Abnormality management device and abnormality management method

Abstract

To manage abnormal traffic without collecting a large amount of data on past abnormal traffic. [Solution] The abnormality management device 1 includes a first learning unit 12 configured to treat each observed value of the normal communication volume sequence as a mutually independent discrete value and estimate probability parameters of a probabilistic model representing normal communication volume after quantization based on the occurrence frequency of each observed value, and a second learning unit 13 configured to update only the classifier parameters of a classifier 132 that distinguishes between true normal data and pseudo-normal data based on the probability parameters of the normal communication volume estimated by the first learning unit 12, in a direction to maximize the classification accuracy, while keeping fixed generator parameters of a generator 131 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, with each observed value of the normal communication volume sequence as true normal data.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread in addition to smartphones and tablets. As the number of IoT devices increases, controlling the traffic of IoT device communications has become an issue.

[0003] Conventionally, there are known techniques for estimating abnormal traffic such as burst traffic and predicting the amount of traffic flowing through a communication network. For example, Patent Document 1 discloses a system that predicts the maximum value of traffic volume for a predetermined link using a statistical estimation method such as maximum likelihood estimation based on correlation data of multiple past traffic data for different links.

[0004] However, when estimating abnormal traffic such as burst traffic using statistical estimation such as maximum likelihood estimation as disclosed in Patent Document 1, a large amount of data on past abnormal traffic is required. Also, when estimating abnormal traffic using machine learning based on a supervised learning model, a large amount of learning data related to abnormal traffic must be prepared. Therefore, if it is not possible to collect a large amount of data on past abnormal traffic, it may be difficult to estimate or detect abnormal traffic. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-216585 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it may be difficult to detect abnormal traffic unless a large amount of past abnormal traffic data is collected.

[0007] The present invention has been made to solve the above-mentioned problems, and has as its object to manage abnormal traffic without collecting a large amount of data on past abnormal traffic. [Means for solving the problem]

[0008] In order to solve the above-described problems, an anomaly management device according to the present invention includes: a quantization unit configured to quantize normal communication volumes for each time period and convert the quantized normal communication volumes into a normal communication volume sequence of integer values; a first learning unit configured to treat each observed value of the normal communication volume sequence as a mutually independent discrete value and to estimate probability parameters of a probabilistic model representing the quantized normal communication volume based on the appearance frequency of each observed value; a second learning unit configured to update only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the normal communication volume estimated by the first learning unit, in a direction to maximize classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value of the normal communication volume sequence considered as true normal data; and a storage unit configured to store the pseudo-normal data output by the generator as information indicating anomalous communication volumes for each time period after the second learning unit updates the classifier parameters of the classifier.

[0009] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect communication volume of the managed object for each time period, the quantization unit quantizing the collected communication volume of the managed object and converting it into a communication volume series of integer values, and a determination unit configured to determine that abnormal communication has occurred when the communication volume series matches the pseudo-normal data stored in the memory unit.

[0010] In addition, in the abnormality management device of the present invention, the communication volume of the managed object for each time period may be the communication volume for each time period for each communication terminal, and may further include a communication management unit configured to instruct the communication terminal performing communication related to the communication volume of the managed object to cut off communication when the judgment unit determines that abnormal communication has occurred.

[0011] In addition, in the abnormality management device of the present invention, the communication volume of the managed object for each time period may be the communication volume for each time period of the entire communication network, and may further include a communication management unit configured to notify that a communication abnormality has occurred in the communication network when the judgment unit determines that abnormal communication has occurred.

[0012] In order to solve the above-described problems, an anomaly management method according to the present invention includes a quantization step of quantizing normal communication volumes for each time period and converting the quantized normal communication volume into a normal communication volume sequence of integer values; a first learning step of treating each observed value of the normal communication volume sequence as a mutually independent discrete value and estimating probability parameters of a probabilistic model representing the quantized normal communication volume based on the appearance frequency of each observed value; a second learning step of updating only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the normal communication volume estimated in the first learning step, in a direction that maximizes classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, using each observed value of the normal communication volume sequence as true normal data; and a storage step of storing the pseudo-normal data output by the generator in a storage unit as information indicating the anomalous communication volume for each time period after updating the classifier parameters of the classifier in the second learning step.

[0013] In addition, the abnormality management method of the present invention may further include a collection step of collecting the communication volume of the managed object for each time period, wherein the quantization step quantizes the collected communication volume of the managed object and converts it into a communication volume series of integer values, and further includes a determination step of determining that abnormal communication has occurred when the communication volume series matches the pseudo-normal data stored in the memory unit.

[0014] In addition, in the abnormality management method of the present invention, the communication volume of the managed object for each time period may be the communication volume for each time period for each communication terminal, and may further include a communication management step of instructing a communication terminal performing communication related to the communication volume of the managed object to cut off communication when it is determined in the determination step that abnormal communication has occurred.

[0015] In addition, in the abnormality management method of the present invention, the communication volume of the managed object for each time period may be the communication volume for each time period of the entire communication network, and may further include a communication management step of notifying that a communication abnormality has occurred in the communication network if it is determined in the determination step that abnormal communication has occurred. [Effects of the Invention]

[0016] According to the present invention, while fixing the generator parameters of the generator that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data by regarding each observed value of a normal traffic volume sequence as true normal data, only the classifier parameters of the classifier that distinguishes true normal data from pseudo-normal data are updated in a direction that maximizes the classification accuracy, based on the probability parameters of normal traffic volume estimated by the first learning unit. As a result, abnormal traffic can be managed without collecting a large amount of data on past abnormal traffic. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining abnormal traffic volume managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a block diagram showing the configuration of the second learning unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0019] [Configuration of anomaly management system] First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described.

[0020] The fault management system according to this embodiment includes a fault management device 1, a communication terminal 2, a base station 3, and a core network 4. As an example, the fault management system is provided in a 5G mobile communication network, but may also be a network using a fixed line. As shown in FIG. 1, the fault management device 1 is connected to the core network 4 via a network NW such as a LAN, a WAN, or the Internet.

[0021] The communication terminal 2 is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, an industrial robot, etc. The communication terminal 2 is equipped with a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as an International Mobile Subscriber Identity (IMSI). The communication terminal 2 is uniquely identified by the IMSI.

[0022] The communication terminal 2 is also configured as an IoT device to which a terminal IP address that uniquely identifies the terminal is assigned. In this embodiment, there are n communication terminals 2 (n is a positive integer of 2 or more). The communication terminals 2 connect to an external data network (not shown) from a core network 4 via the base station 3 in which each communication terminal 2 is located.

[0023] Among the multiple communication terminals 2, there are communication terminals 2 that communicate at a communication volume that exceeds the set bandwidth, and such communication may cause or threaten traffic congestion. Other communication terminals 2 may also include terminals that engage in sudden or continuous high-volume communication that deviates from normal usage trends, irregular communication, or communication at unconventional times or using unconventional protocols. Such abnormal communication volumes that differ from normal communication volumes include intentional communication by users of the communication terminals 2, as well as unintentional communication such as DDoS attacks. In this specification, such communication volumes that exceed the set bandwidth are defined as abnormal communication volumes relative to normal communication volumes.

[0024] Fig. 2 is a diagram for explaining abnormal data on communication volume. In Fig. 2(a), the horizontal axis is time and the vertical axis is communication volume, with curve a1 showing the time series of normal communication volume by a certain communication terminal 2 and curve b1 showing the time series of abnormal communication volume by another communication terminal 2. In the example of Fig. 2(a), the communication volume of the other communication terminal 2 is higher than the normal communication volume throughout the entire time period, indicating an abnormality in communication volume.

[0025] The base station 3 is composed of a wireless base station compatible with the 5G system, and relays communications between the communication terminal 2 located within the communication area and the core network 4. The base station 3 is connected to the core network 4 via a network such as a backhaul link.

[0026] The core network 4 provides centralized control, routing, management, and security for communications relayed by the base station 3. The core network 4 includes a UPF (User Plane Function) 40 in the U-plane. The core network 4 also includes nodes in the C-plane, such as an AMF (Access and Mobility Management Function) and a UDM (Unified Data Management), which are not shown. Functional nodes in the U-plane and C-plane other than the UPF 40 that the core network 4 includes are not shown in the figure.

[0027] The UPF 40 is a user plane function that processes packets between the base station 3 and a data network such as the Internet. The UPF 40 includes a communication interface 40a for communicating with the abnormality management device 1. The UPF 40 records the communication volume of the communication terminal 2 that performs traffic processing.

[0028] [Function block of the abnormality management device] Next, functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10, a quantization unit 11, a first learning unit 12, a second learning unit 13, an abnormal communication volume database (storage unit) 14, a determination unit 15, a communication management unit 16, and a storage unit 17.

[0029] The collection unit 10 acquires the communication volume for each time period collected by the core network 4 that controls the communication of multiple communication terminals 2. The collection unit 10 acquires the history of communication volume for each communication terminal 2 for which traffic processing is performed on the UPF 40. The communication volume for each time period indicates time series data of communication volume for each IMSI. The collection unit 10 collects time series data of communication volume that can be considered as normal communication volume, which accounts for most of the normal communication volume used for learning by the first learning unit 12 and the second learning unit 13. The collection unit 10 also collects the communication volume for each time period of the managed object that is the target of abnormality judgment by the judgment unit 15.

[0030] The quantization unit 11 quantizes the normal communication volume for each time period and converts it into a normal communication volume sequence of integer values. The quantization unit 11 converts the continuous communication volume for each time period that can be considered normal, collected by the collection unit 10, into a set discrete integer value, for example, positive integer level values ​​1 to 7, as shown in FIG. 2(b). The quantization unit 11 rounds the value up or down by rounding. FIG. 2(b) shows that the level value ("normal value") obtained by quantizing the normal communication volume in time period t1 is 2, and the level value ("abnormal value") obtained by quantizing the abnormal communication volume in time period t1 is 5. The quantization unit 11 orders the discrete values ​​for each time period in a chronological order to generate a communication volume sequence.

[0031] The first learning unit 12 treats each observation value of the normal communication volume sequence as a mutually independent discrete value and estimates probability parameters of a probability model representing normal communication volume after quantization based on the occurrence frequency of each observation value. The first learning unit 12 sets a probability model based on a multinomial distribution for normal communication volume, estimates the probability parameters, and calculates the log-likelihood of the sequence of each observation value based on the probability model. That is, when there is very little data on abnormal communication volume, the first learning unit 12 uses normal communication volume, which is available in large quantities, to obtain a probability model of normal communication volume, which is a statistical standard, and a corresponding normality index.

[0032] The first learning unit 12 focuses on the fact that the naive Bayes method treats each observation value as a conditionally independent discrete variable, and sets a probability model by extending the naive Bayes method to a multinomial distribution model so that the quantized communication volume for each time period can be regarded as a vector of the number of occurrences for each category. Here, as shown in the following formula (1), the communication volume observed in each time period is quantized, and the vector expressed by the number of occurrences of M categories is taken as the observation value X. X=x=(x1,x2,...,x M ) ···(1)

[0033] Furthermore, the class label to which the observed value X belongs, that is, the event Y, is defined as a binary variable by the following equation (2).

number

[0034] Here, Bayes' theorem is defined by the following equation (3).

number

[0035] In the above equation (3), P(X) is the marginal probability (outcome) of observing observed value X, P(Y) is the prior probability that event Y occurs, P(X|Y) is the conditional probability that observed value X occurs given that event Y occurs, and P(Y|X) is the conditional probability (posterior probability) that event Y occurs given that observed value X occurs. It is known that maximum likelihood estimation determines the parameters of the prior probability P(Y) so that the posterior probability P(Y|X) is maximized, using observed value X as the teacher signal, which is the correct value. In contrast, Bayesian estimation is a procedure for determining the parameters (probabilistic values) of the prior probability P(Y) that best explain observed value X, which is represented by a quantized communication volume series.

[0036] In other words, by arbitrarily setting the parameters of the prior probability P(Y) in advance (e.g., normal distribution), it is possible to estimate the parameters of the prior probability P(Y) that maximizes P(X|Y), i.e., that best matches the marginal probability P(X) (outcome). In this way, the advantage of Bayesian estimation is that the prior probability P(Y) can be arbitrarily specified in advance. When each of the P(X|Y) is independent, the event Y is predicted by the observed variable x under given conditions. i are conditionally independent of each other, and the likelihood ρ(x|y) is given by the naive Bayes estimation method of the following equation (4).

[0037]

number

[0038] In this embodiment, we deal with a sequence of integer values ​​obtained by quantizing the communication volume for each time period (for example, time slot), so we use an occurrence count vector x = (x1, x2, . . . , x M ) as one sample, and while maintaining the naive assumption that each time period is conditionally independent, we extend it to a multinomial distribution probability model. The occurrence probability of each marginal probability P(X) is θ1, ,θ M are independent and the sum of their occurrence probabilities is 1. Under this constraint, the probability model of the multinomial distribution is expressed by the following equation (5).

[0039]

number

[0040] As shown in the above equation (5), the observed value x i The sum of (x1+x2++x M ) is determined, the distribution is the product of the following equation (6), and the observed value x observed in the i-th time period in the series is i Independently, probability θ i ^x i can be obtained.

number

[0041] Therefore, it can be seen that the relationship is similar to that of the naive Bayes method in equation (4). Here, the prior probability P(Y) is a binary problem of abnormal values ​​(Y=0) and normal values ​​(Y=1), and each unknown parameter is θ 0 ,θ 1 Also, D is defined as the marginal probability (outcome), and the observed value of the abnormal value (Y=0) is D 0 , the normal value (Y=1) observation is D 1 The above equation (6) can be expressed as the following equation (7) by converting the product form into a sum under the Naive Bayes independence assumption and decomposing the log likelihood for the observation set D, which is the data set, by class.

[0042]

number

[0043] Here, the constraint is expressed by the following equation (8).

number

[0044] Furthermore, by applying the Lagrange multiplier method, the outlier parameter θ 0 The maximum value of the logarithmic likelihood for the i-th component of is given by the following equation (9).

number

[0045] Normal value parameter θ 1 Similarly, if we calculate the maximum value of the log likelihood for 1 , θ 0 is expressed by the following equation (10).

number

[0046] In addition, x i Since takes integer values, x i To prevent the problem of the multinomial distribution diverging when ^(n) is 0, smoothing can be performed by specifying +α (e.g., α=1) smoothing. In this way, the first learning unit 12 regards the normal communication volume series for each quantized time slot as a multinomial distribution, estimates probability parameters from the count of occurrence frequency, and measures the normality by likelihood. Note that the first learning unit 12 also calculates the abnormal value parameter θ 0 No estimates are made regarding

[0047] The second learning unit 13 regards each observed value of the normal communication volume sequence as true normal data and updates only the classifier parameters of the classifier 132 that distinguishes between true normal data and pseudo-normal data in a direction that maximizes the classification accuracy, while keeping fixed the generator parameters of the generator 131 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, based on the probability parameters of the normal communication volume estimated by the first learning unit 12.

[0048] As shown in Fig. 3, the second learning unit 13 executes a Max learning phase of a GAN (Generative Adversarial Network) having a generator 131 and a classifier 132, in which only the parameters of the classifier 132 are updated while the generator 131 is fixed. When a normal communication volume sequence is regarded as true normal data, the second learning unit 13 aims to generate pseudo-normal data that deviates sufficiently from the distribution of normal data, that is, a communication volume sequence that can be treated as an anomalous communication volume sequence. For this reason, the Min learning phase in the normal GAN ​​adversarial learning procedure, in which the generator 131 is updated in the minimization direction, is not performed.

[0049] As shown in FIG. 3, a generative model according to this embodiment, which includes a generator 131 and a classifier 132, is provided for each observed value (time period) of a communication volume sequence. Therefore, in this embodiment, M generative models are trained. Here, pseudo-normal data that deviates sufficiently from the distribution of normal data refers to a generated sequence that, as a statistical property, is located in a region that significantly deviates from the normal region of normal data, relative to normal data that indicates a normal communication volume sequence. When the index of distance or deviation from normal data is log-likelihood, a sequence with a smaller likelihood corresponds to the pseudo-normal data. When the index is cross-entropy, a sequence with a larger entropy value corresponds to a larger deviation. Furthermore, when the index is KL distance, a sequence with a large deviation in the overall distribution is treated as a sufficiently deviated sequence.

[0050] 4 and 5 are diagrams schematically illustrating the neural network configuration of the generator 131 and the classifier 132 of the generative model used by the second learning unit 13. As shown in FIG. 4, the generator 131 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m ).

[0051] The generator 131 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 131 is pseudo-normal data that deviates from the distribution of true normal data. CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0052] The classifier 132 shown in Fig. 5 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5, as input training data, a normal communication volume sequence collected by the collection unit 10 and calculated by the quantization unit 11 is given as true normal data.

[0053] The classifier 132 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 132 outputs an output y=1 when it correctly identifies the training data related to the input true normal data as true normal data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo normal data as pseudo normal data. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0054] FIG. 3 is a block diagram for explaining the configuration of the generative model by the second learning unit 13. The generator 131 of the generative model adopted by the second learning unit 13 is represented as a function G, and the classifier 132 is represented as a function D. Furthermore, true normal data is represented as x, the predicted value output by the classifier 132 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 131. In this case, the classifier 132 calculates the cross entropy E CE It can be expressed as:

[0055]

number

[0056] The first term in the brace of the above equation (11) represents t n lny n In this case, the predicted value y n is the correct label of the true normal data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CEis the maximum value when the predicted value matches the correct label value.

[0057] Here, the generator 131 that configures the generative model uses parameters w G ,θ G and the function G(w G ,θ G ) The classifier 132 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (11) CE The objective function E of the generative model including the generator 131 and the discriminator 132 based on the above can be expressed by the following equation (12).

number

[0058] The first term of the above equation (12) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 132 classifies true normal data as true normal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 132 classifies the pseudo-normal data generated by the generator 131 as pseudo-normal data. Here, the objective function E of the generative model in the above formula (12) is set to the parameter θ using the prior probability of the classes of abnormal values ​​(Y=0) and normal values ​​(Y=1) in the multinomial distribution. 0 , θ 1 When these are multiplied and incorporated, the objective function E is expressed by the following equation (13).

[0059]

number

[0060] In the above equation (13), the parameter θ of the multinomial distribution 0 , θ1 The objective function E of the i-th component is expressed by the following equation (14).

number

[0061] By weighting the objective function (equation (12)) of a normal GAN, an adversarial loss that proportionally allocates the contributions of the normal value class and the abnormal value class can be obtained, as shown in the above equations (13) and (14). Here, the objective function E when the generator 131 is fixed is expressed by the following equation (15).

number

[0062] The convergence value (maximum value) of the discriminator 132 is expressed by the following equation (16).

number

[0063] Normal value parameter θ i ^1 is calculated using the above formula (10). The parameter θ of the abnormal value i For ^0, since the number of abnormal data related to abnormal communication volume is small, empirical rules or pre-set values ​​are used. i ^1,θ i ^0 is the value of each observation x i The expected value ratio, E, varies depending on the ρ(x|y=1) :E ρ(x|y=0) For example, since the number of normal data is overwhelmingly large, the ratio is set in advance to 0.99:0.01.

[0064] In the learning of the generative model of this embodiment, only Max optimization of the objective function E is performed, and the parameters of the discriminator 132 with the generator 131 fixed are learned. Therefore, it is possible to prevent the output of the generator 131 from converging to the distribution of normal data, and conversely, to maintain a sequence that is sufficiently deviated from the distribution of normal data. When the update of the discriminator 132 has converged, the pseudo-normal data sequence output by the fixed generator 131 is a sequence that is similar to the normal communication volume model (parameters θ of the multinomial distribution). 1 ) has a low likelihood. In this case, the generator 131 can generate only pseudo-normal data, which is an abnormal sequence expressed by the following equation (17).

number

[0065] The abnormal communication volume database 14 treats and registers the pseudo-normal data generated by the generator 131 after the second learning unit 13 updates the parameters of the classifier 132 as abnormal communication volumes for each time slot for determining an abnormality. Specifically, when the generator 131 provided in the generation model corresponding to each time slot (time slot) learns with, for example, 10,000 pieces of training data, it generates 10,000 pieces of pseudo-normal data and registers them in the abnormal communication volume database 14.

[0066] The determination unit 15 determines that abnormal communication has occurred when the traffic volume series of the managed object matches the pseudo-normal data stored in the abnormal traffic volume database 14. More specifically, when the traffic volume series obtained by converting the traffic volume of the managed object for each time period matches the pseudo-normal data stored in the abnormal traffic volume database 14, the determination unit 15 identifies the IMSI of the communication terminal 2 communicating with the traffic volume of the managed object.

[0067] The judgment unit 15 can judge that an abnormality in communication volume has occurred not only when the level value of the communication volume series to be managed matches the pseudo-normal data stored in the abnormal communication volume database 14, but also when the sum of the squares of the differences between the level values ​​of the communication volume series to be managed and the level values ​​of the pseudo-normal data stored in the abnormal communication volume database 14 is within a set threshold value according to the following equation (18).

number

[0068] When the determination unit 15 determines that abnormal communication has occurred, the communication management unit 16 instructs the communication terminal 2 performing communication related to the communication volume to be determined to cut off communication. For example, the communication management unit 16 specifies the IMSI and transmits an instruction to cut off communication to the core network 4. Specifically, the communication management unit 16 can be configured to transmit a control request to the policy control function (PCF) or the session management function (SMF) to stop communication of the IMSI, thereby invalidating the communication session of the communication terminal 2.

[0069] The storage unit 17 stores parameters of a probabilistic model that indicates normal communication volume, estimated by learning by the first learning unit 12. The storage unit 17 also stores a generator 131 included in a trained generative model constructed by learning by the second learning unit 13.

[0070] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0071] 6, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0072] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0073] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, the quantization unit 11, the first learning unit 12, the second learning unit 13, the determination unit 15, and the communication management unit 16 shown in FIG.

[0074] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0075] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0076] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a first learning program for estimating parameters related to normal communication volume using a multinomial distribution probability model executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a second learning program for training the classifier 132 of the generative model executed by the abnormality management device 1. The auxiliary storage device 105 realizes the abnormal communication volume database 14 and the storage unit 17 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0077] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0078] Display device 107 is configured by an organic EL display, a liquid crystal display, etc. Display device 107 can display information about communication terminal 2 that is performing abnormal communication on the screen.

[0079] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0080] As shown in Fig. 7, first, the collection unit 10 collects communication volumes that include a certain amount or more of data on normal communication volumes (step S1). The collection unit 10 collects data on communication volumes for each time period, such as 99% of which is normal communication volumes. The collection unit 10 collects the communication volumes for each time period of each communication terminal 2 from the UPF 40. The communication volumes collected by the collection unit 10 in step S1 can be treated as normal communication volumes.

[0081] Next, the quantization unit 11 quantizes the normal communication volume for each time period collected in step S1 and converts it into a normal communication volume sequence of integer values ​​(step S2). Next, the first learning unit 12 performs a first learning process (step S3). FIG. 8 is a flowchart illustrating the first learning process of step S3 in more detail. As shown in step S30 of FIG. 8, the first learning unit 12 models the normal communication volume sequence obtained by conversion in step S2 using a multinomial distribution (step S30). The first learning model sets the probability model of the above equation (5).

[0082] Next, the first learning unit 12 calculates a parameter θ for binary classification of normal and abnormal communication volumes. 1 , θ 0 (Step S31). Next, the first learning unit 12 defines the log-likelihood in accordance with the above formula (7) (Step S32). In Step S32, the first learning unit 12 converts the objective function for optimization from a product form (formula (5)) to a sum form. Next, the first learning unit 12 determines a parameter θ related to the normal communication volume that maximizes the log-likelihood (formula (7)) under the constraint (formula (8)) by the Lagrange multiplier method of the above formula (9). 1 (Equation (10)) is estimated (step S33). 1 is stored in the storage unit 17, and the process proceeds to step S4 in FIG.

[0083] Next, the second learning unit 13 regards each observed value of the normal communication volume sequence as true normal data, and while fixing the generator parameters of the generator 131 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, changes the normal value parameters θ estimated by the first learning unit 12 in step S3. 1 Based on this, only the classifier parameters of the classifier 132 that distinguishes between true normal data and pseudo normal data are updated in a direction that maximizes the classification accuracy (second learning process) (step S4).

[0084] 9 is a flowchart for explaining the second learning process in step S4. First, the second learning unit 13 calculates the normal and abnormal value parameters θ of the probabilistic model of the multinomial distribution estimated in the first learning process in step S3. 1 ,θ 0 is set as the objective function (equation (15)) of the generative model (step S50). More specifically, the second learning unit 13 sets the parameter θ i ^1 is substituted into the objective function when the generator 131 in the above equation (15) is fixed, and the parameter θ i For ^0, we use an empirical rule or a preset value and substitute it into the above equation (15). Furthermore, the ratio of the expected values, E ρ(x|y=1) :E ρ(x|y=0) Regarding , since the number of normal data is overwhelmingly large, a preset value of, for example, 0.99:0.01 is adopted in the above equation (15).

[0085] Next, the second learning unit 13 acquires the normal communication volume sequence collected in step S1 and quantized and converted in step S2 as true normal data (step S51). Next, the second learning unit 13 inputs the true normal data as training data 134 to the classifier 132, and adjusts the parameter w D ,θ D(Step S52). In Step S52, the second learning unit 13 can cause the classifier 132 to learn true normal data using, for example, an error backpropagation method. In Step S51, the classifier 132 that can distinguish true normal data from true normal data is pre-trained.

[0086] Next, the second learning unit 13 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 131 (step S53). Subsequently, the generator 131 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo-normal data G(z) (step S54).

[0087] Next, the second learning unit 13 learns the classifier 132. The learning of the classifier 132 is performed by using the parameter w D ,θ D First, the second learning unit 13 provides true normal data as training data 134 as input to the classifier 132. Then, the second learning unit 13 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D (Step S55). The label of the training data 134 is set to 1 (true normal data).

[0088] Next, the second learning unit 13 provides the pseudo-normal data generated by the generator 131 in step S54 to the classifier 132, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D is updated (step S56).

[0089] The learning of the classifier 132 in steps S55 and S56 corresponds to the dashed arrows in the block diagram of the second learning unit 13 shown in FIG. 3 , which indicate that a classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0090] Thereafter, the learning of the classifier 132 from step S54 to step S56 is repeated until the value of the objective function E converges (step S57: NO). On the other hand, if the value of the objective function E converges to the optimal solution of the above equation (16) (step S57: YES), the processing from step S52 to step S57 is repeated using the remaining true normal data in order until the generator 131 and the classifier 132 are learned (step S58: NO).

[0091] Thereafter, when the classifier 132 has been trained using all true normal data (step S58: YES), the second learning unit 13 stores the generator 131 in the storage unit 17 (step S59). Furthermore, the second learning unit 13 performs the processes from step S50 to step S59 for each generative model corresponding to the M observation values ​​(time periods) to train each classifier 132. After that, the process proceeds to step S5 in FIG. 7.

[0092] Next, the anomalous traffic database 14 stores the pseudo-normal data generated by the generator 131 after the classifier 132 has been updated through learning by the second learning unit 13 (step S5). In step S5, the pseudo-normal data generated by the generator 131 corresponding to each time period is registered in the anomalous traffic database 14. For example, assume that 1,000 time periods (M=1,000) are set. In this case, if learning is performed using, for example, 10,000 pieces of training data in each of 1,000 generative models corresponding to the 1,000 time periods in the second learning process of step S4, the generator 131 of each generative model generates 10,000 pieces of pseudo-normal data. Therefore, 10,000 pieces of pseudo-normal data for each of the 1,000 time periods are registered in the anomalous traffic database 14. Thereafter, the collection unit 10 collects the traffic of the managed object for each time period (step S6). Next, the quantization unit 11 quantizes the traffic of the managed object collected in step S6 and converts it into a traffic volume series (step S7).

[0093] Next, the determination unit 15 determines that abnormal communication has occurred (step S8) if the communication volume series of integer values ​​of the management target obtained in step S7 matches the pseudo-normal data stored in the abnormal communication volume database 14. In step S8, it can be determined that abnormal communication has occurred if the time-series data of the communication volume of the management target matches the pseudo-normal data or true normal data completely or matches within a certain tolerance range.

[0094] Specifically, the judgment unit 15 can judge that abnormal communication has occurred if the sum of the squares of the differences between the level values ​​of the traffic volume series of the managed object and the level values ​​of the pseudo-normal data is within a threshold value according to the above equation (18).

[0095] In addition, by checking the traffic volume series from an early time period, if the traffic volume series of the management target matches the pseudo-normal data series, it can be determined that the communication is abnormal.

[0096] Next, the communication management unit 16 identifies the IMSI of the communication terminal 2 that performed communication corresponding to the communication volume series related to the time period determined to be abnormal communication, and instructs the core network 4 to cut off communication by specifying the identified IMSI (step S9).

[0097] As described above, the anomaly management device 1 according to this embodiment employs Naive Bayes with a multinomial distribution as a probability model for a sequence of integer values ​​quantized from normal traffic volumes, and estimates probability parameters related to a normal traffic volume sequence. Furthermore, the probability parameters of the estimated normal traffic volume sequence are set in the objective function of the generative model, and learning is performed by updating only the discriminator 132 while keeping the generator 131 fixed, so that pseudo-normal data that is sufficiently deviated from the distribution of true normal data that indicates a normal traffic volume sequence is output from the generator 131. The collected pseudo-normal data is registered in a database for anomaly detection, making it possible to manage abnormal traffic without collecting a large amount of past abnormal traffic data.

[0098] Furthermore, the abnormality management device 1 according to this embodiment collects data on the amount of communication for each communication terminal 2 and determines the abnormal data, thereby identifying the communication terminal 2 performing abnormal communication and then cutting off the communication. This allows for more effective traffic management of the communication network.

[0099] Furthermore, according to the abnormality management device 1 of this embodiment, it is possible to determine whether or not there is abnormal communication in the time period before a sudden increase in communication volume, such as burst traffic, actually occurs, thereby enabling more effective traffic management.

[0100] [Variations] Next, a modified example of this embodiment will be described. In the above-described embodiment, the collection unit 10 collects the communication volume for each time period for each communication terminal 2, and identifies a communication terminal 2 that is performing abnormal communication. In contrast, in this modified example, the collection unit 10 collects the communication volume for the entire communication network, and detects abnormal communication that occurs in the entire communication network. The following description will focus on configurations that differ from the above-described embodiment.

[0101] In the abnormality management device 1 according to the modified example, the collection unit 10 collects time-series data on the communication volume of the entire communication network. Furthermore, when the determination unit 15 determines that communication is abnormal, the communication management unit 16 issues a notification indicating that a communication abnormality has occurred in the communication network. For example, the communication management unit 16 can issue a notification to an external management and monitoring system.

[0102] Furthermore, the first learning unit 12 estimates parameters of a probabilistic model using a multinomial distribution based on data on the traffic volume of the entire communication network. Similarly, the second learning unit 13 updates the classifier 132 of the generative model while fixing the generator 131, using a normal traffic volume sequence of normal traffic volumes of the entire communication network as true normal data.

[0103] In this way, according to the abnormality management device 1 of the modified example, even if there is little data related to abnormal communication volume, a database of abnormal communication volume can be constructed based on data on normal communication volume, and abnormal communication throughout the entire communication network can be detected.

[0104] In the embodiment described above, the anomaly management system is described as a system conforming to the 5G standard, but the communication standard may be 3G, 4G / LTE, 6G, etc. Furthermore, the anomaly management system is not limited to a mobile communication network, and may be a network using a fixed line as described above. In this case, the system may be configured to collect communication volume logs via a wireless router or wireless access point.

[0105] In the embodiment described above, the second learning unit 13 has been described as having a generative model with a GAN configuration. However, the generative model can be configured not only based on a GAN but also based on a VAE (Variational Autoencoder), Energy-Based Models (EBMs), or the like.

[0106] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0107] 1...abnormality management device, 2...communication terminal, 3...base station, 4...core network, 10...collection unit, 11...quantization unit, 12...first learning unit, 13...second learning unit, 14...abnormal communication volume database, 15...determination unit, 16...communication management unit, 17...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 131...generator, 132...identifier, NW...network.

Claims

1. a quantization unit configured to quantize the normal traffic volume observed for each time period and convert it into a normal traffic volume sequence of integer values; a first learning unit configured to treat each observed value of the normal communication volume sequence as a discrete value independent of each other, and to estimate probability parameters of a probability model representing the normal communication volume after quantization based on an appearance frequency of each observed value; a second learning unit configured to learn a generative model having a generator and a classifier, the second learning unit configured to substitute the probability parameters of the normal communication volume estimated by the first learning unit into an objective function of the generative model while fixing generator parameters of the generator that generates pseudo-normal data sufficiently deviating from the distribution of the true normal data, with each observed value of the normal communication volume sequence being regarded as true normal data, and to update only classifier parameters of the classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes classification accuracy; a storage unit configured to store the pseudo-normal data output by the generator as information indicating an abnormal communication volume for each time period after the second learning unit updates the classifier parameters of the classifier; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, Further, a collection unit configured to collect the traffic volume of the management target for each time period, the quantization unit quantizes the collected traffic volume of the management target and converts it into a traffic volume series of integer values; The communication device further includes a determination unit configured to determine that an abnormal communication has occurred when the communication volume series matches the pseudo-normal data stored in the storage unit. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, the communication volume to be managed for each time period is the communication volume for each communication terminal for each time period, Further, a communication management unit configured to instruct a communication terminal performing communication related to the traffic volume to be managed to cut off communication when the determination unit determines that abnormal communication has occurred. An abnormality management device characterized by:

4. 3. The abnormality management device according to claim 2, the traffic volume to be managed for each time period is the traffic volume for each time period of the entire communication network, The communication management unit is further configured to notify the occurrence of a communication abnormality in the communication network when the determination unit determines that an abnormal communication has occurred. An abnormality management device characterized by:

5. a quantization step in which the normal traffic volume observed for each time period is quantized and converted into an integer-valued normal traffic volume sequence; a first learning step of treating each observed value of the normal traffic volume sequence as a mutually independent discrete value and estimating probability parameters of a probability model representing the quantized normal traffic volume based on the occurrence frequency of each observed value; a second learning step of learning a generative model having a generator and a classifier, the second learning step including substituting the probability parameters of the normal communication volume estimated in the first learning step into an objective function of the generative model while fixing generator parameters of the generator that generates pseudo-normal data sufficiently deviating from the distribution of the true normal data, with each observed value of the normal communication volume sequence being regarded as true normal data, and updating only classifier parameters of the classifier that distinguishes between the true normal data and the pseudo-normal data in a direction that maximizes classification accuracy; a storage step of storing the pseudo-normal data output by the generator in a storage unit as information indicating abnormal communication volume for each time period after updating the classifier parameters of the classifier in the second learning step; An abnormality management method comprising:

6. 6. The abnormality management method according to claim 5, Further, a collection step of collecting the traffic volume of the management target for each time period is provided, the quantization step quantizes the collected traffic volume of the management target and converts it into a traffic volume series of integer values; The method further includes a determination step of determining that an abnormal communication has occurred when the communication volume series matches the pseudo-normal data stored in the storage unit. An abnormality management method characterized by:

7. 7. The abnormality management method according to claim 6, the communication volume to be managed for each time period is the communication volume for each communication terminal for each time period, Further, the method includes a communication management step of issuing an instruction to cut off communication to a communication terminal that performs communication related to the traffic volume to be managed when it is determined in the determination step that abnormal communication has occurred. An abnormality management method characterized by:

8. 7. The abnormality management method according to claim 6, the traffic volume to be managed for each time period is the traffic volume for each time period of the entire communication network, Further, the method includes a communication management step of notifying the user that a communication abnormality has occurred in the communication network when it is determined in the determination step that an abnormal communication has occurred. An abnormality management method characterized by:

Images