Device estimation system, device estimation apparatus, and program

Abstract

This device estimation system (1) comprises: a packet analysis model training apparatus (20) for generating a packet analysis model (200); a waveform analysis model training apparatus (30) for generating a waveform analysis model (300); a traffic information collection apparatus (50) for collecting packets of a subject device (5); and a device estimation apparatus (10) for extracting a statistical value and a keyword from the packets, generating candidates for manufacturers and function categories of the subject device (5) using the packet analysis model (200), generating traffic waveform information from the packets, narrowing down the candidates using the waveform analysis model (300) so as to identify the manufacturer and function category of the subject device (5), and transmitting these to an analysis model management apparatus (40).

Description

[Technical field]

[0001] The present invention relates to a device estimation system and a device estimation apparatus for estimating devices connected to a network. ,oh And regarding the program. [Background technology]

[0002] Conventionally, a technology has been developed for the purpose of detecting suspicious devices, for example, devices installed in the home (see Non-Patent Document 1). In the technology described in Non-Patent Document 1, traffic transmitted by IoT (Internet of Things) devices is analyzed to extract features unique to each device. Then, the features are used for machine learning to classify the device model and the device function category (for example, webcam or smart speaker). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] A. Sivanathan et al., "Characterizing and classifying IoT traffic in smart cities and campuses," 2017 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), 2017, pp. 559-564, doi: 10.1109 / INFCOMW.2017.8116438 Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology described in Non-Patent Document 1, traffic information is converted into numerical features such as packet transmission intervals for each protocol, and machine learning is used to identify IoT devices. At this time, a number of IoT devices are set in advance as the IoT devices to be identified, and a specific IoT device is identified from among them.

[0005] However, in actual households and companies (factories) connected to a network, it would cost a huge amount of money to manage a huge number of diverse devices such as IoT terminals as a system, and no technology has been established to efficiently manage each device. As shown in the technology in Non-Patent Document 1, the traffic of each device has its own characteristics, and it is possible to identify each device with high accuracy, but there is little correlation between manufacturers and functional categories, and the accuracy of the classification decreases, which is a problem.

[0006] The present invention has been made in view of the above-mentioned points, and an object of the present invention is to improve the accuracy of estimating the manufacturer and functional category of a target device from the traffic of each device. [Means for solving the problem]

[0007] A device estimation system according to the present invention is a device estimation system for estimating devices within a network, the device estimation system comprising a traffic information collection device for collecting traffic information of a target device indicating the device to be estimated, a device estimation device connected to the traffic information collection device, and a packet analysis model learning device, a waveform analysis model learning device, and an analysis model management device, all connected to the device estimation device, wherein the packet analysis model learning device acquires a first learning data set from the analysis model management device and learns it to generate a packet analysis model that outputs candidates for the manufacturer and functional category of the target device when statistics and keywords extracted from the header and payload of a packet transmitted by the target device are input, and the waveform analysis model learning device acquires a second learning data set from the analysis model management device and learns it to generate a packet analysis model that outputs candidates for the manufacturer and functional category of the target device. and generates a waveform analysis model that outputs a functional category of the target device when traffic waveform information indicating a time change in the number of transmitted packets of the target device is input, and the traffic information collecting apparatus includes a data collecting unit that collects traffic packets in the network, and a packet set generating unit that generates packet set information in which the collected packets are grouped together for each source device that is the target device, and the device estimation apparatus includes a device connection information extracting unit that receives the packet set information and extracts device connection information indicating information for connecting to the target device, and a packet analysis model learning unit that receives the packet set information from the traffic information collecting apparatus, extracts the statistical values ​​and the keywords from the headers and payloads of packets of the target device, and inputs the statistical values ​​and the keywords into the packet analysis model obtained from the packet analysis model learning apparatus, thereby outputting candidates for the manufacturer and functional category of the target device. In order of highest probability of correct answera packet processing unit that receives the packet set information from the traffic information collecting device, generates the traffic waveform information of the target device, and inputs the traffic waveform information to the waveform analysis model acquired from the waveform analysis model learning device, thereby determining a functional category of the target device, and from among the manufacturers and functional category candidates indicated in the device classification candidate information, selects a candidate having the determined functional category. Of , Select the candidate with the highest probability of correct answer The manufacturer and functional category of the target device are estimated. At the same time, if there is no candidate having the determined functional category in the device classification candidate information, the candidate having the highest probability of correct answer among all the candidates shown in the device classification candidate information is estimated to be the manufacturer and functional category of the target device. The device identification unit generates device identification information including the estimated manufacturer and functional category and the extracted device connection information of the target device, and transmits the device identification information to the analysis model management device. Effect of the Invention

[0008] According to the present invention, it is possible to improve the accuracy of estimating the manufacturer and functional category of a target device from the traffic of each device. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram showing an overall configuration of a device estimation system including a device estimation apparatus according to an embodiment of the present invention. [Diagram 2] 5 is a diagram illustrating an example of a data configuration of device classification candidate information according to the embodiment. FIG. [Diagram 3] FIG. 4 is a diagram showing an example of traffic waveform information according to the embodiment; [Figure 4] FIG. 4 is a diagram showing an example of traffic waveform information according to the embodiment; [Diagram 5] 1 is a functional block diagram of a packet analysis model learning device according to an embodiment of the present invention. [Figure 6] 1 is a functional block diagram of a waveform analysis model learning device according to an embodiment of the present invention. [Figure 7] FIG. 2 is a functional block diagram of an analysis model management device according to the present embodiment. [Figure 8]5 is a flowchart showing a flow of processing of the device estimation system according to the present embodiment. [Figure 9] FIG. 2 is a hardware configuration diagram showing an example of a computer that realizes the functions of each apparatus in the device estimation system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Next, an embodiment of the present invention (hereinafter, referred to as "the present embodiment") will be described.

[0011] The device estimation system 1 including the device estimation apparatus 10 according to this embodiment uses traffic information transmitted by the device to perform analysis in two stages: a stage of analyzing packet header and payload information (packet analysis stage), and a stage of analyzing traffic waveforms that represent changes in traffic over time (traffic waveform analysis stage), thereby estimating the manufacturer and functional category of a target device with improved accuracy compared to conventional techniques. Hereinafter, a device estimation system 1 including the device estimation apparatus 10 of the present invention will be specifically described.

[0012] FIG. 1 is a diagram showing the overall configuration of a device estimation system 1 including a device estimation apparatus 10 according to this embodiment. The device estimation system 1 estimates the manufacturer and the functional category of a device 5 to be estimated (hereinafter, also referred to as a “target device 5”) among a plurality of devices 5 accommodated in a management target network 1000.

[0013] As shown in FIG. 1, the device estimation system 1 includes a device estimation device 10, a packet analysis model learning device 20, a waveform analysis model learning device 30, an analysis model management device 40, and a traffic information collection device 50. The device estimation system 1 is communicatively connected to a management target network 1000 via a traffic information collecting apparatus 50, and targets each device 5 accommodated in the management target network 1000 as an estimation target. The traffic information collecting device 50, the device estimation device 10, the packet analysis model learning device 20, the waveform analysis model learning device 30, and the analysis model management device 40, which constitute the device estimation system 1, will be specifically described below.

[0014] <Traffic information collection device> The traffic information collection device 50 performs a process of capturing (collecting) packets of traffic flowing on the management target network 1000 and storing them for each source device. The traffic information collecting device 50 is configured by a computer equipped with a control unit, an input / output unit, and a storage unit (all of which are not shown).

[0015] The input / output unit inputs and outputs information between the switch 6 and the device estimation device 10 accommodated in the managed network 1000. This input / output unit is composed of a communication interface that transmits and receives information via a communication line, and an input / output interface that inputs and outputs information between an input device such as a keyboard and an output device such as a monitor (not shown).

[0016] The storage unit is composed of a hard disk, a flash memory, a RAM (Random Access Memory), and the like. This storage unit stores a packet set database (DB: DataBase) 53 that stores packet set information 500 (details to be described later) obtained by analyzing traffic information collected from the managed network 1000 by a data collection unit 51 to be described later. The storage unit also temporarily stores programs for executing the various functions of the control unit and information required for processing by the control unit.

[0017] The control unit manages all the processes executed by the traffic information collecting device 50 , and includes a data collecting unit 51 and a packet aggregation generating unit 52 .

[0018] The data collection unit 51 captures (collects) packets of traffic flowing on the managed network 1000 via the switch 6 accommodated in the managed network 1000 .

[0019] The packet set generation unit 52 groups the packets collected by the data collection unit 51 for each source device (e.g., MAC address of the target device 5) and generates packet set information 500 for each target device 5. Then, the packet set generation unit 52 stores the generated packet set information 500 in the packet set DB 53. In addition, the packet set generating unit 52 transmits the packet set information 500 of each target device 5 to the device estimation apparatus 10.

[0020] In this manner, the traffic information collecting apparatus 50 can generate packet set information 500 originating from each device 5 accommodated in the managed network 1000 , and output the packet set information 500 to the device estimation apparatus 10 .

[0021] In this embodiment, the traffic information collecting device 50 is described as one device, but if there are multiple managed networks 1000, multiple traffic information collecting devices 50 may be provided corresponding to the multiple managed networks. Also, by providing multiple traffic information collecting devices 50 for one managed network 1000, it is possible to speed up packet collection and generation of packet collection information 500. Furthermore, a packet collection DB 53 for storing packet collection information 500 may be provided in a device in a housing separate from the traffic information collecting device 50.

[0022] <Device Estimation Device> Next, the device estimation apparatus 10 will be described with reference to FIG. The device estimation apparatus 10 acquires packet set information 500 of the target device 5 from the traffic information collection apparatus 50, analyzes packet header and payload information using a packet analysis model 200 (details of which will be described later), and generates device classification candidates ("device classification candidate information 210" described later) indicating the manufacturer and functional category of the target device 5. The device estimation apparatus 10 also generates a traffic waveform indicating a temporal change in traffic from the packet set information 500, and estimates the functional category of the target device 5 by analyzing the traffic waveform using a waveform analysis model 300 (details of which will be described later), and identifies the manufacturer and functional category of the target device 5 from the device classification candidates. The device estimation apparatus 10 is configured by a computer equipped with a control unit, an input / output unit, and a storage unit (all of which are not shown).

[0023] The input / output unit of the device estimation device 10 inputs and outputs information between the traffic information collection device 50, the packet analysis model learning device 20, the waveform analysis model learning device 30, the analysis model management device 40, etc. This input / output unit is composed of a communication interface that transmits and receives information via a communication line, and an input / output interface that inputs and outputs information between an input device such as a keyboard and an output device such as a monitor (not shown).

[0024] The storage unit of the device estimation apparatus 10 is composed of a hard disk, a flash memory, a RAM, and the like. This memory unit stores a packet analysis model 200 obtained from the packet analysis model learning device 20 and used in processing by the packet information analysis unit 122 described below, and a waveform analysis model 300 obtained from the waveform analysis model learning device 30 and used in processing by the traffic waveform analysis unit 132 described below. The storage unit also temporarily stores programs for executing the various functions of the control unit and information required for processing by the control unit.

[0025] The control unit of the device estimation apparatus 10 is responsible for all the processes executed by the device estimation apparatus 10, and is configured to include a device connection information extraction unit 11, a packet processing unit 12, a traffic waveform processing unit 13, and a device identification unit .

[0026] The device connection information extraction unit 11 receives packet collection information 500 of the target device 5 from the traffic information collection device 50 via an input / output unit (not shown), and extracts information required for connecting to the target device 5 (e.g., MAC address, IP address, etc.) from the packet header, etc., as device connection information. The device connection information extraction unit 11 outputs the extracted device connection information for each target device 5 to the device identification unit 14.

[0027] The packet processing unit 12 acquires in advance the packet analysis model 200 generated by the packet analysis model learning device 20. Then, the packet processing unit 12 receives packet set information 500 of the target device 5 from the traffic information collecting device 50, and extracts statistical values ​​and keywords from the header and payload of the packets as header / payload information. The packet processing unit 12 inputs the header / payload information into the packet analysis model 200, thereby generating device classification candidate information 210 (see FIG. 2 described later) indicating candidates for the manufacturer and functional category of the target device 5. The packet processing unit 12 includes a packet information extraction unit 121 and a packet information analysis unit 122 .

[0028] The packet information extraction unit 121 receives packet collection information 500 of the target device 5 from the traffic information collection apparatus 50 via an input / output unit (not shown). Then, the packet information extraction unit 121 extracts statistical values ​​and keywords from the packet headers and payloads as header / payload information. Here, the statistical values ​​are information indicating the characteristics of each packet in the traffic flowing through the network, and are, for example, the packet rate (pps), packet size, number of packet transmissions, destination address, number of destinations, and the like, which can be extracted from the packet header. The keywords are, for example, character string patterns, host names, and DNS (Domain Name System) server names, which can be obtained from the payload, and the like. The packet information extraction unit 121 outputs the extracted header / payload information to the packet information analysis unit 122. In addition, the packet information extraction unit 121 transmits the extracted header / payload information to the packet analysis model learning device 20. This transmitted information is used by the packet analysis model learning device 20 to update the packet analysis model 200.

[0029] The packet information analysis unit 122 acquires in advance the packet analysis model 200 generated by the packet analysis model learning device 20. In addition, the packet information analysis unit 122 acquires the latest packet analysis model 200 from the packet analysis model learning device 20, for example, at predetermined time intervals or immediately before processing, and updates the packet analysis model 200 that it uses.

[0030] When the packet information analysis unit 122 acquires the header / payload information from the packet information extraction unit 121, it inputs the acquired header / payload information into the packet analysis model 200 to generate device classification candidate information 210 (see FIG. 2 ) indicating candidates for the manufacturer and functional category of the target device 5.

[0031] The device classification candidate information 210 is information that extracts candidate device classifications for narrowing down the manufacturer and functional category of the target device 5. For example, as shown in FIG. 2, manufacturer IDs and functional category IDs are stored in association with device classification IDs, and multiple candidates are shown. Here, the device classification ID is identification information of a classification indicated by a combination of a manufacturer and a functional category. The manufacturer ID is identification information of the manufacturer (sales) of the device 5. The functional category ID is identification information of a functional category. Note that, as functional categories, for example, televisions, digital cameras, sensor devices (temperature sensors, humidity sensors, acceleration sensors, etc.), lighting equipment, smart speakers, smart switches, smart hubs, automobiles, industrial robots, etc. are set. The device classification candidate information 210 shown in FIG. 2 is an analysis result of the packet analysis model 200, in which device classification candidates that have a probability close to the correct answer for the combination of the manufacturer and functional category of the target device 5 are arranged in the first to fifth rows in order of the probability of being correct. 2 shows an example in which the manufacturer IDs are "1" and "2" and the device classification candidates are output in descending order of the probability of correct answer, including cases where the manufacturers are different. In addition to this example, one manufacturer with a high probability of correct answer may be selected, and the function categories of that manufacturer may be output as device classification candidates in descending order of the probability of correct answer.

[0032] The packet information analysis unit 122 outputs the generated device classification candidate information 210 to the traffic waveform processing unit 13 ("traffic waveform analysis unit 132" to be described later).

[0033] 1, the traffic waveform processing unit 13 acquires in advance the waveform analysis model 300 generated by the waveform analysis model learning device 30. Then, the traffic waveform processing unit 13 receives packet set information 500 of the target device 5 from the traffic information collecting device 50, generates a traffic waveform indicating a time change in traffic, and estimates (determines) the functional category of the target device 5 by analyzing it using the waveform analysis model 300. Then, the traffic waveform processing unit 13 estimates the manufacturer and functional category of the target device 5 by narrowing down the target devices 5 of the determined functional category from the device candidates indicated in the device classification candidate information 210 generated by the packet processing unit 12. The traffic waveform processing unit 13 includes a traffic waveform generating unit 131 and a traffic waveform analyzing unit 132 .

[0034] The traffic waveform generating unit 131 receives packet collection information 500 of the target device 5 from the traffic information collecting device 50 via an input / output unit (not shown), and generates a waveform (traffic waveform information) showing the change in the transmitted packets over time by calculating the number of transmitted packets per unit time from the target device 5. 3 and 4 show examples of traffic waveform information, with Fig. 3 showing the traffic waveform of a smart hub and Fig. 4 showing the traffic waveform of a smart switch. In this way, traffic waveforms that differ depending on the functional category are learned as waveform analysis model 300. Thus, traffic waveform information is input to waveform analysis model 300, and the functional category is estimated from the waveform. The traffic waveform generation unit 131 outputs the generated traffic waveform information to the traffic waveform analysis unit 132. In addition, the traffic waveform generation unit 131 transmits the generated traffic waveform information to the waveform analysis model learning device 30. The transmitted information is used by the waveform analysis model learning device 30 to update the waveform analysis model 300.

[0035] The traffic waveform analysis unit 132 acquires in advance the waveform analysis model 300 generated by the waveform analysis model learning device 30. In addition, the traffic waveform analysis unit 132 acquires the latest waveform analysis model 300 from the waveform analysis model learning device 30, for example, at predetermined time intervals or immediately before processing, and updates the waveform analysis model 300 that it uses.

[0036] When the traffic waveform analysis unit 132 acquires traffic waveform information of the target device 5 from the traffic waveform generation unit 131, the traffic waveform analysis unit 132 inputs the acquired traffic waveform information to the waveform analysis model 300, thereby estimating (determining) the functional category of the target device 5. Then, the traffic waveform analysis unit 132 refers to the device classification candidate information 210 (see FIG. 2) acquired from the packet processing unit 12 (packet information analysis unit 122), narrows down the device classification candidates belonging to the determined functional category, and estimates the manufacturer and functional category of the target device 5. At this time, for example, if the analysis result by the waveform analysis model 300 is a functional category with a functional category ID of "4", the traffic waveform analysis unit 132 estimates that the device with the device classification ID "2" (manufacturer ID "1", functional category ID "4") among the device candidates shown in Figure 2 is classified as the target device 5. Furthermore, for example, if the analysis result by the waveform analysis model 300 is functional category ID "2," the traffic waveform analysis unit 132 estimates that the device (manufacturer ID "1," functional category ID "2") with device classification ID "1" (the device classification candidate in the first row) that is determined to have a higher probability of being correct among the two device classification candidates with functional category ID "2" shown in FIG. 2 is the classification of the target device 5. Furthermore, if the device classification candidate information 210 (FIG. 2) does not contain a functional category that is the same as the functional category (for example, functional category ID "6") indicated by the analysis result by the waveform analysis model 300, the traffic waveform analysis unit 132 presumes that the device (manufacturer ID "1", functional category ID "2") with device classification ID "1" (the device classification candidate in the first row) that is determined to have a higher probability of being correct by the packet analysis model 200 is the classification of the target device 5.

[0037] The traffic waveform analysis unit 132 outputs information on the estimated manufacturer and functional category of the target device 5 (hereinafter, referred to as “estimated result information”) to the device identification unit 14.

[0038] The device identification unit 14 receives estimation result information from the traffic waveform analysis unit 132 and device connection information from the device connection information extraction unit 11, thereby identifying the manufacturer, functional category, and device connection information for the target device 5 and generating device identification information. Then, the device identifying unit 14 transmits device identifying information including the manufacturer, the functional category, and the device connection information of the target device 5 to the analysis model management apparatus 40.

[0039] In this way, the device estimation apparatus 10 generates device classification candidate information 210 by inputting the header / payload information extracted from the packet set information 500 of the target device 5 into the packet analysis model 200, and can identify the manufacturer and functional category of the target device 5 by narrowing down the device classification candidates using the functional category obtained by analyzing the traffic waveform information of the target device 5 using the waveform analysis model 300. In this embodiment, the device estimation system 1 is described as having one device estimation apparatus 10, but when there are multiple managed networks 1000, the device estimation system 1 may have multiple device estimation apparatuses 10 corresponding to the multiple managed networks 1000. In this case, the multiple device estimation apparatuses 10 are connected to a packet analysis model learning apparatus 20, a waveform analysis model learning apparatus 30, and an analysis model management apparatus 40, respectively.

[0040] <Packet analysis model learning device> Next, the packet analysis model learning device 20 according to this embodiment will be described. The packet analysis model learning device 20 is a device that inputs header / payload information, which is information on statistics and keywords that can be extracted from the header and payload of a packet transmitted from a target device 5, and generates a packet analysis model 200 that outputs device classification candidate information 210 (see FIG. 2) that indicates candidates for the manufacturer and functional category of the target device 5. This packet analysis model learning device 20 generates the packet analysis model 200 by learning a set of the header / payload information, and the manufacturer and functional category of the target device as a learning dataset. The learning method used by the packet analysis model learning device 20 may be, for example, a machine learning method such as multiple regression analysis, random forest, or neural network, or a method such as pattern matching. In the following description, it is assumed that machine learning is performed. As shown in FIG. 5, the packet analysis model learning device 20 includes a control unit 21, an input / output unit 22, and a storage unit .

[0041] The input / output unit 22 inputs and outputs information between the analysis model management device 40, the device estimation device 10, etc. This input / output unit 22 is composed of a communication interface that transmits and receives information via a communication line, and an input / output interface that inputs and outputs information between an input device such as a keyboard and an output device such as a monitor (not shown).

[0042] The storage unit 23 is configured with a hard disk, a flash memory, a RAM, and the like. In the storage unit 23, a set of header / payload information, which is information on statistics and keywords that can be extracted from the header and payload of a packet transmitted from the target device 5, and the manufacturer and functional category of the target device 5 is stored as a learning dataset 230. In addition, the packet analysis model 200 generated by machine learning using the learning dataset 230 is stored in the storage unit 23. The storage unit 23 further temporarily stores programs for executing the various functional units of the control unit 21 and information required for the processing of the control unit 21.

[0043] The control unit 21 controls all of the processes executed by the packet analysis model learning device 20 , and includes a data collection unit 211 , a data set creation unit 212 , a learning unit 213 , and a packet analysis model output unit 214 .

[0044] In an initial model construction stage (hereinafter also referred to as the “initial stage”) prior to the stage (hereinafter referred to as the “operation stage”) in which the device estimation process is executed by the device estimation device 10, the data collection unit 211 acquires data (the “first learning dataset 431” described below) consisting of a pair of header / payload information and the corresponding correct answer data, that is, the manufacturer and functional category of the device 5, from the analysis model management device 40, and stores it in the memory unit 23 as the learning dataset 230 held by the data collection unit 211.

[0045] Furthermore, the data collection unit 211 acquires the header / payload information extracted for the target device 5 from the packet information extraction unit 121 of the device estimation apparatus 10 during the operation stage.

[0046] In the operation stage, the dataset creation unit 212 acquires, from the analysis model management device 40, for the header / payload information of the target device 5 acquired by the data collection unit 211 from the device estimation device 10, information (correct answer information) on the manufacturer and functional category indicated in the device identification information acquired as a processing result by the device estimation device 10 of the target device 5. Then, the dataset creation unit 212 newly creates a learning dataset 230 consisting of pairs of the header / payload information, and the manufacturer and functional category, and stores it in the storage unit 23. The data set creation unit 212 transmits the created learning data set 230 to the analysis model management device 40.

[0047] In an initial stage, the learning unit 213 generates a packet analysis model 200 by machine learning using the learning data set 230 (first learning data set 431) acquired by the data collection unit 211 from the analysis model management device 40.

[0048] In addition, during the operation phase, the learning unit 213 further performs machine learning using the learning dataset 230 created by the dataset creation unit 212 on a combination of the header / payload information of the target device 5 obtained from the device estimation device 10 (packet information extraction unit 121) and information on the manufacturer and functional category (correct answer information) indicated in the device identification information of the target device 5 obtained from the analysis model management device 40, and updates the packet analysis model 200.

[0049] In the initial stage, the packet analysis model output unit 214 outputs the packet analysis model 200 generated by the learning unit 213 to the device estimation device 10 (packet information analysis unit 122). In addition, in the operation stage, the packet analysis model output unit 214 outputs the packet analysis model 200 updated by the learning unit 213 to the device estimation device 10 (packet information analysis unit 122).

[0050] In this way, the packet analysis model learning device 20 can improve the estimation performance by re-learning (updating) the packet analysis model 200 using the new learning dataset 230 during the operation phase.

[0051] <Waveform analysis model learning device> Next, the waveform analysis model learning device 30 according to this embodiment will be described. The waveform analysis model learning device 30 is a device that receives a waveform (traffic waveform information) indicating a time change in the number of transmitted packets and generates a waveform analysis model 300 that outputs a functional category of the target device 5 . The learning method used by the waveform analysis model learning device 30 may be, for example, a machine learning method such as multiple regression analysis, random forest, or neural network, or a method such as pattern matching. In the following description, it is assumed that machine learning is performed. As shown in FIG. 6, the waveform analysis model learning device 30 includes a control unit 31, an input / output unit 32, and a storage unit 33.

[0052] The input / output unit 32 inputs and outputs information between the analysis model management device 40, the device estimation device 10, etc. This input / output unit 32 is composed of a communication interface that transmits and receives information via a communication line, and an input / output interface that inputs and outputs information between an input device such as a keyboard and an output device such as a monitor (not shown).

[0053] The storage unit 33 is configured with a hard disk, a flash memory, a RAM, and the like. In this storage unit 33, a pair of a waveform (traffic waveform information) indicating a time change in the number of transmitted packets of the target device 5 and the functional category of the target device 5 is stored as a learning dataset 330. In addition, the storage unit 33 stores a waveform analysis model 300 generated by machine learning using the learning dataset 330. The storage unit 33 further temporarily stores programs for executing the various functional units of the control unit 31 and information required for the processing of the control unit 31.

[0054] The control unit 31 controls all of the processes executed by the waveform analysis model learning device 30 , and includes a data collection unit 311 , a data set creation unit 312 , a learning unit 313 , and a waveform analysis model output unit 314 .

[0055] In the initial model construction stage (initial stage) prior to the stage (operation stage) in which the device estimation process is executed by the device estimation device 10, the data collection unit 311 acquires data consisting of a pair of traffic waveform information and the functional category of the target device 5 from the analysis model management device 40 (the “second learning dataset 432” described later), and stores it in the memory unit 33 as the learning dataset 330 held by the data collection unit 311.

[0056] Furthermore, the data collection unit 311 acquires traffic waveform information generated for the target device 5 from the traffic waveform generation unit 131 of the device estimation apparatus 10 during the operation stage.

[0057] In the operation stage, for the traffic waveform information of the target device 4 acquired by the data collection unit 311 from the device estimation device 10, the dataset creation unit 312 acquires, from the analysis model management device 40, information on the functional category indicated in the device identification information acquired as a processing result by the device estimation device 10 of the target device 5 (correct answer information). Then, the dataset creation unit 312 creates a new learning dataset 330 composed of pairs of traffic waveform information and functional categories, and stores it in the storage unit 33. The data set creation unit 312 transmits the created learning data set 330 to the analysis model management device 40.

[0058] In an initial stage, the learning unit 313 generates a waveform analysis model 300 by performing machine learning using the learning data set 330 (second learning data set 432) acquired by the data collection unit 311 from the analysis model management device 40.

[0059] In addition, during the operation phase, the learning unit 313 further performs machine learning using a learning dataset 330 created by the dataset creation unit 312 with a combination of the traffic waveform information of the target device 5 obtained from the device estimation device 10 (traffic waveform generation unit 131) and the functional category (correct answer information) indicated in the device identification information of the target device 5 obtained from the analysis model management device 40, to update the waveform analysis model 300.

[0060] The waveform analysis model output unit 314 outputs the waveform analysis model 300 generated by the learning unit 313 to the device estimation device 10 (traffic waveform analysis unit 132) in the initial stage. Also, the waveform analysis model output unit 314 outputs the waveform analysis model 300 updated by the learning unit 313 to the device estimation device 10 (traffic waveform analysis unit 132) in the operation stage.

[0061] In this way, the waveform analysis model learning device 30 can improve the estimation performance by re-learning (updating) the waveform analysis model 300 using a new learning data set 330 during the operation phase.

[0062] <Analysis model management device> Next, the analysis model management device 40 according to this embodiment will be described. The analysis model management device 40 is a device that manages learning data (learning data sets) for the packet analysis model 200 generated by the packet analysis model learning device 20 and the waveform analysis model 300 generated by the waveform analysis model learning device 30 in order to improve the estimation performance. As shown in FIG. 7, the analysis model management device 40 includes a control unit 41, an input / output unit 42, and a storage unit 43.

[0063] The input / output unit 42 inputs and outputs information between the packet analysis model learning device 20, the waveform analysis model learning device 30, the device estimation device 10, etc. This input / output unit 42 is composed of a communication interface that transmits and receives information via a communication line, and an input / output interface that inputs and outputs information between an input device such as a keyboard (not shown) and an output device such as a monitor.

[0064] The storage unit 43 is configured with a hard disk, a flash memory, a RAM, and the like. The storage unit 43 stores an initial learning data DB 430. The initial learning data DB 430 stores data (first learning data set 431) consisting of a pair of header / payload information to be transmitted to the packet analysis model learning device 20 in the initial stage and the manufacturer and functional category of the device 5, which are corresponding correct answer data. The initial learning data DB 430 also stores data (second learning data set 432) consisting of a pair of traffic waveform information to be transmitted to the waveform analysis model learning device 30 in the initial stage and the functional category of the target device 5. The storage unit 43 further temporarily stores programs for executing the various functional units of the control unit 41 and information required for the processing of the control unit 41.

[0065] The control unit 41 is responsible for all the processes executed by the analysis model management device 40 , and is configured to include an initial learning data providing unit 411 , a device identification information processing unit 412 , and a learning data updating unit 413 .

[0066] The initial learning data providing unit 411 transmits data (first learning data set 431) consisting of a set of header / payload information and the manufacturer and function category of the device 5, which are corresponding correct answer data, as an initial-stage learning data set to the packet analysis model learning device 20. As a result, the packet analysis model learning device 20 performs machine learning and generates the packet analysis model 200.

[0067] Furthermore, the initial learning data providing unit 411 transmits data (second learning data set 432) consisting of a pair of traffic waveform information and the functional category of the target device 5 as an initial-stage learning data set to the waveform analysis model learning device 30. As a result, the waveform analysis model learning device 30 performs machine learning and generates the waveform analysis model 300.

[0068] The device identification information processing unit 412 acquires device identification information, which identifies the manufacturer, the functional category, and the device connection information of the target device 5, from the device estimation apparatus 10 (the device identification unit 14). Then, the device identification information processing unit 412 transmits the obtained device identification information to the packet analysis model learning device 20 and the waveform analysis model learning device 30.

[0069] The learning data update unit 413 acquires the newly created learning dataset 230 from the packet analysis model learning device 20 (the dataset creation unit 212). Then, the learning data update unit 413 adds the acquired learning dataset 230 to the first learning dataset 431 stored in the initial learning data DB 430 to update it. Furthermore, the learning data update unit 413 acquires a newly created learning data set 330 from the waveform analysis model learning device 30 (the data set creation unit 312). Then, the learning data update unit 413 adds the acquired learning data set 330 to the second learning data set 432 stored in the initial learning data DB 430 to update it. In this way, a learning data set to which more accurate learning data has been added can be provided in the analytical model management device 40 as a learning data set for the initial stage.

[0070] As a result of the above, the packet analysis model learning device 20 can create a learning dataset using a combination of the header / payload information of the target device 5 acquired during the operation phase and information (correct answer information) on the manufacturer and functional category indicated in the device identification information of the target device 5 acquired from the analysis model management device 40, and perform machine learning to update the packet analysis model 200. In addition, the waveform analysis model learning device 30 can create a learning dataset using a combination of traffic waveform information of the target device 5 acquired during the operation phase and a functional category (correct answer information) indicated in the device identification information of the target device 5 acquired from the analysis model management device 40, and perform machine learning to update the waveform analysis model 300.

[0071] <Device estimation system processing> Next, a flow of processing (device estimation processing) of the device estimation system 1 according to this embodiment will be described. FIG. 8 is a flowchart showing the flow of processing in the device estimation system 1 according to this embodiment. Here, it is assumed that the packet analysis model learning device 20 acquires a learning data set (first learning data set 431) from the analysis model management device 40 in an initial stage and has already generated the packet analysis model 200. It is also assumed that the waveform analysis model learning device 30 acquires a learning data set (second learning data set 432) from the analysis model management device 40 in an initial stage and has already generated the waveform analysis model 300.

[0072] First, when starting the device estimation process, in the device estimation device 10, the packet information analysis unit 122 acquires the packet analysis model 200 from the packet analysis model learning device 20. In addition, the traffic waveform analysis unit 132 acquires the waveform analysis model 300 from the waveform analysis model learning device 30 (step S1).

[0073] Next, the data collector 51 of the traffic information collecting device 50 captures (collects) packets of the traffic flowing on the managed network 1000 via the switch 6 accommodated in the managed network 1000 (step S2).

[0074] Next, the packet set generating unit 52 of the traffic information collecting apparatus 50 groups the collected packets by source device (eg, MAC address of the target device 5) and generates packet set information 500 for each target device 5 (step S3). Then, the packet set generation unit 52 stores the generated packet set information 500 in the packet set database 53 and transmits it to the device estimation apparatus 10.

[0075] When the device estimation apparatus 10 receives the packet set information 500, the device connection information extraction unit 11, the packet processing unit 12, and the traffic waveform processing unit 13 execute the following processes. Note that this process may be performed in parallel for each target device 5 by, for example, virtualizing each function of the device estimation apparatus 10 into a VM (Virtual Machine) or a container.

[0076] The device connection information extraction unit 11 of the device estimation device 10 receives the packet set information 500 of the target device 5 from the traffic information collection device 50, and extracts information required for connecting to the target device 5 (e.g., MAC address, IP address, etc.) from the packet header, etc. as device connection information (step S4). Then, the device connection information extraction unit 11 outputs the extracted device connection information of the target device 5 to the device identification unit 14.

[0077] The packet processing unit 12 (packet information extraction unit 121) of the device estimation apparatus 10 receives packet collection information 500 of the target device 5 from the traffic information collection apparatus 50. Then, the packet information extraction unit 121 extracts statistics and keywords from the header and payload of the packet as header / payload information (step S5). The packet information extraction unit 121 outputs the extracted header / payload information to the packet information analysis unit 122 and also transmits it to the packet analysis model learning device 20 (step S6).

[0078] Next, the packet information analysis unit 122 generates device classification candidate information 210 (see FIG. 2) indicating candidates for the manufacturer and functional category of the target device 5 by inputting the acquired header / payload information into the packet analysis model 200 (step S7). Then, the packet information analysis unit 122 outputs the generated device classification candidate information 210 to the traffic waveform processing unit 13 .

[0079] The traffic waveform processing unit 13 (traffic waveform generating unit 131) of the device estimation apparatus 10 receives packet collection information 500 of the target device 5 from the traffic information collecting apparatus 50, and calculates the number of transmitted packets per unit time from the target device 5 to generate a waveform (traffic waveform information) showing the change in transmitted packets over time (step S8).

[0080] The traffic waveform generator 131 outputs the generated traffic waveform information to the traffic waveform analyzer 132 and also transmits it to the waveform analysis model learning device 30 (step S9).

[0081] Next, the traffic waveform analysis unit 132 inputs the acquired traffic waveform information into the waveform analysis model 300 to estimate (determine) the functional category of the target device 5 (step S10). Then, the traffic waveform analysis unit 132 refers to the device classification candidate information 210 (see FIG. 2) acquired from the packet processing unit 12 (packet information analysis unit 122), narrows down the device classification candidates based on the determined functional category, and estimates the manufacturer and model category of the target device 5 (step S11). Next, the traffic waveform analysis unit 132 outputs information on the estimated manufacturer and functional category of the target device 5 (estimated result information) to the device identification unit 14.

[0082] The device identification unit 14 receives the estimation result information from the traffic waveform analysis unit 132 and the device connection information from the device connection information extraction unit 11, thereby identifying the manufacturer, functional category, and device connection information for the target device 5 and generating device identification information (step S12). Then, the device identifying unit 14 transmits device identifying information including the manufacturer, the functional category, and the device connection information of the target device 5 to the analysis model management apparatus 40 (step S13).

[0083] The device identification information processing unit 412 of the analysis model management device 40 transmits the acquired device identification information to the packet analysis model learning device 20 and the waveform analysis model learning device 30 (step S14). Then, in step S15, the packet analysis model learning device 20 creates a new learning data set 230 based on the manufacturer and functional category information (correct answer information) indicated in the acquired device identification information, and updates the packet analysis model 200. Also, the waveform analysis model learning device 30 creates a new learning data set 330 based on the functional category (correct answer information) indicated in the acquired device identification information, and updates the waveform analysis model 300. The updated packet analysis model 200 and the updated waveform analysis model 300 are transmitted at a predetermined timing to the device estimation apparatus 10. This makes it possible to improve the estimation performance of the device estimation apparatus 10.

[0084] In addition, the packet analysis model learning device 20 and the waveform analysis model learning device 30 transmit the newly created learning data sets 230, 330 to the analysis model management device 40, and add them to the initial-stage learning data sets (the first learning data set 431, the second learning data set 432) to update them (step S16). In this manner, the process of the device estimation system 1 (device estimation process) ends.

[0085] <Hardware configuration> Each device of the device estimation system 1 according to this embodiment (the device estimation device 10, the packet analysis model learning device 20, the waveform analysis model learning device 30, the analysis model management device 40, and the traffic information collection device 50) is realized by a computer 900 having a configuration as shown in FIG. 9, for example. 9 is a hardware configuration diagram showing an example of a computer 900 that realizes the functions of each device in the device estimation system 1 according to this embodiment. The computer 900 has a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM 903, an HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0086] The CPU 901 operates based on a program stored in the ROM 902 or the HDD 904, and performs control by each control unit. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0087] The CPU 901 controls an input device 910 such as a mouse or a keyboard, and an output device 911 such as a display or a printer, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0088] The HDD 904 stores programs executed by the CPU 901 and data used by the programs, etc. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0089] The media I / F 907 reads a program or data stored in the recording medium 912, and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a semiconductor memory, or the like.

[0090] For example, when the computer 900 functions as each of the devices of the present invention (device estimation device 10, packet analysis model learning device 20, waveform analysis model learning device 30, analysis model management device 40, traffic information collection device 50), the CPU 901 of the computer 900 executes a program loaded onto the RAM 903 to realize the function of each device. Furthermore, the data in the RAM 903 is stored in the HDD 904. The CPU 901 reads and executes a program relating to a target process from the recording medium 912. Additionally, the CPU 901 may read a program relating to a target process from another device via a communication network (NW 920).

[0091] <Effects> The effects of the device estimation system according to the present invention will be described below. The device estimation system according to the present invention is a device estimation system 1 which estimates devices within a network (a managed network 1000), and the device estimation system 1 includes a traffic information collection device 50 which collects traffic information of a target device 5 which indicates the device to be estimated, a device estimation device 10 connected to the traffic information collection device 50, and a packet analysis model learning device 20, a waveform analysis model learning device 30 and an analysis model management device 40 which are all connected to the device estimation device 10.

[0092] The packet analysis model learning device 20 acquires the first learning dataset 431 from the analysis model management device 40 and learns from it, thereby generating a packet analysis model 200 that outputs candidates for the manufacturer and functional category of the target device 5 when statistics and keywords extracted from the header and payload of a packet transmitted by the target device 5 are input. In addition, the waveform analysis model learning device 30 acquires a second learning data set from the analysis model management device 40 and learns from it, thereby generating a waveform analysis model 300 that outputs the functional category of the target device 5 when traffic waveform information indicating the change over time in the number of packets transmitted by the target device 5 is input.

[0093] The traffic information collection device 50 includes a data collection unit 51 that collects traffic packets in the network, and a packet set generation unit 52 that generates packet set information by grouping the collected packets by source device, which is a target device 5.

[0094] The device estimation apparatus 10 includes a device connection information extraction unit 11 that receives packet set information and extracts device connection information indicating information for connecting to the target device 5, a packet processing unit 12 that receives packet set information from the traffic information collection apparatus 50, extracts statistics and keywords from the header and payload of the packet of the target device 5, and inputs the statistics and keywords to a packet analysis model 200 obtained from the packet analysis model learning apparatus 20, thereby generating device classification candidate information 210 indicating candidates for the manufacturer and functional category of the target device 5, and a packet processing unit 13 that receives packet set information from the traffic information collection apparatus 50 and extracts device connection information indicating information for connecting to the target device 5. The device is characterized by comprising a traffic waveform processing unit 13 that generates traffic waveform information of the device 5 and inputs the information to a waveform analysis model 300 obtained from the waveform analysis model learning device 30, thereby determining the functional category of the target device 5, and infers a candidate having the determined functional category from among the manufacturer and functional category candidates indicated in the device classification candidate information 210, as the manufacturer and functional category of the target device 5; and a device identification unit 14 that generates device identification information including the estimated manufacturer and functional category and the extracted device connection information of the target device, and transmits the information to the analysis model management device 40.

[0095] In this way, the device estimation device 10 of the device estimation system 1 extracts statistics and keywords from the header and payload extracted from the packets of the target device 5, and inputs them to the packet analysis model 200 acquired from the packet analysis model learning device 20, thereby generating candidates for the manufacturer and functional category of the target device 5. The device estimation device 10 also generates traffic waveform information from the packets of the target device 5, and inputs it to the waveform analysis model 300 acquired from the waveform analysis model learning device 30, thereby determining the functional category of the target device 5, narrowing down the candidates, and identifying the manufacturer and functional category of the target device 5. Therefore, according to the present device identification system 1, it is possible to improve the accuracy of estimating the manufacturer and functional category of the target device 5 from the traffic on the network.

[0096] In the device estimation system 1, the packet processing unit 12 of the device estimation device 10 transmits the extracted statistical values ​​and keywords to the packet analysis model learning device 20, the traffic waveform processing unit 13 of the device estimation device 10 transmits the generated traffic waveform information to the waveform analysis model learning device 30, the analysis model management device 40 transmits the acquired device identifying information to the packet analysis model learning device 20 and the waveform analysis model learning device 30, the packet analysis model learning device 20 creates a new learning data set by pairing the received statistical values ​​and keywords with the manufacturer and functional category indicated in the device identifying information, re-learns and updates the packet analysis model 200, and transmits the updated packet analysis model 200 to the device estimation device 10, and the waveform analysis model learning device 30 creates a new learning data set by pairing the received traffic waveform information with the functional category indicated in the device identifying information, re-learns and updates the waveform analysis model 300, and transmits the updated waveform analysis model 300 to the device estimation device.

[0097] In this way, the packet analysis model learning device 20 can acquire the statistical values ​​and keyword information extracted from the packets of the target device by the device estimation device 10, and the manufacturer and functional category information that are the device estimation results, to generate a learning data set, and re-learn the packet analysis model. Also, the waveform analysis model learning device 30 can acquire the traffic waveform information generated by the device estimation device 10 from the packets of the target device, and the functional category information that are the device estimation results, to generate a learning data set, and re-learn the waveform analysis model. Therefore, by the device estimation apparatus 10 acquiring the re-learned packet analysis model and waveform analysis model, it becomes possible to estimate the target device 5 with further improved accuracy.

[0098] Furthermore, in the device estimation system 1, the packet analysis model learning device 20 transmits a new learning data set that it has created to the analysis model management device 40, and adds it to the first learning data set 431 to update it, and the waveform analysis model learning device 30 transmits a new learning data set that it has created to the analysis model management device 40, and adds it to the second learning data set 432 to update it.

[0099] In this way, the number of learning data sets stored in the analysis model management device 40 can be increased every time the packet estimation process is executed. This makes it possible to generate more accurate packet analysis models 200 and waveform analysis models 300 in the packet analysis model learning device 20 and the waveform analysis model learning device 30, respectively.

[0100] The device estimation apparatus according to the present invention is a device estimation apparatus 10 which estimates devices within a network, and includes a device connection information extraction unit 11 which receives packet set information in which packets collected from the network are set for each source device, and extracts device connection information indicating information for connecting to a target device 5 which indicates the device to be estimated, and a device classification unit 200 which receives the packet set information, extracts statistics and keywords from the header and payload of the packet of the target device, and inputs the statistics and keywords to a packet analysis model 200, thereby outputting candidates for the manufacturer and functional category of the target device 5, and The device classification candidate information 210 includes a packet processing unit 12 that generates class candidate information 210, a traffic waveform processing unit 13 that receives packet set information, generates traffic waveform information indicating the time change in the number of transmitted packets of the target device 5, and inputs the traffic waveform information to a waveform analysis model 300 to output the functional category of the target device 5, and estimates that a candidate having the output functional category from among the manufacturer and functional category candidates indicated in the device classification candidate information 210 is the manufacturer and functional category of the target device 5, and a device identification unit 14 that generates device identification information including the estimated manufacturer and functional category and the extracted device connection information of the target device 5.

[0101] According to the device estimation apparatus 10, it is possible to improve the accuracy of estimating the manufacturer and functional category of the target device 5 from the traffic on the network.

[0102] The packet analysis model learning device according to the present invention comprises a device estimation device 10 which estimates devices in a network, and a packet analysis model learning device 20 which is connected to an analysis model management device 40. The packet analysis model learning device 20 includes a data collection unit 211 which acquires from the analysis model management device 40 a learning dataset indicated by a set of statistical values ​​and keywords extracted from packets of a target device 5 which indicates a device to be estimated, and a manufacturer and a functional category of the target device 5, and generates a packet analysis model 200 which outputs candidates for the manufacturer and functional category of the target device 5 when statistical values ​​and keywords extracted from a header and a payload of a transmission packet of the target device 5 are inputted using the acquired learning dataset. and a packet analysis model output unit 214 that transmits the generated packet analysis model 200 to the device estimation device 10. The data collection unit 211 acquires, from the device estimation device 10, information on statistics and keywords extracted from packets of the target device 5, and acquires information on a manufacturer and functional category identified for the target device 5 from the analysis model management device 40, and creates a new learning data set by combining the acquired statistics and keywords with the acquired manufacturer and functional category. The learning unit 213 re-learns and updates the packet analysis model 200, and the packet analysis model output unit 214 transmits the updated packet analysis model 200 to the device estimation device 10.

[0103] According to the present packet analysis model learning device 20, every time the device estimation device 10 executes the packet estimation process, a new learning data set can be created to update the packet analysis model 200. Therefore, it is possible to provide the device estimation device 10 with a packet analysis model 200 with higher estimation accuracy.

[0104] The waveform analysis model learning device according to the present invention comprises a device estimation device 10 which estimates devices in a network, and a waveform analysis model learning device 30 which is connected to an analysis model management device 40. The waveform analysis model learning device 30 comprises a data collection unit 311 which acquires from the analysis model management device 40 a learning dataset which is indicated by a combination of traffic waveform information which indicates a time change in the number of packets transmitted by a target device 5 which indicates a device to be estimated, and a functional category of the target device 5, and a learning unit which generates a waveform analysis model 300 which outputs the functional category of the target device 5 when traffic waveform information is inputted, using the acquired learning dataset. The data collection unit 311 acquires traffic waveform information of the target device 5 from the device estimation device 10, and acquires information on a functional category identified for the target device 5 from the analysis model management device 40, and creates a new learning data set by combining the acquired traffic waveform information with the acquired functional category, the learning unit 313 re-learns and updates the waveform analysis model 300, and the waveform analysis model output unit 314 transmits the updated waveform analysis model 300 to the device estimation device 10.

[0105] According to the present waveform analysis model learning device 30, every time the device estimation device 10 executes a packet estimation process, a new learning data set can be created to update the waveform analysis model 300. Therefore, it is possible to provide the device estimation device 10 with a waveform analysis model 300 with higher estimation accuracy.

[0106] The present invention is not limited to the above-described embodiment, and many modifications can be made by those having ordinary skill in the art within the technical scope of the present invention. [Explanation of symbols]

[0107] 1. Device Identification System 5 Devices (target devices) 6 Switch 10. Device Estimation Equipment 11. Device connection information extraction unit 12 Packet Processing Unit 13 Traffic waveform processing section 14 Device Specific Part 20 Packet analysis model learning device 21, 31, 41 Control section 22,32,42 Input / output section 23,33,43 Storage section 30 Waveform analysis model learning device 40 Analysis model management device 50 Traffic information collection device 51 Data Collection Department 52 Packet aggregation generator 53 Packet Set DB 121 Packet Extraction Unit 122 Packet Information Analysis Unit 131 Traffic Waveform Generator 132 Traffic Waveform Analysis Unit 200 Packet Analysis Model 210 Device Classification Candidate Information 211,311 Data Collection Department 212,312 Data Set Creation Department 213,313 Learning Department 214 Packet analysis model output section 230,330 Training Data Set 300 Waveform Analysis Model 314 Waveform analysis model output section 411 Initial Learning Data Provision Department 412 Device specific information processing unit 413 Learning Data Update Unit 430 Initial learning data DB 431 First training dataset 432 Second training dataset 500 Packet Collection Information 1000 Managed Networks

Claims

1. A device estimation system for estimating devices in a network, comprising: The device estimation system includes a traffic information collection device that collects traffic information of a target device indicating a device to be estimated, a device estimation device connected to the traffic information collection device, and a packet analysis model learning device, a waveform analysis model learning device, and an analysis model management device that are connected to the device estimation device; the packet analysis model learning device acquires a first learning data set from the analysis model management device and learns the data set, thereby generating a packet analysis model that outputs candidates for a manufacturer and a functional category of the target device when statistics and keywords extracted from a header and a payload of a packet transmitted by the target device are input; the waveform analysis model learning device acquires a second learning data set from the analysis model management device and learns the data, thereby generating a waveform analysis model that outputs a functional category of the target device when traffic waveform information indicating a time change in the number of packets transmitted by the target device is input; The traffic information collecting device comprises: a data collection unit that collects traffic packets in the network; a packet set generating unit that generates packet set information in which the collected packets are grouped for each transmission source device that is the target device, The device estimation apparatus includes: a device connection information extraction unit that receives the packet set information and extracts device connection information indicating information for connecting to the target device; a packet processing unit that receives the packet set information from the traffic information collecting device, extracts the statistics and the keywords from the headers and payloads of the packets of the target device, and inputs the statistics and the keywords into the packet analysis model obtained from the packet analysis model learning device, thereby generating device classification candidate information that indicates candidates for the manufacturer and function category of the target device in order of high probability of being correct; a traffic waveform processing unit that receives the packet set information from the traffic information collecting device, generates the traffic waveform information of the target device, and inputs the traffic waveform information of the target device into the waveform analysis model acquired from the waveform analysis model learning device to determine a functional category of the target device, selects a candidate having the determined functional category from among the candidates of manufacturers and functional categories indicated in the device classification candidate information, the candidate having the highest probability of correct answer, and estimates the candidate to be the manufacturer and functional category of the target device, and if there is no candidate having the determined functional category in the device classification candidate information, estimates the candidate having the highest probability of correct answer from among all the candidates indicated in the device classification candidate information to be the manufacturer and functional category of the target device; a device identification unit that generates device identification information including the estimated manufacturer and function category and the device connection information of the extracted target device, and transmits the device identification information to the analysis model management apparatus; A device estimation system comprising:

2. the packet processing unit of the device estimation apparatus transmits the extracted statistical value and the extracted keyword to the packet analysis model learning apparatus; the traffic waveform processing unit of the device estimation apparatus transmits the generated traffic waveform information to the waveform analysis model learning apparatus; the analysis model management device transmits the acquired device identification information to the packet analysis model learning device and the waveform analysis model learning device; the packet analysis model learning device creates a new learning data set by combining the received statistical value and keyword with the manufacturer and function category indicated in the device identification information, re-learns and updates the packet analysis model, and transmits the updated packet analysis model to the device estimation device; the waveform analysis model learning device creates a new learning data set by combining the received traffic waveform information with the functional category indicated by the device identification information, re-learns and updates the waveform analysis model, and transmits the updated waveform analysis model to the device estimation device. The device identification system according to claim 1 .

3. the packet analysis model learning device transmits a new learning data set created by itself to the analysis model management device, and adds it to the first learning data set to update it; the waveform analysis model learning device transmits a new learning data set created by itself to the analysis model management device, and adds the new learning data set to the second learning data set for updating the analysis model management device. The device identification system according to claim 2 .

4. A device estimation apparatus for estimating devices in a network, comprising: a device connection information extraction unit that receives packet set information in which packets collected from the network are grouped by source device, and extracts device connection information indicating information for connecting to a target device indicating a device to be estimated; a packet processing unit that receives the packet set information, extracts statistics and keywords from the headers and payloads of the packets of the target device, and inputs the statistics and keywords into a packet analysis model to output candidates for the manufacturer and functional category of the target device, thereby generating device classification candidate information that shows the candidates for the manufacturer and functional category of the target device in order of the probability of being correct; a traffic waveform processing unit that receives the packet set information, generates traffic waveform information indicating a time change in the number of transmitted packets of the target device, and inputs the generated traffic waveform information into a waveform analysis model to output a functional category of the target device, and selects, from among the candidates of manufacturers and functional categories indicated in the device classification candidate information, a candidate having the output functional category with the highest probability of correct answer to estimate the manufacturer and functional category of the target device, and if there is no candidate having the output functional category in the device classification candidate information, estimates the candidate having the highest probability of correct answer to be the manufacturer and functional category of the target device; a device identification unit that generates device identification information including the estimated manufacturer and functional category and the device connection information of the extracted target device; A device estimation apparatus comprising:

5. A program for causing a computer to function as the device estimation apparatus according to claim 4.

Images