Abnormal communication detection device and abnormal communication detection method

Abstract

The purpose is to more reliably manage abnormal communications. [Solution] The anomalous communication detection device 1 includes a learning unit 11 that constructs a multivariate probability model using information on the presence state indicating whether the communication terminal 2 was present in the communication area of ​​each base station 3 during each time period, based on a history of presence information regarding the communication area of ​​the base station 3 in which the communication terminal 2 identified by the subscriber identifier was present, estimates parameters of the multivariate probability model, and generates a matrix indicating conditional dependencies between presence states, and a determination unit 12 that determines that an inconsistency exists in the presence information of the communication terminal when the value of a component in the matrix indicating the conditional dependencies between presence states exceeds a predetermined threshold.

Description

[Technical Field]

[0001] The present invention relates to an abnormal communication detection device and an abnormal communication detection method. [Background technology]

[0002] In recent years, there has been an issue with so-called clone SIMs (Subscriber Identity Modules), in which a legitimate user's subscriber identifier (International Mobile Subscriber Identity: IMSI) is illegally obtained, and by illegally accessing a mobile IP network, a location registration request signal is sent while impersonating the legitimate user, thereby intercepting the legitimate user's communications (see Non-Patent Documents 1 and 2).

[0003] A known technique for detecting such fraudulent location registration requests is to check the base station number and AMF (Access and Mobility Management Function) number included in the location registration request to a control device on the mobile communications carrier network side, and detect it as fraudulent access when location registration requests with the same IMSI are made at almost the same time from distant locations, such as in Japan and a foreign country (see Non-Patent Document 1).

[0004] However, when a fraudulent location registration request occurs relatively close to the legitimate user's location (for example, within Japan), it is difficult to distinguish whether the request is from a legitimate user or an attacker. This makes it difficult to detect abnormal communications such as those from clone SIMs. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] GSM Association, “FS.19 Diameter Interconnect Security Version 4.0”, 04 May 2018. [Non-patent document 2] GSM Association, “FS.11-SS7 Interconnect Security Monitoring and Firewall Guidelines 4.0”, 04 May 2018. Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, it has been difficult to reliably detect abnormal communications with conventional techniques.

[0007] The present invention has been made to solve the above-mentioned problems, and has an object to more reliably detect abnormal communications. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the anomalous communication detection device of the present invention comprises a learning unit configured to construct a multivariate probabilistic model using information on the presence state indicating whether or not a communication terminal identified by a subscriber identifier was present in the communication area of ​​each base station in each time period based on a history of presence information regarding the communication area of ​​the base station in which the communication terminal was present, estimate parameters of the multivariate probabilistic model, and generate a matrix indicating conditional dependencies between the presence states; and a judgment unit configured to determine that an inconsistency exists in the presence information of the communication terminal when the value of a component in the matrix indicating the conditional dependencies between the presence states exceeds a predetermined threshold.

[0009] The anomalous communication detection device according to the present invention may further include an acquisition unit configured to acquire the history of the presence information of the communication terminal from a core network.

[0010] In addition, in the anomalous communication detection device of the present invention, the judgment unit may be configured to judge that anomalous communication has occurred using a subscriber identifier that is identical to the subscriber identifier of the communication terminal when the value of the component in the matrix that indicates the conditional dependency between the presence states exceeds the predetermined threshold, and may further be equipped with a sending unit configured to send a response request to a telephone number linked to the subscriber identifier of the communication terminal when the judgment unit judges that anomalous communication using the identical subscriber identifier has occurred, and an instruction unit configured to give an instruction to block communication using the identical subscriber identifier when no response to the response request is received from the identical subscriber identifier.

[0011] In addition, in the anomalous communication detection device of the present invention, the instruction unit may instruct to delete the subscriber profile linked to the same subscriber identifier when no response to the response request is received from the same subscriber identifier.

[0012] Furthermore, in the anomalous communication detection device according to the present invention, the learning unit may estimate the parameters of a multivariate normal distribution model for multivariate data having the presence state as a variable by maximum likelihood estimation, and generate a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the presence states.

[0013] In order to solve the above-mentioned problems, the anomalous communication detection method of the present invention comprises a learning step of constructing a multivariate probabilistic model using presence state information indicating whether a communication terminal identified by a subscriber identifier was present in the communication area of ​​each base station for each time period based on a history of presence information regarding the communication area of ​​a base station in which the communication terminal was present, estimating parameters of the multivariate probabilistic model, and generating a matrix indicating conditional dependencies between the presence states; and a determination step of determining that an inconsistency exists in the presence information of the communication terminal if the value of a component indicating the conditional dependencies between the presence states in the matrix generated in the learning step exceeds a predetermined threshold.

[0014] The anomalous communication detection method according to the present invention may further include an acquisition step of acquiring the history of the location information of the communication terminal from a core network.

[0015] Furthermore, in the anomalous communication detection method according to the present invention, the determination step may determine that anomalous communication has occurred using a subscriber identifier that is identical to the subscriber identifier of the communication terminal when the value of the component in the matrix that indicates the conditional dependency between the presence states exceeds the predetermined threshold, and may further include a sending step of sending a response request to a telephone number linked to the subscriber identifier of the communication terminal when it is determined in the determination step that anomalous communication using the identical subscriber identifier has occurred, and an instruction step of issuing an instruction to block communication using the identical subscriber identifier when no response to the response request is received from the identical subscriber identifier.

[0016] In addition, in the anomalous communication detection method of the present invention, the instruction step may instruct to delete the subscriber profile linked to the same subscriber identifier when no response to the response request is received from the same subscriber identifier.

[0017] Furthermore, in the anomalous communication detection method according to the present invention, the learning step may estimate the parameters of a multivariate normal distribution model for multivariate data having the presence state as a variable by maximum likelihood estimation, and generate a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the presence states. [Effects of the Invention]

[0018] According to the present invention, a multivariate probabilistic model is constructed using location status information indicating whether a communication terminal, identified by a subscriber identifier, was present in the communication area of ​​each base station for each time period, based on the location information history relating to the communication areas of the base stations in which the communication terminal was present, and parameters of the multivariate probabilistic model are estimated to generate a matrix indicating the conditional dependencies between location statuses, thereby enabling more reliable detection of abnormal communications. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 is a block diagram showing the configuration of an anomalous communication detection system including an anomalous communication detection device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the history of location information acquired by the anomalous communication detection device according to this embodiment. [Figure 3] FIG. 3 is a schematic diagram for explaining the configuration of the learning unit included in the anomalous communication detection device according to this embodiment. [Figure 4] FIG. 4 is a schematic diagram for explaining the configuration of the learning unit included in the anomalous communication detection device according to this embodiment. [Figure 5] FIG. 5 is a block diagram showing the hardware configuration of the anomalous communication detection device according to this embodiment. [Figure 6] FIG. 6 is a sequence diagram showing the operation of the anomalous communication detection system including the anomalous communication detection device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0021] [Configuration of an abnormal communication detection system] First, with reference to FIG. 1, an outline of an anomalous communication detection system including an anomalous communication detection device 1 according to an embodiment of the present invention will be described.

[0022] The anomalous communication detection system according to this embodiment is provided in, for example, a mobile communication network compatible with the 5G communication standard. The anomalous communication detection system includes an anomalous communication detection device 1, a communication terminal 2, a base station 3, and a core network 4. The anomalous communication detection system learns a multivariate model from the time-series history of presence information for each IMSI that identifies the communication terminal 2, and detects presence relationships that deviate from normal behavior patterns, thereby detecting anomalous communication that may be the result of fraudulent use of IMSIs.

[0023] The communication terminal 2 can be realized by a computer equipped with a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output (I / O), and a program that controls these hardware resources. The communication terminal 2 also includes a SIM (Subscriber Identity Module), and can be realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, a wearable device, an industrial robot, or the like. In this embodiment, there are multiple communication terminals 2.

[0024] The SIM installed in the communication terminal 2 stores a user's contract profile. The SIM's contract profile stores the user's subscriber identification information, including identification information such as the IMSI, which is a subscriber identifier assigned to a mobile phone line contract, the subscriber's telephone number (MSISDN: Mobile Subscriber International Subscriber Directory Number), and the SIM card number (ICCID: Integrated Circuit Card Identifier). The communication terminal 2 is uniquely identified by the assigned IMSI. Note that the actual subscriber user is called a legitimate user, and the term "illegal" refers to an act in which an attacker or other non-legitimate user communicates using the legitimate user's IMSI. Such fraudulent communication is detected as abnormal communication by an anomalous communication detection system. The legitimate user's SIM and the attacker's SIM may be electronic SIMs.

[0025] The communication terminal 2 can also be configured as an IoT device to which a terminal IP address that uniquely identifies the terminal is assigned. In this embodiment, there are n communication terminals 2 (n is an integer of 2 or more).

[0026] The communication terminal 2 performs mobile communication and can move sequentially from the communication area of ​​the current base station 3 to the communication area of ​​the destination base station 3 according to the movement route. When the communication terminal 2 crosses from the communication area of ​​the source base station 3 to the communication area of ​​the destination base station 3, it transmits a location registration request signal to the core network 4 via the base station 3 of the current communication area at regular intervals and when the power is turned on. For example, the communication terminal 2 transmits a location registration request signal at regular intervals of one minute. On the other hand, if the communication terminal 2 is performing abnormal communication, it may not follow the set interval and may transmit a location registration request signal at intervals shorter than one minute.

[0027] The base station 3 is configured as a wireless base station compatible with the 5G communication standard, and relays communication between the communication terminal 2 present in the communication area and the core network 4. Each base station 3 and each communication area is identified by the address of the AMF 40. In this embodiment, it is assumed that M base stations 3 (M is an integer of 2 or more) are provided. Each base station 3 is connected to the core network 4 via a network such as a backhaul link. In this embodiment, it is assumed that each base station 3 covers one communication area.

[0028] The core network 4 is connected to the anomalous communication detection device 1 via a network NW such as a LAN or WAN. The core network 4 includes an AMF 40, a UDM (Unified Data Management) 41, and a UDR 42, which are nodes in the control plane (C-plane). Note that other functions included in the core network 4 are not shown in the figure.

[0029] The AMF 40 is a node that provides mobility control functions and performs mobility control such as location registration, paging, and handover. The UDM 41 is a node that manages user contract information and authentication information. The address of the AMF 40 identifies the base station 3 and the communication area that the base station 3 covers.

[0030] The UDR 42 is a node that stores a subscriber profile that holds the IMSI and location information of the communication terminal 2. The UDR 42 is realized by a computer that includes a processor, a main storage device, a communication interface, an auxiliary storage device, and an input / output I / O, and a program that controls these hardware resources. The UDR 42 also includes a communication interface 42a for communicating with the anomalous communication detection device 1. The UDR 42 stores, as a transmission history, the timestamp of the location registration request signal transmitted for each IMSI.

[0031] 2 shows a table 420 that stores in-service information for each IMSI, which is included in a subscriber profile provided in the UDR 42. As shown in the table 420, the subscriber profile associates the IMSI, the transmission timestamp of a location registration request signal, and the address of the AMF 40 as a in-service log at the time of the timestamp. The subscriber profile also records, as a log, the transmission interval [s] of the location registration request signal based on the transmission timestamp of the location registration request signal for each IMSI.

[0032] The communication terminal 2 moves sequentially to the communication area of ​​the next destination base station 3 according to each movement route and remains there for a predetermined time. During this time, the communication terminal 2 transmits a location registration request signal at regular intervals, and furthermore, each time the communication terminal 2 crosses a destination communication area, it transmits a location registration request signal. The presence information in table 420 is updated by the transmission of the location registration request signal accompanying the movement of the communication terminal 2 in this way. As shown in table 420, a history of presence information in each communication area for each IMSI for each predetermined time (for example, in units of one minute) is acquired based on the address of the AMF 40 corresponding to the timestamp of the transmission of the location registration request signal for each IMSI.

[0033] [Function block of the abnormal communication detection device] Next, functional blocks of the anomalous communication detection device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the anomalous communication detection device 1 includes an acquisition unit 10, a learning unit 11, a determination unit 12, a transmission unit 13, an instruction unit 14, and a storage unit 15.

[0034] The acquisition unit 10 acquires the history of location information of the communication terminal 2 from the core network 4. The acquisition unit 10 refers to a subscriber profile table 420 stored in the UDR 42 included in the core network 4, and acquires the history of location information relating to the communication areas of the base stations 3 in which each of the multiple communication terminals 2 has been located. The history of location information acquired by the acquisition unit 10 is observation data that indicates, for each IMSI and for each time period (e.g., one minute), whether or not the communication terminal 2 has been located in each of M base stations 3. The observation value is a value in which one transmission of a location registration request signal is counted as one. The acquisition unit 10 can acquire the history of location information for each IMSI in one-minute increments for a set period (e.g., 24 hours).

[0035] If the period of the periodically transmitted location registration request signal is one minute, the history of the location information should indicate that the IMSI has been present in only one of base stations 1 to M. For example, the history of the location information for IMSI_1 of a valid subscriber over one minute is x=(x1, x2, x3, x4, . . . , x M ) = (0, 1, 0, 0, , 0). This indicates that for one minute, IMSI_1 is in the range of the base station 3 with base station ID "M=2", and there is no record of it being in the range of any other base station 3.

[0036] However, if a cloned SIM or the like occurs and there are multiple IMSIs identical to the legitimate user's IMSI_1, the one-minute location information history for IMSI_1 will be x = (0, 1, 0, 2, . . . , 0), etc. This indicates that in addition to the location information at base station ID "M=2", the same IMSI (IMSI_1) has transmitted a location registration request signal twice, once every 30 seconds, at base station 3 with base station ID "M=4". In communications using an IMSI that involves abnormal communications, as mentioned above, the location registration request signal may be transmitted at a shorter interval than the one-minute transmission interval.

[0037] Based on the history of location information related to the communication areas of base stations 3 in which communication terminal 2 identified by IMSI is located, learning unit 11 constructs a multivariate probability model using location state information indicating whether communication terminal 2 is located in the communication area of ​​each base station 3 for each time period, estimates parameters of the multivariate probability model, and generates a matrix indicating conditional dependency between location states. More specifically, learning unit 11 estimates parameters of a multivariate normal distribution model for multivariate data with location states as variables by maximum likelihood estimation, and generates a precision matrix of the multivariate normal distribution model as a matrix indicating conditional independence (dependence) between location states.

[0038] The learning unit 11 learns the essential dependencies between variables, using the presence state of the communication terminal 2 (IMSI) in the communication area of ​​each base station 3 as a variable. Figures 3(a) and (b) show a directed graph used by the learning unit 11. Each node a, b, and c represents a variable, and indicates a presence state indicating whether the communication terminal 2, i.e., the IMSI, is present in the communication area of ​​each base station 3. Each edge represents a direct probability dependency. In the directed graph of Figure 3(a), the value of node c is unobserved. At this time, the joint probability distribution ρ(a, b, c) of variables a, b, and c is expressed by the following equation (1).

number

[0039] By marginalizing the variable c, it can be expressed as the following equation (2).

number

[0040] In the above equation (2), the two variables a and b are not independent, since they cannot generally be expressed as ρ(a)ρ(b). On the other hand, in the directed graph of Figure 3(b), variable c is observed. The joint probability ρ(a, b|c) when variable c is observed is expressed by the following equation (3).

number

[0041] In the above equation (3), when the value of the observed variable c, which is a common condition, is taken into consideration, it can be seen that variables a and b do not affect each other, i.e., they are independent. This is called conditional independence. By taking conditional independence into consideration, it becomes possible to extract the essential or true relationship between variables. For example, even if there appears to be a correlation between the coverage areas of one base station 3 and another base station 3, when the coverage area of ​​yet another base station 3 is taken into consideration, this corresponds to a case in which the coverage areas of these base stations 3 do not affect each other.

[0042] As mentioned above, the history of location information is an M-dimensional observation x = (x1, x2, . . . , x M ) A data set D consisting of N observations x is expressed as D={x (1) ,x (2) ,···,x (M)}, this multivariate normal distribution model is expressed by the following equation (4).

number

[0043] In the above equation (4), μ represents the mean, Σ represents the covariance matrix, and |·| represents the determinant. The learning unit 11 performs maximum likelihood estimation to find μ and Σ, which are parameters of the multivariate normal distribution model, from a dataset D of observed data. The logarithmic likelihood L(μ,Σ|D) of the dataset D is expressed by the following equation (5).

number

[0044] Substituting the above equation (4) into the above equation (5) gives the following equation (6).

number

[0045] The parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) in the above equation (6) are estimated as the most likely solution. For the most likely solution of the parameters μ and Σ, μ and Σ are respectively -1 Differentiating with and setting it to 0, the maximum likelihood solutions of the parameters μ and Σ are expressed by the following equations (7) and (8), respectively.

number

number

[0046] Inverse matrix Σ of parameters Σ -1 is called the precision matrix Λ. The precision matrix Λ can be obtained by calculating the inverse matrix of the above formula (8). Note that in the maximum likelihood estimation shown in the above formulas (7) and (8), if regularization is not effective and there is a risk of overlearning, the learning unit 11 can also perform estimation by applying maximum a posteriori estimation (MAP estimation) to the parameters μ and Σ.

[0047] Here, the correlation structure in a multivariate normal distribution is expressed by a graph model. Such a graph model is called a Gaussian graphic model. Below, we will explain how to calculate conditional probability when applying a multivariate normal distribution model to graph theory. In the multivariate normal distribution model of the above formula (4), the inverse matrix Σ of the parameter Σ is -1 When the precision matrix Λ is used and the parameter μ is set to 0, it is expressed by the following equation (9).

number

[0048] The ρ(x) in the above equation (9) is called a Gaussian graphic model. Under a multivariate normal distribution, the conditional probability ρ(x1,x2|x3,...,x M ) is expressed by the following equation (10).

number

[0049] The function of variables x1 and x2 in the above equation (10) is ρ(x) in the above equation (9), that is, N(x|0,Λ -1 ), so if we extract all the parts of the above equation (9) related to the variables x1 and x2, we obtain the relationship in the following equation (11).

number

[0050] where the conditional independence ρ(x1|x3, ,x M )ρ(x2|x3, ,x M The condition for satisfying this is given by the following equation (12):

number

[0051] The above equation (12) indicates that the values ​​of the first and second components of the precision matrix Λ are zero, i.e., there is no edge between variables x1 and x2, as in the case of variables a and b in the directed graph of Figure 3. Figure 4 is a schematic diagram showing the relationship between the correlation between variables on the graph of a Gaussian graphical model and the precision matrix Λ. The nodes in (a) and (b) of Figure 4 represent the presence status of a certain IMSI at each of 1 to M base stations 3. In the example of Figure 4, the communication terminal 2 of a legitimate user is present at the base station 3 of the third node.

[0052] As shown in Figure 4(a), in a situation where there is no fraudulent communication such as clone SIM, there should be no correlation between the presence status of the base station 3 of the third node and the presence status of the base station 3 of any other node. This indicates that the IMSI of the same user will not be present at multiple base stations 3 at the same time. As shown in the precision matrix Λ in Figure 4(a), all components of the precision matrix Λ are zero except for the components on the diagonal that indicate the base station 3 where the legitimate user was present.

[0053] On the other hand, Figure 4(b) shows that during the same time period, a legitimate user is present at base station 3 of node 3, while a user using the same IMSI as the legitimate user, such as a clone SIM, is present at base station 3 of node M-3. In this case, there is an edge between node 3 and node M-3, indicating a correlation between these variables. When this situation is confirmed using the precision matrix Λ, non-zero values ​​appear in the components surrounded by dotted circles among the components other than the diagonal components.

[0054] Note that while the example in Figure 4(b) shows that a cloned SIM is present at one node, it may be present at multiple nodes. This is because a cloned SIM may also move between base stations 3. If a specific element of the precision matrix Λ is zero, this means that the two variables are conditionally independent. This makes it possible to detect abnormal communications by looking only at the direct relationship between variables, without being affected by noise or indirect relationships.

[0055] 1, when the value of a component indicating conditional independence (dependence) between presence states in the precision matrix Λ (matrix) exceeds a predetermined threshold, the determination unit 12 determines that an inconsistency exists in the presence information of the communication terminal 2. More specifically, when the value of a component indicating conditional independence between presence states in the precision matrix Λ exceeds a predetermined threshold, the determination unit 12 determines that abnormal communication using the same IMSI as the IMSI of the communication terminal 2 has occurred.

[0056] As shown in (b) of Figure 4, when the values ​​of components other than the diagonal components of the precision matrix Λ generated by the learning unit 11 are non-zero, the judgment unit 12 judges that there is a suspicion of fraudulent use by a clone SIM in the base station 3 of the M-3th node corresponding to the non-zero component.

[0057] In this way, the determination unit 12 focuses on non-zero elements that are a sparse representation of the precision matrix Λ, and determines whether or not there is an inconsistency in the presence information of the communication terminal 2. Note that the determination unit 12 can make the determination after setting a predetermined threshold value, taking into consideration the case where the values ​​of components other than the diagonal components of the precision matrix Λ are non-zero, as well as the possibility that component values ​​that are essentially zero may take on slightly non-zero values ​​due to noise, sampling error, etc.

[0058] When the determination unit 12 determines that an inconsistency exists in the location information, that is, that abnormal communication has occurred using an IMSI that is the same as that of the legitimate user, the transmission unit 13 transmits a response request by short message service (SMS) to the telephone number (MSISDN) linked to the IMSI of the communication terminal 2. This utilizes the fact that if the communication terminal 2 is that of the legitimate user, it will respond when it receives an SMS response request, but if it is a clone SIM in which the IMSI of the legitimate user has been replicated, it will not respond to the SMS response request.

[0059] When no response to a response request is received from an IMSI that is the same as the IMSI of the authorized user among the multiple IMSIs determined to be inconsistent by the determination unit 12, the instruction unit 14 gives an instruction to block communication using the same IMSI as the IMSI of the authorized user. More specifically, the instruction unit 14 gives an instruction to block communication using an IMSI from which no response is received to a response request sent by the sending unit 13 among the multiple IMSIs determined to be inconsistent by the determination unit 12. The instruction unit 14 specifies the IMSI from which no response is received to a response request and sends an instruction to block communication to the core network 4.

[0060] More specifically, when a response to a response request from an IMSI that is the same as the IMSI of the authorized user is not received, the instruction unit 14 instructs the UDR 42 to delete the subscriber profile associated with the IMSI that is the same as the IMSI of the authorized user. Using the example of FIG. 4(b), the instruction unit 14 instructs the UDR 42 to delete the subscriber profile of the IMSI that is stored as location information by the base station 3 of the M-3 node, out of the two identical IMSIs. Furthermore, it is possible to notify the UDM 41 and the AMF 40 to block communication for that IMSI.

[0061] The storage unit 15 stores the parameters μ and Σ of the multivariate normal distribution model estimated by the learning unit 11 through learning, and the precision matrix Λ generated by the learning unit 11 .

[0062] [Hardware configuration of the abnormal communication detection device] Next, an example of a hardware configuration for realizing the abnormal communication detection device 1 having the above-described functions will be described with reference to FIG.

[0063] 5, the anomalous communication detection device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106, which are connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the anomalous communication detection device 1 includes a display device 107.

[0064] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0065] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the anomalous communication detection device 1, such as the acquisition unit 10, learning unit 11, determination unit 12, transmission unit 13, and instruction unit 14 shown in FIG.

[0066] The communication interface 104 is an interface circuit for connecting the anomalous communication detection device 1 to various external electronic devices via a network. The communication interface 104 realizes at least a part of the configuration of the sending unit 13.

[0067] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0068] The auxiliary storage device 105 has a program storage area for storing an anomalous communication detection program. The auxiliary storage device 105 also has a program storage area for storing a learning program that estimates parameters using a multivariate normal distribution model and generates a precision matrix, which is executed by the anomalous communication detection device 1. The auxiliary storage device 105 realizes the storage unit 15 described in Fig. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data and programs.

[0069] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0070] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display on the screen information of the IMSI that is performing abnormal communication and information of the base station 3 in its area.

[0071] [Operation of the abnormal communication detection device] Next, the operation of the anomalous communication detection system including the anomalous communication detection device 1 having the above-described configuration will be described with reference to the sequence of FIG.

[0072] 6, first, UDR 42 stores information on the communication areas of base stations 3 in which multiple communication terminals 2 are located, and a history of location information associated with the time spent in each communication area, in subscriber profile table 420 (step S1). UDR 42 updates the location information in table 420 based on location registration request signals transmitted by each communication terminal 2.

[0073] Next, the acquisition unit 10 of the anomalous communication detection device 1 acquires the history of location information of the communication terminal 2 from the core network 4 (step S2). The acquisition unit 10 refers to the subscriber profile table 420 stored in the UDR 42 in step S1, and acquires the history of location information related to the communication area of ​​the base station 3 in which each of the multiple communication terminals 2 is located. Next, the acquisition unit 10 creates a data set D of the observation value x from the history of location information acquired in step S2 (step S3).

[0074] In step S3, the acquisition unit 10 acquires the history of location information for each time period set for each IMSI over a predetermined period of time as an M-dimensional observation value x=(x1, x2, . . . , x M ) based on the data set D consisting of N observations x, let D={x (1) ,x (2) ,···,x (M) For example, if a 24-hour history of location information is obtained for each IMSI in one-minute increments, N=1,440 observation values ​​x, which are the location information history, are obtained for each IMSI. In this way, a data set D is created for each IMSI.

[0075] Next, the learning unit 11 estimates the parameters μ and Σ of the multivariate normal distribution model for the dataset D, which is multivariate data with the presence state as a variable, by maximum likelihood estimation (step S4). In step S4, the learning unit 11 uses the above equation (6) to estimate the parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) as the maximum likelihood solution (the above equations (7) and (8)).

[0076] Next, the learning unit 11 generates a precision matrix Λ of the multivariate normal distribution model as a matrix indicating conditional independence between the presence states (step S5). In step S5, the learning unit 11 generates an inverse matrix Σ of the parameters Σ estimated in step S4. -1 Since steps S4 and S5 are processes performed for each data set D created for each IMSI, a precision matrix Λ is generated for each IMSI.

[0077] Next, when the value of a component indicating conditional independence between presence states in the precision matrix Λ generated in step S5 exceeds a predetermined threshold (step S6: YES), the determination unit 12 determines that an inconsistency exists in the presence information of the communication terminal 2. More specifically, when the value of a component other than the diagonal component indicating conditional independence between presence states in the precision matrix Λ is non-zero, the determination unit 12 determines that abnormal communication using the same IMSI as the IMSI of the communication terminal 2 has occurred. Furthermore, in step S6, the base station 3 corresponding to the non-zero component other than the diagonal component of the precision matrix Λ is identified.

[0078] On the other hand, if the values ​​of the components indicating conditional independence between the presence states in the precision matrix Λ generated in step S5 are all zero (step S6: NO), the processes from step S2 to step S5 are repeated.

[0079] Next, when it is determined that abnormal communication using the same IMSI has occurred (step S6: YES), the sender 13 sends a response request by short message service (SMS) to the telephone number (MSISDN) linked to the IMSI of the communication terminal 2 (step S7). In step S7, the history of the location information is referenced to identify the base stations 3 in which the multiple IMSIs in which the inconsistency was detected are located, and the response request is sent via each of the identified base stations 3. In the example of FIG. 6, the response request is sent via each of base station 3 (M=3) and base station 3 (M=M-3).

[0080] Thereafter, the communication terminal 2 having one of the multiple IMSIs receives the response request by the SMS message sent in step S7 and transmits a response (step S8). In step S8, the communication terminal 2 located in the range of the base station 3 (M=3) from which the response was received is identified as a legitimate user. On the other hand, the IMSI of the communication terminal 2 located in the range of the base station 3 (M=M-3) from which the response was not received is likely to be an IMSI that has been duplicated from an IMSI of a legitimate user, and the instruction unit 14 instructs the blocking of communication for that IMSI (step S9).

[0081] Specifically, the instruction unit 14 instructs the UDR 42 to delete the subscriber profile linked to the IMSI for which no response to the response request was received. Furthermore, the instruction unit 14 can notify the UDM 41 and the AMF 40 to block communication for that IMSI. Thereafter, the UDR 42, in accordance with the instruction in step S9, deletes the subscriber profile linked to the IMSI present in the range of the base station (M-3) (step S10). The processes from step S2 to step S10 are performed for each IMSI. Therefore, for example, if there are one million IMSIs of legitimate users, the process is performed one million times.

[0082] As described above, the anomalous communication detection device 1 according to this embodiment focuses on the fact that when a communication terminal 2 having the same IMSI is present at multiple base stations 3 during the same time period, an unnatural presence pattern that differs from a normal behavioral history is observed. Then, a multivariate model is constructed from the presence information history for each IMSI, and a precision matrix Λ that represents the conditional dependency relationship between the presence states of each base station 3 is calculated. This determines whether an abnormal correlation has occurred between base stations 3 that should normally be independent, and detects anomalous communication that may be a clone SIM based on the results. This makes it possible to more reliably detect anomalous communication.

[0083] Furthermore, the anomalous communication detection device 1 according to this embodiment detects multiple identical IMSIs present in the communication areas of multiple different base stations 3 during the same time period as IMSIs with inconsistent area information, so it is possible to detect multiple identical IMSIs communicating during the same time period in the communication areas of multiple base stations 3 located at a relatively short geographical distance. As a result, it is possible to more reliably detect anomalous communication that may be a clone SIM.

[0084] Furthermore, the anomalous communication detection device 1 according to this embodiment determines whether or not there is anomalous communication based on the history of location information for each IMSI, identifies IMSIs that may be clone SIMs, and then blocks communication. This makes it possible to take measures against clone SIMs more effectively.

[0085] Furthermore, according to the anomalous communication detection device 1 of this embodiment, even if there is little historical data on presence information related to unauthorized communications such as clone SIMs, learning can be performed without using anomalous communication patterns by learning only the history of normal presence information from legitimate users' communication terminals 2 and modeling the statistical relationship (conditional dependency) of presence states between base stations 3 under normal conditions. As a result, when anomalous history is input in which unnatural presence states are simultaneously observed due to clone SIMs, it becomes possible to detect anomalous communications from the inconsistency with the model of normal communication patterns.

[0086] In the embodiment described above, the anomalous communication detection system is described as a system that complies with the 5G standard, but the communication standard may be 3G, 4G / LTE, 6G, etc.

[0087] In the embodiment described above, the learning unit 11 employs a Gaussian graphic model to analyze conditional independence through a precision matrix, which is the inverse matrix of the covariance matrix. However, the algorithm employed by the learning unit 11 is not limited to the Gaussian graphic model. For example, in sparse estimation such as Graphical Lasso, it can be employed in combination with Maximum A Posteriori Estimation (MAP). Alternatively, Bayesian network structure learning can be employed.

[0088] The above describes embodiments of the anomalous communication detection device and anomalous communication detection method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can imagine are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0089] 1...Abnormal communication detection device, 2...Communication terminal, 3...Base station, 4...Core network, 10...Acquisition unit, 11...Learning unit, 11...Determination unit, 13...Sending unit, 14...Instruction unit, 15...Memory unit, 40...AMF, 41...UDM, 42...UDR, 101...Bus, 102...Processor, 103...Main memory device, 42a, 104...Communication interface, 105...Auxiliary memory device, 106...Input / output I / O, 107...Display device, NW...Network.

Claims

1. a learning unit configured to construct a multivariate probability model using location state information indicating whether a communication terminal identified by a subscriber identifier is located in the communication area of ​​each base station in each time period, based on a history of location information related to the communication area of ​​a base station in which the communication terminal is located, estimate parameters of the multivariate probability model, and generate a matrix representing conditional dependencies between the location states; a determination unit configured to determine that an inconsistency exists in the presence information of the communication terminal when a value of a component indicating the conditional dependency between the presence states exceeds a predetermined threshold in the matrix generated by the learning unit; and An abnormal communication detection device comprising:

2. 2. The anomalous communication detection device according to claim 1, The communication device further includes an acquisition unit configured to acquire the history of the location information of the communication terminal from a core network. An abnormal communication detection device characterized by:

3. 2. The anomalous communication detection device according to claim 1, the determination unit determines that abnormal communication using a subscriber identifier identical to the subscriber identifier of the communication terminal has occurred when a value of the component in the matrix indicating the conditional dependency between the presence states exceeds the predetermined threshold; a sending unit configured to send a response request to a telephone number associated with the subscriber identifier of the communication terminal when the determining unit determines that the abnormal communication using the same subscriber identifier has occurred; an instruction unit configured to issue an instruction to block communication using the same subscriber identifier when a response to the response request from the same subscriber identifier is not received; An abnormal communication detection device comprising:

4. 4. The anomalous communication detection device according to claim 3, The instruction unit issues an instruction to delete a subscriber profile linked to the same subscriber identifier when a response to the response request is not received from the same subscriber identifier. An abnormal communication detection device characterized by:

5. 2. The anomalous communication detection device according to claim 1, The learning unit estimates the parameters of a multivariate normal distribution model for multivariate data having the presence states as variables by maximum likelihood estimation, and generates a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the presence states. An abnormal communication detection device characterized by:

6. a learning step of constructing a multivariate probability model using location state information indicating whether a communication terminal identified by a subscriber identifier is located in the communication area of ​​each base station in each time period, based on a location information history relating to the communication area of ​​the base station in which the communication terminal is located, estimating parameters of the multivariate probability model, and generating a matrix indicating conditional dependencies between the location states; a determining step of determining that an inconsistency exists in the presence information of the communication terminal when a value of a component indicating the conditional dependency between the presence states in the matrix generated in the learning step exceeds a predetermined threshold; An abnormal communication detection method comprising:

7. The anomalous communication detection method according to claim 6, The method further includes an acquisition step of acquiring the history of the location information of the communication terminal from a core network.

2. A method for detecting abnormal communication.

8. The anomalous communication detection method according to claim 6, the determining step determines that an abnormal communication using a subscriber identifier identical to the subscriber identifier of the communication terminal has occurred when a value of the component in the matrix indicating the conditional dependency between the presence states exceeds the predetermined threshold; a sending step of sending a response request to a telephone number associated with the subscriber identifier of the communication terminal when it is determined in the determining step that the abnormal communication using the same subscriber identifier has occurred; an instruction step of issuing an instruction to block communication using the same subscriber identifier when a response to the response request from the same subscriber identifier is not received; An abnormal communication detection method comprising:

9. The anomalous communication detection method according to claim 8, The instruction step instructs to delete a subscriber profile linked to the same subscriber identifier when a response to the response request from the same subscriber identifier is not received.

2. A method for detecting abnormal communication.

10. The anomalous communication detection method according to claim 6, The learning step estimates the parameters of a multivariate normal distribution model for multivariate data having the presence states as variables by maximum likelihood estimation, and generates a precision matrix of the multivariate normal distribution model as the matrix indicating the conditional dependency between the presence states.

2. A method for detecting abnormal communication.

Images