Abnormality management device and abnormality management method

Abstract

The purpose is to appropriately manage abnormal communications with a simpler configuration. [Solution] The abnormality management device 1 includes a second learning unit 12 that updates only the classifier parameters of a classifier 122 that distinguishes between true normal data and pseudo-normal data, based on the probability parameters of a probabilistic model representing the number of normal received packets estimated by the first learning unit 11, in a direction that maximizes the classification accuracy, while keeping fixed the generator parameters of a generator 121 that generates pseudo-normal data that deviates sufficiently from the distribution of true normal data, taking each observed value of the series of number of normal received packets as true normal data, and an abnormal received packet number database 13 that stores the pseudo-normal data output by the generator 121 after the second learning unit 12 updates the classifier parameters of the classifier 122 as information indicating the number of abnormal received packets that deviates from the range considered to be the number of normal received packets.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread in addition to smartphones and tablets. As the number of IoT devices increases, the amount of traffic in the entire communication network increases, making communication traffic management even more important.

[0003] Conventionally, attacks have been known in which malicious attackers intentionally send a large number of short packets to a specific device, causing congestion and even resource exhaustion. To detect such abnormal communications, for example, Patent Document 1 discloses a system that performs two-stage CNN processing on time-series data, calculates an anomaly score without a teacher, and estimates the feature amount and time that contributed to the anomaly.

[0004] In Patent Document 1, a system for detecting anomalies is constructed using unsupervised learning because there is little data on anomalous communications. However, since it is necessary to determine the deviation between normal communications and anomalous communications without any data on anomalous communications, the system configuration becomes more complex in order to improve detection accuracy. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7586322 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it may be difficult to appropriately manage abnormal communications with a simple configuration.

[0007] The present invention has been made to solve the above-mentioned problems, and has an object to appropriately manage abnormal communications with a simpler configuration. [Means for solving the problem]

[0008] In order to solve the above-described problems, an anomaly management device according to the present invention includes: a first collection unit configured to collect a sequence of numbers of normally received packets indicating the number of normal packets received for each time period; a first learning unit configured to treat each observed value of the sequence of numbers of normally received packets as a mutually independent discrete value and to estimate probability parameters of a probabilistic model representing the number of normally received packets for each time period based on the frequency of occurrence of each observed value; a second learning unit configured to update only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the probabilistic model representing the number of normally received packets estimated by the first learning unit, in a direction to maximize classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, by treating each observed value of the sequence of numbers of normally received packets as true normal data; and a storage unit configured to store the pseudo-normal data output by the generator after the second learning unit updates the classifier parameters of the classifier, as information indicating the number of abnormal received packets that deviates from the range considered to be the number of normal received packets.

[0009] In addition, the abnormality management device of the present invention may further include a second collection unit configured to collect a received packet count series indicating the number of packets received by the communication node to be managed in each time period, and a judgment unit configured to judge that the number of packets received by the communication node to be managed is abnormal if the received packet count series collected by the second collection unit matches the pseudo-normal data stored in the memory unit.

[0010] In addition, the abnormality management device of the present invention may further include an alarm unit configured to output an alarm when the judgment unit judges that the number of packets received at the communication node to be managed is abnormal.

[0011] In order to solve the above-described problems, an anomaly management method according to the present invention includes: a first collecting step of collecting a sequence of numbers of normally received packets indicating the number of normal packets received for each time period; a first learning step of treating each observed value in the sequence of numbers of normally received packets as a mutually independent discrete value and estimating probability parameters of a probabilistic model representing the number of normally received packets for each time period based on the frequency of occurrence of each observed value; a second learning step of updating only classifier parameters of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameters of the probabilistic model representing the number of normally received packets estimated in the first learning step, in a direction to maximize classification accuracy, while keeping fixed generator parameters of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value in the sequence of numbers of normally received packets considered to be true normal data; and a storage step of storing the pseudo-normal data output by the generator after updating the classifier parameters of the classifier in the second learning step, in a storage unit, as information indicating the number of abnormal received packets that deviates from the range considered to be the number of normal received packets.

[0012] In addition, the abnormality management method of the present invention may further include a second collection step of collecting a received packet count series indicating the number of packets received by the communication node to be managed in each time period, and a determination step of determining that the number of packets received by the communication node to be managed is abnormal if the received packet count series collected in the second collection step matches the pseudo-normal data stored in the memory unit.

[0013] Furthermore, the abnormality management method according to the present invention may further include an alarm step of outputting an alarm when the number of packets received by the communication node to be managed is determined to be abnormal in the determination step. [Effects of the Invention]

[0014] According to the present invention, after the second learning unit updates the classifier parameters of the classifier, the pseudo-normal data output by the generator is stored as information indicating the number of abnormal received packets that is outside the range considered to be the normal number of received packets, thereby enabling appropriate management of abnormal communications with a simpler configuration. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the number of normal received packets and the number of abnormal received packets collected by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a block diagram showing the configuration of the second learning unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a diagram for explaining the second learning unit included in the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 7] FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 9] FIG. 9 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0017] [Configuration of anomaly management system] First, with reference to FIG. 1, an overview of an abnormality management system including an abnormality management device 1 and a communication node 2 according to an embodiment of the present invention will be described.

[0018] The fault management system according to this embodiment is provided in a mobile communication network or a network using fixed lines that conforms to 3G, 4G / LTE, 5G, 6G, etc. As shown in Fig. 1, the fault management device 1 is connected to a communication node 2 via a network NW such as a LAN, a WAN, or the Internet.

[0019] The communication node 2 is a network device that has the function of counting the number of received packets, recording them in a log file, and sending them externally. It is realized by a router, access point, switch, etc. The communication node 2 can record the number of received packets for a certain time period, such as every 10 minutes. The communication node 2 also records the number of received packets over an arbitrarily set period, such as one month. The communication node 2 is uniquely identified by a MAC address or an IP address. The communication node 2 also has a packet capture function and saves a packet capture file that records the source IP address of each packet and a timestamp indicating the capture time. The packet capture file is used by the abnormality management device 1 to analyze the source IP addresses of packets with an abnormal number of packets.

[0020] FIG. 2 is a diagram illustrating the number of normal received packets and the number of abnormal received packets. The horizontal axis shows time divided into 10-minute increments, and the vertical axis shows the number of packets received at communication node 2. FIG. 2 shows the cumulative value of the number of received packets for each 10-minute increment. The dotted line in FIG. 2 indicates normal data a1, where a normal number of packets is received over the entire time period. The normal number of received packets refers to the number of received packets observed in a certain time period in a normal communication environment, for example, when the number of packets is within an acceptable range based on past communication history.

[0021] On the other hand, the solid line values ​​in Figure 2 indicate anomalous data b1, where an abnormal number of packets is received over the entire time period. Anomaly data refers to the number of received packets that deviates from the range of the number of received packets considered normal. Furthermore, anomalous data reflects abnormal behavior caused by attacks, malfunctions, etc., and indicates that a large number of packets that could overwhelm the packet processing performance of a communication node 2, such as a router, were received during a certain time period. For example, anomalies that are difficult to detect based on communication volume, such as attacks in which a large number of short packets are sent in a short period of time, where the number of received bytes is relatively small, can also be targeted for anomaly detection.

[0022] [Function block of the abnormality management device] Next, the functional blocks of the abnormality management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the abnormality management device 1 includes a collection unit 10 (first collection unit, second collection unit), a first learning unit 11, a second learning unit 12, an abnormally received packet count database (storage unit) 13, a determination unit 14, an alarm unit 15, and a storage unit 16. The abnormality management device 1 builds a database of abnormal data through a learning process using normal data.

[0023] The collection unit 10 (first collection unit) collects a sequence of normally received packets indicating the number of normal packets received for each time period. The collection unit 10 collects the number of received packets per unit time (e.g., 10 minutes) received and recorded by the communication node 2 via the network NW for a certain period (e.g., one month), and arranges the number of received packets per unit time to create a sequence of normally received packets. The collection unit 10 collects data for M time periods (e.g., 10,000) as the number of normally received packets that constitute the sequence of normally received packets. The sequence of normally received packets collected by the collection unit 10 takes discrete values. The collection unit 10 (second collection unit) similarly collects a sequence of received packets indicating the number of packets received by the communication node 2 to be managed in each time period.

[0024] The first learning unit 11 treats each observation value in the sequence of the number of normally received packets as a mutually independent discrete value, and estimates probability parameters of a probability model that represents the number of normally received packets for each time period based on the occurrence frequency of each observation value. The first learning unit 11 sets a probability model based on a multinomial distribution for the number of normally received packets, estimates its probability parameters, and calculates the log-likelihood of the sequence of each observation value based on the probability model. In other words, when there is very little data on the number of abnormally received packets, the first learning unit 11 uses a large amount of data on the number of normally received packets that is available to determine a probability model of the number of normally received packets, which is a statistical standard, and a corresponding index of normality.

[0025] The first learning unit 11 focuses on the fact that the naive Bayes method treats each observation value as a conditionally independent discrete variable, and sets a probability model by extending the naive Bayes method to a multinomial distribution model so that the number of received packets for each time period can be regarded as a vector of the number of occurrences for each category. Here, as shown in the following formula (1), the number of received packets observed in each time period is expressed as a vector of the number of occurrences for M categories, and the observed value X is defined as X=x=(x1,x2,...,x M ) ···(1)

[0026] Furthermore, the class label to which the observed value X belongs, that is, the event Y, is defined as a binary variable by the following equation (2).

number

[0027] Here, Bayes' theorem is defined by the following equation (3).

number

[0028] In the above equation (3), P(X) is the marginal probability (outcome) of observing observed value X, P(Y) is the prior probability that event Y occurs, P(X|Y) is the conditional probability that observed value X occurs given that event Y occurs, and P(Y|X) is the conditional probability (posterior probability) that event Y occurs given that observed value X occurs. It is known that maximum likelihood estimation determines the parameters of the prior probability P(Y) so that the posterior probability P(Y|X) is maximized, using observed value X as a teacher signal, which is the correct value. In contrast, Bayesian estimation is a procedure for determining the parameters (probabilistic values) of the prior probability P(Y) that best explain observed value X, represented by a packet count sequence.

[0029] In other words, by arbitrarily setting the parameters of the prior probability P(Y) in advance (e.g., normal distribution), it is possible to estimate the parameters of the prior probability P(Y) that maximizes P(X|Y), i.e., that best matches the marginal probability P(X) (outcome). In this way, the advantage of Bayesian estimation is that the prior probability P(Y) can be arbitrarily specified in advance. When each of the P(X|Y) is independent, the event Y is predicted by the observed variable x under given conditions. i are conditionally independent of each other, and the likelihood ρ(x|y) is given by the naive Bayes estimation method of the following equation (4).

[0030]

number

[0031] In this embodiment, we handle a sequence in which the number of received packets is arranged by time period, so we use a vector of the number of occurrences for each category x = (x1, x2, . . . , x M ) as one sample, and while maintaining the naive assumption that each time period is conditionally independent, we extend it to a multinomial distribution probability model. The occurrence probability of each marginal probability P(X) is θ1, ,θ M are independent and the sum of their occurrence probabilities is 1. Under this constraint, the probability model of the multinomial distribution is expressed by the following equation (5).

[0032]

number

[0033] As shown in the above equation (5), the observed value x i The sum of (x1+x2++x M ) is determined, the distribution is the product of the following equation (6), and the observed value x observed in the i-th time period in the series is i Independently, probability θ i ^x i can be obtained.

number

[0034] Therefore, it can be seen that the relationship is similar to that of the naive Bayes method in equation (4). Here, the prior probability P(Y) is a binary problem of abnormal values ​​(Y=0) and normal values ​​(Y=1), and each unknown parameter is θ 0 ,θ 1 Also, D is defined as the marginal probability (outcome), and the observed value of the abnormal value (Y=0) is D 0 , the normal value (Y=1) observation is D 1 The above equation (6) can be expressed as the following equation (7) by converting the product form into a sum under the Naive Bayes independence assumption and decomposing the log likelihood for the observation set D, which is the data set, by class.

[0035]

number

[0036] Here, the constraint is expressed by the following equation (8).

number

[0037] Furthermore, by applying the Lagrange multiplier method, the outlier parameter θ 0 The maximum value of the logarithmic likelihood for the i-th component of is given by the following equation (9).

number

[0038] Normal value parameter θ 1 Similarly, if we calculate the maximum value of the log likelihood for 1 , θ 0 is expressed by the following equation (10).

number

[0039] In addition, x i Since takes integer values, x i In order to prevent the problem of the multinomial distribution diverging when ^(n) is 0, smoothing can be performed by specifying +α (e.g., α=1) smoothing. In this way, the first learning unit 11 regards the series of the number of normal received packets for each time period as a multinomial distribution, estimates probability parameters from the occurrence frequency, and measures the normality by likelihood. Note that the first learning unit 11 also uses the parameter θ of the abnormal value 0 No estimates are made regarding

[0040] The second learning unit 12 regards each observed value of the sequence of the number of normally received packets as true normal data, and updates only the classifier parameters of the classifier 122 that distinguishes between true normal data and pseudo-normal data in a direction that maximizes the classification accuracy, while keeping the generator parameters of the generator 121 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data fixed, based on the probability parameters of the number of normally received packets estimated by the first learning unit 11.

[0041] As shown in Fig. 3, the second learning unit 12 executes a Max learning phase of a GAN (Generative Adversarial Network) having a generator 121 and a classifier 122, in which only the parameters of the classifier 122 are updated while the generator 121 is fixed. When a sequence of the number of normal received packets is regarded as true normal data, the second learning unit 12 aims to generate a sequence of the number of received packets that can be treated as pseudo-normal data that deviates sufficiently from the distribution of normal data, that is, an abnormal packet number sequence. For this reason, the second learning unit 12 does not execute the Min learning phase of the normal GAN ​​adversarial learning procedure, in which the generator 121 is updated in the minimization direction.

[0042] As shown in FIG. 3, a generative model according to this embodiment, which includes generator 121 and classifier 122, is provided for each observed value (time period) of the received packet count sequence. Therefore, in this embodiment, M generative models are trained. Here, pseudo-normal data that deviates sufficiently from the distribution of normal data refers to a generated sequence that, as a statistical property, is located in a region that significantly deviates from the normal region of normal data, relative to normal data that indicates a normal received packet count sequence. When the index of distance or deviation from normal data is log-likelihood, a sequence with a smaller likelihood corresponds to the pseudo-normal data, and when the index is cross-entropy, a sequence with a larger entropy value corresponds to a larger deviation. Furthermore, when the index is KL distance, a sequence with a large deviation in the overall distribution is treated as a sufficiently deviated sequence.

[0043] 4 and 5 are diagrams schematically illustrating the neural network configuration of the generator 121 and the classifier 122 of the generative model used by the second learning unit 12. As shown in FIG. 4, the generator 121 is configured as a neural network having an input layer, a hidden layer, and an output layer. The generator 121 is a model that generates pseudo-normal data from random noise. For example, m randomly sampled Gaussian noise vectors (z1 to z m ).

[0044] The generator 121 outputs the output G(z) after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The output G(z) from the generator 121 is pseudo-normal data that deviates from the distribution of true normal data. CNN or ResNet can be used as the neural network that constitutes the generator 121.

[0045] The classifier 122 shown in Fig. 5 is configured with a neural network having an input layer, a hidden layer, and an output layer. In the example of Fig. 5, the sequence of the number of normally received packets collected by the collection unit 10 is given as true normal data as training data input.

[0046] The classifier 122 outputs a binary value of 1 or 0 after performing a product-sum operation on the input and weight parameters and threshold processing using an activation function. The classifier 122 outputs an output y=1 when it correctly identifies the training data related to the input true normal data as true normal data. On the other hand, it outputs an output y=0 when it correctly identifies the training data related to the input pseudo normal data as pseudo normal data. In this way, the classifier 122 is a model that distinguishes the model distribution generated by the generator 121 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 122.

[0047] FIG. 3 is a block diagram for explaining the configuration of the generative model by the second learning unit 12. The generator 121 of the generative model adopted by the second learning unit 12 is represented by function G, and the classifier 122 is represented by function D. Furthermore, true normal data is represented by x, the predicted value output by the classifier 122 is represented by y, and the correct label is represented by t. The correct label t is set to 1 for true normal data and 0 for pseudo-normal data generated by the generator 121. In this case, the classifier 122 calculates the cross entropy E CE It can be expressed as:

[0048]

number

[0049] The first term in the brace of the above equation (11) represents t n lny n In this case, the predicted value y n is the correct label of the true normal data, t n = 1. On the other hand, the second term in the braces represents (1-t n )ln(1-y n ), the predicted value y n is the correct label value (1-t n ) = 0. In this way, the cross entropy E CE is the maximum value when the predicted value matches the correct label value.

[0050] Here, the generator 121 that configures the generative model uses parameters w G ,θ G and the function G(w G ,θ G ) The classifier 122 also uses the parameter w D ,θ D and function D(w D ,θ D ) The cross entropy E in the above equation (11) CE The objective function E of the generative model including the generator 121 and the discriminator 122 based on the above can be expressed by the following equation (12).

number

[0051] The first term of the above equation (12) represents E D(x)=1 lnD(w D ,θ D ) is the expected value at which the classifier 122 classifies true normal data as true normal data. D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value at which the classifier 122 classifies the pseudo-normal data generated by the generator 121 as pseudo-normal data. Here, the objective function E of the generative model in the above formula (12) is set to the parameter θ using the prior probability of the classes of abnormal values ​​(Y=0) and normal values ​​(Y=1) in the multinomial distribution. 0 , θ 1 When these are multiplied and incorporated, the objective function E is expressed by the following equation (13).

[0052]

number

[0053] In the above equation (13), the parameter θ of the multinomial distribution 0 , θ 1 The objective function E of the i-th component is expressed by the following equation (14).

number

[0054] By weighting the objective function (equation (12)) of a normal GAN, an adversarial loss that proportionally allocates the contributions of the normal value class and the abnormal value class can be obtained, as shown in the above equations (13) and (14). Here, the objective function E when the generator 121 is fixed is expressed by the following equation (15).

number

[0055] The convergence value (maximum value) of the discriminator 122 is expressed by the following equation (16).

number

[0056] Normal value parameter θ i ^1 is calculated using the above formula (10). The parameter θ of the abnormal value i For ^0, since the number of abnormal data related to the number of abnormal received packets is small, an empirical rule or a preset value is used. i ^1,θ i ^0 is the value of each observation x i The expected value ratio, E, varies depending on the ρ(x|y=1) :E ρ(x|y=0) For example, since the number of normal data is overwhelmingly large, the ratio is set in advance to 0.99:0.01.

[0057] In the learning of the generative model of this embodiment, only Max optimization of the objective function E is performed, and the parameters of the discriminator 122 with the generator 121 fixed are learned. Therefore, it is possible to prevent the output of the generator 121 from converging to the distribution of normal data, and conversely, to maintain a sequence that is sufficiently deviated from the distribution of normal data. When the update of the discriminator 122 has converged, the pseudo-normal data sequence output by the fixed generator 121 is determined by the model of the number of normal received packets for each time period (parameters θ of the multinomial distribution). 1 ) has a low likelihood. In this case, the generator 121 can generate only pseudo-normal data, which is an abnormal sequence expressed by the following equation (17).

number

[0058] The database 13 for the number of anomalous received packets stores the pseudo-normal data generated by the generator 121 after the second learning unit 12 updates the parameters of the classifier 122 as information indicating the number of anomalous received packets that deviates from a range considered to be the number of normal received packets. Specifically, when the generator 121 provided in the generation model corresponding to each time period learns with, for example, 10,000 pieces of training data, it generates 10,000 pieces of pseudo-normal data, which are registered in the database 13 for the number of anomalous received packets. The database 13 for the number of anomalous received packets registers the number of anomalous received packets for each time period as a reference pattern for determining an abnormality.

[0059] The determination unit 14 determines that the number of packets received by the communication node 2 to be managed is abnormal when the received packet count series indicating the number of packets received by the communication node 2 to be managed in each time period, collected by the collection unit 10, matches the pseudo-normal data stored in the database 13 for the number of anomalously received packets. More specifically, when the received packet count series indicating the number of packets received by the communication node 2 to be managed in each time period matches the pseudo-normal data stored in the database 13 for the number of anomalously received packets, the determination unit 14 determines that the number of packets received by the communication node 2 includes an abnormal value.

[0060] In addition to the case where the received packet count matches the pseudo-normal data stored in the database 13 for the number of abnormally received packets, if the sum of the squares of the differences between the values ​​of the received packet count series, which are the number of received packets per time period received by the communication node 2 to be managed, and the values ​​of the pseudo-normal data stored in the database 13 for the number of abnormally received packets, is within a set threshold value according to the following equation (18), the judgment unit 14 can determine that the number of received packets is an abnormal value and that the number of packets received by the communication node 2 to be managed is abnormal.

number

[0061] The alarm unit 15 outputs an alarm when the determination unit 14 determines that the number of packets received by the communication node 2 under management is abnormal. The alarm unit 15 issues an alarm notification via the network NW to, for example, the communication node 2 in which an abnormal number of received packets has occurred. The alarm unit 15 also analyzes a packet capture file recorded in the communication node 2 and identifies the IP address of the sender that sends the abnormal number of packets to the communication node 2. Specifically, the alarm unit 15 identifies a time period in which the communication node 2 received an abnormal number of packets, and analyzes the source IP address information of the packets received during the identified time period. The alarm unit 15 further instructs the communication node 2 to block communication with the identified IP address.

[0062] The storage unit 16 stores parameters of a probabilistic model that indicates the number of normal received packets for each time period, estimated by learning by the first learning unit 11. The storage unit 16 also stores a generator 121 included in the trained generative model constructed by learning by the second learning unit 12.

[0063] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0064] 6, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0065] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0066] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, the first learning unit 11, the second learning unit 12, the determination unit 14, and the alarm unit 15 shown in FIG.

[0067] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0068] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0069] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a first learning program that estimates parameters related to the number of normal received packets for each time period using a multinomial distribution probability model executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a second learning program for training the classifier 122 of the generative model executed by the abnormality management device 1. The auxiliary storage device 105 realizes the abnormally received packet count database 13 and the storage unit 16 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0070] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0071] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display on a screen the received packet count sequence collected from the communication node 2. The display device 107 can also display a packet capture file received from the communication node 2.

[0072] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0073] 7, first, the collection unit 10 collects, via the network NW, a sequence of the number of normally received packets, which indicates the number of received packets for each time period in which a certain number or more of normally received packets are included (step S1). The collection unit 10 collects, for example, data on the number of normally received packets for one month from the communication node 2 in 10-minute increments in which the number of normally received packets is 99% or more.

[0074] Next, the first learning unit 11 performs a first learning process (step S2). FIG. 8 is a flowchart illustrating the first learning process of step S2 in more detail. As shown in step S30 of FIG. 8, the first learning unit 11 models the sequence of the number of normally received packets collected in step S1 using a multinomial distribution (step S30). The first learning model sets the probability model of the above equation (5).

[0075] Next, the first learning unit 11 calculates a parameter θ for binary classification of the number of normal received packets and the number of abnormal received packets. 1 , θ 0 (Step S31). Subsequently, the first learning unit 11 defines the log-likelihood in accordance with the above formula (7) (Step S32). In Step S32, the first learning unit 11 converts the objective function for optimization from a product form (formula (5)) to a sum form. Next, the first learning unit 11 determines a parameter θ related to the number of normal received packets that maximizes the log-likelihood (formula (7)) under the constraint (formula (8)) by the Lagrange multiplier method of the above formula (9). 1(Equation (10)) is estimated (step S33). 1 is stored in the storage unit 16, and the process proceeds to step S3 in FIG.

[0076] Next, the second learning unit 12 regards each observed value of the sequence of the number of normally received packets as true normal data, and while fixing the generator parameters of the generator 121 that generates pseudo-normal data that is sufficiently deviated from the distribution of true normal data, changes the normal value parameters θ estimated by the first learning unit 11 in step S2. 1 Based on this, only the classifier parameters of the classifier 122 that distinguishes between true normal data and pseudo normal data are updated in a direction that maximizes the classification accuracy (second learning process) (step S3).

[0077] 9 is a flowchart for explaining the second learning process in step S3. First, the second learning unit 12 calculates the normal and abnormal value parameters θ of the probabilistic model of the multinomial distribution estimated in the first learning process in step S2. 1 ,θ 0 is set as the objective function (equation (15)) of the generative model (step S50). More specifically, the second learning unit 12 sets the parameter θ i ^1 is substituted into the objective function when the generator 121 of the above equation (15) is fixed, and the parameter θ i For ^0, we use an empirical rule or a preset value and substitute it into the above equation (15). Furthermore, the ratio of the expected values, E ρ(x|y=1) :E ρ(x|y=0) Regarding , since the number of normal data is overwhelmingly large, a preset value of, for example, 0.99:0.01 is adopted in the above equation (15).

[0078] Next, the second learning unit 12 acquires the sequence of the number of normally received packets collected in step S1 as true normal data (step S51). Next, the second learning unit 12 inputs the true normal data as training data 124 to the classifier 122, and adjusts the parameter w D ,θ D (Step S52). In Step S52, the second learning unit 12 can cause the classifier 122 to learn true normal data using, for example, an error backpropagation method. In Step S51, the classifier 122 that can distinguish true normal data from true normal data is pre-trained.

[0079] Next, the second learning unit 12 generates Gaussian noise and provides a random vector of the generated Gaussian noise as an input to the generator 121 (step S53). Subsequently, the generator 121 calculates a random vector of the input z and the weight parameter w based on the provided Gaussian noise. G ,θ G Then, a product-sum operation and a threshold process using an activation function are performed to generate pseudo-normal data G(z) (step S54).

[0080] Next, the second learning unit 12 learns the classifier 122. The learning of the classifier 122 is performed by using the parameter w D ,θ D First, the second learning unit 12 provides true normal data as training data 124 as input to the classifier 122. Then, the second learning unit 12 adjusts the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ D (Step S55). The label of the training data 124 is set to 1 (true normal data).

[0081] Next, the second learning unit 12 provides the pseudo-normal data generated by the generator 121 in step S54 to the classifier 122, and calculates the parameter w by backpropagation or the like so that the objective function E in the above equation (15) is maximized. D ,θ Dis updated (step S56).

[0082] The learning of the classifier 122 in steps S55 and S56 corresponds to the dashed arrows in the block diagram of the second learning unit 12 shown in FIG. 3 , which indicate that a classifier error is calculated in block 125 of the objective function E based on the output 123 from the classifier 122, and then the error is backpropagated to the classifier 122.

[0083] Thereafter, the learning of the classifier 122 from step S54 to step S56 is repeated until the value of the objective function E converges (step S57: NO). On the other hand, if the value of the objective function E converges to the optimal solution of the above equation (16) (step S57: YES), the processing from step S52 to step S57 is repeated using the remaining true normal data in order until the generator 121 and the classifier 122 are learned (step S58: NO).

[0084] Thereafter, when the classifier 122 has been trained using all true normal data (step S58: YES), the second learning unit 12 stores the generator 121 in the storage unit 16 (step S59). The second learning unit 12 also performs the processes from step S50 to step S59 for each generative model corresponding to M observations (time periods) to train the classifier 122. Note that in steps S52, S55, and S56, batch processing may be performed to update the parameters. Similarly, in steps S53 and S54, noise may be generated in batch units to generate pseudo-normal data. Thereafter, the process proceeds to step S5 in FIG. 7.

[0085] Next, the database 13 for the number of anomalously received packets stores the pseudo-normal data generated by the generator 121 after the classifier 122 has been updated through learning by the second learning unit 12 (step S5). In step S5, the pseudo-normal data generated by the generator 121 corresponding to each time period is registered in the database 13 for the number of anomalously received packets. For example, assume that 1,000 time periods (M=1,000) are set. In this case, if learning is performed using, for example, 10,000 pieces of training data in each of 1,000 generative models corresponding to the 1,000 time periods in the second learning process of step S3, the generator 121 of each generative model generates 10,000 pieces of pseudo-normal data. Therefore, 10,000 pieces of pseudo-normal data are registered in the database 13 for the number of anomalously received packets for each of the 1,000 time periods.

[0086] Next, the collection unit 10 collects a received packet count sequence indicating the number of packets received by the communication node 2 to be managed in each time period (step S5). Next, the determination unit 14 determines that an abnormality has occurred in the communication node 2 to be managed if the received packet count sequence obtained in step S5 matches the pseudo-normal data stored in the abnormal received packet count database 13 (step S6). In step S6, it can be determined that an abnormality has occurred in the communication node 2 to be managed if the received packet count sequence of the communication node 2 to be managed matches the pseudo-normal data completely or matches it within a certain tolerance range.

[0087] Specifically, according to the above equation (18), if the sum of the squares of the differences between the values ​​of the received packet count series of the managed communication node 2 and the values ​​of the pseudo-normal data is within a threshold value, the judgment unit 14 can judge that the received packet count of the managed communication node 2 is abnormal.

[0088] In addition, the pseudo-normal data for each time period can be sequentially compared without necessarily matching the received packet count series for all time periods, and when it partially matches the received packet count series corresponding to the received packets received for each time period at the communication node 2 to be managed, it can be determined that the number of received packets received at the communication node 2 to be managed is an abnormal value.

[0089] Next, if it is determined in step S6 that the number of packets received by the communication node 2 to be managed is abnormal, the alarm unit 15 outputs an alarm (step S7). The alarm unit 15 issues an alarm notification via the network NW to, for example, the communication node 2 in which an abnormal number of received packets has occurred. The alarm unit 15 also acquires a packet capture file recorded in the communication node 2, identifies the source IP address of the abnormal number of packets, and instructs the communication node 2 to block communication with the identified IP address.

[0090] As described above, the anomaly management device 1 according to this embodiment employs a multinomial distribution Naive Bayes algorithm in a probabilistic model of a sequence of normally received packets indicating the number of normally received packets received for each time period, and estimates a probability parameter associated with the sequence of normally received packets. Furthermore, the probability parameter of the estimated sequence of normally received packets is set in the objective function of the generative model, and learning is performed by updating only the discriminator 122 while keeping the generator 121 fixed, so that pseudo-normal data sufficiently deviating from the distribution of true normal data indicating a sequence of normally received packets is output from the generator 121. The collected pseudo-normal data is registered in a database for anomaly determination, enabling appropriate management of abnormal communications with a simpler configuration.

[0091] Furthermore, according to the abnormality management device 1 of this embodiment, the probability parameters of the normal received packet count sequence estimated by the first learning unit 11 are set in the objective function of the generation model, and learning is performed by only updating the discriminator 122 while keeping the generator 121 fixed, so that theoretical modeling is possible using only normal data.

[0092] In the embodiment described above, the second learning unit 12 has been described as having a generative model with a GAN configuration. However, the generative model can be configured not only based on a GAN but also based on a VAE (Variational Autoencoder), Energy-Based Models (EBMs), or the like.

[0093] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0094] 1...abnormality management device, 2...communication node, 10...collection unit, 11...first learning unit, 12...second learning unit, 13...database of number of abnormally received packets, 14...judgment unit, 15...alarm unit, 16...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 121...generator, 122...identifier, NW...network.

Claims

1. a first collection unit configured to collect a sequence of the number of normally received packets indicating the number of normally received packets for each time period; a first learning unit configured to treat each observed value of the sequence of the number of normally received packets as a discrete value independent of each other, and to estimate a probability parameter of a probability model representing the number of normally received packets for each time period based on an appearance frequency of each observed value; a second learning unit configured to update only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameter of the probabilistic model that represents the number of normal received packets estimated by the first learning unit, in a direction that maximizes classification accuracy, while keeping fixed a generator parameter of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value of the sequence of the number of normal received packets considered to be true normal data; a storage unit configured to store the pseudo-normal data output by the generator after the second learning unit updates the classifier parameters of the classifier as information indicating the number of abnormal received packets that deviates from a range considered to be the number of normal received packets; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, a second collection unit configured to collect a received packet count sequence indicating the number of packets received by the communication node to be managed in each time period; a determination unit configured to determine that the number of packets received by the communication node to be managed is abnormal when the received packet number series collected by the second collection unit matches the pseudo-normal data stored in the storage unit. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, Further, the device includes an alarm unit configured to output an alarm when the determination unit determines that the number of packets received by the communication node to be managed is abnormal. An abnormality management device characterized by:

4. A computer-implemented anomaly management method, comprising: a first collecting step of collecting a sequence of the number of normally received packets indicating the number of normally received packets for each time period; a first learning step of treating each observed value of the sequence of the number of normally received packets as a discrete value independent of each other, and estimating probability parameters of a probability model representing the number of normally received packets for each time period based on the frequency of occurrence of each observed value; a second learning step of updating only a classifier parameter of a classifier that distinguishes between the true normal data and the pseudo-normal data, based on the probability parameter of the probabilistic model that represents the number of normal received packets estimated in the first learning step, in a direction that maximizes classification accuracy, while keeping fixed a generator parameter of a generator that generates pseudo-normal data that is sufficiently deviated from the distribution of the true normal data, with each observed value of the sequence of the number of normal received packets considered to be true normal data; a storage step of storing the pseudo-normal data output by the generator in a storage unit as information indicating the number of abnormal received packets that deviates from a range considered to be the number of normal received packets after updating the classifier parameters of the classifier in the second learning step; An abnormality management method comprising:

5. 5. The abnormality management method according to claim 4, a second collecting step of collecting a received packet count sequence indicating the number of packets received by the communication node to be managed in each time period; and a determining step of determining that the number of packets received by the communication node to be managed is abnormal when the received packet number series collected in the second collecting step matches the pseudo-normal data stored in the storage unit. An abnormality management method characterized by:

6. 6. The abnormality management method according to claim 5, Further, the method includes a warning step of outputting a warning when it is determined in the determining step that the number of packets received by the communication node to be managed is abnormal. An abnormality management method characterized by:

Images