DETECTION APPARATUS, DETECTION METHOD, AND DETECTION PROGRAM

Abstract

A detection device (10) includes: a feature value DB (16) that stores, in advance, feature values of packets, labels assigned to the feature values of the packets, and a threshold used for determination; an encoding unit (12) that converts a target packet into a feature value by using a first natural language processing model that has been trained beforehand using normal communication packets as training data; and a determination unit (14) that assigns a label to the feature value, which is obtained by the conversion using the first natural language processing model, on the basis of the feature value obtained by the conversion using the first natural language processing model and data stored in the feature value DB (16) and determines whether the target packet is anomalous on the basis of the assigned label.

Description

[Technical field]

[0001] The present invention relates to a detection device, a detection method, and a detection program. [Background technology]

[0002] Technologies for detecting unauthorized packets from traffic within a network include signature-based detection technology and anomaly-based detection technology.

[0003] Signature-based detection technology generates a signature specific to an attack from attack data in advance, and detects the attack by matching the communication with the signature. Signature-based detection technology is good at detecting known attacks, but it has difficulty dealing with attack variants, obfuscation, and unknown attacks. In addition, signature-based detection technology requires the collection of a huge amount of real attack data to generate signatures.

[0004] Anomaly-based detection technology learns normal conditions from traffic within a system and detects deviations from the normal state as abnormalities. Compared to signature-based detection technology, anomaly-based detection technology requires learning normal communication data, but it can detect even unknown attacks, and there is no need to collect attack data in advance. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2020-102671 A [Non-patent literature]

[0006] [Non-Patent Document 1] Diederik P. Kingma, Max Welling, “Auto-Encoding Variational Bayes”, ICLR 2014., [online], [Retrieved May 14, 2021], Internet<URL:https: / / arxiv.org / pdf / 1312.6114.pdf> Summary of the Invention [Problem to be solved by the invention]

[0007] However, anomaly detection technology using machine learning requires time for learning, and therefore it is necessary to keep the technology vulnerable to attacks during the learning period, or to mistakenly recognize attack packets as normal packets during learning if attack packets are mixed in.

[0008] Although it is possible to use signature-based detection technology in combination, various attack information must be collected in advance to generate the signatures. Therefore, it is desirable for anomaly-based detection technology to have a learning model that can detect attacks immediately, reducing the gap in monitoring without reducing system availability.

[0009] The present invention has been made in consideration of the above, and aims to provide a detection device, a detection method, and a detection program that can reduce monitoring gaps while maintaining system availability. [Means for solving the problem]

[0010] In order to solve the above-mentioned problems and achieve the object, the detection device of the present invention is characterized by having a memory unit that pre-stores packet features, labels assigned to the features of each packet, and a threshold value used for judgment, a conversion unit that converts a packet to be processed into a feature using a first natural language processing model that has been pre-trained using normal communication packets as learning data, and a judgment unit that assigns a label to the feature converted using the first natural language processing model based on the feature converted using the first natural language processing model and the data stored in the memory unit, and judges whether or not the packet to be processed has an abnormality based on the assigned label. Effect of the Invention

[0011] According to the present invention, it is possible to reduce the gap in monitoring without reducing the availability of the system. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a detection device according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating the detection process by the VAE. [Diagram 3] FIG. 3 is a diagram illustrating an anomaly determination process using the BERT model. [Figure 4] FIG. 4 is a diagram illustrating an anomaly determination process using the BERT model. [Diagram 5] FIG. 5 is a diagram illustrating an anomaly determination process using the BERT model. [Figure 6] FIG. 6 is a diagram illustrating an anomaly determination process using the BERT model. [Figure 7] FIG. 7 is a diagram illustrating an anomaly determination process using the BERT model. [Figure 8] FIG. 8 is a flowchart showing a procedure of an anomaly determination process using the BERT model. [Figure 9] FIG. 9 is a flowchart showing a procedure of a determination process using a plurality of BERT models. [Figure 10] FIG. 10 is a diagram illustrating an example of a computer that realizes the detection device by executing a program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are indicated by the same reference numerals.

[0014] [Embodiment Mode] An embodiment of the present invention will be described. In this embodiment, a new determination method is used during the learning period of the anomaly-based detection model to determine whether or not a packet has an abnormality by comparing a feature amount converted from a packet using a pre-trained natural language processing model with a feature amount of a past packet. This determination method does not require learning, and since the detection processing time depends only on the amount of data of the feature amount of the past packet to be compared, attacks can be detected immediately. Therefore, in this embodiment, by using this determination method during the learning period of the anomaly-based detection model, it is possible to reduce the blank period of monitoring while maintaining the availability of the system.

[0015] [Detection device configuration] Next, the configuration and processing of a detection device according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of a detection device according to an embodiment.

[0016] The detection device 10 according to the embodiment is realized, for example, by loading a predetermined program into a computer including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. As shown in FIG. 2, the detection device 10 includes a collection unit 11, an encoding unit 12 (conversion unit), a detection unit 13, a determination unit 14, a process control unit 15, and a feature database (DB) 16.

[0017] The collection unit 151 collects packets to be processed.

[0018] The encoding unit 152 converts the processing target packet into one fixed-length vector, which is a feature, using a natural language processing model (for example, a Bidirectional Encoder Representations from Transformers (BERT) model). The BERT model has been trained in advance using packets of normal communication as training data.

[0019] The BERT model is a model that has learned the rules for treating one packet as one sentence and converting it into a fixed-length vector; in other words, it is a model that has learned frequent patterns such as the order of internal byte sequences in packets of normal communication.

[0020] For example, the BERT model learns a good intermediate representation, i.e., a fixed-length vector, that reflects the characteristics of a packet by solving an auxiliary task of predicting a word in a document from surrounding words. The BERT model also predicts a byte at a certain position in a packet from surrounding bytes to obtain a vector representation that reflects the characteristics of the packet. The encoding unit 152 uses the BERT model to convert each packet into a fixed-length vector that reflects the characteristics of each packet.

[0021] The encoding unit 152 holds one BERT model (first natural language processing model), and may also use a new BERT model (second natural language processing model) when processing packets of a protocol that is not supported by this BERT model, as described below.

[0022] The detection unit 13 detects attacks by using a detection model to detect the presence or absence of anomalies in packets based on the fixed-length vectors converted by the encoding unit 152. The detection device 10 learns patterns of fixed-length vectors of packets that have been determined to be normal communications by a determination unit 14 (described later).

[0023] The detection unit 153 uses a detection model based on unsupervised learning, such as a variational auto encoder (VAE), an auto encoder (AE), or a local outlier factor (LoF), as a detection model. Hereinafter, an example will be described in which the VAE is used as the detection model.

[0024] For example, in VAE, after learning the probability density of normal communication packets, it detects communications with low probability density as abnormal, so it is only necessary to know normal communication packets, and anomalies can be detected without learning all malicious data. VAE learns the degree of anomaly using fixed-length vectors corresponding to normal communication packets as learning data.

[0025] The detection unit 13 holds one VAE (first detection model). In addition, when the encoding unit 12 uses a new BERT model to process a packet of an unsupported protocol, the detection unit 13 may use a new VAE (second detection model) to process a fixed-length vector converted by the new BERT model.

[0026] The feature DB 16 stores in advance the feature of a packet, a label assigned to the feature of each packet, and a threshold value used for judgment. The feature is a fixed-length vector of a packet converted by the BERT model.

[0027] The labels include normal labels, abnormal labels, and pre-learned labels. The normal label is a label indicating that the fixed-length vector is a converted packet of normal communication. The abnormal label is a label indicating that the fixed-length vector is a converted packet of abnormal communication. The pre-learned label is a label indicating that the fixed-length vector is a converted packet of normal communication used in pre-learning. The feature DB 16 stores the pre-learned labels in association with all or representative fixed-length vectors used in pre-learning. The threshold value is used in the judgment unit 14 to judge the similarity between the fixed-length vector of the packet to be processed and the fixed-length vectors stored in the feature DB 16.

[0028] The judgment unit 14 assigns a label to the feature converted using the BERT model based on the fixed-length vector converted using the BERT model of the encoding unit 12 and the data stored in the feature DB 16, and judges whether or not there is an abnormality in the packet to be processed based on the assigned label.

[0029] The determination unit 14 searches the feature DB 16 for fixed-length vectors having a similarity equal to or greater than a threshold value for the fixed-length vector converted using the BERT model. The determination unit 14 then assigns the label assigned to the searched fixed-length vector to the fixed-length vector converted using the BERT model. The determination unit 14 outputs the fixed-length vectors to which the normal label has been assigned, among the fixed-length vectors converted using the BERT model, as learning data for the VAE of the detection unit 13.

[0030] The judgment unit 14 judges whether or not the fixed-length vector can be appropriately converted in the BERT model based on the similarity between the fixed-length vector to which the pre-learned label has been assigned and the fixed-length vector of the packet to be processed that has been converted using the BERT model of the encoding unit 12.

[0031] If the judgment unit 14 judges that the features have not been properly converted in the BERT model, the processing control unit 15 sets up a new BERT model in the encoding unit 12 and has this new BERT model learn how to convert the packet to be processed into a fixed-length vector.

[0032] [VAE processing] First, a description will be given of the learning process and detection process of the VAE in the detection unit 13. Fig. 2 is a diagram for explaining the detection process by the VAE.

[0033] As shown in FIG. 2, the collection unit 11 acquires a plurality of variable-length packets as packets to be learned or evaluated ((1) in FIG. 2).

[0034] The encoding unit 12 uses a BERT model that has learned frequent patterns such as the order of byte sequences in each packet to convert each packet into a fixed-length vector that reflects the characteristics of each packet (Figure 2 (2) and (3)).

[0035] The detection unit 13 uses the VAE to obtain the degree of anomaly (frequency of occurrence of abnormal packets) for the fixed-length vector converted by the encoding unit 12. In the learning stage, the VAE learns the degree of anomaly (e.g., anomaly score) based on the fixed-length vector corresponding to packets of normal communication ((4) in FIG. 2). In this case, the parameters of the detection model of the VAE are adjusted so that the degree of anomaly obtained by the VAE is minimized.

[0036] In the evaluation stage, the detection unit 13 uses the VAE to obtain an anomaly level (e.g., an anomaly score) for the fixed-length vector converted by the encoding unit 12 ((5) in FIG. 2). Then, when the anomaly score exceeds a predetermined threshold, the detection unit 13 detects an anomaly in the packet to be evaluated and issues an alert. The threshold is set, for example, according to the required detection accuracy, the resources of the detection device 10, etc.

[0037] [Anomaly detection processing using the BERT model] Next, an abnormality determination process using the BERT model will be described. Figures 3 to 5 are diagrams for explaining the abnormality determination process using the BERT model.

[0038] The VAE of the detection unit 13 needs to learn in order to calculate the degree of anomaly in the production environment in order to analyze the contents of communication ((1) in FIG. 3 and (B) in FIG. 4). However, since the VAE takes time to learn, there is a risk that the VAE may be attacked during the learning period, or that the VAE may mistakenly recognize an attack packet as a normal state during learning.

[0039] In a properly tuned detection device, the BERT model in the encoding unit 12 analyzes the protocol structure of the packet ((2) in FIG. 3), and the VAE in the detection unit 13 analyzes the communication parameters in the environment. This BERT model can be created in advance by learning frequent patterns such as the order of byte sequences inside packets of normal communication.

[0040] Here, by using the fixed-length vector output by encoding the BERT model, it is possible to compare the proximity of packets to each other. Based on this, it is possible to determine whether the packet to be processed is normal or abnormal by determining whether the fixed-length vector of the packet to be processed, which is converted by the BERT model, is similar to the fixed-length vector of the packet of normal communication or abnormal communication previously obtained. Therefore, in this embodiment, the abnormal packet determination process using the BERT model is used for attack detection until the learning of the VAE is completed ((3) in FIG. 3).

[0041] Specifically, as the abnormal packet determination process, the determination unit 14 determines whether or not the packet to be processed is abnormal by using the similarity between the fixed-length vector of the packet to be processed converted by the BERT model and the fixed-length vector of a packet of normal communication or abnormal communication obtained in advance ((A) of FIG. 4). For example, the determination unit 14 uses cos similarity or L2 norm as the similarity.

[0042] In detection processing using VAE, the detection processing time is constant, but if a certain amount of data is not collected before training, it may lead to false positives, and overdetection correction requires retraining the entire model.

[0043] In contrast, in anomaly detection processing using the BERT model, although the detection processing time depends on the amount of data, it is possible to determine whether a packet is abnormal or not by simply comparing it with past packets, so no learning is required. Also, in anomaly detection processing using the BERT model, overdetection correction requires only labeling past packets, and it can be used for various purposes other than detection by ingenuity in labeling and data usage.

[0044] Next, application of an anomaly determination process using a BERT model will be described with reference to Fig. 5. As shown in Fig. 5, the feature DB 16 stores the feature (fixed-length vector) of a packet of normal communication used in pre-learning of the BERT model, the feature of a packet of normal communication used in actual learning, the feature of a packet of abnormal communication, a label associated with each packet, and a threshold value used for determination (arrow Y1).

[0045] While the VAE of the detection unit 13 is being trained, the judgment unit 14 labels the input packet using the fixed-length vector converted from the packet by the pre-trained BERT model of the encoding unit 12 (arrow Y2) and the data stored in the feature DB 16 (arrow Y3).

[0046] Specifically, the determination unit 14 calculates the similarity between the fixed-length vector converted using the BERT model and the fixed-length vector in the feature DB 16 ((1) in FIG. 5). The determination unit 14 extracts fixed-length vectors having a similarity equal to or greater than a threshold from the feature DB 16. Then, the determination unit 14 assigns the label assigned to the extracted fixed-length vector to the fixed-length vector of the packet to be processed. The determination unit 14 determines the presence or absence of an abnormality in the packet to be processed based on the assigned label.

[0047] If the assigned label is abnormal, the judgment unit 14 judges that the packet to be processed is similar to a packet of abnormal communication (arrow Y4) and generates an abnormality alert ((2) of FIG. 5). If the assigned label is normal, the judgment unit 14 judges that the packet to be processed is similar to a packet of normal communication (arrow Y5) and uses it as learning data for the VAE ((3) of FIG. 5).

[0048] Furthermore, if the calculated similarity falls below the threshold, the determination unit 14 determines that the packet to be processed is unknown data, and notifies the administrator of a confirmation request. Upon referring to this notification, the administrator determines the normality of the packet to be processed ((4) in FIG. 5) and inputs the determination result to the detection device 10. This determination result is fed back to the feature DB 16 by the determination unit 14 and used for the next determination, thereby suppressing overdetection. In other words, the determination unit 14 outputs a notification regarding a packet to be processed that has no label assigned to its feature, and when a label for the packet to be processed is input, the determination unit 14 stores the feature of the packet to be processed and the input label in association with each other in the feature DB 16.

[0049] In addition, the judgment unit 14 calculates the similarity with the feature amount to which the pre-learning label is attached, and if the calculated similarity is below a threshold, it notifies the administrator that the packet is a protocol that the BERT model does not support (arrow Y6), and does not perform the normality judgment. Alternatively, the judgment unit may make the judgment using 7-tuple judgment.

[0050] An example of a judgment made by the judgment unit 14 will be described. For example, packet 1 is confirmed as normal by the administrator. The judgment unit 14 associates a normal label with the feature of packet 1 and stores the result in the feature DB 16. For packet 2, the judgment unit 14 calculates the similarity with packet 1, and since the similarity falls below a threshold, notifies the administrator of a confirmation request. Since packet 2 is confirmed as normal by the administrator, the judgment unit 14 associates a normal label with the feature of packet 2 and stores the result in the feature DB 16.

[0051] The determination unit 14 calculates the similarity of packet 3 with packets 1 and 2, and notifies the administrator of a confirmation request since the similarity of both packets is below the threshold. Since packet 3 has been confirmed as abnormal by the administrator, the determination unit 14 associates an abnormality label with the feature of packet 3 and stores it in the feature DB 16.

[0052] The determination unit 14 calculates the similarity of packet 4 with packets 1 to 3, and determines that packet 4 is normal communication since it is most similar to packet 2. Note that, for packet 4, the feature amount and the like are not stored in the feature amount DB 16.

[0053] The determination unit 14 calculates the similarity of packet 5 with packets 1 to 3, and since packet 5 is most similar to packet 3, it determines that the communication is abnormal and outputs an alert. In order to suppress initial overdetection, the determination unit 14 may process the processed packets as normal data for the first few minutes, assign normal labels to each feature, and store them in the feature DB 16. In addition, since the number of records in the feature DB 16 increases and performance decreases every time a new communication pattern occurs, the detection device 10 switches the detection method to a method via the VAE ((B) in FIG. 3) when learning of the VAE of the detection unit 13 is completed.

[0054] [Decision-making process using multiple BERT models] Furthermore, the detection device 10 may perform the determination using a plurality of BERT models and VAE. Figures 6 and 7 are diagrams for explaining the anomaly determination process using the BERT model.

[0055] In the detection device 10, during the learning period of the first VAE 13-1, packets that the pre-trained first BERT model 12-1 (first natural language processing model) determines to be normal communication are output to the first VAE 13-1 corresponding to this first BERT model 12-1 as packets of a protocol that is supported by the first BERT model 12-1 (arrow Y11).

[0056] Protocols not included in the packets used in the pre-learning (proprietary protocols or minor protocols) can be detected by comparing them with representative features of the pre-learning data. The determination unit 14 calculates the similarity between the features with the pre-learning labels and the features of the packet to be processed, and if the calculated features are below a threshold, determines that the packet to be processed is a communication protocol that is not supported by the first BERT model 12-1 ((1) in FIG. 6).

[0057] Here, if the entire first BERT model 12-1 is retrained to learn communication for an unsupported protocol, the features generated by the BERT model itself will change, and the entire first VAE 13-1 will also need to be retrained.

[0058] For this reason, in the detection device 10, a second BERT model 12-2 (second natural language processing model) and a second VAE 13-2 (second detection model) corresponding to the second BERT model 12-2 are newly provided only for protocols that are not supported by the first BERT model 12-1, and are used for detection ((2) in FIG. 6). The detection device 10 trains the second BERT model 12-2 to convert the target packet into a feature. Then, the determination unit 14 outputs the feature converted by the second BERT model 12-2 as learning data for the second VAE 13-2. In this way, according to the detection device 10, when a communication packet of a protocol that is not supported by the first BERT model 12-1 is input, it is possible to appropriately process the packet without re-learning the first VAE 13-1.

[0059] During monitoring, as shown in FIG. 7, the judgment unit 14 selects, from the first BERT model 12-1 and the second BERT model 12-2, a BERT model in which the converted features of the packet to be processed are most similar to the features of the training data, and performs attack detection using a VAE model corresponding to the selected BERT model.

[0060] For example, the determination unit 14 calculates the similarity between the feature converted by the first BERT model 12-1 for the packet to be processed and the feature of a packet of normal communication used for pre-learning held in the feature DB 16. Then, the determination unit 14 calculates the similarity between the feature converted by the second BERT model 12-2 for the packet to be processed and the feature of a packet learned in the production environment by the second BERT model 12-2 held in the feature DB 16-2.

[0061] Next, the determination unit 14 compares the calculated similarities, selects the VAE corresponding to the BERT model with the higher similarity, and executes detection. In this way, the detection device 10 can improve the detection accuracy by selecting a BERT model and a VAE suitable for detection and performing detection. Note that the detection device 10 may also compress the first BERT model 12-1 and the second BERT model 12-2 into one model in accordance with the timing of re-learning the VAE.

[0062] [Processing procedure for anomaly detection using the BERT model] Next, a procedure for anomaly determination processing using the BERT model during VAE learning will be described. Fig. 8 is a flowchart showing the procedure for anomaly determination processing using the BERT model.

[0063] As shown in FIG. 8, when a packet to be processed is input (step S11), the encoding unit 12 converts the packet into a fixed-length vector, which is a feature quantity, using a BERT model (step S12).

[0064] The determination unit 14 searches the feature DB 16 for features having a similarity equal to or greater than a threshold value with the feature of the packet to be processed that has been converted by the BERT model, and their labels (step S13). The determination unit 14 assigns the label of the searched feature to the feature of the packet to be processed. Next, the determination unit 14 determines whether the label assigned to the feature of the packet to be processed is a normal label (step S14).

[0065] If the label is a normal label (step S14: Yes), the determination unit 14 outputs the feature amount of the packet to be processed as learning data for the VAE of the detection unit 13 (step S15), and causes the VAE of the detection unit 13 to proceed with learning.

[0066] On the other hand, if the label is not a normal label (step S14: No), the determination unit 14 determines whether the label attached to the feature of the packet to be processed is abnormal (step S16). If the label is an abnormal label (step S16: Yes), the determination unit 14 issues an alert indicating that the packet to be processed is abnormal (step S17).

[0067] If the label is not an abnormal label (step S16: No), the determination unit 14 determines whether the label assigned to the feature amount of the packet to be processed is a pre-learned label (step S18).

[0068] If the label is a pre-learned label (step S18: Yes), an alert is issued indicating that the packet to be processed is unknown data (step S19). When the determination unit 14 receives feedback including the label of this packet from the administrator in response to the alerts of steps S17 and S19 (step S20), the determination unit 14 stores the label determined by the administrator in the feature DB 16 in association with the feature of the packet to be processed, and updates the threshold used for similarity determination (step S21).

[0069] If the label determined by the administrator is a normal label (step S22: Yes), the determination unit 14 outputs the feature amount of the packet to be processed as learning data for the VAE of the detection unit 13 (step S23), and advances learning of the VAE of the detection unit 13. If the label determined by the administrator is not a normal label (step S22: No), the abnormality determination process for the packet to be processed is terminated.

[0070] If the label is not a pre-learned label (step S18: No), an alert is issued indicating that the packet to be processed is a packet of a protocol not supported by the BERT model (step S24). In this case, the detection device 10 provides a new BERT model in the encoding unit 12 (step S25), and trains the new BERT model to convert the packet to be processed into a fixed-length vector. The detection device 10 trains a new VAE in the detection unit 13 with the fixed-length vector converted by the new BERT model as training data.

[0071] [Processing procedure for anomaly detection using multiple BERT models] FIG. 9 is a flowchart showing a procedure of a determination process using a plurality of BERT models.

[0072] When a packet to be processed is input (step S31), the first BERT model 12-1 and the second BERT model 12-2 convert the feature amount of the packet to be processed (step S32).

[0073] The determination unit 14 calculates the similarity between the feature converted by the first BERT model 12-1 and the feature of the normal communication packet used in the pre-learning held in the feature DB 16, and the similarity between the feature converted by the second BERT model 12-2 and the feature held in the feature DB 16-2. Then, the determination unit 14 compares the calculated similarities and determines the BERT model with the higher similarity (step S33).

[0074] If the BERT model with the higher similarity is the first BERT model 12-1 (step S33: first BERT model 12-1), the determination unit 14 inputs the feature amount converted by the first BERT model 12-1 to the first VAE 13-1 and executes detection using the first VAE 13-1 (step S34).If the BERT model with the higher similarity is the second BERT model 12-2 (step S33: second BERT model 12-2), the determination unit 14 inputs the feature amount converted by the second BERT model 12-2 to the second VAE 13-2 and executes detection using the second VAE 13-2 (step S35).

[0075] [Effects of the embodiment] The detection device 10 according to the embodiment applies a new determination method for determining whether or not a packet has an anomaly by comparing features converted from the packet using a pre-trained BERT model with features of past packets. This determination method does not require learning during monitoring, and since the detection processing time depends only on the amount of data of the features of past packets to be compared, attacks can be detected immediately. Therefore, by using this determination method during the learning period of the anomaly-based detection model, the detection device 10 can reduce the gap in monitoring while maintaining the availability of the system.

[0076] In addition, after pre-training, the BERT model has been verified to correctly recognize or authenticate data when converting data from a different environment, and the BERT model can also be used to accurately determine whether or not anomalies exist.

[0077] [System configuration of the embodiment] Each component of the detection device 10 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the detection device 10 is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0078] Further, all or any part of each process performed in the detection device 10 may be realized by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and the GPU. Further, each process performed in the detection device 10 may be realized as hardware using wired logic.

[0079] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the process procedures, control procedures, specific names, and information including various data and parameters described above and shown in the drawings can be changed as appropriate unless otherwise specified.

[0080] [program] 12 is a diagram showing an example of a computer in which a program is executed to realize the detection device 10. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0081] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0082] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the detection device 10 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the detection device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0083] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary, and executes the program.

[0084] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0085] Although the embodiment of the invention made by the present inventor has been described above, the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0086] 10. Detection Device 11 Collection Department 12 Encoding section 13 Detection section 14 Judgment section 15 Processing control section 16 Feature DB

Claims

1. a storage unit that stores in advance the feature amounts of packets, the labels assigned to the feature amounts of each packet, and a threshold value used for determination; a conversion unit that converts a packet to be processed into a feature quantity by using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a determination unit that assigns a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model and the data stored in the storage unit, and determines whether or not the packet to be processed has an abnormality based on the assigned label; having The detection device is characterized in that the determination unit outputs, among the features converted using the first natural language processing model, features that have been assigned a normal label as learning data for a first detection model that detects attacks.

2. A storage unit that stores in advance packet feature amounts, labels assigned to the feature amounts of each packet, and a threshold value used for judgment; a conversion unit that converts a packet to be processed into a feature quantity by using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a determination unit that assigns a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model and the data stored in the storage unit, and determines whether or not the packet to be processed has an abnormality based on the assigned label; having the storage unit stores all or a representative set of feature quantities used in pre-learning in association with a pre-learning label indicating that the feature quantity is used in pre-learning; The detection device is characterized in that the determination unit determines whether or not the first natural language processing model can convert the features appropriately based on the similarity between the features to which the pre-learned labels have been assigned and the features of the packet to be processed that have been converted using the first natural language processing model.

3. The detection device according to claim 1 or 2, characterized in that the determination unit outputs a notification regarding the packet to be processed in which the label has not been assigned to the feature, and when a label for the packet to be processed is input, causes the memory unit to store the feature of the packet to be processed in association with the input label.

4. The detection device according to any one of claims 1 to 3, characterized in that when input is received indicating that the label assigned to the feature to which the label has been assigned is incorrect, the judgment unit updates the threshold value stored in the memory unit.

5. a processing control unit that, when the determination unit determines that the feature has not been appropriately converted in the first natural language processing model, provides a new second natural language processing model in the conversion unit and causes the second natural language processing model to learn conversion of the packet to be processed into the feature; The detection device according to claim 2 , wherein the determination unit outputs the feature amount converted by the second natural language processing model as learning data for a second detection model that detects an attack.

6. The detection device according to claim 5, characterized in that the determination unit selects, from the first natural language processing model and the second natural language processing model, a natural language processing model whose converted features are most similar to the features of a packet that is training data, and performs attack detection using a detection model corresponding to the selected natural language processing model.

7. A detection method performed by a detection device, comprising: converting a packet to be processed into a feature quantity using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a step of assigning a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model, the feature amount of the packet obtained in advance, the label assigned to the feature amount of each packet, and a threshold value used for judgment, and judging the presence or absence of an anomaly in the packet to be processed based on the assigned label; Including, The detection method is characterized in that the determining step includes outputting, as learning data for a first detection model that detects attacks, features that have been labeled as normal, among the features converted using the first natural language processing model.

8. A detection method performed by a detection device, comprising: converting a packet to be processed into a feature quantity using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a step of assigning a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model, the feature amount of the packet obtained in advance, the label assigned to the feature amount of each packet, and a threshold value used for judgment, and judging the presence or absence of an anomaly in the packet to be processed based on the assigned label; having all or a representative feature of the packet features used in pre-learning are associated with a pre-learning label indicating that the feature is a feature used in pre-learning, A detection method characterized in that the determining step determines whether or not the first natural language processing model can convert features appropriately based on the similarity between the features to which the pre-learned labels have been assigned and the features of the packet to be processed that have been converted using the first natural language processing model.

9. converting a packet to be processed into a feature quantity using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a step of assigning a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model, the feature amount of the packet obtained in advance, the label assigned to the feature amount of each packet, and a threshold value used for judgment, and judging the presence or absence of an anomaly in the packet to be processed based on the assigned label; Run the following on your computer: The determining step is a detection program that outputs features that have been converted using the first natural language processing model and that have been assigned a normal label as learning data for a first detection model that detects attacks.

10. A step of converting a packet to be processed into a feature quantity using a first natural language processing model that has been trained in advance using packets of normal communication as training data; a step of assigning a label to the feature amount converted using the first natural language processing model based on the feature amount converted using the first natural language processing model, the feature amount of the packet obtained in advance, the label assigned to the feature amount of each packet, and a threshold value used for judgment, and judging the presence or absence of an anomaly in the packet to be processed based on the assigned label; Run the following on your computer: all or a representative feature of the packet features used in pre-learning are associated with a pre-learning label indicating that the feature is a feature used in pre-learning, The determining step is a detection program that determines whether or not the feature conversion in the first natural language processing model is appropriate based on the similarity between the feature to which the pre-learned label has been assigned and the feature of the packet to be processed that has been converted using the first natural language processing model.

Images