidth as training data; and a generation step of generating pseudo-abnormal data similar to the true abnormal data, using the trained recurrent neural network constructed by the training step in the first learning step as true abnormal data for the time series data of the communication volume for each time interval of a user terminal that abnormally uses the network bandwidth. the pseudo-anomalous data generated by the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data; a generation step that generates the pseudo-anomalous data using the trained generator obtained by the adversarial learning in the second learning step; a determination step that determines that the user terminal to be monitored is a user terminal that is making the abnormal use of the network bandwidth when time series data of the communication volume for each time interval of the user terminal to be monitored matches the pseudo-anomalous data generated in the generation step; and a notification step that notifies the determination result in the determination step.

[0014] In addition, the communication monitoring method of the present invention further includes a first acquisition step of acquiring time series data of communication volume for each time interval of a user terminal that makes abnormal use of the network bandwidth, which data is used as the training data, and the abnormal use of the network bandwidth may include use that exceeds the upper limit of the network bandwidth that the user terminal can use.

[0015] Furthermore, in the communication monitoring method of the present invention, the determination step may further determine that the user terminal to be monitored is a user terminal making the abnormal use of the network bandwidth when the time series data of the communication volume for each time interval of the user terminal to be monitored matches the true abnormal data.

[0016] Furthermore, the communication monitoring method according to the present invention may further comprise a second acquisition step of acquiring, from a core network, time series data on the communication volume of the user terminal to be monitored for each time interval. [Effects of the Invention]

[0017] According to the present invention, the trained recurrent neural network constructed by the training by the first training unit is subjected to adversarial training of a generative model having a generator that generates pseudo-anomalous data similar to true anomalous data as true anomalous data for time-series data of communication volume for each time interval of a user terminal that abnormally uses network bandwidth, and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and true anomalous data, thereby making it possible to more reliably monitor abnormal usage of network bandwidth. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a block diagram showing the configuration of a communication monitoring system including a communication monitoring device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the first learning unit included in the communication monitoring device according to this embodiment. [Figure 3]FIG. 3 is a block diagram showing the configuration of the second learning unit included in the communication monitoring device according to this embodiment. [Figure 4] FIG. 4 is a block diagram showing the configuration of the second learning unit included in the communication monitoring device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the communication monitoring device according to this embodiment. [Figure 6] FIG. 6 is a block diagram showing the hardware configuration of the communication monitoring device according to this embodiment. [Figure 7] FIG. 7 shows an operation sequence of the communication monitoring system according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the communication monitoring device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0020] [Configuration of communication monitoring system] First, with reference to FIG. 1, an overview of a communication monitoring system including a communication monitoring device 1 according to an embodiment of the present invention will be described.

[0021] The communication monitoring system according to this embodiment includes a communication monitoring device 1, multiple user terminals 2, a UPF (User Plane Function) 3, and a data network (DN) 4. The communication monitoring device 1 and the UPF 3 are communicably connected to each other via a communication network NW such as a LAN, a WAN, or the Internet. The user terminals 2 can communicate with a core network including the UPF 3 via a wired network such as the LAN, the WAN, the Internet, or ISDN, or a wireless LAN, for example, a mobile communication network using a 5G wireless communication system.

[0022] The communication monitoring system of this embodiment builds in advance a database of fluctuation patterns in communication volume that indicate abnormal use of network bandwidth, and based on the built database, determines whether each of multiple user terminals 2 to be monitored is a terminal that is making abnormal use of bandwidth, and notifies the user of the determination result.

[0023] The user terminal 2 includes a mobile terminal and a fixed line terminal. The user terminal 2 configured as a mobile terminal is equipped with a SIM and is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, or the like.

[0024] The SIM included in the user terminal 2 stores a user contract profile. The SIM contract profile stores the user's subscriber identification information, and includes identifier information such as the IMSI assigned to the mobile phone line contract, the telephone number of the subscriber user (MSISDN: Mobile Subscriber International Subscriber Directory Number), and the SIM card number (ICCID: Integrated Circuit Card Identifier). The user terminal 2 is uniquely identified by the assigned IMSI.

[0025] When the user terminal 2 is configured as a fixed line terminal, it is realized as a desktop computer, a server, an IoT device, etc., and is assigned a terminal IP address that uniquely identifies the terminal. In the following explanation, the case where the user terminal 2 is a mobile terminal will be described as an example.

[0026] The UPF 3 is a user plane function of the core network, and processes data packets between a radio access network (RAN) (not shown) and a data network (DN) 4. The UPF 3 records a log of the communication volume of each of a plurality of user terminals 2. If the user terminal 2 is a mobile terminal, time series data of the communication volume for each IMSI is recorded. In this embodiment, the UPF 3 records time series data of the communication volume for each preset time interval.

[0027] The data network (DN) 4 is the Internet or the like outside the core network, and the user terminal 2 connects to it via the UPF 3 of the core network in a wired or wireless manner.

[0028] [Communication monitoring device function block] As shown in FIG. 1, the communication monitoring device 1 includes a first acquisition unit 10, a first learning unit 11, a second learning unit 12, a first memory unit 13, a generation unit 14, a second memory unit 15, a second acquisition unit 16, a judgment unit 17, and a notification unit 18.

[0029] The first acquisition unit 10 acquires time-series data of communication volume for each time interval by a user terminal 2 that is making abnormal use of the network bandwidth, which the first learning unit 11 uses as training data. The network bandwidth is the upper limit of the available bandwidth set for each user terminal 2 based on a service contract between each user terminal 2 and a telecommunications carrier. Abnormal bandwidth usage includes use that exceeds the upper limit of the available bandwidth for a certain period of time, or use that occurs intermittently for a certain period of time. Abnormal bandwidth usage also includes communication modes that deviate from normal use of the set bandwidth, such as use of the upper limit bandwidth that is slightly or not exceeding the upper limit for a certain period of time, or use that occurs intermittently for a certain period of time. Such abnormal bandwidth usage by one or more user terminals 2 can result in higher-than-normal traffic, which can cause network congestion or burst traffic.

[0030] The first acquisition unit 10 can acquire time series data of communication volume for each time interval of the user terminal 2, calculated based on a bandwidth usage pattern predefined as abnormal bandwidth usage. Alternatively, the first acquisition unit 10 can acquire a history of time series data of actual communication volume for each time interval by a user terminal 2 that has previously engaged in abnormal bandwidth usage. In this way, the first acquisition unit 10 can acquire time series data of communication volume for each time interval corresponding to abnormal bandwidth usage modes that are assumed to cause network congestion or burst traffic. For example, the first acquisition unit 10 can externally acquire time series data of communication volume corresponding to abnormal bandwidth usage that has been set in advance by an administrator.

[0031] A time interval is a continuous unit of time with a preset start time and end time, and the length of one time interval can be, for example, 1 [ms]. Furthermore, the time series data of the communication volume for each time interval of the user terminal 2 is a time series data set of the communication volume [bps] generated for each time interval [ms].

[0032] The first learning unit 11 uses time-series data of communication volume for each time interval of a user terminal 2 that abnormally uses network bandwidth as training data, and when time intervals are sequentially given as input, trains a recurrent neural network (RNN) that outputs the communication volume of the user terminal 2 for each time interval. Specifically, the first learning unit 11 uses the time-series data of communication volume for each time interval of a user terminal 2 that abnormally uses bandwidth acquired by the first acquiring unit 10, i.e., a time-series sequence in which the value of the communication volume of the user terminal 2 is assigned as a correct answer label to the value of each time interval, as training data for the RNN. In this way, the first learning unit 11 learns a fluctuation pattern of communication volume related to abnormal bandwidth use using the RNN.

[0033] 2 is a schematic diagram showing the network structure of the RNN used in the learning of the first learning unit 11. As shown in FIG. 2, the RNN is a neural network consisting of an input layer X, a hidden layer H which is a memory cell, and an output layer Y, and input time series data x (t) Predict time series data y (t) In this embodiment, the input time series data is a value for a time interval. The predicted time series data is the communication volume of the user terminal 2 in each time interval. In an RNN, information is transmitted from the hidden layer at a certain time to the hidden layer at the next time along the time series. Therefore, the hidden layer at time t receives input from the hidden layer at time t and the hidden layer at the immediately preceding time t-1.

[0034] Given time series data x (t) On the other hand, RNN is defined by the following equations (1) and (2). h (t) =σ(U×x (t) +W×h (t-1) +b) (1) y (t) =V×h (t) +c (2)

[0035] The above equation (1) represents the propagation from the input layer to the hidden layer, and x (t) is the input vector at time t. h (t) is the output of the hidden layer at time t. U is the weight parameter from the input to the hidden layer, W is the weight parameter from the hidden state at the previous time t-1 to the hidden state at the current time t. b is the bias vector of the hidden layer, and σ is the activation function.

[0036] The above equation (2) represents the propagation from the hidden layer to the output layer, and y (t) is the output vector at time t. V is the weight parameter from the hidden layer to the output layer, and c is the bias vector for the output layer.

[0037] The first learning unit 11 uses a backpropagation method or the like to compare the obtained predicted output value with the output value of the training data for a given input value, introduces an objective function to minimize the error, examines the error of the weight parameters and propagates it backward, and finally determines the weight parameters U, W, V and biases b and c. Through this learning process, the first learning unit 11 constructs a trained RNN. The trained RNN constructed by the first learning unit 11 is used as training data for adversarial learning of a generative model by the second learning unit 12.

[0038] The second learning unit 12 performs adversarial learning of a generative model that uses the trained RNN obtained by the training by the first learning unit 11 as true abnormal data for the time series data of communication volume for each time interval of a user terminal 2 that makes abnormal use of network bandwidth, and has a generator 121 that generates pseudo-abnormal data similar to the true abnormal data, and a classifier 122 that distinguishes between the pseudo-abnormal data generated by the generator 121 and true abnormal data.

[0039] As shown in FIG. 3, the second learning unit 12 adversarially trains a GAN (Generative Adversarial Network) having a generator 121 and a classifier 122. A trained generator 121′ is constructed by the training of the second learning unit 12. As described above, in this embodiment, a fluctuation pattern of communication volume related to a predefined abnormal bandwidth usage pattern, which is indicated by the trained RNN constructed by the training of the first learning unit 11, is considered as true abnormal data. Furthermore, the true abnormal data is used as training data to train the generator 121 that generates pseudo abnormal data similar to the time-series data of communication volume for each time interval related to the abnormal bandwidth usage indicated by the true abnormal data.

[0040] 4 and 5 are diagrams schematically illustrating the neural network structures of the generator 121 and the classifier 122 of the GAN used by the second learning unit 12. As shown in FIG. 4, the generator 121 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 121 is configured as D generators 121_1 to 121_D corresponding to the values ​​t_1 to t_D of consecutive time intervals. As shown in FIGS. 3 and 4, the generator 121 is configured to provide the value s of the sequential time intervals as input to each of the generators 121_1 to 121_D, and generate pseudo abnormal data G1(s) to GD(s).

[0041] Each of the generators 121_1 to 121_D corresponds to a memory cell of the trained RNN at each time used in training the RNN by the first learning unit 11. For example, the generator 121_1 indicated by G1 has a neural network structure that can learn pseudo-abnormal data similar to the parameters of a trained RNN that receives a time interval value t_1 as input and outputs a communication amount T1 at the time interval value t_1 when the user terminal 2 abnormally uses the bandwidth. CNN or ResNet can be used as the neural network that constitutes the generator 121.

[0042] The generator 121 outputs an output G(s) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. For example, the output G1(s) from the generator 121_1 is pseudo-abnormal data similar to the communication volume T1 output when the value of the time interval value t_1 is given as input to the trained RNN. Similarly, the generators 121_2 to 121_D corresponding to the time interval values ​​t_2 to t_D each output pseudo-abnormal data similar to the communication volumes T2 to TD output from the trained RNN. In this way, the generator 121 according to this embodiment outputs a random function using the value of each time interval as input.

[0043] The classifier 122 shown in Fig. 5(a) is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5(a), true abnormal data indicating the communication volume of the user terminal 2 in each time interval, output from the trained RNN obtained by the first learning unit 11, is provided as training data input. Fig. 5(b) is a diagram for explaining input data provided to the classifier 122. The example of Fig. 5(b) illustrates training data related to true abnormal data. That is, communication volumes T1 to TD when the user terminal 2 performs data communication in each time interval t_1 to t_D are provided to the classifier 122 as training data.

[0044] The classifier 122 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 122 outputs an output y=1 when it correctly identifies the training data related to the input truly anomalous data as truly anomalous data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo-anomalous data as pseudo-anomalous data. In this way, the classifier 122 is a model that distinguishes the model distribution generated by the generator 121 from the data distribution of the training data, which is the true distribution. The pseudo-anomalous data has a data distribution that has the smallest statistical distance from the data distribution of the truly anomalous data. A CNN can be used as the neural network that constitutes the classifier 122.

[0045] FIG. 3 is a block diagram for explaining the adversarial learning of GAN by the second learning unit 12. The generator 121 of the GAN adopted by the second learning unit 12 is represented as function G, and the discriminator 122 is represented as function D. Note that, hereinafter, the functions G1 to GD of the generators 121_1 to 121_D are collectively referred to as function G. Furthermore, true abnormal data is represented as x, the predicted value output by the discriminator 122 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true abnormal data and 0 for pseudo abnormal data generated by the generator 121. In this case, the discriminator 122 calculates the cross entropy E CE It can be expressed as:

[0046]

number

[0047] The first term in the brace of the above equation (3) represents t n lny n In this case, the predicted value y n is the correct label for the true anomaly data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0048] Here, the generator 121 that constitutes the GAN has parameters w G ,θ G and the function G(w G ,θ G ) The classifier 122 also uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (3) CE The objective function E of the GAN including the generator 121 and the discriminator 122 based on the above can be expressed by the following equation (4).

number

[0049] The first term in the above equation (4) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 122 classifies true abnormal data as true abnormal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θD )) is the expected value at which the classifier 122 classifies the pseudo-anomalous data generated by the generator 121 as pseudo-anomalous data. In GAN learning, the generator 121 and the classifier 122 are trained adversarially through min-max optimization of the objective function E. Therefore, the generator 121 is trained to be able to generate pseudo-anomalous data that can fool the classifier 122, and the classifier 122 is trained to classify the pseudo-anomalous data generated by the generator 121 as pseudo-anomalous data.

[0050] In learning of the classifier 122, when true abnormal data is given, the classifier 122 outputs an output close to y=1, thereby maximizing the first term of the objective function E in the above equation (4). On the other hand, when pseudo abnormal data is given, the classifier 122 learns to output an output close to y=0, thereby maximizing the second term of the objective function E.

[0051] In the learning of the generator 121, D(G(w G ,θ G ),w D ,θ D ) (G1(s)~GD(s) in Figure 3) is close to 1. G ,θ G ) (G1(s) to GD(s) in FIG. 3), thereby minimizing the objective function E. The second learning unit 12 uses a learning procedure that alternately updates the parameters of the generator 121 and the parameters of the classifier 122. Details of the learning procedure of the generator 121 and the classifier 122 by the second learning unit 12 will be described later.

[0052] The first storage unit 13 stores the trained RNN parameters and the trained generator 121'. Specifically, the first storage unit 13 stores trained generators 121_1' to 121_D' corresponding to the respective time intervals t_1 to t_D.

[0053] The generation unit 14 generates pseudo-anomalous data using the learned generator 121' obtained by adversarial learning in the second learning unit 12. More specifically, the generation unit 14 inputs the time interval values ​​t_1 to t_D to the learned generators 121_1' to 121_D', and performs calculations on the learned generators 121_1' to 121_D' to generate pseudo-anomalous data indicating the communication volume of the user terminal 2 for each time interval. The sequence of pseudo-anomalous data generated by each of the learned generators 121_1' to 121_D' represents a fluctuation pattern of communication volume due to abnormal use of bandwidth.

[0054] The second storage unit 15 stores the pseudo-abnormal data generated by the generation unit 14. The second storage unit 15 also stores true abnormal data used as training data by the second learning unit 12. The second storage unit 15 builds a database of time-series data of communication volume for each time interval that indicates abnormal bandwidth usage.

[0055] The second acquisition unit 16 acquires time series data of communication volume for each time interval of the monitored user terminal 2 from the core network. Specifically, the second acquisition unit 16 periodically acquires the communication volume history of each of the multiple user terminals 2 from the UPF 3 of the core network. The second acquisition unit 16 acquires the communication volume history for each time interval of each user terminal 2 using the IMSI as a key.

[0056] The determination unit 17 determines that the user terminal 2 to be monitored is a terminal making abnormal use of bandwidth when the time series data of the communication volume for each time interval of the user terminal 2 to be monitored matches the pseudo-abnormal data generated by the generation unit 14. Furthermore, the determination unit 17 determines that the user terminal 2 to be monitored is a terminal making abnormal use of bandwidth when the time series data of the communication volume for each time interval of the user terminal 2 to be monitored matches the true abnormal data. Specifically, the determination unit 17 performs the determination process based on a database of abnormal data that includes pseudo-abnormal data and true abnormal data, which is stored in the second storage unit 15.

[0057] Furthermore, the determination unit 17 can determine that a user terminal 2 having a value of time series data of communication volume for each time interval that is within a certain range from the values ​​of the time series data of communication volume for each time interval that are indicated by the pseudo abnormal data and the true abnormal data stored in the second storage unit 15 is a terminal that is making abnormal use of bandwidth. Here, the time series data set of communication volume for each time interval of the user terminal 2 to be monitored that is acquired by the second acquisition unit 16 is expressed as [X1, X2, X3, . . . , X D ]. The l time series data sets of communication volume for each time interval related to abnormal data stored in the second storage unit 15 are expressed as [Y (1,1) ,Y (1,2) ,Y (1,3) ,···,Y (1,D) ],[Y (2,1) ,Y (2,2) ,Y (2,3) ,···,Y (2,D) ],···,[Y (L,1) ,Y (L,2) ,Y (L,3) ,···,Y (L,D) ] is expressed as

[0058] The determination unit 17 can determine how similar the communication volume pattern for each time interval is to the communication volume pattern for each time interval stored in the second storage unit 15 by calculating the Euclidean distance between the two time series data sets as shown in the following equation (5) and determining whether the distance is equal to or less than a threshold value.

number

[0059] Furthermore, before the determination process of the above formula (5), the determination unit 17 obtains the time series data set [X1, X2, X3, . . . , X D ] and the time series data set [Y (l,1) ,Y (l,2) ,Y (l,3) ,···,Y (l,D)], it is determined which time intervals correspond to each other. For example, in the above formula (5), the communication volume Y (l,1) As the communication volume for the time interval closest to the time interval, the communication volume X1 for the first time interval is identified from the time series data set of the communication volume of the user terminal 2 to be monitored.

[0060] When performing the determination process using the above formula (5), the determination unit 17 can calculate the difference and squared terms between data points corresponding to each time interval only when the value of the communication volume of the monitored user terminal 2 in each time interval is within a certain range from the value of the communication volume of the abnormal data in the corresponding time interval. For example, the communication volume Y (l,1) is 2 [Gbps], the communication volume X1 of the monitored user terminal 2 in the corresponding first time interval is 1.7 [Gbps], and if it is within a certain range from 2 [Gbps], these data points are taken into account in the above formula (5). If it is not within the certain range, for example, if the communication volume X1 is 0.7 [Gbps], the calculation is performed assuming that there is no value between the data points of the corresponding term in the above formula (5) in that time interval.

[0061] Furthermore, the determination unit 17 performs threshold processing using the above formula (5) in order from 1 to L time series data sets of L communication volumes stored in the second storage unit 15, and terminates the determination processing when the above formula (5) is satisfied. Furthermore, the determination processing using the above formula (5) is similarly performed for all of the multiple user terminals 2 that are the monitoring targets.

[0062] Furthermore, among the data points of the communication volume of the time series data set of the communication volume for each time interval of the monitored user terminal 2, for example, the communication volume X1 corresponding to the first time interval, which is the earliest time interval, to the communication volume X2 for the second time interval, are substituted into the above formula (5) in order, and the judgment process can be terminated when a data point for a time interval that is equal to or less than the threshold appears. This makes it possible to obtain a judgment result without performing calculations on all data points from 1 to D.

[0063] The notification unit 18 notifies the UPF 3 of the determination result by the determination unit 17. Specifically, the notification unit 18 notifies the UPF 3 of the IMSI of the user terminal 2 to be monitored that has been determined to be a terminal making abnormal use of the network bandwidth. Furthermore, the notification unit 18 can instruct the UPF 3 to cut off communication with the user terminal 2 identified by these IMSIs.

[0064] [Hardware configuration of communication monitoring device] Next, an example of a hardware configuration for realizing the communication monitoring device 1 having the above-described functions will be described with reference to FIG.

[0065] As shown in Figure 6, the communication monitoring device 1 can be realized, for example, by a computer having a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program that controls these hardware resources.

[0066] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0067] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the communication monitoring device 1, such as the first acquisition unit 10, the first learning unit 11, the second learning unit 12, the generation unit 14, the second acquisition unit 16, the determination unit 17, and the notification unit 18 shown in FIG.

[0068] The communication interface 104 is an interface circuit for connecting the communication monitoring device 1 to various external electronic devices via a network.

[0069] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0070] The auxiliary storage device 105 has a program storage area for storing a communication monitoring program executed by the communication monitoring device 1. The auxiliary storage device 105 also has an area for storing a first learning program for performing RNN learning and a second learning program for performing adversarial learning using GAN. The auxiliary storage device 105 realizes the first storage unit 13 and the second storage unit 15 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0071] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0072] The display device 107 is configured by an organic EL display, a liquid crystal display, or the like.

[0073] [Communication monitoring system operation] Next, the operation of the communication monitoring system including the communication monitoring device 1 having the above-described configuration will be described with reference to the sequence diagram of FIG.

[0074] First, the first acquisition unit 10 of the communication monitoring device 1 acquires training data to be used in RNN learning (step S1). The first acquisition unit 10 acquires, for example, time series data of communication volume for each time interval corresponding to a pattern of abnormal bandwidth usage set in advance by a network administrator. Alternatively, the first acquisition unit 10 can extract and acquire time series data of communication volume for each time interval in which abnormal bandwidth usage occurred from the communication volume history of multiple user terminals 2.

[0075] Next, the first learning unit 11 performs a first learning process to learn an RNN (step S2). More specifically, the first learning unit 11 uses the time-series data of the communication volume for each time interval by the user terminal 2 that abnormally uses the bandwidth, acquired in step S1, as training data, and learns an RNN that outputs the communication volume of the user terminal 2 for each time interval when the time intervals are sequentially given as input.

[0076] In step S2, the first learning unit 11 uses a backpropagation method or the like to compare the predicted output value obtained for a given input value with the output value of the training data, introduces an objective function that minimizes the error, checks the error of each weight parameter, and propagates it backward to finally determine the weight parameters U, W, and V and the biases b and c in the above equations (1) and (2). The first storage unit 13 stores the trained RNN constructed in the first learning process in step S3 (step S3).

[0077] Next, the second learning unit 12 performs a second learning process (step S4). More specifically, the second learning unit 12 uses the trained RNN obtained in the first learning process of step S2 as training data, i.e., true abnormal data, and performs adversarial learning of a GAN having a generator 121 that generates pseudo-abnormal data similar to the true abnormal data, and a classifier 122 that distinguishes between the pseudo-abnormal data generated by the generator 121 and true abnormal data. The true abnormal data is time-series data of communication volume for each time interval that represents a fluctuation pattern of communication volume corresponding to a usage pattern predetermined as an abnormal use of bandwidth. Details of the second learning process of step S4 will be described later.

[0078] Next, the first storage unit 13 stores the trained generator 121' constructed in step S4 (step S5). Specifically, the trained generators 121_1' to 121_D' corresponding to each time interval are stored in the first storage unit 13. Subsequently, the generation unit 14 generates pseudo abnormal data using the trained generator 121' (trained generators 121_1' to 121_D') constructed in step S5 (step S6). In step S6, values ​​for each time interval prepared in advance are given as inputs to the trained generators 121_1' to 121_D'.

[0079] Next, the second storage unit 15 stores the pseudo abnormal data generated in step S6 and the true abnormal data used in step S4 (step S7). In step S7, a database of known abnormal data is constructed. After that, the second acquisition unit 16 acquires time series data of communication volume for each time interval of the multiple user terminals 2 to be monitored from the UPF 3 (step S8). The time series data of communication volume for each time interval acquired in step S8 is a time series data set of communication volume acquired using the IMSI as a key.

[0080] Thereafter, when the time series data of the communication volume for each time interval of the user terminal 2 to be monitored matches the pseudo-anomalous data generated by the generation unit 14, the determination unit 17 determines that the user terminal 2 to be monitored is a user terminal 2 that abnormally uses the set bandwidth (step S9). In step S9, the determination unit 17 first identifies a corresponding time interval between the time series data set of the communication volume related to the anomalous data stored in the second storage unit 15 and the time series data set of the communication volume of the user terminal 2 to be monitored. Furthermore, the determination unit 17 determines a corresponding time interval between the time series data set of the communication volume for each time interval of the user terminal 2 to be monitored, and the pseudo-anomalous data generated by the generation unit 14. (l,1) Only when the values ​​of data point X1 and data point X2 are within a certain range, the squared term of the difference between the data points in equation (5) above is calculated, and a judgment process is performed using a threshold value.

[0081] In the determination process of step S9, for each user terminal 2 to be monitored identified by the IMSI, threshold processing is performed using the above formula (5) in order using the time series data sets of communication volume related to 1 to L pieces of abnormal data stored in the second storage unit 15. If a matching time series data set exists among 1 to L pieces, the user terminal 2 to be monitored is determined to be a terminal making abnormal use of bandwidth. On the other hand, if a matching time series data set does not exist, the user terminal 2 to be monitored is determined to not be making abnormal use of bandwidth.

[0082] Thereafter, the notification unit 18 notifies the UPF 3 of the determination result in step S9 via the network NW (step S10). In step S10, an instruction can be given to the UPF 3 to block communication of the IMSI of the user terminal 2 to be monitored that has been determined to be a terminal making abnormal use of bandwidth.

[0083] Thereafter, based on the notification of the IMSI from the communication monitoring device 1, the UPF 3 cuts off the communication of the notified IMSI (step S11).

[0084] Next, the second learning process (step S4) by the second learning unit 12 of the communication monitoring device 1 will be described with reference to Fig. 8. First, the second learning unit 12 acquires the learned parameters, i.e., the learned RNN, obtained in the first learning process by the first learning unit 11 in step S2 of Fig. 7 as true abnormal data related to the time-series data of the communication volume for each time interval of the user terminal 2, which indicates an abnormal bandwidth usage pattern (step S30).

[0085] 3, the true abnormal data collected in step S30 is used as training data 124 input when training the classifier 122. The training data related to the true abnormal data input to the classifier 122 is a time series sequence of the communication volume of the user terminal 2 for each time interval obtained by the trained RNN. Furthermore, a set of n time series sequences of communication volume can be used as the training data.

[0086] Next, the second learning unit 12 inputs the true abnormal data to the classifier 122 as training data 124, and adjusts the parameter w of the classifier 122 so that the true abnormal data is classified as true abnormal data (y=1). D ,θ D (Step S31). In Step S31, the second learning unit 12 can cause the classifier 122 to learn true abnormal data using, for example, an error backpropagation method. By Step S31, the classifier 122 that can distinguish true abnormal data from true abnormal data is constructed in advance.

[0087] Next, the second learning unit 12 provides the identification numbers of the time intervals as input to the generator 121 (step S32). More specifically, as shown in Fig. 3, the value t_1 of the earliest time interval along the time axis is input to the generator 121_1. Similarly, the values ​​t_2 to t_D of the time intervals are input to the generators 121_2 to 121_D, respectively.

[0088] Next, the generator 121 generates the input s and the weight parameter w based on the identification number of the given time interval. G ,θ G The generators 121_1 to 121_D perform a product-sum operation and threshold processing using an activation function to generate pseudo abnormal data G(s) (step S33). More specifically, the generators 121_1 to 121_D generate pseudo abnormal data G1(s) to GD(s), respectively.

[0089] Next, the second learning unit 12 learns the classifier 122. The learning of the classifier 122 is performed by using the parameter w D ,θ D First, the second learning unit 12 provides the training data 124 of the true abnormal data acquired in step S30 as input to the classifier 122, and calculates the parameter w by backpropagation or the like so that the objective function E of the above formula (4) is maximized. D ,θ D (Step S34). The label of the training data 124 is set to 1 (true abnormal data).

[0090] Next, the second learning unit 12 provides the pseudo abnormal data generated by the generator 121 in step S33 to the discriminator 122, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (4) is maximized. D ,θ D That is, in steps S34 and S35, in order to maximize the objective function E in the above equation (4), the first term is updated as D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D )=0. Note that the label 0 (pseudo abnormal data) is set for the training data 124. In step S35, the pseudo abnormal data G1(s) to GD(s) generated by the generators 121_1 to 121_D corresponding to each time interval are provided to the classifier 122.

[0091] The training of the classifier 122 in steps S34 and S35 corresponds to the dashed arrows in FIG. 3, which indicate that a classifier error is calculated in block 125 of the objective function E based on the output 123 from the classifier 122, and then the error is backpropagated to the classifier 122.

[0092] Next, the second learning unit 12 performs learning of the generator 121. The learning of the generator 121 is performed with the parameters of the discriminator 122 fixed. The second learning unit 12 trains the generator 121 so that pseudo abnormal data is generated when the identification number of each time interval is given to the generator 121. Specifically, the second learning unit 12 learns the parameters w G ,θ G is updated (step S36).

[0093] The learning in step S36 corresponds to the dashed arrows shown in Fig. 3, which indicate backpropagation of errors to the generators 121. That is, step S36 corresponds to the dashed arrows in which the pseudo abnormal data G1(s) to GD(s) generated by each of the generators 121_1 to 121_D in Fig. 3 are input to the discriminator 122, a generator error is calculated from the output 123 in a block 125 of the objective function E, and the error is further backpropagated to the generators 121_1 to 121_D. In this way, in step S36, the generators 121_1 to 121_D provided corresponding to each time interval are trained separately.

[0094] Thereafter, learning of the discriminator 122 and the generator 121 (generators 121_1 to 121_D) from step S33 to step S36 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S37: NO). On the other hand, if the value of the objective function E has converged (step S37: YES), the processing from step S31 to step S37 is repeated for n sets of true abnormal data until learning of the generator 121 (generators 121_1 to 121_D) and the discriminator 122 is performed (step S38: NO).

[0095] Thereafter, when the generator 121 (generators 121_1 to 121_D) and the classifier 122 are trained using training data for the time interval t_1 to t_D of all n pieces of true abnormal data (step S38: YES), the second learning unit 12 stores the trained generator 121′ (trained generators 121_1′ to 121_D′) in the first storage unit 13 (step S5). The trained generator 121′ (trained generators 121_1′ to 121_D′) is constructed by the processes from step S30 to step S38.

[0096] As described above, the communication monitoring device 1 according to this embodiment trains an RNN using a preset traffic fluctuation pattern associated with an abnormal bandwidth usage pattern as training data. Then, using the trained RNN as true abnormal data, a trained generator 121' is constructed by adversarial learning of the GAN, and a large amount of pseudo-anomalous data similar to the traffic fluctuation pattern associated with the abnormal bandwidth usage is generated using the trained generator 121'. Furthermore, the pseudo-anomalous data is stored in the second storage unit 15, and a database of abnormal data is constructed. This enables more reliable monitoring of abnormal network bandwidth usage. As a result, it becomes possible to prevent burst traffic and network congestion caused by abnormal bandwidth usage. Furthermore, it is possible to prevent malicious and intentional increases in traffic, such as DoS and DDoS, and burst traffic.

[0097] Furthermore, according to the communication monitoring device 1 of this embodiment, true abnormal data is stored in addition to pseudo abnormal data in the second storage unit 15. Therefore, it is possible to build a database that includes a wider variety of abnormal usage patterns of network bandwidth in the known abnormal data.

[0098] Furthermore, according to the communication monitoring device 1 of this embodiment, latent parameters such as the hidden state of the RNN at each time, memory cell values, and weight parameters between units are learned through GAN learning, making it possible to generate a variety of abnormal data with a simpler configuration.

[0099] Furthermore, according to the communication monitoring device 1 of this embodiment, the determination unit 1 performs the determination process using the above formula (5), and therefore can identify user terminals 2 that are making abnormal use of bandwidth based on a match of some data points included in the time-series data set, thereby further reducing the calculation load.

[0100] Furthermore, according to the communication monitoring device 1 of this embodiment, data on pre-set patterns of fluctuations in communication volume related to abnormal bandwidth usage is set as training data for the RNN, making it possible to generate known abnormal data that can identify abnormal usage patterns that are difficult to extract from past network traffic history, or abnormal usage patterns that have not existed in the past.

[0101] In the embodiment described above, the first learning unit 11 learns an RNN, but the first learning unit 11 can also perform learning using an LSTM (Long short-term memory).

[0102] Furthermore, in the embodiment described above, a communication monitoring system compatible with a 5G mobile communication network has been described, but the communication network may be LTE / 4G or 6G, etc. Furthermore, the communication network may be a fixed communication network such as Wi-Fi or Ethernet. When the user terminal 2 is a fixed line terminal, time-series data of communication volume is acquired using the IP address as a key. Furthermore, the notification unit 18 can notify the ISP network of the IP address of the user terminal 2 that is abnormally using the bandwidth.

[0103] The above describes embodiments of the communication monitoring device and communication monitoring method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can make within the scope of the invention described in the claims are possible. [Explanation of symbols]

[0104] 1...communication monitoring device, 2...user terminal, 10...first acquisition unit, 11...first learning unit, 12...second learning unit, 13...first memory unit, 14...generation unit, 15...second memory unit, 16...second acquisition unit, 17...determination unit, 18...notification unit, 101...bus, 102...processor, 103...main memory unit, 104...communication interface, 105...auxiliary memory unit, 106...input / output I / O, 107...display device, 121, 121_1 to 121_D...generator, 121', 121_1' to 121_D'...trained generator, 122...discriminator, 123...output, 124...training data, 125...block of objective function E, NW...network.

Claims

1. a first learning unit configured to learn a recurrent neural network that outputs the communication volume of a user terminal for each time interval when the time intervals are sequentially input, using time series data of the communication volume of the user terminal for each time interval as training data; a second learning unit configured to perform adversarial learning of a generative model using the trained recurrent neural network constructed by the training by the first learning unit, the generative model including a generator that generates pseudo-anomalous data similar to true anomalous data as true anomalous data for time series data of communication volume for each time interval of a user terminal that abnormally uses the network bandwidth, and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data; a generation unit configured to generate the pseudo abnormal data using a trained generator obtained by adversarial training of the second learning unit; a determination unit configured to determine that the user terminal to be monitored is a user terminal making the abnormal use of the network bandwidth when time series data of the communication volume for each time interval of the user terminal to be monitored matches the pseudo-abnormal data generated by the generation unit; a notification unit configured to notify a determination result by the determination unit; A communication monitoring device comprising:

2. 2. The communication monitoring device according to claim 1, The network management system further includes a first acquisition unit configured to acquire time series data of communication volume for each time interval of the user terminal that abnormally uses the network bandwidth, the time series data being used as the teacher data, and The abnormal use of the network bandwidth includes use exceeding the upper limit of the network bandwidth available to the user terminal. A communication monitoring device characterized by:

3. 2. The communication monitoring device according to claim 1, Furthermore, the determination unit determines that the user terminal to be monitored is a user terminal making the abnormal use of the network bandwidth when time series data of the communication volume for each time interval of the user terminal to be monitored matches the true abnormal data. A communication monitoring device characterized by:

4. 2. The communication monitoring device according to claim 1, Further, a second acquisition unit configured to acquire time series data of the communication volume for each time interval of the user terminal to be monitored from a core network. A communication monitoring device characterized by:

5. 2. The communication monitoring device according to claim 1, The pseudo-abnormal data has a data distribution that has a minimum statistical distance from the data distribution of the true abnormal data. A communication monitoring device characterized by:

6. a first learning step of learning a recurrent neural network that outputs the communication volume of a user terminal for each time interval when the time intervals are sequentially input, using time series data of the communication volume of the user terminal for each time interval as training data; a second learning step of performing adversarial learning of a generative model using the trained recurrent neural network constructed by the learning in the first learning step, the generative model having a generator that generates pseudo-anomalous data similar to true anomalous data as true anomalous data for time series data of communication volume for each time interval of the user terminal that abnormally uses the network bandwidth, and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data; a generation step of generating the pseudo abnormal data using a trained generator obtained by adversarial training in the second training step; a determining step of determining that the user terminal to be monitored is a user terminal making the abnormal use of the network bandwidth when time series data of the communication volume for each time interval of the user terminal to be monitored matches the pseudo-abnormal data generated in the generating step; a notification step of notifying the determination result in the determination step; A communication monitoring method comprising:

7. 7. The communication monitoring method according to claim 6, further comprising a first acquisition step of acquiring time series data of communication volume for each time interval of the user terminal making the abnormal use of the network bandwidth, which is used as the teacher data; The abnormal use of the network bandwidth includes use exceeding the upper limit of the network bandwidth available to the user terminal. A communication monitoring method comprising:

8. 7. The communication monitoring method according to claim 6, Furthermore, in the determination step, when time series data of the communication volume for each time interval of the user terminal to be monitored matches the true abnormal data, the user terminal to be monitored is determined to be a user terminal making the abnormal use of the network bandwidth. A communication monitoring method comprising:

9. 7. The communication monitoring method according to claim 6, Further, a second acquisition step of acquiring time series data of the communication volume of the user terminal to be monitored for each time interval from a core network is provided. A communication monitoring method comprising:

Images