Abnormality management device and abnormality management method

Abstract

To manage abnormal traffic without collecting a large amount of data on past abnormal traffic. [Solution] The abnormality management device 1 includes a first learning unit 11 configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs the posterior probability that the communication volume at each time is normal, using normal data that indicates normal communication volume included in the time series data of communication volume as training data, and a derivation unit 12 configured to derive the probability distribution of abnormal data that indicates abnormal communication volume based on the posterior probability estimated by the learned probability model, the probability distribution of normal data, and the prior probability of normality.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread in addition to smartphones and tablets. As the number of IoT devices increases, controlling the traffic of IoT device communications has become an issue.

[0003] Conventionally, there are known techniques for estimating abnormal traffic such as burst traffic and predicting the amount of traffic flowing through a communication network. For example, Patent Document 1 discloses a system that predicts the maximum value of traffic volume for a predetermined link using a statistical estimation method such as maximum likelihood estimation based on correlation data of multiple past traffic data for different links.

[0004] However, when estimating abnormal traffic such as burst traffic using statistical estimation such as maximum likelihood estimation as disclosed in Patent Document 1, a large amount of data on past abnormal traffic is required. Also, when estimating abnormal traffic using machine learning based on a supervised learning model, a large amount of learning data related to abnormal traffic must be prepared. Therefore, if it is not possible to collect a large amount of data on past abnormal traffic, it may be difficult to estimate or detect abnormal traffic. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-216585 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it may be difficult to detect abnormal traffic unless a large amount of past abnormal traffic data is collected.

[0007] The present invention has been made to solve the above-mentioned problems, and has as its object to manage abnormal traffic without collecting a large amount of data on past abnormal traffic. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the anomaly management device of the present invention includes a first learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the communication volume at each time is normal, using normal data that indicates normal communication volume included in time-series data of communication volume as training data; a derivation unit configured to derive a probability distribution of anomalous data that indicates anomalous communication volume based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing unit configured to obtain time-series data of the communication volume of the anomalous data based on the derived probability distribution of the anomalous data; a second learning unit configured to learn a generator that generates pseudo-anomalous data that is statistically similar to the true anomalous data, using the time-series data of the communication volume of the anomalous data obtained by the data processing unit as true anomalous data; and a memory unit configured to store the pseudo-anomalous data generated using the trained generator constructed by the second learning unit.

[0009] In addition, the abnormality management device of the present invention may further include a collection unit configured to collect time series data of the communication volume of the managed object, and a judgment unit configured to judge that the communication is abnormal when the collected time series data of the communication volume matches the pseudo-abnormal data stored in the memory unit.

[0010] In addition, in the abnormality management device of the present invention, the time series data of communication volume may be time series data of communication volume for each communication terminal, and may further include a communication management unit configured to instruct the communication terminal performing communication related to the time series data of communication volume to cut off communication when the judgment unit judges that the communication is abnormal.

[0011] In addition, in the abnormality management device of the present invention, the time series data of communication volume is time series data of communication volume of the entire communication network, and may further include a communication management unit configured to notify that a communication abnormality has occurred in the communication network when the judgment unit judges that communication is abnormal.

[0012] Furthermore, in the anomaly management device according to the present invention, the second learning unit may perform adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data.

[0013] In order to solve the above-mentioned problems, the anomaly management method of the present invention includes a first learning step of learning, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the communication volume at each time instant is normal, using normal data that indicates normal communication volume included in time-series data of communication volume as training data; a derivation step of deriving a probability distribution of anomalous data that indicates anomalous communication volume based on the posterior probability estimated by the learned probability model, the probability distribution of the normal data, and the prior probability of normality; a data processing step of obtaining time-series data of communication volume of the anomalous data based on the derived probability distribution of the anomalous data; a second learning step of learning a generator that generates pseudo-anomalous data that is statistically similar to the true anomalous data, using the time-series data of communication volume of the anomalous data obtained in the data processing step as true anomalous data; and a storage step of storing the pseudo-anomalous data generated using the trained generator constructed in the second learning step in a storage unit.

[0014] In addition, the abnormality management method of the present invention may further include a collection step of collecting time series data of the communication volume of the managed object, and a determination step of determining that the communication is abnormal if the collected time series data of the communication volume matches the pseudo-abnormal data stored in the memory unit.

[0015] In addition, in the abnormality management method of the present invention, the time series data of communication volume may be time series data of communication volume for each communication terminal, and may further include a communication management step of instructing a communication terminal performing communication related to the time series data of communication volume to cut off communication when the communication is determined to be abnormal in the determination step.

[0016] In addition, in the abnormality management method of the present invention, the time series data of communication volume may be time series data of communication volume of the entire communication network, and may further include a communication management step of notifying that a communication abnormality has occurred in the communication network if the communication is determined to be abnormal in the determination step.

[0017] In addition, in the anomaly management method according to the present invention, the second learning step may perform adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo anomalous data generated by the generator and the true anomalous data. [Effects of the Invention]

[0018] According to the present invention, normal data indicating normal traffic volume is used as training data, and parameters of a probabilistic model that outputs the posterior probability that traffic volume at each time is normal are learned by maximum likelihood estimation, and the probability distribution of abnormal data indicating abnormal traffic volume is derived based on the posterior probability estimated by the learned probabilistic model, the probability distribution of normal data, and the probability of normality.As a result, abnormal traffic can be managed without collecting a large amount of data on past abnormal traffic. [Brief explanation of the drawings]

[0019] [Figure 1]FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining an outline of traffic abnormality data managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0021] [Communication control system configuration] First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 according to an embodiment of the present invention will be described.

[0022] The fault management system according to this embodiment includes a fault management device 1, a communication terminal 2, a base station 3, and a core network 4. As an example, the fault management system is provided in a 5G mobile communication network, but may also be a network using a fixed line. As shown in FIG. 1, the fault management device 1 is connected to the core network 4 via a network NW such as a LAN, a WAN, or the Internet.

[0023] The communication terminal 2 is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, an industrial robot, etc. The communication terminal 2 is equipped with a SIM (Subscriber Identity Module), and the contract profile of the SIM includes identifier information such as an International Mobile Subscriber Identity (IMSI). The communication terminal 2 is uniquely identified by the IMSI.

[0024] The communication terminal 2 is also configured as an IoT device to which a terminal IP address that uniquely identifies the terminal is assigned. In this embodiment, there are n communication terminals 2 (n is a positive integer of 2 or more). The communication terminals 2 connect to an external data network (not shown) from a core network 4 via the base station 3 in which each communication terminal 2 is located.

[0025] Among the multiple communication terminals 2, there are some that communicate at a volume exceeding the set bandwidth, and such communications may cause or threaten traffic congestion. Other communication terminals 2 may also include, for example, terminals that engage in sudden or continuous high-volume communications that deviate from normal usage trends, irregular communications, or communications at unconventional times or protocols. Such communications with abnormal volumes that deviate from normal volumes include intentional communications by users of the communication terminals 2, as well as unintentional communications such as DDoS attacks. In this specification, such communications volumes exceeding the set bandwidth are defined as abnormal volumes relative to normal volumes.

[0026] Fig. 2 is a diagram for explaining abnormal data on communication volume. In Fig. 2(a), the horizontal axis is time and the vertical axis is communication volume, with curve a1 representing time series data of normal communication volume from one communication terminal 2 and curve b1 representing time series data of abnormal communication volume from another communication terminal 2. In time range c, traffic increases suddenly, and an abnormality in communication volume occurs.

[0027] The base station 3 is composed of a wireless base station compatible with the 5G system, and relays communications between the communication terminal 2 located within the communication area and the core network 4. The base station 3 is connected to the core network 4 via a network such as a backhaul link.

[0028] The core network 4 provides centralized control, routing, management, and security for communications relayed by the base station 3. The core network 4 includes a UPF (User Plane Function) 40 in the U-plane. The core network 4 also includes nodes in the C-plane, such as an AMF (Access and Mobility Management Function) and a UDM (Unified Data Management), which are not shown. Functional nodes in the U-plane and C-plane other than the UPF 40 that the core network 4 includes are not shown in the figure.

[0029] The UPF 40 is a user plane function that processes packets between the base station 3 and a data network such as the Internet. The UPF 40 includes a communication interface 40a for communicating with the abnormality management device 1. The UPF 40 records the communication volume of the communication terminal 2 that performs traffic processing.

[0030] [Function block of the abnormality management device] Next, the functional blocks of the fault management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the fault management device 1 includes a collection unit 10, a first learning unit 11, a derivation unit 12, a data processing unit 13, a second learning unit 14, a generation unit 15, a storage unit 16, a determination unit 17, and a communication management unit 18.

[0031] The collection unit 10 acquires time series data of communication volume collected by the core network 4 that controls communication between multiple communication terminals 2. The collection unit 10 acquires a history of communication volume for each communication terminal 2 for which traffic processing is performed on the UPF 40. The time series data of communication volume indicates communication volume for each IMSI. Furthermore, the time series data of communication volume indicates communication volume for each time period. The collection unit 10 collects time series data that includes a certain amount or more of normal communication volume to be used for learning by the first learning unit 11. Furthermore, the collection unit 10 collects time series data of communication volume that is the target of abnormality judgment by the judgment unit 17.

[0032] The first learning unit 11 uses normal data indicating normal communication volume included in the time-series data of communication volume as training data and learns parameters of a probability model that outputs a posterior probability that the communication volume at each time is normal by maximum likelihood estimation. The first learning unit 11 learns the probability model by maximum likelihood estimation using normal data in a situation where there is little abnormal data. The first learning unit 11 can use time-series data of communication volume that includes a certain amount of normal data as training data.

[0033] Here, x is the communication volume x at a certain observation point in a certain time period (for example, a time slot number). As shown in the following equation (1), the density function of normal data is expressed as ρ d (x), the density function of the abnormal data is ρ g (x) and (x) respectively.

number

[0034] In the above formula (1), y=1 indicates the normal class, and y=0 indicates the abnormal class. d(x) indicates the tendency of the amount of communication x when it belongs to the normal class y=1, and ρ g (x) shows the tendency of the amount of communication x when belonging to the abnormal class y=0. Here, (b) of Figure 2 shows the amount of communication on the horizontal axis and the probability distribution on the vertical axis, and shows the density function (probability distribution) a2 of normal data and the density function (probability distribution) b2 of abnormal data at the data points of the black circles for normal data a1 and abnormal data b1 in (a) of Figure 2. In the example of (b) of Figure 2, the probability distributions of both normal data and abnormal data are normal distributions.

[0035] The density ratio γ(x) of the density function in the above equation (1) is expressed by the following equation (2):

number

[0036]

number

[0037] Here, if π=ρ(y=1), the above equation (3) can be further expressed as the following equation (4).

number

[0038] Therefore, we first calculate the posterior probability ρ(y=1|x) that the observed value x is normal (y=1) in large quantities. Assuming that the posterior probability ρ(y=1|x) of normal data follows a normal distribution, it is defined as shown in the following equation (5).

number

[0039] Furthermore, the output of the probabilistic model f(x n ) can be expressed as a linear combination as shown in the following equation (6).

number

[0040]

number

[0041]

number

[0042] Furthermore, the communication volume f(x n ) and the actual normal traffic volume t n The average error from the (teacher signal) is the variance σ of the normal distribution shown in the following equation (9). 2 The value becomes

number

[0043] In this way, when a linear combination of probability models estimates the posterior probability that communication volume is normal for an input x, each observation t is calculated based on the estimated value f(x n ) is assumed to follow a normal distribution with mean x n ,t n ) to obtain the parameters w and error variance σ of the probability model. 2 In addition, from the definition of the normal distribution in equation (5) above, the density function ρ d (x) is found.

[0044] Here, if we approximately estimate the posterior probability ρ(y=1|x) of normal data, then ρ(y=1|x)≒q w The relationship is (y=1|x). The posterior probability that the input communication volume x is normal is estimated as q w Based on (y=1|x), the cross entropy is defined as the loss function U as shown in the following equation (10).

number

[0045] The convergence value (minimum value) of the loss function U in the above equation (10) is expressed by the following equation (11).

number

[0046] The derivation unit 12 transforms the above formula (11) into the following formula (12), and calculates the density function ρ g Derive (x).

number

[0047] In the above equation (12), the probability distribution of normal data, i.e., the density function of normal data, ρ d (x) is calculated from normal data collected by the collection unit 10. The prior probability of normal data, π, is much larger than the prior probability of abnormal data, (1-π), and can be set to, for example, 0.99. Furthermore, the logarithmic likelihood lnq when y=1 for the observed value x is w As shown in the above equations (6) to (9), (y=1|x) is calculated by maximum likelihood estimation based on a large amount of normal data (teacher signal). In this way, even if there is a small amount of abnormal data, the probability distribution of abnormal data can be calculated from the normal data.

[0048] The derivation unit 12 calculates the estimated value q of the posterior probability estimated by the probability model learned by the first learning unit 11. w (y=1|x) and the density function ρ of normal data d Based on (x) and the prior probability π of normality, the density function ρ of abnormal data indicating abnormal communication volume is calculated. g Derive (x).

[0049] The data processing unit 13 obtains time series data of the communication volume of the abnormal data based on the derived probability distribution of the abnormal data. The data processing unit 13 calculates the time series data of the communication volume of the abnormal data based on the density function ρ gBy using (x) to generate values ​​of communication volume in an abnormal state by, for example, random sampling and arranging them in time series, time series data of communication volume of abnormal data can be obtained. Furthermore, the data processing unit 13 can obtain time series data of communication volume of abnormal data corresponding to any multiple data points in the time range c in Figure 2(a) where the abnormal state occurs.

[0050] The second learning unit 14 learns a generator 141 that generates pseudo-anomalous data that is statistically similar to true anomalous data, using the time-series data of the communication volume of the anomalous data obtained by the data processing unit 13 as true anomalous data. The second learning unit 14 performs adversarial learning of a generative model that includes, for example, the generator 141 and a classifier 142 that distinguishes between the pseudo-anomalous data generated by the generator 141 and true anomalous data.

[0051] As shown in FIG. 3, the second learning unit 14 performs adversarial learning on a GAN (Generative Adversarial Network) having a generator 141 and a classifier 142.

[0052] 4 and 5 are diagrams schematically illustrating the neural network configurations of the generator 141 and the classifier 142 of the GAN used by the second learning unit 14. As shown in FIG. 4, the generator 141 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 141 is a model that generates pseudo-anomalous data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m ).

[0053] The generator 141 performs a product-sum operation on the input and weight parameters and performs threshold processing using an activation function to output the output G(z). The output G(z) from the generator 141 is data similar to true abnormal data. CNN or ResNet can be used as the neural network that constitutes the generator 141.

[0054] The classifier 142 shown in Fig. 5 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5, the time-series data of the communication volume of abnormal data obtained by the data processing unit 14 as a result of learning by the first learning unit 11 is provided as the input of training data.

[0055] The classifier 142 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 142 outputs an output y=1 when it correctly identifies the training data related to the input true anomalous data as true anomalous data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo anomalous data as pseudo anomalous data. In this way, the classifier 142 is a model that distinguishes the model distribution generated by the generator 141 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 142.

[0056] FIG. 3 is a block diagram for explaining the adversarial learning of GAN by the second learning unit 14. The generator 141 of the GAN adopted by the second learning unit 14 is represented as a function G, and the classifier 142 is represented as a function D. Furthermore, true abnormal data is represented as x, the predicted value output by the classifier 142 is represented as y, and the correct label is represented as t. The correct label t is set to 1 for true abnormal data and 0 for pseudo abnormal data generated by the generator 141. In this case, the classifier 142 calculates the cross entropy E CE It can be expressed as:

[0057]

number

[0058] The first term in the brace of the above equation (13) represents t n lny n In this case, the predicted value y n is the correct label for the true anomaly data, t n = 1. On the other hand, the second term in the braces represents (1-t n)ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0059] Here, the generator 141 constituting the GAN has parameters w G ,θ G and the function G(w G ,θ G ) The classifier 142 uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (13) CE The objective function E of the GAN including the generator 141 and the discriminator 142 based on the above can be expressed by the following equation (14).

number

[0060] The first term of the above equation (14) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 142 classifies true abnormal data as true abnormal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 142 classifies the pseudo-anomalous data generated by the generator 141 as pseudo-anomalous data. In GAN learning, the generator 141 and the classifier 142 are trained adversarially through min-max optimization of the objective function E. Therefore, the generator 141 is trained to be able to generate pseudo-anomalous data that can fool the classifier 142, and the classifier 142 is trained to classify the pseudo-anomalous data generated by the generator 141 as pseudo-anomalous data.

[0061] In learning of the classifier 142, when true abnormal data is given, the classifier 142 outputs an output close to y=1, thereby maximizing the first term of the objective function E in the above equation (14). On the other hand, when pseudo abnormal data is given, the classifier 142 learns to output an output close to y=0, thereby maximizing the second term of the objective function E.

[0062] In the learning of the generator 141, D(G(w G ,θ G ),w D ,θ D ) (D(G(z)) in Figure 3) is close to 1. G ,θ G ) (G(z) in FIG. 3 ), thereby minimizing the objective function E. The second learning unit 14 uses a learning procedure that alternately updates the parameters of the generator 141 and the classifier 142. Details of the learning procedure of the generator 141 and the classifier 142 by the second learning unit 14 will be described later.

[0063] The generation unit 15 generates pseudo abnormal data using a trained generator 141′ in which the objective function E of the GAN has been optimized by the second learning unit 14.

[0064] The storage unit 16 stores the generated pseudo abnormal data as well as the true abnormal data obtained by the data processing unit 13.

[0065] The determination unit 17 determines that the communication is abnormal when the time series data of the communication volume collected by the collection unit 10 matches the pseudo-abnormal data stored in the storage unit 16. More specifically, when the time series data of the communication volume matches the pseudo-abnormal data and the true abnormal data stored in the storage unit 16, the determination unit 17 identifies the IMSI of the communication terminal 2 related to the time series data of the communication volume.

[0066] When the determination unit 17 determines that the communication is abnormal, the communication management unit 18 instructs the communication terminal 2 performing communication related to the time-series data of the communication volume to be determined to cut off the communication. For example, the communication management unit 18 specifies the IMSI and transmits an instruction to cut off the communication to the core network 4. Specifically, the communication management unit 17 can be configured to transmit a control request to the policy control function (PCF) or the session management function (SMF) to stop the communication of the IMSI, and invalidate the communication session of the communication terminal 2.

[0067] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0068] 6, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0069] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0070] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, the first learning unit 11, the derivation unit 12, the data processing unit 13, the second learning unit 14, the generation unit 15, the determination unit 17, and the communication management unit 18 shown in FIG.

[0071] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0072] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0073] The auxiliary storage device 105 has a program storage area for storing the abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a learning program for performing GAN adversarial learning executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a first learning program executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 16 described in FIG. 1. Furthermore, for example, the auxiliary storage device 105 may have a backup area for backing up the above-mentioned data, programs, etc.

[0074] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0075] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display true abnormal data on the screen.

[0076] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0077] 7, first, the collection unit 10 collects time-series data of communication volume that includes a certain amount or more of normal data (step S1). The collection unit 10 collects time-series data of communication volume in which, for example, 99% of the data constituting the time-series data of communication volume is normal data. The collection unit 10 collects time-series data of communication volume of each communication terminal 2 from the UPF 40.

[0078] Next, the first learning unit 11 performs a first learning process (step S2). After that, the derivation unit 12 derives a density function of the abnormal data (step S3). FIG. 8 is a flowchart illustrating steps S2 and S3 in more detail. As shown in step S30 of FIG. 8, the first learning unit 11 uses the normal data as training data and, based on the time-series data of the communication volume that contains normal data at a rate above a certain level, the first learning unit 11 derives an estimate q of the posterior probability that the communication volume x is normal. w Parameters w,σ of the probabilistic model that outputs (y=1|x) 2 is learned by maximum likelihood estimation (step S30).

[0079] In step S30, the first learning unit 11 performs learning by maximum likelihood estimation in accordance with the above equations (6) to (9). Also, in step S30, the first learning unit 11 uses the parameters w, σ estimated by maximum likelihood estimation. 2 From the probability model with w Find (y=1|x).

[0080] Furthermore, the first learning unit 11 calculates the density function ρ of normal data based on the normal communication amount x at each time. d (x) (normal distribution) is estimated (step S31).

[0081] Next, the derivation unit 12 adds the log likelihood lnq of the posterior probability calculated in step S30 to the above equation (12). w (y=1|x), the density function ρ of the normal data obtained in step S31 d (x) and the prior probability of normal data π (e.g., 0.99) to obtain the density function ρ of the abnormal data. g (x) is derived (step S33).

[0082] Thereafter, the process proceeds to step S4 in Fig. 7. Subsequently, the data processing unit 13 calculates the density function ρ of the abnormal data derived in step S3. g Based on (x), the communication volume of the abnormal data for each time is arranged to obtain time series data (step S4). For example, in step S4, the density function ρg From (x), create 10,000 data points centered around the median. If there are 1,000 time slots, create (10,000 to the power of 1,000) pieces of time series data.

[0083] Next, the second learning unit 14 learns a generator 141 that generates pseudo-abnormal data that is statistically similar to the true abnormal data, using the time series data of the communication volume of the abnormal data obtained in step S4 as the true abnormal data (step S5) (second learning process).

[0084] Specifically, the second learning unit 14 performs adversarial learning of a GAN having a generator 141 that generates pseudo-anomalous data similar to the true anomalous data, using the time-series data of the communication volume of the anomalous data obtained in step S4 as true anomalous data, and a classifier 142 that distinguishes between the pseudo-anomalous data generated by the generator 141 and the true anomalous data. Details of the learning process in step S5 will be described later.

[0085] Next, the generation unit 15 generates pseudo abnormal data using the trained generator 141′ (step S6). The generated pseudo abnormal data is stored in the storage unit 16 (step S7). In step S7, the true abnormal data used as training data for the GAN is also stored in the storage unit 16.

[0086] Thereafter, the collection unit 10 collects time-series data of the communication volume of the management target (step S8). Next, the determination unit 17 determines that an abnormal communication has occurred if the time-series data of the communication volume collected in step S8 matches the pseudo-abnormal data or the true abnormal data stored in the storage unit 16 (step S9). In step S9, the time-series data of the communication volume of the management target can be determined to be an abnormal communication when it completely matches the pseudo-abnormal data or the true abnormal data, or when it matches within a certain tolerance range. In addition, the time-series data of the communication volume can be compared from an earlier time period, and an abnormal communication can be determined when it matches in a time period before the peak of the curve b1 of the abnormal data in FIG. 2(a).

[0087] Next, the communication management unit 18 identifies the IMSI of the communication terminal 2 that performed the communication related to the time series data of the communication volume that was determined to be abnormal communication, and instructs the core network 4 to cut off the communication by specifying the identified IMSI (step S10).

[0088] Next, the second learning process (step S5) of the abnormality management device 1 described in FIG. 7 will be described with reference to FIG. 9. First, the second learning unit 14 inputs true abnormal data to the classifier 142 as training data 144, and adjusts the parameter w of the classifier 142 so that the true abnormal data is classified as true abnormal data (y=1). D ,θ D is learned and updated (step S20).

[0089] In step S20, the second learning unit 14 can cause the classifier 142 to learn true abnormal data using, for example, an error backpropagation method. By step S20, the classifier 142 that can distinguish true abnormal data from true abnormal data is constructed in advance.

[0090] Next, the second learning unit 14 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 141 (step S21). Subsequently, the generator 141 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo abnormal data G(z) (step S22).

[0091] Next, the second learning unit 14 learns the classifier 142. The learning of the classifier 142 is performed by using the parameter w D ,θ D First, the second learning unit 14 provides true abnormal data as training data 144 as input to the classifier 142. Then, the second learning unit 14 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (14) is maximized. D ,θ D(Step S23). The label of the training data 144 is set to 1 (true abnormal data).

[0092] Next, the second learning unit 14 provides the pseudo abnormal data generated by the generator 141 in step S22 to the discriminator 142, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (14) is maximized. D ,θ D That is, in steps S23 and S24, in order to maximize the objective function E in the above equation (14), the first term is updated as D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D )=0. Note that the training data 144 is set to a label of 0 (pseudo abnormal data).

[0093] The learning of the classifier 142 in steps S23 and S24 corresponds to the dashed arrows in the block diagram of the second learning unit 14 shown in FIG. 3 , which indicate that a classifier error is calculated in block 145 of the objective function E based on output 143 from the classifier 142, and then the error is backpropagated to the classifier 142.

[0094] Next, the second learning unit 14 performs learning of the generator 141. The learning of the generator 141 is performed with the parameters of the discriminator 142 fixed. The second learning unit 14 trains the generator 141 so that pseudo abnormal data is generated when random Gaussian noise is given to the generator 141. Specifically, the second learning unit 14 uses the backpropagation method or the like to learn the parameters w G ,θ G is updated (step S25).

[0095] The learning in step S25 corresponds to the flow indicated by the dashed arrow indicating backpropagation of error to the generator 141 in the block diagram of the second learning unit 14 in Fig. 3. That is, step S25 corresponds to the flow indicated by the dashed arrow in which pseudo abnormal data generated by the generator 141 in Fig. 3 is input to the discriminator 142, a generator error is calculated from the output 143 thereof in the block 145 of the objective function E, and the error is further backpropagated to the generator 141.

[0096] Thereafter, learning of the discriminator 142 and the generator 141 from step S22 to step S25 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S26: NO). On the other hand, if the value of the objective function E has converged (step S26: YES), the processing from step S20 to step S26 is repeated using the remaining true abnormal data in turn until learning of the generator 141 and the discriminator 142 is performed (step S27: NO).

[0097] Thereafter, when the generator 141 and the classifier 142 have been trained using all true abnormal data (step S27: YES), the second learning unit 14 stores the trained generator 141' in the storage unit 16 (step S28). The trained generator 141' is constructed by the above-described processes from step S20 to step S28. After that, the process proceeds to step S6 in FIG. 7.

[0098] As described above, the abnormality management device 1 according to this embodiment estimates the posterior probability that the traffic volume is normal by learning the parameters of a probabilistic model that outputs the posterior probability that the traffic volume is normal using normal data as training data through maximum likelihood estimation. Furthermore, a density function for abnormal data is derived based on the estimated value of the posterior probability, the density function for normal data, and the prior probability for normal data. Furthermore, time-series data on the traffic volume of the abnormal data obtained from the derived density function for the abnormal data is used as true abnormal data in the generation model, and pseudo-abnormal data similar to the true abnormal data is generated. The generated pseudo-abnormal data is stored in the storage unit 16 as a database together with the true abnormal data. Therefore, abnormal traffic can be managed without collecting a large amount of data on past abnormal traffic.

[0099] Furthermore, the abnormality management device 1 according to this embodiment collects time-series data on the communication volume for each communication terminal 2 and determines the abnormal data, thereby identifying the communication terminal 2 performing abnormal communication and then cutting off the communication. This allows for more effective traffic management of the communication network.

[0100] Furthermore, according to the abnormality management device 1 of this embodiment, the presence or absence of abnormal communication is determined in a time period before a sudden increase in communication volume, such as burst traffic, actually occurs, thereby enabling more effective traffic management.

[0101] [Variations] Next, a modified example of this embodiment will be described. In the above-described embodiment, the collection unit 10 collects time-series data on the communication volume for each communication terminal 2, and identifies a communication terminal 2 that is performing anomalous communication. In contrast, in this modified example, the collection unit 10 collects communication volume for the entire communication network, and detects anomalous communication that occurs in the entire communication network. The following description will focus on configurations that differ from the above-described embodiment.

[0102] In the abnormality management device 1 according to the modified example, the collection unit 1 collects time-series data on the communication volume of the entire communication network. Furthermore, when the determination unit 17 determines that communication is abnormal, the communication management unit 18 issues a notification indicating that a communication abnormality has occurred in the communication network. For example, the communication management unit 18 can issue a notification to an external management and monitoring system.

[0103] The first learning unit 11 learns the parameters of the probabilistic model based on the time-series data of the traffic volume of the entire communication network. The second learning unit 14 also learns the generator 141 by using the time-series data of the abnormal data of the entire communication network as true abnormal data.

[0104] In this way, according to the abnormality management device 1 of the modified example, even if there is little abnormal data, it is possible to build a database of abnormal data based on normal data and detect abnormal communications throughout the entire communication network.

[0105] In the embodiment described above, the anomaly management system is described as a system conforming to the 5G standard, but the communication standard may be 3G, 4G / LTE, 6G, etc. Furthermore, the anomaly management system is not limited to a mobile communication network, and may be a network using a fixed line as described above. In this case, the system may be configured to collect communication volume logs via a wireless router or wireless access point.

[0106] In the embodiment described above, the second learning unit 14 performs GAN learning. However, the learning of the generator 141 can be performed using a VAE (Variational Autoencoder), a diffusion model, Energy-Based Models (EBMs), or the like in addition to adversarial learning.

[0107] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0108] 1...abnormality management device, 2...communication terminal, 3...base station, 4...core network, 10...collection unit, 11...first learning unit, 12...derivation unit, 13...data processing unit, 14...second learning unit, 15...generation unit, 16...memory unit, 17...judgment unit, 18...communication management unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 141...generator, 142...identifier, NW...network.

Claims

1. a first learning unit configured to learn, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the communication volume at each time point is normal, using normal data that indicates normal communication volumes included in the time-series data of communication volumes as training data; a derivation unit configured to derive a probability distribution of abnormal data indicating an abnormal communication volume based on the posterior probability estimated by the probability model in which the first learning unit learns the parameters by maximum likelihood estimation, the probability distribution of the normal data, and a priori probability of normality; a data processing unit configured to obtain time series data of the communication volume of the abnormal data based on the probability distribution of the abnormal data derived by the derivation unit; a second learning unit configured to learn a generator that generates pseudo-anomalous data that is statistically similar to the true abnormal data, using the time-series data of the communication volume of the abnormal data obtained by the data processing unit as true abnormal data; a storage unit configured to store the pseudo abnormal data generated using the trained generator constructed by the second learning unit; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, a collection unit configured to collect time series data of the communication volume of the management target; a determination unit configured to determine that an abnormal communication has occurred when the time-series data of the communication volume of the managed object collected by the collection unit matches the pseudo-abnormal data stored in the storage unit; and An abnormality management device comprising:

3. 3. The abnormality management device according to claim 2, the time series data of communication volume is time series data of communication volume for each communication terminal, a communication management unit configured to instruct, when the determination unit determines that abnormal communication has occurred, to cut off communication with a communication terminal that performs communication related to the time-series data of the communication volume of the management target. An abnormality management device comprising:

4. 3. The abnormality management device according to claim 2, the time series data of the communication volume is time series data of the communication volume of the entire communication network, a communication management unit configured to notify the occurrence of a communication abnormality in the communication network when the determination unit determines that an abnormal communication has occurred; An abnormality management device comprising:

5. 2. The abnormality management device according to claim 1, The second learning unit performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data. An abnormality management device characterized by:

6. a first learning step of learning parameters of a probabilistic model that outputs a posterior probability that the communication volume at each time point is normal by maximum likelihood estimation, using normal data indicating normal communication volumes included in the time-series data of communication volumes as training data; a derivation step of deriving a probability distribution of abnormal data indicating an abnormal communication volume based on the posterior probability estimated by the probability model in which the parameters are learned by maximum likelihood estimation in the first learning step, the probability distribution of the normal data, and a prior probability of normality; a data processing step of obtaining time series data of the communication volume of the abnormal data based on the probability distribution of the abnormal data derived in the derivation step; a second learning step of learning a generator that generates pseudo-anomalous data that is statistically similar to the true abnormal data, using the time-series data of the communication volume of the abnormal data obtained in the data processing step as true abnormal data; a storage step of storing the pseudo abnormal data generated using the trained generator constructed in the second learning step in a storage unit; An abnormality management method comprising:

7. 7. The abnormality management method according to claim 6, Furthermore, a collection step of collecting time series data of the communication volume of the management target; a determining step of determining that an abnormal communication has occurred when the time-series data of the communication volume of the managed object collected in the collecting step matches the pseudo-abnormal data stored in the storage unit; An abnormality management method comprising:

8. The abnormality management method according to claim 7, the time series data of communication volume is time series data of communication volume for each communication terminal, and a communication management step of issuing an instruction to cut off communication with a communication terminal that performs communication related to the time-series data of the communication volume of the management target when it is determined in the determination step that abnormal communication has occurred. An abnormality management device comprising:

9. The abnormality management method according to claim 7, the time series data of the communication volume is time series data of the communication volume of the entire communication network, and a communication management step of issuing a notification indicating that a communication abnormality has occurred in the communication network when it is determined in the determination step that an abnormal communication has occurred. An abnormality management method comprising:

10. 7. The abnormality management method according to claim 6, The second learning step performs adversarial learning of a generative model having the generator and a classifier that distinguishes between the pseudo-anomalous data generated by the generator and the true anomalous data. An abnormality management method characterized by:

Images