Abnormality management device, abnormality management method, and abnormality management system

Abstract

An object is to appropriately manage abnormal communication with a simpler configuration. 【Solution means】 The abnormality management device 1 uses normal data indicating the number of normal packets received in each time zone as teacher data, and learns the parameters of a probability model that outputs the posterior probability that the number of packets received in each time zone is normal by maximum likelihood estimation. A learning unit 11, a posterior probability in each time zone estimated by the learned probability model, a probability distribution of normal data estimated based on the normal data, and a prior probability of being normal. A derivation unit 12 that derives a probability distribution of abnormal data indicating an abnormal number of packets, and a probability distribution of normal data corresponding to each time zone and a probability distribution of abnormal data. And a setting unit 13 that sets, as a threshold for abnormality determination of the number of packets received in each time zone, the number of packets corresponding to the value of the probability distribution that becomes an equal value.

Description

[Technical field]

[0001] The present invention relates to an abnormality management device, an abnormality management method, and an abnormality management system. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread in addition to smartphones and tablets. As the number of IoT devices increases, the amount of traffic in the entire communication network increases, making communication traffic management even more important.

[0003] Conventionally, attacks have been known in which malicious attackers intentionally send a large number of short packets to a specific device, causing congestion and even resource exhaustion. To detect such abnormal communications, for example, Patent Document 1 discloses a system that performs two-stage CNN processing on time-series data, calculates an anomaly score without a teacher, and estimates the feature amount and time that contributed to the anomaly.

[0004] In Patent Document 1, a system for detecting anomalies is constructed using unsupervised learning because there is little data on anomalous communications. However, since it is necessary to determine the deviation between normal communications and anomalous communications without any data on anomalous communications, the system configuration becomes more complex in order to improve detection accuracy. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7586322 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it may be difficult to appropriately manage abnormal communications with a simple configuration.

[0007] The present invention has been made to solve the above-described problems, and an object thereof is to appropriately manage abnormal communication with a simpler configuration.

Means for Solving the Problems

[0008] In order to solve the above-described problems, an abnormality management apparatus according to the present invention uses normal data indicating the number of normal packets received in each time period as teacher data, and outputs a posterior probability that the number of packets received in each time period is normal. A learning unit configured to learn parameters of a probability model by maximum likelihood estimation; the posterior probability in each time period estimated by the learned probability model; the probability distribution of the normal data estimated based on the normal data; and a normal prior probability And a derivation unit configured to derive a probability distribution of abnormal data indicating an abnormal number of packets, and a probability distribution value at which the probability distribution of the normal data corresponding to each time period and the probability distribution of the abnormal data are equal values. And a setting unit configured to set the number of packets corresponding to the threshold value for determining abnormality of the number of packets received in each time period.

[0009] Further, the abnormality management apparatus according to the present invention may further include a notification unit configured to notify the communication node that processes the packet of the set threshold value.

[0010] Further, the abnormality management apparatus according to the present invention may further include a collection unit configured to collect the normal data indicating the number of normal packets received by the communication node in each time period, and the learning unit may use the normal data collected by the collection unit as the teacher data.

[0011] In order to solve the above-described problems, the anomaly management method according to the present invention includes a learning step of learning, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period is normal, using normal data indicating the number of normal packets received in each time period as teacher data; a derivation step of deriving a probability distribution of anomaly data indicating an abnormal number of packets based on the posterior probability in each time period estimated by the probability model learned in the learning step, the probability distribution of the normal data estimated based on the normal data, and a prior probability of being normal; and a setting step of setting, as a threshold for anomaly determination of the number of packets received in each time period, the number of packets corresponding to a value of the probability distribution at which the probability distribution of the normal data corresponding to each time period and the probability distribution of the anomaly data become equal values.

[0012] Further, the anomaly management method according to the present invention may further include a notification step of notifying the set threshold to a communication node that processes packets.

[0013] Further, the anomaly management method according to the present invention may further include a collection step of collecting the normal data indicating the number of normal packets received by the communication node in each time period, and the learning step may use the normal data collected in the collection step as the teacher data.

[0014] In order to solve the above-described problems, an anomaly management system according to the present invention is an anomaly management system including the anomaly management device according to any one of claims 1 to 3 and the communication node, wherein the communication node is configured to obtain, as the number of packets to be managed, the number of packets received in each time period; configured to perform anomaly determination of the number of packets to be managed in each time period based on the threshold; and includes an alarm unit configured to output an alarm when the determination unit determines that the number of packets to be managed is abnormal.

Effects of the Invention

[0015] According to the present invention, the number of packets corresponding to the value of the probability distribution at which the probability distribution of normal data and the probability distribution of abnormal data corresponding to each time zone become equal values is set as the threshold value for determining abnormality of the number of packets received in each time zone. Therefore, abnormal communication can be appropriately managed with a simpler configuration.

Brief Description of the Drawings

[0016] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram for explaining abnormal data of the number of received packets managed by the abnormality management system according to the present embodiment. [Figure 3] FIG. 3 is a block diagram showing the hardware configuration of the abnormality management device according to the present embodiment. [Figure 4] FIG. 4 is a block diagram showing the hardware configuration of the communication node according to the present embodiment. [Figure 5] FIG. 5 is a sequence diagram showing the operation of the abnormality management system according to the present embodiment. [Figure 6] FIG. 6 is a flowchart showing the operation of the abnormality management device according to the present embodiment.

Embodiments for Carrying Out the Invention

[0017] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to FIGS. 1 to 6.

[0018] [Configuration of Abnormality Management System] First, referring to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 and a communication node 2 according to an embodiment of the present invention will be described.

[0019] The anomaly management system according to this embodiment includes an anomaly management device 1 and a communication node 2. The anomaly management system is provided in a network that uses a mobile communication network compliant with 3G, 4G / LTE, 5G, 6G, etc. or a fixed-line network. As shown in FIG. 1, the anomaly management device 1 is connected to the communication node 2 via a network NW such as a LAN, WAN, or the Internet.

[0020] The communication node 2 is a network device having a function of counting the number of received packets, recording them in a log file, and sending them out externally, and is realized by a router, an access point, a switch, etc. The communication node 2 can record the number of received packets every certain time period, such as every 10 minutes. Also, the communication node 2 acquires, as normal data indicating the normal number of received packets used by the learning unit 11 of the anomaly management device 1 described later, the number of received packets over an arbitrarily set period, such as one month. The functional blocks and hardware configuration of the communication node 2 will be described later.

[0021] FIG. 2(a) is a diagram for explaining normal data indicating the normal number of received packets and abnormal data indicating the abnormal number of received packets. The horizontal axis represents time, and the vertical axis represents the number of packets received by the communication node 2. The dotted line value in FIG. 2(a) indicates normal data a1, which is the normal number of received packets over all time periods. The normal number of received packets refers to the number of packets observed in a certain time period in a normal communication environment when, for example, the number of packets is within an allowable range based on past communication history.

[0022] On the one hand, regarding the number of received packets represented by the solid line shown in Fig. 2(a), the number of received packets increases sharply during time period t1. The number of received packets represented by the solid line during this time period t1 is abnormal data b1, which is an abnormal number of received packets. Abnormal data indicates the number of received packets that deviates from the range of packet numbers considered normal. Further, abnormal data reflects abnormal behavior caused by attacks, malfunctions, etc., and indicates that a number of packets that can stress the packet processing performance of the communication node 2 such as a router have been received during a certain time period. In the example of Fig. 2(a), an attack occurs where a large number of short packets are sent in a short time. Thus, in particular, abnormal data can be set as data for abnormal detection, which is an abnormality that has a relatively small number of received bytes and is difficult to detect based on traffic volume.

[0023] [Functional Blocks of the Abnormality Management Device] Next, the functional blocks of the abnormality management device 1 according to the present embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10, a learning unit 11, a derivation unit 12, a setting unit 13, a notification unit 14, and a storage unit 15. The abnormality management device 1 performs learning based on normal data and sets a threshold value for abnormality determination.

[0024] The collection unit 10 collects normal data indicating the number of normal packets received by the communication node 2 in each time period. The collection unit 10 collects the number of received packets per unit time (e.g., 10 minutes) received and recorded by the communication node 2 over a certain period (e.g., one month). Since the number of packets received by the communication node 2 has very little abnormal data, it is assumed that it can be treated as normal data.

[0025] The learning unit 11 learns the parameters of a probability model that outputs the posterior probability that the number of packets received in each time period is normal, using the normal data indicating the number of normal packets received in each time period as teacher data, by maximum likelihood estimation. The learning unit 11 learns the probability model by maximum likelihood estimation using normal data in a situation where there is little abnormal data.

[0026] Here, let x be the number of received packets x in a time period at a certain observation point. Also, as shown in the following equation (1), the probability density function (probability distribution) of normal data is ρ d (x), and the probability density function (probability distribution) of abnormal data is ρ g (x) are defined respectively.

Equation

[0027] In the above equation (1), y = 1 indicates the normal class, and y = 0 indicates the abnormal class. Therefore, ρ d (x) shows the occurrence tendency of the number of received packets x when belonging to the normal class y = 1, and ρ g (x) shows the occurrence tendency of the number of received packets x when belonging to the abnormal class y = 0. Here, (b) in Figure 2 shows that the horizontal axis is the number of received packets and the vertical axis is the probability distribution, corresponding to the normal data a1 and abnormal data b1 (black circle data points) at time period t1 in (a) of Figure 2, showing the probability distribution (probability density function) a2 of normal data and the probability distribution (probability density function) b2 of abnormal data. In the example of (b) in Figure 2, the probability distributions of both normal data and abnormal data follow a normal distribution.

[0028] The density ratio γ(x) of the probability density function in the above equation (1) is expressed by the following equation (2).

Equation

[0029]

Equation

[0030] Here, if we set π = ρ(y = 1), the above equation (3) can be further expressed by the following equation (4).

Equation

[0031] Therefore, first, we will find the posterior probability ρ(y = 1|x) of being normal (y = 1) with a large number of received packet numbers x. Assuming that the posterior probability ρ(y = 1|x) of normal data follows a normal distribution, it is defined as shown in the following equation (5).

Equation

[0032] Furthermore, if the output f(x n ) of the probability model is represented by a linear combination, it can be expressed as in the following equation (6).

Equation

[0033] [Number] In the above equation (7), Φ is the matrix of the feature vector x of all observed data. t n is the vector t of the number of received packets of the correct answer (normal data) at each observation point x n =(t1,···,t N ) T represents. Furthermore, in the above equation (7), Φ is represented by the following equation (8).

[0034] [Number] That is, Φ is an N×M matrix obtained by arranging the feature vectors Φ(x n ) obtained from each observation point as rows for N observation points x n .

[0035] Furthermore, the average of the error between the estimated number of received packets f(x n ) based on the learned parameter w and the actual normal number of received packets t n (teacher signal) is the variance σ of the normal distribution shown by the following equation (9) 2 . [Number]

[0036] Thus, when the probability model represented by the linear combination estimates the posterior probability that the number of received packets is normal for the input x, each observed value t is assumed to follow a normal distribution with the estimated value f(x n ) of the probability model as the mean. By performing maximum likelihood estimation for all data (x n ,t n ), the parameter w of the probability model and the variance σ of the error 2 are estimated. Also, from the definition formula of the normal distribution in the above equation (5), the probability distribution (probability density function) ρ d (x) of the normal data is obtained.

[0037] Here, when approximately estimating the posterior probability ρ(y = 1|x) of normal data, ρ(y = 1|x) ≈ q w becomes the relationship of (y = 1|x). The estimated value q of the posterior probability that the input number of received packets x is normal w Based on (y = 1|x), cross-entropy is defined as the loss function U as shown in the following equation (10).

Equation

[0038] The convergence value (minimum value) of the loss function U in the above equation (10) is represented by the following equation (11).

Equation

[0039] The derivation unit 12 transforms the above equation (11) into the following equation (12) to derive the probability distribution (density function) ρ g (x) of abnormal data.

Equation

[0040] In the above equation (12), the probability distribution (density function) ρ d (x) of normal data is calculated from the normal data collected by the collection unit 10. Also, since the prior probability π of normal data is much larger than the prior probability (1 - π) of abnormal data, it can be set to 0.99, for example. Furthermore, for the observed value x, the log-likelihood lnq w (y = 1|x) is obtained by maximum likelihood estimation based on a large amount of normal data (teacher signals) as shown in the above equations (6) to (9). Thus, even when there is little abnormal data, the probability distribution of abnormal data can be obtained from normal data.

[0041] The derivation unit 12 uses the estimated value q of the posterior probability estimated by the probability model learned by the learning unit 11 w(y = 1|x), and the probability distribution (density function) ρ estimated based on normal data d (x), and the prior probability π of being normal, based on which the probability distribution (density function) ρ of abnormal data indicating the number of abnormal received packets is derived. g (x).

[0042] The setting unit 13 sets, as the threshold for abnormality determination of the number of packets received in each time zone, the number of packets corresponding to the value of the probability distribution at which the probability distribution of normal data and the probability distribution of abnormal data corresponding to each time zone become equal. As shown in Fig. 2(b), the setting unit 13 sets, as the threshold in time zone t1, the number of received packets at the intersection of the probability distribution of normal data a2 and the probability distribution of abnormal data b2 in time zone t1. The setting unit 13 sets the threshold for abnormality determination for each time zone.

[0043] The notification unit 14 notifies the communication node 2 that processes packets of the set threshold. The notification unit 14 notifies the communication node 2 of the threshold for each time zone via the network NW.

[0044] The storage unit 15 stores the threshold for abnormality determination for each time zone set by the setting unit 13.

[0045] [Functional Blocks of Communication Node] As shown in Fig. 1, the communication node 2 includes an acquisition unit 20, a communication unit 21, a determination unit 22, an alarm unit 23, and a storage unit 24. The communication node 2 performs abnormality determination on the number of received packets to be managed.

[0046] The acquisition unit 20 acquires, as the number of packets to be managed, the number of packets received in each time zone. The acquisition unit 20 acquires, as the number of received packets to be managed, the number of received packets counted for each set time zone. Also, the acquisition unit 20 similarly acquires the normal data used by the abnormality management device 1 as teacher data.

[0047] The communication unit 21 transmits the teacher data of the normal data acquired by the acquisition unit 20 to the abnormality management device 1 via the network NW. Also, the communication unit 21 receives the threshold value for abnormality determination notified from the abnormality management device 1.

[0048] The determination unit 22 performs an abnormality determination on the number of packets to be managed in each time zone based on the threshold value. The threshold value is the threshold value for each time zone notified by the notification unit 14 of the abnormality management device 1. When the number of received packets for each time zone to be managed exceeds the threshold value, the determination unit 22 determines that an abnormality has occurred. When the number of received packets for each time zone to be managed is less than or equal to the threshold value, the determination unit 22 determines that it is normal.

[0049] When the determination unit 22 determines that the number of packets to be managed is abnormal, the alarm unit 23 outputs an alarm. The alarm unit 23 can display the occurrence of an abnormality on the display device 207 or indicator of its own device. Also, the alarm unit 23 may transmit an alarm to an external management server.

[0050] The storage unit 24 stores the number of received packets for each time zone. Also, the storage unit 24 stores the threshold value for each time zone notified by the notification unit 14 of the abnormality management device 1.

[0051] [Hardware Configuration of Abnormality Management Device] Next, an example of the hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG. 3.

[0052] As shown in FIG. 3, the abnormality management device 1 can be realized by, for example, a computer including a processor 102, a main storage device 103, a communication interface 104, an auxiliary storage device 105, and an input / output I / O 106 connected via a bus 101, and a program for controlling these hardware resources. Further, the abnormality management device 1 includes a display device 107.

[0053] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0054] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, learning unit 11, derivation unit 12, and setting unit 13 shown in FIG.

[0055] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 and various external electronic devices via a network. The communication interface 104 realizes at least a part of the notification unit 14.

[0056] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0057] The auxiliary storage device 105 has a program storage area for storing the abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a learning program for learning the probabilistic model executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 15 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0058] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0059] The display device 107 is configured by an organic EL display, a liquid crystal display, or the like.

[0060] [Hardware configuration of communication node] Next, an example of the hardware configuration for realizing the communication node 2 having the functions described above will be described with reference to FIG. 4.

[0061] As shown in FIG. 4, the communication node 2 can be realized, for example, by a computer including a processor 202, a main storage device 203, a communication interface 204, an auxiliary storage device 205, and an input / output I / O 206 connected via a bus 201, and by a program that controls these hardware resources. Further, the communication node 2 includes a display device 207. The communication node 2 has the same configuration as the abnormality management device 1, and the description of the corresponding configuration is omitted.

[0062] Each function of the communication node 2, such as the acquisition unit 20, the determination unit 22, and the alarm unit 23 shown in FIG. 1, is realized by the processor 202 and the main storage device 203.

[0063] Each time the communication interface 204 receives a packet, it increments a counter indicating the number of received packets. The counter value is read by the processor 202 at a fixed period.

[0064] The auxiliary storage device 205 has a program storage area for storing an abnormality determination program. The storage unit 24 described in FIG. 1 is realized by the auxiliary storage device 205.

[0065] [Operation of the Abnormality Management System] Next, the operation of the abnormality management system including the abnormality management device 1 and the communication node 2 having the above-described configuration will be described with reference to the sequence of FIG. 5.

[0066] As shown in FIG. 5, first, the acquisition unit 20 of communication node 2 acquires the number of packets received in each time period (step S1). The acquisition unit 20 of communication node 2 acquires the number of received packets in each time period over the set period. Since the proportion of normal received packet numbers occupies most of the packet numbers acquired in step S1, they can be treated as normal data. The communication unit 21 of communication node 2 sends the normal data of the acquired received packet numbers to the abnormality management device 1 via the network NW.

[0067] Subsequently, the collection unit 10 of the abnormality management device 1 collects normal data from communication node 2 (step S2). Subsequently, the learning unit 11 uses the normal data indicating the number of normal packets received in each time period as teacher data, and learns the parameters of the probability model that outputs the posterior probability that the number of packets received in each time period is normal by maximum likelihood estimation (step S3).

[0068] After that, the derivation unit 12 derives the probability distribution of abnormal data (step S4). FIG. 6 is a flowchart for explaining steps S3 and S4 in more detail. As shown in step S30 of FIG. 6, the learning unit 11 uses the normal data as teacher data based on the time series of the number of received packets including normal data at a certain ratio or more collected in step S2, and the estimated value q of the posterior probability that the number of received packets x is normal w (y = 1|x) outputs the parameters w, σ of the probability model 2 Learn by maximum likelihood estimation (step S30).

[0069] In step S30, the learning unit 11 performs learning by maximum likelihood estimation according to the above formulas (6) to (9). Also, in step S30, the learning unit 11 estimates the parameters w, σ estimated by maximum likelihood 2 From the probability model having, obtain the estimated value q of the posterior probability that the number of received packets x is normal w (y = 1|x).

[0070] Furthermore, the learning unit 11 is based on the number of normal received packets x at each time, and the probability distribution ρ of the normal data d(x) is estimated for the normal distribution (step S31).

[0071] Next, the derivation unit 12 substitutes the logarithm of the posterior probability lnq obtained in step S30, the probability distribution ρ of the normal data obtained in step S31, and the prior probability π of the normal data (e.g., 0.99) into the above formula (12) to derive the probability distribution ρ of the abnormal data (step S33). w (y = 1|x), the probability distribution ρ of the normal data obtained in step S31, d (x), and the prior probability π of the normal data (e.g., 0.99) to derive the probability distribution ρ of the abnormal data (step S33). g (x) (step S33).

[0072] After that, the process proceeds to step S5 in FIG. 5. Subsequently, the setting unit 13 sets, based on the probability distribution ρ of the abnormal data derived in step S3, the number of packets corresponding to the value of the probability distribution where the probability distribution ρ of the normal data corresponding to each time period is equal to the probability distribution ρ of the abnormal data as the threshold for anomaly determination of the number of packets received in each time period (step S5). In step S5, the setting unit 13 sets the threshold for each time period. g (x), the probability distribution ρ of the normal data corresponding to each time period based on d (x) and the probability distribution ρ of the abnormal data g (x) as the threshold for anomaly determination of the number of packets received in each time period (step S5). In step S5, the setting unit 13 sets the threshold for each time period.

[0073] Next, the notification unit 14 notifies the threshold for each time period to the communication node 2 via the network NW (step S6). The communication node 2 receives the notified threshold and stores it in the storage unit 24. Subsequently, the communication node 2 counts the number of received packets and stores it in the storage unit 24. The acquisition unit 20 of the communication node 2 acquires the number of packets to be managed received in each time period (step S7).

[0074] Next, the determination unit 22 of the communication node 2 performs anomaly determination on the number of received packets in each time period obtained in step S7 based on the threshold notified in step S6 (step S8). The determination unit 22 determines that an anomaly has occurred in the time period when the number of received packets in each time period exceeds the threshold. Next, the alarm unit 23 outputs an alarm when it is determined in step S8 that an anomaly has occurred (step S9).

[0075] As described above, according to the abnormality management device 1 according to the present embodiment, by using normal data as teacher data and learning the parameters of the probability model that outputs the posterior probability that the number of received packets in each time zone is normal by maximum likelihood estimation, the posterior probability that the number of received packets in each time zone is normal is estimated. Further, based on the estimated value of the posterior probability, the probability distribution of the normal data, and the prior probability of the normal data, the probability distribution of the abnormal data in each time zone is derived. Further, the number of received packets corresponding to the value of the probability distribution at which the values of the probability distribution of the abnormal data and the probability distribution of the normal data derived for each time zone are the same is set as the threshold for abnormality determination. Abnormal communication can be appropriately managed with a simpler configuration.

[0076] Also, according to the abnormality management device 1 according to the present embodiment, since the parameters of the probability model that outputs the posterior probability that the number of received packets in each time zone is normal are learned by maximum likelihood estimation using normal data as teacher data, it is possible to theoretically model using only normal data.

[0077] Also, according to the abnormality management device 1 according to the present embodiment, the threshold for abnormality determination is set based on the intersection of the probability distribution of the normal data and the probability distribution of the abnormal data. Therefore, the threshold has the explanatory power as a theoretical classification boundary that is the point where normality and abnormality are most equal.

[0078] Also, according to the abnormality management device 1 according to the present embodiment, since abnormality determination is performed using the threshold for each time zone, it is possible to appropriately detect abnormalities such as an attack that sends a large amount of short packets in a short time, where the number of received bytes is relatively small and it is difficult to detect based on the traffic volume.

[0079] As described above, the embodiments of the abnormality management device, the abnormality management method, and the abnormality management system of the present invention have been described. However, the present invention is not limited to the described embodiments, and various modifications that those skilled in the art can assume are possible within the scope of the invention described in the claims.

Explanation of Reference Numerals

[0080] 1... Abnormality management device, 2... Communication node, 10... Collection unit, 11... Learning unit, 12... Derivation unit, 13... Setting unit, 14... Notification unit, 15, 24... Memory unit, 20... Acquisition unit, 21... Communication unit, 22... Judgment unit, 23... Alarm unit, 101, 201... Bus, 102, 202... Processor, 103, 203... Main memory device, 104, 204... Communication interface, 105, 205... Auxiliary memory device, 106, 206... Input / output I / O, 107, 207... Display device, NW... Network.

Claims

1. A learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period is normal, using normal data indicating the number of normal packets received in each time period as teacher data; A derivation unit configured to derive a probability distribution of abnormal data indicating an abnormal number of packets deviating from a range of packet numbers regarded as normal, based on the posterior probability in each time period estimated by the learned probability model, the probability distribution of the normal data estimated based on the normal data, and a prior probability of being normal; A setting unit configured to set, as a threshold for abnormal determination of the number of packets received in each time period, the number of packets corresponding to a value of a probability distribution at which the probability distribution of the normal data corresponding to each time period and the probability distribution of the abnormal data become equal; An abnormality management device comprising the above.

2. The abnormality management device according to claim 1, wherein further comprising a notification unit configured to notify a communication node that processes packets of the set threshold. An abnormality management device comprising the above.

3. The abnormality management device according to claim 1, wherein further comprising a collection unit configured to collect the normal data indicating the number of normal packets received by the communication node in each time period, and the learning unit uses the normal data collected by the collection unit as the teacher data. An abnormality management device characterized by the above.

4. An abnormality management method executed by a computer, comprising: a learning step of learning, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period is normal, using normal data indicating the number of normal packets received in each time period as teacher data; a derivation step of deriving a probability distribution of abnormal data indicating an abnormal number of packets deviating from a range of packet numbers regarded as normal, based on the posterior probability in each time period estimated by the probability model learned in the learning step, the probability distribution of the normal data estimated based on the normal data, and a prior probability of being normal; a setting step of setting, as a threshold for abnormal determination of the number of packets received in each time period, the number of packets corresponding to a value of a probability distribution at which the probability distribution of the normal data corresponding to each time period and the probability distribution of the abnormal data become equal. An abnormality management method comprising

5. In the abnormality management method according to claim 4, further comprising a notification step of notifying the set threshold value to a communication node that processes packets An abnormality management method comprising

6. In the abnormality management method according to claim 4, further comprising a collection step of collecting the normal data indicating the number of normal packets received by the communication node in each time period, wherein the learning step uses the normal data collected in the collection step as the teacher data An abnormality management method characterized by

7. An abnormality management system comprising the abnormality management device according to any one of claims 1 to 3 and a communication node, wherein the communication node is configured to obtain, as the number of packets to be managed, the number of packets received in each time period; is configured to perform an abnormality determination of the number of packets to be managed in each time period based on the threshold value; and an alarm unit configured to output an alarm when the determination unit determines that the number of packets to be managed is abnormal An abnormality management system comprising

Images