Estimation device, estimation method, and estimation program

Abstract

An extraction unit (15b) extracts a fixed-length feature value from a communication data payload. A calculation unit (15e) calculates the degree of similarity between the feature values of abnormal communication data. When the calculated degree of similarity is greater than a predetermined threshold, a determination unit (15f) determines that 《RA2》these communications《 / RA2》 are the same type of events.

Description

[Technical field]

[0001] The present invention relates to an estimation device, an estimation method, and an estimation program. [Background technology]

[0002] In recent years, with the spread of cyber-physical systems (CPS), the importance of detecting anomalies in CPS has increased. CPS protocols are diverse, and it is costly and difficult to set up anomaly detection rules for each one, so a method of learning detection rules using machine learning is useful. In particular, attacks on CPS are still in their infancy, and new attacks are expected to appear one after another in the future, so anomaly-based anomaly detection using unsupervised learning that can respond to unknown anomalies is important.

[0003] Furthermore, since it is difficult to directly incorporate detectors into CPSs, an anomaly detection system using communication data is envisioned.Unlike anomaly detection for failure countermeasures, in cybersecurity it is important to estimate attack trends because they also affect countermeasures.

[0004] When detecting anomalies using CPS communication data, alerts that indicate events determined to be anomalous are searched for to identify what type of attack is occurring on the entire system. A naive method for counting alerts of the same type as a certain alert is to count alerts that have the same discrete quantities as the protocol, IP, port, etc. However, since trends in CPS attacks are thought to appear in the payload, it is desirable to count payload matches (see Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] “Modbus Protocol Overview”, [online], M-Systems Engineering Co., Ltd., [Retrieved April 26, 2021], Internet<URL: https: / / www.m-system.co.jp / mssjapanese / kaisetsu / nmmodbus.pdf> Summary of the Invention [Problem to be solved by the invention]

[0006] However, it has been difficult to search for similar alerts by matching payloads from among a large number of alerts. For example, payloads contain places where sequential numbers increment meaninglessly, making it difficult to search for an exact match.

[0007] The present invention has been made in consideration of the above, and has an object to make it possible to search for similar alerts by matching payloads from among a large number of alerts. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems and achieve the object, the estimation device of the present invention is characterized by having an extraction unit that extracts fixed-length features from a payload of communication data, a calculation unit that calculates a similarity between the features of each piece of anomalous communication data, and a determination unit that determines that the events are of the same type when the calculated similarity is greater than a predetermined threshold value. Effect of the Invention

[0009] According to the present invention, it is possible to search for similar alerts from among a large number of alerts by matching payloads. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic diagram illustrating a schematic configuration of an estimation device. [Diagram 2] FIG. 2 is a flowchart showing a procedure of the detection process. [Diagram 3] FIG. 3 is a flowchart showing the procedure of the search process. [Figure 4] FIG. 4 is a diagram for explaining an embodiment. [Diagram 5] FIG. 5 is a diagram illustrating a computer that executes the estimation program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are indicated by the same reference numerals.

[0012] [Configuration of the estimation device] Fig. 1 is a schematic diagram illustrating a schematic configuration of an estimation device. As illustrated in Fig. 1, an estimation device 10 is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0013] The input unit 11 is realized by input devices such as a keyboard and a mouse, and inputs various instruction information such as a command to start processing to the control unit 15 in response to an input operation by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, or the like.

[0014] The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between an external device such as a server via a network and the control unit 15. For example, the communication control unit 13 controls communication between the control unit 15 and a management device or the like that manages communication data that is the target of an estimation process described later.

[0015] The storage unit 14 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk, and stores parameters of the model 14a learned by a learning unit 15c (described later). The storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

[0016] The control unit 15 is realized by using a CPU (Central Processing Unit) or the like, and executes a processing program stored in a memory. As a result, the control unit 15 functions as an acquisition unit 15a, an extraction unit 15b, a learning unit 15c, a detection unit 15d, a calculation unit 15e, and a determination unit 15f, as exemplified in FIG. 1. Note that each or some of these functional units may be implemented in different hardware. For example, the learning unit 15c may be implemented in a device different from the other functional units. Alternatively, the learning unit 15c and the detection unit 15d may be implemented in a device different from the other functional units. The control unit 15 may also include other functional units.

[0017] The acquisition unit 15a acquires communication data. For example, the acquisition unit 15a acquires communication data used in an estimation process described later via the input unit 11 or the communication control unit 13. The acquisition unit 15a may store the acquired communication data in the storage unit 14. The acquisition unit 15a may transfer the information to the extraction unit 15b without storing it in the storage unit 14.

[0018] The extraction unit 15b extracts fixed-length features from the payload of the communication data. Specifically, the extraction unit 15b converts the payload into a fixed-length feature vector by BERT (Bidirectional Encoder Representations from Transformers) to extract the fixed-length features.

[0019] Generally, in BERT, variable-length sequence data in a natural language is converted into a fixed-length feature vector z as shown in the following equation (1).

[0020]

number

[0021] The input data x is a tensor consisting of a data index n, a time index t, and a word index d, where in natural language, the data index n is the number of sentences, the time index t is the number of characters, and the word index d is the type of word. Also, in the above formula (1), h is the index of the feature vector.

[0022] On the other hand, if the input data is the payload of network traffic, the data index n can be the number of packets, the time index t can be the length of the payload, and the word index d can be 256 types of bytes expressed as two-digit hexadecimal numbers.

[0023] That is, the extraction unit 15b extracts the payload of the packet, performs preprocessing by converting every 8 bits into a 2-digit hexadecimal character, and then converts it into a fixed-length feature vector by BERT.

[0024] The learning unit 15c learns the model 14a that judges whether the communication data is normal or abnormal, using fixed-length features extracted from the payload of the communication data. For example, the learning unit 15c generates the model 14a by VAE that judges whether an input packet is normal or abnormal, by anomaly-based unsupervised learning.

[0025] The detection unit 15d detects abnormal communication data by the model 14a that judges whether the communication data is normal or abnormal using fixed-length features extracted from the payload of the communication data. That is, the detection unit 15d detects abnormal communication data using the trained model 14a. For example, the detection unit 15d transfers a packet that is determined to be abnormal using the trained VAE model 14a to the calculation unit 15e described below via the extraction unit 15b.

[0026] The calculation unit 15e calculates the similarity between the feature quantities of each abnormal communication data. For example, the calculation unit 15e calculates the distance between the converted feature vectors of each abnormal communication data as the similarity between the feature vectors. Here, the cosine similarity between the feature vectors corresponds to the distance between the feature vectors, and the higher the cosine similarity, the smaller the distance.

[0027] Furthermore, in order to calculate the similarity between events of packets determined to be abnormal, the calculation unit 15e calculates the similarity between packets, not between bytes. Therefore, the calculation unit 15e first calculates the average so that the payload index remains, as shown in the following formula (2).

[0028]

number

[0029] Furthermore, the calculation unit 15e measures the similarity between packets using the cosine distance shown in the following formula (3) or the L2 norm shown in the following formula (4) for two feature vectors of two packets.

[0030]

number

number

[0031] When the calculated similarity is greater than a predetermined threshold, the determination unit 15f determines that the events are of the same type. For example, when the distance between the feature vectors is less than a predetermined threshold ε, the determination unit 15f determines that the events are of the same type.

[0032] In this way, by using the similarity of the latent variable space, the estimation device 10 can search for similar alerts from a large number of alerts by matching payloads, regardless of the presence of parts in the payload where the serial numbers increase meaninglessly, etc. Therefore, even when traces of an attack appear in the payload, such as in CPS, it is possible to detect attack trends from a large number of alerts.

[0033] [Estimation process] Next, the estimation process by the estimation device 10 according to this embodiment will be described with reference to Fig. 2 and Fig. 3. The estimation process of this embodiment includes a detection process and a search process. First, Fig. 2 is a flowchart showing the procedure of the detection process. The flowchart in Fig. 2 is started, for example, when an operation input is made to instruct the start of the detection process.

[0034] First, the acquisition unit 15a acquires communication data (step S1).

[0035] Next, the extraction unit 15b extracts the payload of the acquired communication data packet (step S2). The extraction unit 15b also extracts fixed-length features from the payload (step S3). For example, the extraction unit 15b extracts the payload of the packet, performs preprocessing to convert every 8 bits into a 2-digit hexadecimal character, and then converts it into a fixed-length feature vector by BERT.

[0036] Then, the detection unit 15d detects abnormal communication data using the trained model 14a (step S4). For example, the detection unit 15d detects abnormal communication data using the trained VAE model 14a. This completes a series of detection processes.

[0037] Next, a search process procedure will be described with reference to the flowchart of Fig. 3. The flowchart of Fig. 3 starts, for example, when an operational input is made to instruct the start of the search process.

[0038] First, the extraction unit 15b acquires communication data detected as abnormal by the detection unit 15d (step S10). The extraction unit 15b may acquire the communication data detected as abnormal via the input unit 11 or the communication control unit 13.

[0039] Moreover, the extraction unit 15b acquires abnormal communication data to be searched for via the input unit 11 or the communication control unit 13 (step S11).

[0040] Next, the extraction unit 15b extracts the payload of each packet of the acquired abnormal communication data (step S2). The extraction unit 15b also extracts fixed-length features from each payload (step S3). For example, the extraction unit 15b extracts the payload from each packet, performs preprocessing to convert every 8 bits into a 2-digit hexadecimal character, and then converts it into a fixed-length feature vector by BERT.

[0041] Next, the calculation unit 15e calculates the similarity between the feature amounts of the payloads of the abnormal communication data (step S14). For example, the calculation unit 15e calculates the distance between the converted feature vectors of the abnormal communication data as the similarity between the converted feature vectors.

[0042] Then, the determination unit 15f determines that the events are abnormal events of the same type when the calculated similarity is greater than a predetermined threshold (step S15). For example, the determination unit 15f determines that the events are abnormal events of the same type when the distance between the feature vectors is less than a predetermined threshold. This ends a series of search processes.

[0043] [effect] As described above, the extraction unit 15b extracts fixed-length features from the payload of communication data. The calculation unit 15e calculates the similarity between the features of each abnormal communication data. The determination unit 15f determines that the events are of the same type when the calculated similarity is greater than a predetermined threshold value.

[0044] Specifically, the extraction unit 15b extracts fixed-length features by converting the payload into a fixed-length feature vector using BERT, the calculation unit 15e calculates the distance between the converted feature vectors of each abnormal communication data as the similarity between the feature vectors, and the determination unit 15f determines that the events are of the same type when the distance between the feature vectors is less than a predetermined threshold value.

[0045] In this way, by using the similarity of the latent variable space, the estimation device 10 can search for similar alerts from a large number of alerts by matching payloads, regardless of the presence of parts in the payload where the serial numbers increase meaninglessly, etc. Therefore, even when traces of an attack appear in the payload, such as in CPS, it is possible to detect attack trends from a large number of alerts.

[0046] In addition, the detection unit 15d detects abnormal communication data by the model 14a that judges whether the communication data is normal or abnormal using fixed-length features extracted from the payload of the communication data. This makes it easy for the estimation device 10 to detect attack trends from a large number of alerts.

[0047] Furthermore, the learning unit 15c learns the model 14a using fixed-length features extracted from the payload of the communication data, which makes it possible to detect new unknown attacks that appear one after another.

[0048] [Example] Fig. 4 is a diagram for explaining an example. In this example, for two abnormal packets, abnormal packet 1 and abnormal packet 2, shown below, the similarity between the feature amounts was calculated as shown in Fig. 4 by the estimation process of the above embodiment.

[0049] Abnormal packet 1: "2e c1 00 00 00 05 01 04 02 00 7f"

[0050] Abnormal packet 2: "e6 e7 00 00 00 05 01 04 02 00 00"

[0051] The "2e c1" at the beginning of abnormal packet 1 and the "e6 e7" at the beginning of abnormal packet 2 are sequential numbers. The "7f" at the end of abnormal packet 1 and the "00" at the end of abnormal packet 2 are essentially the parts that distinguish the abnormalities. Figure 4 illustrates the cos similarity between feature vectors by BERT for each byte of each packet.

[0052] Looking at the diagonal components in Figure 4, the similarities corresponding to the first two consecutive numbers are 0.928 and 0.924. In contrast, the similarity corresponding to the part that distinguishes anomalies is 0.827, meaning that the similarity of the consecutive numbers is higher. In this way, it was confirmed that the consecutive numbers can be relatively ignored in the feature vector generated by BERT.

[0053] [program] A program in which the process executed by the estimation device 10 according to the above embodiment is written in a language executable by a computer can also be created. As an embodiment, the estimation device 10 can be implemented by installing an estimation program that executes the above estimation process as package software or online software on a desired computer. For example, the information processing device can function as the estimation device 10 by executing the above estimation program on the information processing device. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and further slate terminals such as PDA (Personal Digital Assistant). The function of the estimation device 10 may be implemented on a cloud server.

[0054] 5 is a diagram showing an example of a computer that executes an estimation program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0055] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0056] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiments is stored in the hard disk drive 1031 or memory 1010, for example.

[0057] The estimation program is stored in the hard disk drive 1031 as, for example, a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the hard disk drive 1031 stores the program module 1093 in which each process executed by the estimation device 10 described in the above embodiment is written.

[0058] Data used for information processing by the estimation program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-mentioned procedures.

[0059] The program module 1093 and program data 1094 related to the estimation program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the estimation program may be stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and may be read by the CPU 1020 via the network interface 1070.

[0060] Although the embodiment to which the invention made by the present inventor is applied has been described above, the present invention is not limited by the description and drawings which form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0061] 10 Estimation device 11 Input section 12 Output section 13 Communication control section 14 Storage section 14a model 15 Control section 15a Acquisition part 15b Extraction part 15c Learning Section 15d Detection unit 15e Calculation section 15f Judgment section

Claims

1. an extraction unit that extracts fixed-length features from a payload of communication data; A calculation unit that calculates a similarity between the feature amounts of each abnormal communication data; a determination unit that determines that the events are of the same type when the calculated similarity is greater than a predetermined threshold value; having The extraction unit extracts fixed-length features by converting the payload into a fixed-length feature vector using Bidirectional Encoder Representations from Transformers (BERT); The calculation unit calculates a distance between the converted feature vectors of each of the abnormal communication data as a similarity between the converted feature vectors, The determination unit determines that the events are of the same type when the distance between the feature vectors is less than a predetermined threshold value. An estimation device comprising:

2. The estimation device according to claim 1, further comprising a detection unit that detects abnormal communication data using a model that determines whether the communication data is normal or abnormal, using fixed-length features extracted from the payload of the communication data.

3. 3. The estimation device according to claim 2, further comprising a learning unit that learns the model using fixed-length features extracted from a payload of communication data.

4. An estimation method executed by an estimation device, An extraction step of extracting fixed-length features from a payload of communication data; A calculation step of calculating a similarity between the feature amounts of each abnormal communication data; a determining step of determining that the events are of the same type when the calculated similarity is greater than a predetermined threshold value; Including, the extracting step extracts fixed-length features by converting the payload into a fixed-length feature vector using Bidirectional Encoder Representations from Transformers (BERT); the calculating step calculates a distance between the converted feature vectors of each of the abnormal communication data as a similarity between the converted feature vectors; The determining step determines that the events are of the same type when the distance between the feature vectors is less than a predetermined threshold value. The estimation method according to claim 1,

5. An extraction step of extracting fixed-length features from a payload of communication data; A calculation step of calculating a similarity between the feature amounts of each abnormal communication data; a determining step of determining that the events are of the same type when the calculated similarity is greater than a predetermined threshold value; Run the following on your computer: the extracting step extracts fixed-length features by converting the payload into a fixed-length feature vector using Bidirectional Encoder Representations from Transformers (BERT); the calculating step calculates a distance between the converted feature vectors of each of the abnormal communication data as a similarity between the converted feature vectors; In the determining step, when a distance between the feature vectors is less than a predetermined threshold, the events are determined to be of the same type. The present invention relates to an estimation program.

Images