Estimation device, estimation method, and estimation program

Abstract

The present invention estimates an abnormal byte location with excellent accuracy in regard to a communication protocol packet. An extraction unit (23) extracts a prescribed number of similar normal packet data, for which the similarity to abnormal packet data is relatively high, from among a plurality of normal packet data on the basis of a natural language processing model. An estimation unit (24) extracts same-length packet data, which has the same packet length as the abnormal packet data, from among the similar normal packet data having been extracted by the extraction unit (23) and compares the abnormal packet data and the same-length packet data bytewise to estimate an abnormal byte location.

Description

[Technical Field]

[0001] The present invention relates to an estimation device, an estimation method, and an estimation program. [Background technology]

[0002] Anomaly detection systems or intrusion detection systems (OT-IDS: Operational Technology Intrusion Detection System) are attracting attention in communication networks for operational technology (OT) in industrial and building systems. Unexpected operations, such as unauthorized overwriting of packets transmitted over such networks, can cause serious accidents. For example, unauthorized overwriting of a temperature setting by one digit can cause a serious accident. Therefore, it is desirable to be able to detect even a single byte of unauthorized overwriting of the payload, which is the content of the communication. Therefore, precise analysis of payload content is essential for anomaly detection systems targeting industrial and building network control systems.

[0003] For example, a technology for performing detailed analysis of payload contents has been proposed that applies natural language processing techniques such as Bidirectional Encoder Representations from Transformers (BERT) to packet analysis to extract information from the payload of any protocol and detect anomalies. Furthermore, a technology has been proposed for estimating the location of abnormal bytes to provide more information when an anomaly is detected. This technology uses, for example, BERTScore to find the normal packet that is most similar to the detected abnormal packet, and then compares the normal packet with the abnormal packet in a high-dimensional space encoded by BERT. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Tomotaka Yamanaka, Masanori Yamada, Tomokatsu Takahashi, Tomohiro Nagai, "Feature Extraction of Packet Payloads Using BERT", 2021 Annual Conference of the Japanese Society for Artificial Intelligence (35th) Summary of the Invention [Problem to be solved by the invention]

[0005] However, conventional techniques for estimating the location of abnormal bytes work well only under limited circumstances, but it may be difficult to accurately estimate the location of abnormal bytes for some actual abnormal communications. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the estimation device includes an extraction unit that extracts a predetermined number of similar normal packet data that have a relatively high similarity to abnormal packet data from a plurality of normal packet data based on a natural language processing model, and an estimation unit that extracts same-length packet data that has the same packet length as the abnormal packet data from the similar normal packet data extracted by the extraction unit, and compares the abnormal packet data and the same-length packet data byte by byte to estimate the location of the abnormal byte. [Effects of the Invention]

[0007] According to the present invention, it is possible to accurately estimate the location of an abnormal byte in a packet of a communication protocol. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of an information processing apparatus according to an embodiment. [Figure 2] FIG. 2 is a block diagram showing the details of the question generation unit. [Figure 3] FIG. 3 is a block diagram of a machine learning device that trains a question generation model. [Figure 4] FIG. 4 is a diagram illustrating an example of question-answering learning data. [Figure 5]FIG. 5 is a conceptual diagram of learning data for training a question generation model. [Figure 6] FIG. 6 is a diagram illustrating an example of a question created by the information processing device according to the embodiment. [Figure 7] FIG. 7 is a flowchart of a question generation process performed by the information processing device according to the embodiment. [Figure 8] FIG. 8 is a flowchart of the machine learning process performed by the machine learning device according to the embodiment. [Figure 9] FIG. 9 is a diagram showing the results of an experiment using the information processing device according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a computer that executes an information processing program. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the estimation device, estimation method, and estimation program disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the estimation device, estimation method, and estimation program disclosed in the present application are not limited to the following embodiments.

[0010] [Estimation device] An estimation device 1 according to an embodiment of the present invention will be described with reference to FIG. 1. When an abnormal packet is input, the estimation device 1 estimates and outputs the abnormal bytes in the abnormal packet. The estimation device 1 compares the abnormal packet determined to be abnormal by another system with normal packets determined to be normal by another system, and estimates the abnormal bytes and inserted or deleted byte locations in the input abnormal packet. For example, normal packets and abnormal packets are each collected in a communication network of a single operation technology. The other system may use any method to determine whether a packet is normal or abnormal, and the method of determination is not important in the embodiments of the present invention.

[0011] The estimation device 1 has each data item including model data 11, a normal vector data group 12, a normal packet data group 13, abnormal packet data 15, abnormal vector data 16, a similar normal packet data group 17, an abnormal byte 18, and an inserted / deleted byte location 19. The estimation device 1 also includes a conversion unit 21, a generation unit 22, an extraction unit 23, and an estimation unit 24.

[0012] The model data 11 specifies a model for converting packet data into vector data. The vector data associates each byte of packet data with a vector that represents the characteristics of the value of each byte. The model data 11 is generated by a generation unit 22, which will be described later, by learning the values ​​of each byte of multiple normal packet data in the normal vector data group 12. The characteristics of the value of each byte are calculated by comparing it with the values ​​of each byte of multiple normal packet data.

[0013] The model data 11 specifies a model that converts each byte of input packet data into an appropriate fixed-length vector, taking into account the relative positions of each byte, etc. Here, the appropriate fixed-length vector refers to a vector that can detect the presence of an abnormal byte by comparing the abnormal vector data 16 with normal vector data in the estimation unit 24 (described later). For example, as shown in Figure 2, assume that there is fixed-length packet data with a first byte value of "2e," a second byte value of "3f," a third byte value of "00," etc. Each byte of this packet data is converted into a 784-dimensional vector by the model. In the example shown in Figure 2, the model converts each byte of the packet data into a 784-dimensional vector that represents the characteristics of the value of each byte.

[0014] The model data 11 is generated, for example, by BERT. BERT is a natural language processing model. In an embodiment of the present invention, each byte of packet data is considered to be one word. The packet data is converted into vector data by the model generated using BERT.

[0015] The normal packet data group 13 includes data of a plurality of packets identified as normal packets in another system. The normal packet data group 13 may be a normal packet data group used for BERT training, or a packet data group most recently determined to be normal by the estimation device 1, or a mixture of these. The more normal packet data included in the normal packet data group 13 used for comparison with the abnormal packet data 15, the more accurate the estimation by the estimation device 1 will be.

[0016] The normal vector data group 12 includes a plurality of normal vector data. The normal vector data is data obtained by converting normal packet data included in the normal packet data group 13 using a model specified by the model data 11. The normal vector data group 12 is referenced when the generation unit 22 generates the model data 11 or when the extraction unit 23 extracts a similar normal vector data group similar to the abnormal vector data 16. Both the generation unit 22 and the extraction unit 23 may reference the plurality of normal vector data included in the normal vector data group 12. Alternatively, the plurality of normal vector data included in the normal vector data group 12 may be divided into a plurality of groups, with the generation unit 22 referencing one group and the extraction unit 23 referencing another group.

[0017] The abnormal packet data 15 is data of a packet that has been identified as an abnormal packet in another system. The estimation device 1 estimates an abnormal byte 18 and an inserted / deleted byte location 19 for one abnormal packet data 15.

[0018] The abnormal vector data 16 is data obtained by converting the abnormal packet data 15 using a model specified by the model data 11. The abnormal vector data 16 associates the identifier of the position of each byte in the abnormal packet data 15 with each vector that represents the characteristics of the value of each byte.

[0019] The similar normal packet data group 17 is a set of normal packet data before conversion of the similar normal vector data group. The similar normal vector data group is a set of data that has a relatively high similarity to the abnormal vector data 16 among the multiple normal vector data included in the normal vector data group 12. The similar normal vector data group is a set of a predetermined number of normal vector data among the multiple normal vector data included in the normal vector data group 12, sorted in descending order of similarity from the normal vector data with the highest similarity to the abnormal vector data 16. Here, the predetermined number may be, for example, 100. Alternatively, the similar normal vector data group may be a set of a predetermined number of normal vector data among normal vector data whose similarity is higher than a predetermined threshold. The similar normal packet data group 17 includes the same number of normal packet data as the predetermined number of normal vector data included in the similar normal vector data group. In other words, the similar normal packet data group 17 includes a predetermined number of normal packet data.

[0020] The abnormal byte 18 is data that identifies a byte that is presumed to be abnormal among the bytes of the abnormal packet data 15. The abnormal byte 18 is identified, for example, by comparing each byte of the abnormal packet data 15 with that of normal packet data of the same length as the abnormal packet data 15 included in the similar normal packet data group 17.

[0021] The inserted / deleted byte locations 19 are inserted byte locations where extra bytes are suspected to have been inserted or deleted byte locations where normal bytes are suspected to have been deleted in the abnormal packet data 15. The inserted / deleted byte locations 19 are estimated, for example, by calculating the edit distance between the abnormal packet data 15 and each of the similar normal packet data included in the similar normal packet data group 17.

[0022] The converter 21 converts the abnormal packet data 15 into abnormal vector data 16 using the model specified by the model data 11. For example, as shown in FIG. 2, the converter 21 converts the value of each byte of the abnormal packet data 15 into a 784-dimensional vector. The converter 21 associates the position of each byte of the abnormal packet data 15 with the 784-dimensional vector converted from that byte, and outputs the abnormal vector data 16.

[0023] The generation unit 22 learns the values ​​of each byte of multiple normal packet data in the normal vector data group 12 to generate a model identified by the model data 11. The model converts packet data into vector data in which each byte of the packet data is associated with a vector representing the characteristics of the value of each byte. The generation unit 22 generates the model according to, for example, BERT. The generation unit 22 may perform preliminary learning of the characteristics of the value of each byte in normal packet data by solving auxiliary tasks such as MLM (Masked Language Model) or NSP (Next Sentence Prediction). MLM predicts the values ​​of missing bytes in a packet in which multiple bytes are missing. NSP determines whether two packet data are consecutive packets. The generation unit 22 determines the validity of the data in the packet and the validity of consecutive packets using these auxiliary tasks, and generates a model that identifies normal vector data. The auxiliary tasks listed here are merely examples, and the generation unit 22 may perform learning by solving other auxiliary tasks.

[0024] The extraction unit 23 extracts a predetermined number of normal vector data having a relatively high similarity to the abnormal vector data 16 from the plurality of normal vector data in the normal vector data group 12. The extraction unit 23 defines the extracted predetermined number of normal vector data as a similar normal vector data group.

[0025] A relatively high similarity means that the similarity between the abnormal vector data 16 and a certain normal vector data is higher than the similarity between the abnormal vector data 16 and other normal vector data. The extraction unit 23 may extract a predetermined number of normal vector data in descending order of similarity, starting from the normal vector data having the highest similarity to the abnormal vector data 16. Here, the predetermined number may be, for example, 100. Alternatively, the extraction unit 23 may extract a predetermined number of normal vector data from the normal vector data having a similarity higher than a threshold value.

[0026] The extraction unit 23 calculates the similarity between the abnormal vector data 16 and each normal vector data in the normal vector data group 12. The extraction unit 23 may calculate the similarity with a portion of the normal vector data in the normal vector data group 12. For example, the portion of the normal vector data is a plurality of normal vector data obtained by extracting a plurality of representative packet data from a plurality of normal packet data using MMD-Critic (MMD: Maximum Mean Discrepancy) and converting each of the extracted representative packet data using a model. Alternatively, the portion of the normal vector data is a plurality of normal vector data obtained by extracting normal packet data having the same packet length as the abnormal packet data 15 from a plurality of normal packet data and converting each of the extracted normal packet data using a model.

[0027] The extraction unit 23 may use BERTScore as the similarity. Alternatively, the extraction unit 23 may calculate the similarity between the vectors of the abnormal vector data 16 and the vectors of the normal vector data for each byte of the abnormal vector data 16, and then calculate the similarity between the abnormal vector data 16 and the normal vector data from the similarity calculated for each byte. Cosine similarity may be used as the similarity between the vectors of each byte. The similarity between the abnormal vector data 16 and the normal vector data is, for example, the average of the similarities calculated for each byte. In this case, if the number of vectors in the abnormal vector data 16 differs from the number of vectors in the normal vector data, the similarity may be calculated based on the smaller number of vectors. Note that the number of vectors in each vector data is the number of bytes of packet data before conversion.

[0028] Next, the extraction unit 23 acquires a predetermined number of normal packet data before conversion of a predetermined number of normal vector data included in the similar normal vector data group from the normal packet data group 13. Then, the extraction unit 23 extracts the acquired predetermined number of normal packet data as similar normal packet data, and sets the set of similar normal packet data as a similar normal packet data group 17.

[0029] The estimation unit 24 compares the abnormal packet data 15 with similar normal packet data included in the similar normal packet data group 17, and estimates abnormal bytes 18 included in the abnormal packet data 15 or inserted / deleted byte locations 19 in the abnormal packet data 15. The estimation by the estimation unit 24 will be described in detail below. As shown in FIG. 1 , the estimation unit 24 has a length comparison unit 241, an abnormal byte estimation unit 242, and an inserted / deleted byte location estimation unit 243.

[0030] The length comparator 241 compares the packet lengths of the abnormal packet data 15 with those of a predetermined number of similar normal packet data included in the similar normal packet data group 17. The length comparator 241 determines that byte rewriting has occurred if, among the predetermined number of normal packet data, a number of similar normal packet data equal to or greater than a predetermined determination threshold has the same packet length as the abnormal packet data 15. Herein, the determination threshold is a specifiable parameter. The determination threshold may be a fixed value, for example, 50%. Alternatively, the threshold may be determined by a predetermined calculation. For example, multiple pairs of two similar normal packet data that are similar to each other may be extracted, and the threshold may be determined from the lowest similarity among the vector similarities of the two similar normal packet data corresponding to a predetermined byte. Hereinafter, the extracted normal packet data having the same packet length as the abnormal packet data 15 is referred to as "same-length normal packet data." The length comparator 241 then outputs the abnormal packet data 15 and the same-length normal packet data to the abnormal byte estimation unit 242.

[0031] On the other hand, if the number of normal packet data of the same length is less than the judgment threshold, the length comparison unit 241 determines that byte insertion or deletion has occurred, or that the abnormal packet data 15 is completely different from the normal packet data. Then, the length comparison unit 241 outputs the abnormal packet data 15 and all of the predetermined number of normal packet data included in the similar normal packet data group 17 to the abnormal byte estimation unit 242.

[0032] The abnormal byte estimation unit 242 acquires the abnormal packet data 15 and the normal packet data of the same length from the length comparison unit 241. Then, the abnormal byte estimation unit 242 compares the acquired normal packet data of the same length with the abnormal packet data 15 in order to identify the location of the rewritten byte in the abnormal packet data 15.

[0033] Specifically, the anomalous byte estimation unit 242 directly treats the value of the first byte of the normal packet data of the same length extracted for comparison as a number between 0 and 255 and calculates the interquartile range. The anomalous byte estimation unit 242 then determines whether the value of the first byte of the anomalous packet data 15 is included within the calculated interquartile range. If the value of the first byte of the anomalous packet data 15 is included within the calculated interquartile range, the anomalous byte estimation unit 242 determines that the first byte is normal. If the value of the first byte of the anomalous packet data 15 is not included within the calculated interquartile range, the anomalous byte estimation unit 242 considers the first byte to be an anomalous byte. Subsequently, the anomalous byte estimation unit 242 compares each byte in turn, such as the second byte, the third byte, and so on, and determines whether each byte is an anomalous byte location to estimate the anomalous byte. Note that although the interquartile range is used to compare each byte here, there are no particular limitations on the anomaly detection method that can be used, such as a nonparametric method or a naive Bayes method, as long as it can handle one-dimensional data.

[0034] If there is normal packet data of the same length with the number of abnormal byte locations less than a certain value, the abnormal byte estimation unit 242 selects the normal packet data with the smallest number of abnormal byte locations as the final similar normal packet data from among the normal packet data of the same length with the number of abnormal byte locations less than the certain value.The abnormal byte estimation unit 242 then estimates the stored abnormal byte locations in the final similar normal packet data as abnormal bytes 18.

[0035] On the other hand, if the number of abnormal bytes in all the acquired normal packet data of the same length is equal to or greater than a certain value, the abnormal byte estimation unit 242 processes the abnormal packet data 15 as not having the final similar normal packet data corresponding to it. Here, the certain value is a parameter that can specify, for example, approximately 1 / 3 to 1 / 2 of the packet length.

[0036] The inserted / deleted byte location estimation unit 243 acquires the abnormal packet data 15 and a predetermined number of normal packet data from the length comparison unit 241. Then, the inserted / deleted byte location estimation unit 243 compares the acquired normal packet data with the abnormal packet data 15 to identify the inserted byte location or deleted byte location in the abnormal packet data 15.

[0037] Specifically, the insertion / deletion byte location estimation unit 243 calculates the edit distance between the abnormal packet data 15 and each normal packet data using dynamic programming. By calculating the edit distance, the insertion / deletion byte location estimation unit 243 can identify an insertion byte location where an insertion is suspected or a deletion byte location where a deletion is suspected.

[0038] If there is normal packet data whose edit distance is less than the certain distance, the insertion / deletion byte location estimation unit 243 selects the normal packet data whose edit distance is shortest from among the normal packet data whose edit distance is less than the certain distance as the final similar normal packet data.The insertion / deletion byte location estimation unit 243 then estimates the insertion / deletion byte location 19 using the edit distance of the selected final similar normal packet data.

[0039] On the other hand, if the edit distance of all the acquired normal packet data is equal to or greater than the certain distance, the inserted / deleted byte location estimation unit 243 processes the abnormal packet data 15 as not having the final similar normal packet data corresponding to the abnormal packet data 15. Here, the certain distance is a parameter that can specify, for example, approximately 1 / 3 to 1 / 2 of the packet length.

[0040] [Processing of the embodiment] 3 is a flowchart of the estimation process performed by the estimation device according to the embodiment. Next, the flow of the estimation process performed by the estimation device according to the present embodiment will be described with reference to FIG.

[0041] The conversion unit 21 converts the abnormal packet data 15 into abnormal vector data 16 (step S1).

[0042] The extraction unit 23 extracts a predetermined number of normal vector data similar to the abnormal vector data 16 converted in step S1 from the normal vector data group 12 (step S2), and sets the extracted normal vector data as a similar normal vector data group.

[0043] Next, the extraction unit 23 acquires a predetermined number of normal packet data before conversion of the normal vector data included in the similar normal vector data group from the normal packet data group 13 (step S3), and sets the set as similar normal packet data, which is the similar normal packet data group 17.

[0044] The length comparison unit 241 of the estimation unit 24 compares the abnormal packet data 15 with each similar normal packet data included in the similar normal packet data group 17 (step S4). Then, the length comparison unit 241 determines whether the similar normal packet data group 17 includes equal to or more than a determination threshold amount of normal packet data having the same packet length as the abnormal packet data 15 (step S5).

[0045] If there is an amount of normal packet data of the same length equal to or greater than the determination threshold (step S5: Yes), the length comparing unit 241 determines that there is an abnormal byte 18. Then, the length comparing unit 241 transmits the abnormal packet data 15 and the normal packet data of the same length to the abnormal byte estimating unit 242. The abnormal byte estimating unit 242 acquires the abnormal packet data 15 and the normal packet data of the same length, and executes an abnormal byte estimation process (step S6).

[0046] On the other hand, if the number of normal packet data of the same length is less than the determination threshold (step S5: No), the length comparing unit 241 determines that an inserted byte location or a deleted byte location exists. Then, the length comparing unit 241 transmits the abnormal packet data 15 and all of the predetermined number of similar normal packet data included in the similar normal packet data group 17 to the inserted / deleted byte location estimating unit 243. The inserted / deleted byte location estimating unit 243 acquires the abnormal packet data 15 and the predetermined number of similar normal packet data, and executes an inserted / deleted byte location estimating process (step S7).

[0047] 4 is a flowchart of the abnormal bite estimation process. The flow shown in FIG. 4 is an example of the abnormal bite estimation process executed in step S6 in FIG.

[0048] The abnormal byte estimation unit 242 selects one unselected normal packet data of the same length from the normal packet data of the same length (step S101).

[0049] Next, the abnormal byte estimation unit 242 sets a parameter n, which indicates the position of the byte to be compared, to 1 (step S102).

[0050] Next, the abnormal byte estimation unit 242 compares the nth byte of the selected normal packet data of the same length with the nth byte of the abnormal packet data 15 (step S103). For example, the abnormal byte estimation unit 242 directly treats the value of the nth byte of the selected normal packet data of the same length as a number between 0 and 255 and calculates the interquartile range. Then, the abnormal byte estimation unit 242 determines whether the value of the nth byte of the abnormal packet data 15 is included in the calculated interquartile range.

[0051] Next, the abnormal byte estimation unit 242 uses the comparison result to determine whether the nth byte is an abnormal byte (step S104). For example, if the calculated interquartile range contains the numerical value of the nth byte of the abnormal packet data 15, the abnormal byte estimation unit 242 determines that the nth byte is normal. Conversely, if the calculated interquartile range does not contain the numerical value of the nth byte of the abnormal packet data 15, the abnormal byte estimation unit 242 considers the nth byte to be an abnormal byte. If the nth byte is not an abnormal byte (step S104: No), the abnormal byte estimation unit 242 proceeds to step S106.

[0052] On the other hand, if the nth byte is an abnormal byte (step S104: Yes), the abnormal byte estimation unit 242 stores the nth byte in the abnormal packet data 15 as the abnormal byte location (step S105), and proceeds to step S106.

[0053] Then, the abnormal byte estimation unit 242 determines whether the nth byte is the final byte in the abnormal packet data 15 (step S106). If the nth byte is not the final byte (step S106: No), the abnormal byte estimation unit 242 increments n by 1 (step S107) and returns to step S103.

[0054] On the other hand, if the n-th byte is the final byte (step S106: Yes), the abnormal byte estimation unit 242 determines whether or not selection of all of the same-length normal packet data has been completed (step S108).If unselected same-length normal packet data remains (step S108: No), the abnormal byte estimation unit 242 returns to step S101.

[0055] On the other hand, if the selection of all normal packet data of the same length has been completed (step S108: Yes), the abnormal byte estimation unit 242 determines whether there is normal packet data of the same length in which the stored abnormal byte portion is less than a certain value (step S109).

[0056] If there is normal packet data of the same length in which the number of abnormal byte locations is less than the certain value (step S109: Yes), the abnormal byte estimation unit 242 performs the following process. In this case, the abnormal byte estimation unit 242 selects, as the final similar normal packet data, normal packet data with the smallest number of abnormal byte locations from among the normal packet data of the same length in which the number of abnormal byte locations is less than the certain value. Then, the abnormal byte estimation unit 242 estimates the abnormal byte locations of the stored abnormal packet data 15 for the final similar normal packet data as abnormal bytes 18 (step S110), and ends the abnormal byte estimation process.

[0057] On the other hand, if there is no normal packet data of the same length in which the abnormal byte location is less than a certain value (step S109: No), the abnormal byte estimation unit 242 determines that there is no final similar normal packet data (step S111) and terminates the abnormal byte estimation process.

[0058] 5 is a flowchart of the insertion / deletion byte location estimation process, which is an example of the insertion / deletion byte location estimation process executed in step S7 in FIG.

[0059] The inserted / deleted byte location inferring unit 243 selects one unselected normal packet data from a predetermined number of similar normal packet data (step S201).

[0060] Next, the inserted / deleted byte location estimation unit 243 calculates the edit distance between the abnormal packet data 15 and the selected similar normal packet data using dynamic programming (step S202).

[0061] Next, the inserted / deleted byte location estimation unit 243 determines whether or not selection of all of the predetermined number of similar normal packet data has been completed (step S203). If unselected normal packet data remains among the predetermined number of similar normal packet data (step S203: No), the inserted / deleted byte location estimation unit 243 returns to step S201.

[0062] On the other hand, if the selection of all of the predetermined number of similar normal packet data has been completed (step S203: Yes), the insertion / deletion byte location estimation unit 243 determines whether there is similar normal packet data whose edit distance is less than a certain distance (step S204).

[0063] If similar normal packet data whose edit distance is less than the certain distance exists (step S204: Yes), the insertion / deletion byte location estimation unit 243 executes the following process. In this case, the insertion / deletion byte location estimation unit 243 selects the similar normal packet data whose edit distance is shortest among the similar normal packet data whose edit distance is less than the certain distance as the final similar normal packet data. Then, the insertion / deletion byte location estimation unit 243 estimates the insertion / deletion byte location 19 using the edit distance between the selected final similar normal packet data and the abnormal packet data 15 (step S205), and ends the insertion / deletion byte location estimation process.

[0064] On the other hand, if there is no similar normal packet data whose edit distance is less than the certain distance (step S204: No), the inserted / deleted byte location estimation unit 243 determines that there is no final similar normal packet data (step S206) and terminates the abnormal byte estimation process.

[0065] [Experimental Results] Next, the results of an experiment conducted to estimate the anomalous byte 18 or the inserted / deleted byte location 19 using the estimation device 1 according to this embodiment will be described. The experiment was conducted under the following conditions. BERT had been trained using 30,000 Modbus / TCP cases. 400 normal packet data items and 100 abnormal packet data items 15 were used as the data set. Each item of abnormal packet data 15 was input one by one to estimate the cause. In this experiment, only a perfect match was considered to be a successful estimation.

[0066] As the first experiment, we conducted a byte rewriting experiment in which n locations in the payload were rewritten with random bytes.

[0067] Fig. 6 shows the experimental results when bytes were rewritten. Fig. 7 shows the experimental results when random bytes were inserted. Fig. 8 shows the experimental results when bytes were deleted. In all of Figs. 6 to 8, the vertical axis represents the rate of successful estimation, and the horizontal axis represents the number of deleted bytes. Here, the rate of successful estimation represents the rate of successful estimation, with 1 being the rate when estimation was successful for all 100 abnormal packet data 15.

[0068] In the experiment of rewriting bytes, the estimation device 1 can estimate about 90% even when five locations are rewritten, as shown in Figure 6. In this case, since the packet length is 12 to 25, the fact that it can estimate almost everything even when five locations are rewritten means that the estimation accuracy is quite good.

[0069] In the experiment in which random bytes were inserted, as shown in Figure 7, the estimation device 1 was able to estimate with approximately 90% accuracy if up to two rewrites were performed. However, the estimation accuracy decreased when three or more rewrites were performed, and with five rewrites, the estimation accuracy dropped to 50%. One reason for this is thought to be that the majority of data packets, which have packet lengths of 12, 14, or 15, were mixed together due to the insertion of random bytes, preventing the extraction of similar normal packet data group 17 using BERT. In other words, under conditions where packet lengths are unlikely to overlap due to the insertion of random bytes, the estimation accuracy is thought to improve even when three or more rewrites are performed.

[0070] In the experiment of deleting bytes, as shown in FIG. 8, the estimation accuracy of the estimation performed by the estimation device 1 appears to be insufficient. This is thought to be due to the following reason. FIG. 9 is a diagram for explaining the cause of the deterioration of accuracy in byte deletion. For example, consider an experiment in which data 101 in FIG. 9 is the original normal packet data, and byte 110 of data 101 is deleted to generate abnormal packet data 15. In this case, the estimation device 1 generates data 102 as the abnormal packet data 15. When estimating the location of the deleted bytes using data 102, the estimation device 1 may infer that byte 130 in the determination result packet data 103 is the deleted location. In this experiment, such an estimation is not treated as a correct answer, and the estimation accuracy decreases.

[0071] However, since the bytes adjacent to byte 110 in data 101 in Figure 9 have the same value, based on data 102, there are deletions in locations that differ from the actual deletion locations. In this case, it can be considered equivalent regardless of which bytes with the same value are deleted. Therefore, although this judgment result can be said to be incorrect in the strict sense, it can also be considered to be approximately correct. In fact, when checking visually, that is, ignoring errors in the deletion byte locations of adjacent bytes with the same value, if there are approximately three deletion locations, the estimation accuracy was approximately 90%.

[0072] From the above experiments, it is believed that the estimation device 1 according to this embodiment can ensure high estimation accuracy in detecting abnormalities, regardless of whether the abnormality is byte rewriting, random byte insertion, or byte deletion.

[0073] [Effects of the embodiment] As described above, the estimation device 1 according to this embodiment uses BERT to extract a predetermined number of similar normal packet data similar to the detected abnormal packet data 15. Then, the estimation device 1 compares the abnormal packet data 15 with the similar normal packet data byte by byte to estimate tampering locations, and estimates inserted byte locations and deleted byte locations using edit distance calculation. This makes it possible to accurately estimate abnormal byte locations or inserted / deleted byte locations 19 for packets of any communication protocol.

[0074] [System configuration, etc.] Furthermore, the components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0075] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0076] [program] In one embodiment, the estimating device 1 can be implemented by installing an information processing program that executes the above-described question generation process as package software or online software on a desired computer. For example, the above-described estimating process program can be executed by a computer to cause the computer to function as the estimating device 1. The term "computer" as used herein includes desktop and notebook personal computers. Other examples of computers also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handy-phone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The estimating device 1 may be implemented as a web server or as a cloud that provides services related to the above-described management process through outsourcing.

[0077] 10 is a diagram showing an example of a computer that executes an estimation processing program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0078] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to an input unit 1200 such as a mouse 1110 or a keyboard 1120. The video adapter 1060 is connected to an output unit 1300 such as a display 1130.

[0079] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the estimation device 1 having the same functions as the estimation device 1 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, the program module 1093 for executing processes similar to those of the functional configuration of the estimation device 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0080] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0081] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0082] 1 Estimation device 11 Model Data 12 Normal vector data set 13 Normal packet data group 15 Abnormal packet data 16 Abnormal Vector Data 17 Similar normal packet data group 18 Abnormal Bites 19 Insertion / Deletion Byte Location 21 Conversion unit 22 Generation part 23 Extraction part 24 Estimation part 241 Length comparison section 242 Abnormal byte estimation unit 243 Insertion / Deletion Byte Location Estimation

Claims

1. an extracting unit that extracts a predetermined number of similar normal packet data having a relatively high similarity to the abnormal packet data from among a plurality of normal packet data based on a natural language processing model; an estimation unit that extracts identical-length packet data having the same packet length as that of the abnormal packet data from the similar normal packet data extracted by the extraction unit, and estimates an abnormal byte location by comparing the abnormal packet data with the identical-length packet data for each byte; An estimation device comprising:

2. 2. The estimation device according to claim 1, wherein the estimation unit performs one-dimensional anomaly detection by treating each byte of the abnormal packet data and the identical-length packet data as a numerical value and comparing the bytes.

3. The estimation device according to claim 1 or 2, characterized in that when the number of the same length packet data among the predetermined number of the similar normal packet data is less than a judgment threshold, the extraction unit estimates the abnormal byte location based on an edit distance between the abnormal packet data and the similar normal packet data.

4. The estimation device according to any one of claims 1 to 3, characterized in that, using the natural language processing model that converts the packet data into vector data in which each vector representing a feature of a value of each byte of packet data corresponds to each byte, from among a plurality of normal vector data into which a plurality of normal packet data are converted, a predetermined number of similar normal vector data having a relatively high similarity to abnormal vector data into which the abnormal packet data is converted using the natural language processing model is identified, and the normal packet data before the conversion of the similar normal vector data is extracted as the similar normal packet data.

5. 5. The estimation device according to claim 1, wherein the extraction unit uses Bidirectional Encoder Representations from Transformers (BERT) as the natural language processing model.

6. A predetermined number of similar normal packet data having a relatively high similarity to the abnormal packet data is extracted from the plurality of normal packet data based on a natural language processing model; extracting identical-length packet data having the same packet length as that of the abnormal packet data from the similar normal packet data; The abnormal packet data is compared with the same-length packet data for each byte to estimate the location of the abnormal byte. The estimation method according to claim 1,

7. A predetermined number of similar normal packet data having a relatively high similarity to the abnormal packet data is extracted from the plurality of normal packet data based on a natural language processing model; extracting identical-length packet data having the same packet length as that of the abnormal packet data from the similar normal packet data; The abnormal packet data is compared with the same-length packet data for each byte to estimate the location of the abnormal byte. An estimation program that causes a computer to execute a process.

Images