Learning device, learning method, anomaly detection device, anomaly detection method, and program

Abstract

A learning device 10 includes a learning unit 11 which learns a first parameter and a second parameter included in a mapping model for mapping a feature vector that is generated on the basis of normal data input as training data to a region that is set on the basis of a preset subspace and distance from the subspace, said first parameter being for generating the feature vector and said second parameter being for adjusting the distance.

Description

[Technical field]

[0001] The present invention relates to a learning device and a learning method for learning parameters used in mapping, and an anomaly detection device and an anomaly detection method for detecting anomalies based on the results of mapping, and further relates to a program for realizing the learning device, the learning method, the anomaly detection device, and the anomaly detection method. To Regarding. [Background technology]

[0002] In order to prevent attacks on control systems used in infrastructure, plants, buildings, etc., a technology has been disclosed that monitors packets (e.g., packets containing control commands, process values, control values, etc.) flowing through the control system network and detects abnormal data generated by unauthorized control procedures.

[0003] As a related technique, Non-Patent Document 1 discloses a technique for separating feature vectors of normal data from abnormal data by mapping the feature vectors of normal data among input data to the inside of a hypersphere characterized by a center and a radius. In the technique of Non-Patent Document 1, a neural network is trained using Deep Support Vector Data Description (Deep SVDD) to fit as much normal data inside the hypersphere as possible while minimizing the volume of the hypersphere. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Lukas Ruff and 7 others, “Deep One-Class Classification”, July 2018, International Conference on Machine Learning 2018, p.4393 - p.4402 Summary of the Invention [Problem to be solved by the invention]

[0005] However, when normal data and abnormal data are mapped using the technology described in Non-Patent Document 1, a large amount of abnormal data may be mapped inside the hypersphere. One of the reasons why abnormal data is mapped inside the hypersphere is that the target system has multiple states. Note that the system state also includes a transitional state where the system state transitions.

[0006] According to one aspect, there is provided a learning device and a learning method for learning parameters for mapping so that normal data and abnormal data are accurately separated, and an anomaly detection device and an anomaly detection method for accurately detecting anomalies based on the results of the mapping, program The purpose is to provide. [Means for solving the problem]

[0007] In order to achieve the above object, a learning device according to one aspect comprises: a learning unit that learns a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to an area that is set based on a subspace that is set in advance and a distance from the subspace; The present invention is characterized by having the following.

[0008] In order to achieve the above object, an anomaly detection device according to one aspect includes: a mapping unit that inputs input data acquired from a target system into a mapping model, and maps a feature vector generated based on the input data to an area that is set based on a preset subspace and a distance from the subspace; A determination unit that determines that the feature vector is abnormal based on a result of the mapping; The present invention is characterized by having the following.

[0009] In order to achieve the above object, a learning method in one aspect includes: a learning step of learning a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to a region set based on a preset subspace and a distance from the subspace; The present invention is characterized by having the following.

[0010] In order to achieve the above object, an anomaly detection method according to one aspect includes: a mapping step of inputting input data acquired from a target system into a mapping model, and mapping a feature vector generated based on the input data to an area that is set based on a predefined subspace and a distance from the subspace; determining that the feature vector is abnormal based on a result of the mapping; The present invention is characterized by having the following.

[0011] In order to achieve the above objective, the program in one aspect M is , a learning step of learning a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to a region set based on a preset subspace and a distance from the subspace; 、 The recording medium is characterized in that it records a program including instructions for executing the above.

[0012] Furthermore, in order to achieve the above object, M is , a mapping step of inputting input data acquired from a target system into a mapping model, and mapping a feature vector generated based on the input data to an area that is set based on a predefined subspace and a distance from the subspace; determining that the feature vector is abnormal based on a result of the mapping; The recording medium is characterized in that it records a program including instructions for executing the above. Effect of the Invention

[0013] As one aspect, mapping is performed so that normal data and abnormal data are accurately separated, and abnormalities can be accurately detected based on the mapping results. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of a learning device. [Diagram 2] FIG. 2 is a diagram for explaining mapping of feature vectors. [Diagram 3] FIG. 3 is a diagram illustrating an example of a system having an anomaly detection device. [Figure 4] FIG. 4 is a diagram illustrating an example of the operation of the learning device. [Diagram 5] FIG. 5 is a diagram for explaining an example of the operation of the anomaly detection device. [Figure 6] FIG. 6 is a diagram illustrating an example of a system having an anomaly detection device. [Figure 7] FIG. 7 is a diagram for explaining an example of the operation of the anomaly detection device. [Figure 8] FIG. 8 is a block diagram illustrating an example of a computer that realizes the learning device and the anomaly detection device according to the first embodiment, the first modification, and the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] First, an overview will be given to facilitate understanding of the embodiments described below. A system having a learning device and an anomaly detection device described in the embodiment (a system belonging to the same technical field) is used to monitor packets flowing through a network of a control system in order to prevent attacks on the control system.

[0016] The learning device generates a model that accurately separates and maps normal data and abnormal data generated by an unauthorized control procedure. The anomaly detection device detects anomalies using the model generated by the learning device.

[0017] Conventionally, methods using AE (Auto Encoder), Deep SVDD, clustering, etc. have been proposed as methods for separating normal data from abnormal data.

[0018] In the method using AE, the separation of normal data from anomalous data depends on hyperparameters, so there is a problem in that the hyperparameters must be tuned.

[0019] Therefore, in order to solve the above-mentioned problem of AE, a mapping has been proposed to separate normal data from abnormal data using Deep SVDD shown in Non-Patent Document 1. However, the method using Deep SVDD shown in Non-Patent Document 1 has a problem in that it is not possible to separate normal data from abnormal data with high accuracy because the feature vectors of the abnormal data are mapped inside a hypersphere (a normal region that contains the feature vectors of the normal data).

[0020] One of the reasons why the feature vector of the abnormal data is mapped inside the hypersphere is that a control system has multiple system states during operation, and the behavior of the control system changes depending on the system state.

[0021] (1) The technology described in Non-Patent Document 1 uses a neural network that maps different inputs to different points.

[0022] The reason for mapping to different points is that if mapping to the same point is allowed, there is a risk that the feature vectors of normal data and the feature vectors of abnormal data will all be mapped to the same point, making it impossible to detect abnormal data.

[0023] (2) When a control system has multiple system states, the number of input patterns increases according to the system state. As the number of input patterns increases, the number of points to which normal data is mapped also increases.

[0024] Then, due to (1) and (2), the radius of the hypersphere must be increased in order to fit all the feature vector points of the different normal data into the hypersphere.

[0025] (3) In the technology described in Non-Patent Document 1, learning is performed using normal data, but not abnormal data. Therefore, points corresponding to the feature vectors of the abnormal data are distributed evenly throughout the entire space.

[0026] As a result, since the radius of the hypersphere is increased due to (1) and (2), the feature vectors of the abnormal data that are evenly distributed throughout the entire space due to (3) are more likely to be mapped inside the hypersphere.

[0027] Therefore, when there are multiple system states, even if the technique described in Non-Patent Document 1 is used, it becomes difficult to accurately separate normal data from abnormal data.

[0028] In addition to the above-mentioned methods, a method in which the above-mentioned methods are combined with clustering may be considered. However, the system state also includes a transitional system state during a state transition period.

[0029] In that case, in the method combining clustering, the transient normal data during a state transition and the normal data before and after the state transition are clustered into the same set, so that a single hypersphere still contains multiple system states, the radius of the hypersphere becomes large, and it becomes difficult to accurately separate normal data from abnormal data.

[0030] Through this process, the inventors discovered a problem that the conventional methods described above are unable to accurately separate normal data from abnormal data, and came up with a means for solving this problem.

[0031] That is, the inventor has derived a model that accurately separates and maps feature vectors of normal data and feature vectors of abnormal data in monitoring a control system, which is a meaningful product that humans could never generate. As a result, it is possible to accurately detect abnormalities that have occurred in the control system based on the results of mapping the feature vectors using this model.

[0032] Hereinafter, an embodiment will be described with reference to the drawings. In the drawings described below, elements having the same or corresponding functions are denoted by the same reference numerals, and repeated description thereof may be omitted.

[0033] (Embodiment 1) The configuration of the learning device in the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining an example of the learning device.

[0034] [Device configuration] The learning device 10 shown in Fig. 1 is a device that learns a model for mapping feature vectors of normal data and abnormal data acquired from a network of a control system to a subspace. As shown in Fig. 1, the learning device 10 has a learning unit 11 and a selection unit 12.

[0035] The learning device 10 is, for example, an information processing device such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), a GPU (Graphics Processing Unit), or a circuit equipped with any one or more of these, a server computer, a personal computer, a mobile terminal, or the like.

[0036] Data such as event series (traffic data) and time series (sensor data) flows through the network. The traffic data and sensor data may be stored in a storage device such as a database or a server computer by using a data collection device connected to the control system, for example.

[0037] The control system is a system used in public or public interest facilities, facilities, structures, etc., such as power plants, power grids, communication networks, roads, railways, ports, airports, water supply and sewerage systems, irrigation facilities, and flood control facilities.

[0038] An event sequence represents a sequence of events that occur when a control system controls an object. In other words, an event sequence represents the order of events that occur when an object is controlled. Events include, for example, control commands, state transition events, and notification events.

[0039] Traffic data is data including a pair of a packet and the date and time of receipt of the packet. The header field of a packet includes, for example, a source / destination Media Access Control (MAC) address, an Internet Protocol (IP) address, a port number, a version, etc. The payload of a packet includes, for example, an application type, an associated device ID, a control value, a status value, etc. Traffic data may include packet statistics.

[0040] A time series represents a series of process values ​​measured by a sensor. In other words, a time series represents the order of process values ​​that occur when an object is controlled. Process values ​​include, for example, continuous values ​​such as speed, position, temperature, pressure, and flow rate, and discrete values ​​that represent the switching of a switch. If a process value is controlled using an incorrect control procedure, the control system will fall into an abnormal state and the process value will also become abnormal.

[0041] A feature vector can be referred to, for example, as a feature, a latent vector, a representation vector, a representation, an embedding, a low-dimensional vector, a mapping onto a feature space, a mapping onto a representation space, or a mapping (projection) onto a latent space.

[0042] The learning unit 11 extracts feature vectors of normal data from the training data, and learns a mapping model used to map the feature vectors of the normal data to normal regions. After that, the learning unit 11 stores the learned mapping model in the storage device 20.

[0043] Specifically, the learning unit 11 first acquires subspace selection information related to the subspace from the selection unit 12. Next, the learning unit 11 sets the subspace and the like necessary for model learning based on the subspace selection information, and completes preparation for model learning.

[0044] The subspace may be, for example, a hypersphere, or a quadratic hypersurface (eg, a hyperellipsoid, a hyperhyperboloid, etc.), or a torus, or a hyperplane, etc.

[0045] Alternatively, the subspace may be a portion of a hypersphere, a quadratic hypersurface, a torus, or a hyperplane.

[0046] Alternatively, the subspace may be a union of one or more of a hypersphere, a quadratic hypersurface, a torus, and a hyperplane. Note that the union also includes a disjoint union (direct union).

[0047] Alternatively, the subspace may be a product set of one or more of a hypersphere, a quadratic hypersurface, a torus, and a hyperplane.

[0048] The subspace selection information includes information that represents the selected subspace, such as the number of dimensions of the selected subspace, the radius of a hypersphere, the coefficients of a quadratic hypersurface, the ellipticity of a hyperellipsoid, and affine transformation parameters that specify the inclination of a hyperplane.

[0049] The mapping model may be, for example, a linear model, a neural network, a kernel model, a logistic model, a probability distribution regression, a stochastic process regression, a hierarchical Bayesian model, a recurrent neural network (RNN), a transformer, etc. The learning method may be, for example, a generalized inverse matrix, a gradient descent method, a Monte Carlo method, etc.

[0050] Next, when the preparation for model learning is completed, learning starts. The learning unit 11 acquires normal data input as training data.

[0051] The training data may include, for example, data on event series, as well as time series, audio, images, video, relationship data (e.g., the presence or strength of friendships between people, the presence or strength of correlations between data, the presence or absence of inclusion relationships, etc.), behavioral history, etc.

[0052] Next, the learning unit 11 inputs the normal data input as training data into the model, generates a feature vector of the normal data, and learns the model for mapping the generated feature vector of the normal data into a normal region.

[0053] Specifically, the learning unit 11 generates, through learning, a first parameter used for generating a feature vector included in the model, and a second parameter used for adjusting the distance from the subspace.

[0054] The normal region is a region that is set based on a preset subspace and the distance from the subspace (distance from the surface), and is obtained by learning.

[0055] The mapping will now be described. Fig. 2 is a diagram for explaining mapping of feature vectors. First, conventional hypersphere mapping will be explained. When input data (traffic data) shown in Fig. 2 is input to a hypersphere mapping model 21 as shown in Non-Patent Document 1, not only feature vectors of normal data (black circles: ●) but also feature vectors of abnormal data (white circles: ○) are mapped inside the hypersphere 22 in Fig. 2.

[0056] Next, the subspace mapping of the present invention will be described. The subspace mapping model 23 shown in Fig. 2 is a model trained using a selected torus when a torus is selected as a subspace. When the input data shown in Fig. 2 is input to the trained subspace mapping model 23, if the input data is normal data, the feature vector of the normal data (black circle: ●) is mapped to the normal region 24 (near the submanifold) in Fig. 2. If the input data is abnormal data, the feature vector of the abnormal data (white circle: ○) is not mapped to the normal region 24.

[0057] The mapping model will now be described in detail. For example, when a hypersphere is selected as the subspace, the model can be expressed by a loss function such as Equation 1. However, the subspace is not limited to the hypersphere.

[0058]

number

[0059] The learning unit 11 learns, through learning, a first parameter used for generating a feature vector and a second parameter used for adjusting the distance from a subspace, which are included in the loss function (model) of Equation 1.

[0060] The center point may be preset, or may be learned as a third parameter.

[0061] In this way, the first parameter used to generate a feature vector, the second parameter used to adjust the distance of the normal region from the subspace, and the third parameter that specifies a part of the subspace can be set by learning, thereby reducing the work involved in adjusting the parameters.

[0062] In addition, by adding an auxiliary term to the loss function of Equation 1, the feature vectors of the normal data are dispersed so that they do not concentrate near the same point in the normal region.

[0063] As a result, by using the generated model, the feature vectors of normal data can be distributed evenly along the subspace. This prevents the feature vectors of normal data from distributing away from the subspace even if there is a large amount of different normal data, and as a result, the distance of the normal region from the subspace can be reduced. Therefore, the feature vectors of normal data can be mapped to a very thin normal region along the subspace, while the feature vectors of abnormal data can be mapped without following the subspace.

[0064] Furthermore, when mapping a hypersphere as a normal region as in the past, the volume of the hypersphere becomes large in order to fit the feature vectors of the normal data into the hypersphere, so the feature vectors of the abnormal data also get mixed up in the hypersphere.

[0065] However, by setting a subspace and a distance from the subspace as the normal region, the feature vectors of the normal data can be placed inside a small distance from the subspace, and the volume of the normal region can be reduced by making the normal region very thin, so that the feature vectors of the abnormal data are less likely to blend in with the normal region. In other words, the feature vectors of the normal data and the feature vectors of the abnormal data can be separated with high accuracy.

[0066] In addition, the feature vectors of normal data are treated as hyperspheres or quadratic hypersurfaceSince the feature vectors of normal data are mapped to small-volume normal regions around a curved subspace such as the one shown in FIG. 1, it becomes easy to separate the feature vectors of normal data in a transitional state connecting two normal states from the feature vectors of abnormal data that are merely located between two normal states, based on the relationship between the normal region and the feature vectors of normal data, and the relationship between the normal region and the feature vectors of abnormal data.

[0067] The mapping of the feature vector of abnormal data located between two normal states depends on the structure of the mapping model such as a neural network, but in many cases, it is mapped onto a straight line (geodesic) connecting two points on the curved subspace corresponding to the two normal states. Therefore, the feature vector of abnormal data located between two normal states is not mapped onto the curved subspace, but is mapped outside the normal region.

[0068] The selection unit 12 selects the subspace as described above. As the subspace, the selection unit 12 selects at least one of a hypersphere, a quadratic hypersurface (e.g., a hyperellipsoid, a hyperhyperboloid, etc.), a torus, a hyperplane, a part of these, or a union or intersection of these.

[0069] Specifically, first, a subspace for determining a normal region is selected. As a selection method, a method of displaying a plurality of subspaces on a screen and allowing a user to select a subspace is conceivable. Alternatively, a subspace suitable for a control system may be determined in advance by experiments, simulations, machine learning, or the like.

[0070] Next, after one of the subspaces is selected by the user, the selection unit 12 outputs the subspace selection information to the learning unit 11.

[0071] [System Configuration] Next, the configuration of the anomaly detection device 30 in the first embodiment will be specifically described with reference to Fig. 3. Fig. 3 is a diagram showing an example of a system having the anomaly detection device.

[0072] 3, the system in the first embodiment includes a learning device 10, a storage device 20, an anomaly detection device 30, and an output device 40. The anomaly detection device 30 includes a mapping unit 31, a determination unit 32, and an output information generation unit 33.

[0073] The system will now be described. The learning device 10 and the storage device 20 have already been explained, so their explanation will be omitted.

[0074] The anomaly detection device 30 is, for example, an information processing device such as a CPU, a programmable device such as an FPGA, a GPU, or a circuit equipped with any one or more of them, a server computer, a personal computer, or a mobile terminal.

[0075] The output device 40 acquires output information (to be described later) that has been converted into an outputtable format by the output information generating unit 33, and outputs generated images and sounds based on the output information. The output device 40 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may also include an audio output device such as a speaker. The output device 40 may also be a printing device such as a printer.

[0076] The abnormality detection device will be described. The mapping unit 31 inputs input data acquired from a target control system into the model, and maps the feature vector of the input data.

[0077] Specifically, the mapping unit 31 first obtains input data from a control system or a storage device (not shown).

[0078] The input data may be, for example, not only event series and time series data, but also time series, audio, images, videos, relationship data (such as the presence or strength of friendships between people, the presence or strength of correlations between data, the presence or absence of inclusion relationships, etc.), behavioral history, and other data.

[0079] Next, the mapping unit 31 inputs the input data to the mapping model and extracts a feature vector based on the learned mapping model. The feature vector is represented, for example, by a set of n (1 or more) real numbers.

[0080] Next, the mapping unit 31 outputs mapping result information indicating the result of the mapping to the decision unit 3. The mapping result is, for example, an image as shown in the mapping of the invention in FIG.

[0081] The mapping result information includes identification information for identifying the feature vector of each piece of input data, mapping position information indicating the position (point) of the feature vector, and distance information indicating the distance between the point and the normal area.

[0082] The determination unit 32 determines that the feature vector is abnormal based on the mapping result. Specifically, the determination unit 32 first obtains mapping result information from the mapping unit 31.

[0083] Next, the determination unit 32 detects feature vectors mapped outside the normal region based on the mapping result information. The determination unit 32 determines, among the feature vectors, the feature vectors mapped into the normal region as feature vectors of normal data, and determines the feature vectors mapped outside the normal region as feature vectors of abnormal data.

[0084] Next, the determination unit 32 outputs determination result information having the determination result to the output information generation unit 33. The determination result information has, for example, information such as a feature vector of the input data and a determination result indicating whether the input data is normal or abnormal. The determination result information may include, for example, a log.

[0085] Furthermore, the determination result may not only be a binary value of normal or abnormal, but may also have multiple levels of abnormality.

[0086] Furthermore, the determination unit 32 may further output the determination result information to another analysis engine.

[0087] The output information generating unit 33 acquires information such as the judgment result information and the input data, and generates output information by converting the information into a format that can be output to the output device 40. The output information is information for causing the output device 40 to output at least the judgment result.

[0088] (Variation 1) A description will be given of Modification 1. In Modification 1, another determination method of the determination unit 32 will be described.

[0089] The model for mapping the feature vector to the normal region is not necessarily a model trained using data acquired by operating the control system. Even if the model is trained using data acquired by operating the control system, there may be a large time difference between the time of training and the time of operation when the model is used. Moreover, even if there is almost no time difference, overtraining may occur.

[0090] Therefore, when mapping the feature vectors of data acquired from a control system during operation, an error occurs in the position of the feature vector, i.e., an error also occurs in the distance between the normal region and the feature vector.

[0091] Therefore, a threshold value used to absorb this error is set in advance. Specifically, the determination unit 32 compares the distance between the normal region and the feature vector with a threshold value set in advance based on the normal region, and determines whether the distance is equal to or greater than the threshold value.

[0092] The threshold value may be determined by an experiment or a simulation. It is desirable to set the threshold value so that the false positive rate is 1% or less. However, the false positive rate is not limited to 1%.

[0093] [Device operation] Next, the operation of the learning device and the anomaly detection device in the first embodiment will be described with reference to Figs. 4 and 5. Fig. 4 is a diagram for explaining an example of the operation of the learning device. Figs. 5 is a diagram for explaining an example of the operation of the anomaly detection device. In the following description, the diagrams will be referred to as appropriate. In addition, in the first embodiment, the learning method and the anomaly detection method are implemented by operating the learning device and the anomaly detection device. Therefore, the description of the learning method and the anomaly detection method in the first embodiment will be replaced by the following description of the operation of the learning device and the anomaly detection device.

[0094] The operation of the learning device will now be described. 4, the selection unit 12 selects a subspace for determining a normal region (step A1). Specifically, in step A1, the selection unit 12 selects, as the subspace, at least one of a hypersphere, a quadratic hypersurface (e.g., a hyperellipsoid, a hyperhyperboloid, etc.), a torus, a hyperplane, a part of these, and a union or intersection of these, and outputs subspace selection information regarding the subspace.

[0095] Next, the learning unit 11 acquires subspace selection information related to the subspace from the selection unit 12 (step A2). Next, the learning unit 11 sets the subspace and the like necessary for model learning based on the subspace selection information, and ends preparation for model learning (step A3).

[0096] Next, when the preparation for model learning is completed, learning starts. The learning unit 11 acquires normal data input as training data (step A4).

[0097] Next, the learning unit 11 inputs the normal data input as training data into the model, generates a feature vector of the normal data, and learns the model for mapping the generated feature vector of the normal data into a normal region (step A5).

[0098] Specifically, in step A5, the learning unit 11 generates, through learning, a first parameter used to generate a feature vector included in the model and a second parameter used to adjust the distance from the subspace.

[0099] Next, if the learning device 10 receives an instruction to end the learning process (step A6: Yes), the learning device 10 ends the learning process. If the learning process is to be continued (step A6: No), the learning device 10 proceeds to step A1 and continues the process.

[0100] The operation of the anomaly detection device will now be described. As shown in FIG. 5, the mapping unit 31 acquires input data from a control system or a storage device (not shown) (step B1).

[0101] Next, the mapping unit 31 inputs the input data to the mapping model and extracts a feature vector based on the learned mapping model (step B2). The feature vector is represented by, for example, a set of n (1 or more) real numbers.

[0102] Next, the mapping unit 31 outputs mapping result information indicating the result of the mapping to the decision unit 3. The mapping result is, for example, an image as shown in the mapping of the invention in FIG.

[0103] Next, the determination unit 32 acquires the mapping result information from the mapping unit 31 (step B3). Next, the determination unit 32 detects feature vectors that are mapped outside the normal region based on the mapping result information (step B4).

[0104] The determination unit 32 determines, among the feature vectors, the feature vectors mapped to the normal region as the feature vectors of normal data, and determines the feature vectors mapped outside the normal region as the feature vectors of abnormal data. The determination unit 32 outputs determination result information having the determination result to the output information generation unit 33.

[0105] The determination unit 32 may determine whether the characteristic vector is normal data or abnormal data based on the threshold value described in the first modification.

[0106] Furthermore, the determination result may not only be a binary value of normal or abnormal, but may also have multiple levels of abnormality.

[0107] Furthermore, the determination unit 32 may further output the determination result information to another analysis engine.

[0108] Next, the output information generation unit 33 acquires information such as the determination result information and the input data, and generates output information converted into a format that can be output to the output device 40 (step B5). Next, the output information generation unit 33 outputs the output information to the output device 40 (step B6).

[0109] Next, if the abnormality detection device 30 receives an instruction to end the abnormality detection process (step B7: Yes), the abnormality detection device 30 ends the abnormality detection process. If the abnormality detection process is to be continued (step B7: No), the abnormality detection device 30 proceeds to step B1 and continues the process.

[0110] [Effects of the First Embodiment] As described above, according to the first embodiment and the first modification, the first, second and third parameters can be set by learning, so that the work involved in adjusting the parameters can be reduced.

[0111] In addition, by adding an auxiliary term to the loss function of Equation 1, the feature vectors of the normal data are dispersed so that they do not concentrate near the same point in the normal region.

[0112] As a result, by using the generated model, the feature vectors of normal data can be distributed evenly along the subspace. This prevents the feature vectors of normal data from distributing away from the subspace even if there is a large amount of different normal data, and as a result, the distance of the normal region from the subspace can be reduced. Therefore, the feature vectors of normal data can be mapped to a very thin normal region along the subspace, while the feature vectors of abnormal data can be mapped without following the subspace.

[0113] Furthermore, when mapping a hypersphere as a normal region as in the past, the volume of the hypersphere becomes large in order to fit the feature vectors of the normal data into the hypersphere, so the feature vectors of the abnormal data are also mixed in with the hypersphere.

[0114] However, by setting a subspace and a distance from the subspace as the normal region, the feature vectors of the normal data can be placed inside a small distance from the subspace, and the volume of the normal region can be reduced by making the normal region very thin, so that the feature vectors of the abnormal data are less likely to blend in with the normal region. In other words, the feature vectors of the normal data and the feature vectors of the abnormal data can be separated with high accuracy.

[0115] In addition, the feature vectors of normal data are treated as hyperspheres or quadratic hypersurface Since the feature vectors of normal data are mapped to small-volume normal regions around a curved subspace such as the one shown in FIG. 1, it becomes easy to separate the feature vectors of normal data in a transitional state connecting two normal states from the feature vectors of abnormal data that are merely located between two normal states, based on the relationship between the normal region and the feature vectors of normal data, and the relationship between the normal region and the feature vectors of abnormal data.

[0116] [program] The program in the first embodiment and the first modification of the present invention may be a program that causes a computer to execute steps A1 to A6 shown in FIG. 4, and steps B1 to B7 shown in FIG.

[0117] The learning device and learning method, and the anomaly detection device and anomaly detection method of the present embodiment can be realized by installing and executing this program on a computer. In this case, the processor of the computer functions as the learning unit 11, the selection unit 12, the mapping unit 31, the determination unit 32, and the output information generation unit 33, and performs processing.

[0118] The program in this embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the learning unit 11, the selection unit 12, the mapping unit 31, the determination unit 32, and the output information generation unit 33.

[0119] (Embodiment 2) The configuration of an anomaly detection device in the second embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of a system having an anomaly detection device. In the second embodiment, an example in which an autoencoder is used for anomaly detection will be described.

[0120] [System Configuration] 6, the system in the second embodiment includes an anomaly detection device 70, a learning device 10, a storage device 20, and an output device 40. The anomaly detection device 70 includes a mapping unit 31, an output information generation unit 33, a determination unit 71, and an autoencoder 72.

[0121] The learning device 10, the storage device 20, the output device 40, the mapping unit 31, and the output information generating unit 33 have already been explained, so their explanation will be omitted.

[0122] The abnormality detection device will be described. The determining unit 71 determines whether the feature vector is abnormal by using the reconstruction error in addition to the mapping result.

[0123] Specifically, the determination unit 71 first acquires mapping result information from the mapping unit 31. Next, the determination unit 71 acquires reconstructed data corresponding to the input data, which is generated by inputting a feature vector of the input data to the autoencoder 72.

[0124] Next, the determining unit 71 generates reconstruction error information that indicates the difference between the input data and data corresponding to the input data that has been reconstructed from the feature vector of the input data.

[0125] The reconstruction error information is output as one or more real values ​​by calculating, for example, a squared error or a cross entropy.

[0126] Next, the determination unit 71, like the above-mentioned determination unit 32 (see the first embodiment and the first modification), determines whether the input data is normal or abnormal based on the mapping result (first determination). Furthermore, the determination unit 71 determines whether the input data is normal or abnormal based on the difference included in the reconstruction error information (second determination).

[0127] Next, when the first judgment and the second judgment are both normal, the judgment unit 71 judges that the input data is normal. When the first judgment and the second judgment are both abnormal, the judgment unit 71 judges that the input data is abnormal. Furthermore, when either the first judgment or the second judgment is abnormal, the judgment unit 71 judges that the input data is abnormal.

[0128] Or, the determination unit 71 ,Ma Based on the mapping result, a weighted sum of the distance between the feature vector of the input data and the subspace in the normal region and the difference included in the reconstruction error information is calculated. The weighted sum represents the degree of abnormality of the input data.

[0129] Next, the judgment unit 71, like the judgment unit 32 described above, pre-sets an anomaly judgment threshold for the weighted sum, and judges that the input data is normal when the weighted sum is below the threshold. The above If so, it is determined that the input data is abnormal.

[0130] Next, the determination unit 71 outputs determination result information having the determination result to the output information generation unit 33.

[0131] In the learning phase, the autoencoder 72 learns by inputting a feature vector of normal data. Furthermore, the parameters generated by the learning of the autoencoder 72 may be stored in a storage device provided in the anomaly detection device 70, or may be stored in a storage device other than the anomaly detection device 70.

[0132] When the autoencoder 72 is trained using the feature vector of normal data, if the input data is normal data, the autoencoder 72 can restore the input data. On the other hand, when abnormal data is input to the autoencoder 72, the autoencoder 72 cannot reflect the feature vector of the abnormal data.

[0133] Therefore, by comparing the input data and output data of the autoencoder 72, if there is a large difference, it can be determined that the input data contains abnormal data.

[0134] The mapping model and the autoencoder 72 may be trained in parallel or separately.

[0135] [Device operation] Next, the operation of the anomaly detection device in the second embodiment of the present invention will be described with reference to FIG. 7. FIG. 7 is a diagram for explaining an example of the operation of the anomaly detection device. In the following description, the diagram will be referred to as appropriate. In addition, in the second embodiment, an anomaly detection method is implemented by operating the anomaly detection device. Therefore, the description of the anomaly detection method in the second embodiment will be replaced by the following description of the operation of the anomaly detection device.

[0136] 7, the mapping unit 31 acquires input data from a control system or a storage device (not shown) (step B1). Next, the mapping unit 31 inputs the input data to a mapping model and extracts a feature vector based on the learned mapping model (step B2). Next, the mapping unit 31 outputs mapping result information representing the mapping result to the determination unit 71.

[0137] Next, the determination unit 71 acquires the mapping result information from the mapping unit 31 (step B3). Next, the determination unit 71 detects a feature vector that is mapped outside the normal area based on the mapping result information (step B4). Alternatively, the determination unit 71 calculates the distance from a subspace in the normal area to the feature vector.

[0138] The determination unit 71, like the above-mentioned determination unit 32 (see the first embodiment and the first modification), determines whether the input data is normal or abnormal based on the mapping result (first determination). The determination unit 71 outputs determination result information having the determination result to the output information generation unit 33.

[0139] Next, the determination unit 71 acquires reconstructed data corresponding to the input data, which is generated by inputting the feature vector of the input data to the autoencoder 72 (step C1).

[0140] Next, the determination unit 71 generates reconstruction error information that indicates the difference between the input data and data corresponding to the input data that has been reconstructed from the feature vector of the input data (step C2).

[0141] Next, the determining unit 71 further determines whether the input data is normal or abnormal, depending on the difference included in the reconstruction error information (second determination) (step C3).

[0142] Next, when the first judgment and the second judgment are both normal, the judgment unit 71 judges that the input data is normal (step C4). When the first judgment and the second judgment are both abnormal, the judgment unit 71 judges that the input data is abnormal. Furthermore, when either the first judgment or the second judgment is abnormal, the judgment unit 71 judges that the input data is abnormal.

[0143] Alternatively, the determination unit 71 determines the distance from the subspace in the normal region to the feature vector of the input data, The input data, and reconstruction error information representing a difference between the input data reconstructed from the feature vector of the input data and data corresponding to the input data. Furthermore, the weighted sum of the weighted sum is calculated. The above If so, the input data is determined to be abnormal.

[0144] Next, the determination unit 71 outputs determination result information having the determination result to the output information generation unit 33.

[0145] Next, the output information generation unit 33 acquires information such as the determination result information and the input data, and generates output information converted into a format that can be output to the output device 40 (step B5). Next, the output information generation unit 33 outputs the output information to the output device 40 (step B6).

[0146] Next, if the abnormality detection device 30 receives an instruction to end the abnormality detection process (step B7: Yes), the abnormality detection device 30 ends the abnormality detection process. If the abnormality detection process is to be continued (step B7: No), the abnormality detection device 30 proceeds to step B1 and continues the process.

[0147] [Effects of the second embodiment] As described above, according to the second embodiment, the accuracy of anomaly detection can be further improved compared to the first embodiment.

[0148] In addition, by imposing the task of reconstruction using an autoencoder, normal data with various states can be mapped more clearly and widely into the subspace according to the features than in embodiment 1. As a result, a better feature extractor is obtained.

[0149] [program] The program in the second embodiment of the present invention may be a program that causes a computer to execute steps B1 to B4, C1 to C4, and B5 to B7 shown in Fig. 7. By installing and executing this program in a computer, the anomaly detection device and anomaly detection method in this embodiment can be realized. In this case, the processor of the computer functions as the mapping unit 31, the determination unit 71, the output information generation unit 33, and the autoencoder 72 to perform processing.

[0150] The program in this embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the mapping unit 31, the determination unit 71, the output information generation unit 33, and the autoencoder 72.

[0151] [Physical configuration] Here, a computer that realizes the learning device and the anomaly detection device by executing the programs in the first embodiment, the first modification, and the second embodiment will be described with reference to Fig. 8. Fig. 8 is a block diagram showing an example of a computer that realizes the learning device and the anomaly detection device in the first embodiment, the first modification, and the second embodiment.

[0152] 8, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU or an FPGA in addition to the CPU 111 or instead of the CPU 111.

[0153] The CPU 111 loads the programs (codes) in this embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a dynamic random access memory (DRAM). The programs in this embodiment are provided in a state stored in a computer-readable recording medium 120. The programs in this embodiment may be distributed on the Internet connected via the communication interface 117. The recording medium 120 is a non-volatile recording medium.

[0154] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0155] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0156] Specific examples of recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0157] The learning device and the anomaly detection device in this embodiment can be realized by using hardware corresponding to each part, instead of a computer with a program installed. Furthermore, the learning device and the anomaly detection device may be realized in part by a program and the remaining part by hardware.

[0158] [Note] The following supplementary notes are further disclosed regarding the above-described embodiments. A part or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 21) described below, but are not limited to the following descriptions.

[0159] (Appendix 1) a learning unit that learns a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to an area that is set based on a subspace that is set in advance and a distance from the subspace; A learning device having the above configuration.

[0160] (Appendix 2) 2. The learning device according to claim 1, a selection unit that selects, as the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part thereof, a union or intersection thereof; A learning device having the above configuration.

[0161] (Appendix 3) 3. The learning device according to claim 1, An autoencoder that inputs the feature vector of the normal data and reconstructs input data corresponding to the feature vector. A learning device having the above configuration.

[0162] (Appendix 4) a mapping unit that inputs input data acquired from a target system into a mapping model, and maps a feature vector generated based on the input data to an area that is set based on a preset subspace and a distance from the subspace; A determination unit that determines that the feature vector is abnormal based on a result of the mapping; An anomaly detection device having the above configuration.

[0163] (Appendix 5) 5. The anomaly detection device according to claim 4, The determination unit determines that a feature vector mapped outside the region is abnormal. Anomaly detection device.

[0164] (Appendix 6) The anomaly detection device according to claim 4 or 5, An autoencoder that receives a feature vector of the normal data and reconstructs input data corresponding to the feature vector; The determination unit calculates a reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data to the autoencoder, and determines an abnormality in the feature vector based on a result of the mapping and the reconstruction error. Anomaly detection device.

[0165] (Appendix 7) 7. The anomaly detection device according to claim 4, The input data includes any one of network traffic data in the system and sensor data output from a sensor. Anomaly detection device.

[0166] (Appendix 8) a learning step of learning a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to a region set based on a preset subspace and a distance from the subspace; A learning method that has

[0167] (Appendix 9) 9. The learning method according to claim 8, further comprising: A selection step of selecting, as the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part thereof, a union or intersection thereof. A learning method that has

[0168] (Appendix 10) The learning method according to claim 8 or 9, an auto-encoding step of inputting a feature vector of the normal data and reconstructing input data corresponding to the feature vector; A learning method that has

[0169] (Appendix 11) a mapping step of inputting input data acquired from a target system into a mapping model, and mapping a feature vector generated based on the input data to an area that is set based on a predefined subspace and a distance from the subspace; determining that the feature vector is abnormal based on a result of the mapping; The anomaly detection method includes the steps of:

[0170] (Appendix 12) 12. The anomaly detection method according to claim 11, In the determination step, a feature vector mapped outside the region is determined to be abnormal. Anomaly detection methods.

[0171] (Appendix 13) The anomaly detection method according to claim 11 or 12, an auto-encoding step of inputting a feature vector of the normal data and reconstructing input data corresponding to the feature vector; In the determination step, a reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data is calculated, and an abnormality in the feature vector is determined based on the reconstruction error due to the reconstruction. Anomaly detection methods.

[0172] (Appendix 14) 14. The anomaly detection method according to any one of claims 11 to 13, The input data includes any one of network traffic data in the system and sensor data output from a sensor. Anomaly detection methods.

[0173] (Appendix 15) On the computer, a learning step of learning a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter and the second parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to a region set based on a preset subspace and a distance from the subspace; Contains instructions to execute Mup Logura Hmm.

[0174] (Appendix 16) As described in Appendix 15 program And, The program causes the computer to A selection step of selecting, as the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part thereof, a union or intersection thereof. Contains instructions to execute Mup Logura Hmm.

[0175] (Appendix 17) The method described in Appendix 15 or 16 program And, The program causes the computer to an auto-encoding step of inputting a feature vector of the normal data and reconstructing input data corresponding to the feature vector; Contains instructions to execute Mup Logura Hmm.

[0176] (Appendix 18) On the computer, a mapping step of inputting input data acquired from a target system into a mapping model, and mapping a feature vector generated based on the input data to an area that is set based on a predefined subspace and a distance from the subspace; determining that the feature vector is abnormal based on a result of the mapping; Contains instructions to execute Mup Logura Hmm.

[0177] (Appendix 19) As described in Appendix 18 program And, In the determination step, a feature vector mapped outside the region is determined to be abnormal. program .

[0178] (Appendix 20) The method described in Appendix 18 or 19 program And, The program causes the computer to An instruction to execute an auto-encoding step of receiving a feature vector of normal data and reconstructing input data corresponding to the feature vector, In the determination step, a reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data is calculated, and an abnormality in the feature vector is determined based on a result of the mapping and the reconstruction error. program .

[0179] (Appendix 21) Any one of appendix 18 to 20 program And, The input data includes any one of network traffic data in the system and sensor data output from a sensor. program .

[0180] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0181] As described above, according to the present invention, mapping can be performed so that normal data and abnormal data are accurately separated, and abnormalities can be accurately detected based on the mapping results. The present invention is useful in fields where monitoring of control systems is required. [Explanation of symbols]

[0182] 10 Learning Device 11 Learning Department 12 Selection section 20 Storage device 30 Anomaly detection device 31 Mapping Section 32 Judgment section 33 Output information generation unit 40 Output Device 70 Anomaly detection device 71 Judgment section 72 Autoencoder 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. A learning means for learning a first parameter for generating the feature vector and a second parameter for adjusting the distance, the first parameter being included in a mapping model for mapping a feature vector generated based on normal data input as training data to an area set based on a preset subspace and a distance from the subspace. A learning device having the above configuration.

2. The learning device according to claim 1 , A selection means for selecting, as the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part thereof, a union or intersection thereof. A learning device having the above configuration.

3. The learning device according to claim 1 or 2, An autoencoder that inputs the feature vector of the normal data and reconstructs input data corresponding to the feature vector. A learning device having the above configuration.

4. a mapping means for inputting input data acquired from a target system into a mapping model, and mapping a feature vector generated based on the input data into an area that is set based on a preset subspace and a distance from the subspace; A determination means for determining that the feature vector is abnormal based on a result of the mapping; An anomaly detection device having the above configuration.

5. The anomaly detection device according to claim 4, The determining means determines that a feature vector mapped outside the region is abnormal. Anomaly detection device.

6. The anomaly detection device according to claim 4 or 5, An autoencoder that receives a feature vector of normal data and reconstructs input data corresponding to the feature vector; The determination means calculates a reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data to the autoencoder, and determines an abnormality in the feature vector based on a result of the mapping and the reconstruction error. Anomaly detection device.

7. The anomaly detection device according to claim 4, The input data includes any one of network traffic data in the system and sensor data output from a sensor. Anomaly detection device.

8. A computer comprising: A mapping model for mapping a feature vector generated based on normal data input as training data to an area set based on a preset subspace and a distance from the subspace is learned, the mapping model including a first parameter for generating the feature vector and a second parameter for adjusting the distance. How to learn.

9. The learning method according to claim 8, The computer, As the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part of these, a union or intersection of these is selected. How to learn.

10. The learning method according to claim 8 or 9, The computer, The feature vector of the normal data is input, and input data corresponding to the feature vector is reconstructed. How to learn.

11. A computer comprising: Input data acquired from a target system is input to a mapping model, and a feature vector generated based on the input data is mapped to an area that is set based on a predefined subspace and a distance from the subspace; The feature vector is determined to be abnormal based on the result of the mapping. Anomaly detection methods.

12. The anomaly detection method according to claim 11, The computer, In the determination, a feature vector that is mapped outside the region is determined to be abnormal. Anomaly detection methods.

13. The anomaly detection method according to claim 11 or 12, The computer, A feature vector of normal data is input, and input data corresponding to the feature vector is reconstructed; In the determination, a reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data is calculated, and an abnormality in the feature vector is determined based on a result of the mapping and the reconstruction error. Anomaly detection methods.

14. The anomaly detection method according to claim 11, The input data includes any one of network traffic data in the system and sensor data output from a sensor. Anomaly detection methods.

15. On the computer, A mapping model for mapping a feature vector generated based on normal data input as training data to an area set based on a preset subspace and a distance from the subspace is learned, the mapping model including a first parameter for generating the feature vector and a second parameter for adjusting the distance. A program that contains instructions to carry out a process.

16. The program according to claim 15, The program causes the computer to As the subspace, at least one of a hypersphere, a hyperellipsoid, a hyperhyperboloid, a torus, a hyperplane, a part of these, a union or intersection of these is selected. A program that contains instructions to carry out a process.

17. 17. The program according to claim 15 or 16, The program causes the computer to The feature vector of the normal data is input, and input data corresponding to the feature vector is reconstructed. A program that contains instructions to carry out a process.

18. On the computer, Input data acquired from a target system is input to a mapping model, and a feature vector generated based on the input data is mapped to an area that is set based on a predefined subspace and a distance from the subspace; The feature vector is determined to be abnormal based on the result of the mapping. A program that contains instructions to carry out a process.

19. 20. The program of claim 18, The program causes the computer to In the determination, a feature vector that is mapped outside the region is determined to be abnormal. A program that contains instructions to carry out a process.

20. 20. The program according to claim 18 or 19, The program causes the computer to A feature vector of normal data is input, and input data corresponding to the feature vector is reconstructed; A reconstruction error representing a difference between the input data and data reconstructed by inputting a feature vector of the input data is calculated, and an abnormality in the feature vector is determined based on the mapping result and the reconstruction error. A program that contains instructions to carry out a process.

21. 20. The program of claim 18, The input data includes any one of network traffic data in the system and sensor data output from a sensor. program.

Images