Abnormality management device and abnormality management method

Abstract

The purpose is to appropriately manage abnormal communications with a simpler configuration. [Solution] The abnormality management device 1 includes a learning unit 12 that uses the characteristic directions of normal data as training data to learn, by maximum likelihood estimation, parameters of a probability model that outputs the posterior probability that the number of packets received in each time period corresponding to each of the characteristic directions of the normal data is normal; a derivation unit 13 that derives a probability distribution for the characteristic directions of abnormal data that indicates the number of abnormal packets received in each time period that deviates from the range of normal packet numbers, based on the posterior probability estimated by the probability model learned by the learning unit 12, the probability distribution for the characteristic directions of the normal data, and the prior probability of normality; and a calculation unit 14 that calculates a first index value that indicates the degree of spatial agreement formed by the probability distribution for the characteristic directions of the abnormal data derived by the derivation unit 13 and the probability distribution for the characteristic directions of the normal data.

Description

[Technical Field]

[0001] The present invention relates to an abnormality management device and an abnormality management method. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread in addition to smartphones and tablets. As the number of IoT devices increases, the amount of traffic in the entire communication network increases, making communication traffic management even more important.

[0003] Conventionally, attacks have been known in which malicious attackers intentionally send a large number of short packets to a specific device, causing congestion and even resource exhaustion. To detect such abnormal communications, for example, Patent Document 1 discloses a system that performs two-stage CNN processing on time-series data, calculates an anomaly score without a teacher, and estimates the feature amount and time that contributed to the anomaly.

[0004] In Patent Document 1, a system for detecting anomalies is constructed using unsupervised learning because there is little data on anomalous communications. However, since it is necessary to determine the deviation between normal communications and anomalous communications without any data on anomalous communications, the system configuration becomes more complex in order to improve detection accuracy. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7586322 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, with conventional techniques, it may be difficult to appropriately manage abnormal communications with a simple configuration.

[0007] The present invention has been made to solve the above-mentioned problems, and has an object to appropriately manage abnormal communications with a simpler configuration. [Means for solving the problem]

[0008] In order to solve the above-described problems, an abnormality management device according to the present invention includes: a feature extraction unit configured to extract characteristic directions of normal data, based on a data matrix composed of a plurality of observation vectors representing normal data indicating the number of normal packets received in each time period; a learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period corresponding to each of the characteristic directions of the normal data is normal, using the characteristic directions of the normal data extracted by the feature extraction unit as training data; a derivation unit configured to derive a probability distribution for characteristic directions of abnormal data, indicating the number of abnormal packets received in each time period that deviates from the range of the number of normal packets, based on the posterior probability estimated by the probability model learned by the learning unit, a probability distribution for the characteristic directions of the normal data, and a prior probability of normality; a calculation unit configured to calculate a first index value indicating a spatial coincidence formed by the probability distribution for the characteristic directions of the abnormal data derived by the derivation unit and the probability distribution for the characteristic directions of the normal data; and a setting unit configured to set the first index value calculated by the calculation unit as a determination threshold for the number of abnormal packets.

[0009] Furthermore, the abnormality management device according to the present invention may further include a collection unit configured to collect first data indicating the number of packets received in each time period of a first interval and second data indicating the number of packets received in each time period of a second interval following the first interval as the number of packets received in each time period at a communication node to be managed, wherein the feature extraction unit extracts a characteristic direction of the first data and a characteristic direction of the second data based on a first data matrix consisting of observation vectors representing the first data and a second data matrix consisting of observation vectors representing the second data, respectively, and the calculation unit calculates a second index value indicating the degree of spatial coincidence formed by the extracted characteristic direction of the first data and the extracted characteristic direction of the second data, and further includes a determination unit configured to determine that an abnormal number of packets has been received in the second interval if the second index value calculated by the calculation unit exceeds the determination threshold.

[0010] Furthermore, the abnormality management device according to the present invention may further include a notification unit configured to issue an alarm when the determination unit determines that an abnormal number of packets has been received.

[0011] In addition, in the abnormality management device according to the present invention, the feature extraction unit may extract a transformation matrix of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix.

[0012] In order to solve the above-described problems, an anomaly management method according to the present invention includes a feature extraction step of extracting characteristic directions of normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating the number of normal packets received in each time period; a learning step of using the characteristic directions of the normal data extracted in the feature extraction step as training data and learning, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period corresponding to each of the characteristic directions of the normal data is normal; a derivation step of deriving a probability distribution for the characteristic directions of abnormal data indicating the number of abnormal packets received in each time period that deviates from the range of the number of normal packets, based on the posterior probability estimated by the probability model learned in the learning step, a probability distribution for the characteristic directions of the normal data, and a prior probability of normality; a calculation step of calculating a first index value that indicates a spatial coincidence formed by the probability distribution for the characteristic directions of the abnormal data derived in the derivation step and the probability distribution for the characteristic directions of the normal data; and a setting step of setting the first index value calculated in the calculation step as a determination threshold for the number of abnormal packets.

[0013] Furthermore, the anomaly management method according to the present invention may further include a collection step of collecting first data indicating the number of packets received in each time period of a first interval and second data indicating the number of packets received in each time period of a second interval following the first interval as the number of packets received in each time period at a communication node to be managed, wherein the feature extraction step extracts a characteristic direction of the first data and a characteristic direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, respectively, and the calculation step calculates a second index value indicating a spatial coincidence formed between the extracted characteristic direction of the first data and the extracted characteristic direction of the second data, and further includes a determination step of determining that an abnormal number of packets has been received in the second interval if the second index value calculated in the calculation step exceeds the determination threshold.

[0014] The abnormality management method according to the present invention may further comprise a notification step of issuing an alarm when it is determined in the determination step that an abnormal number of packets has been received.

[0015] In addition, in the anomaly management method according to the present invention, the feature extraction step may extract a transformation matrix of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix. [Effects of the Invention]

[0016] According to the present invention, a first index value indicating the spatial degree of coincidence formed between the probability distribution for the characteristic direction of the anomalous data derived by the derivation unit and the probability distribution for the characteristic direction of the normal data is set as a determination threshold for the number of anomalous packets received in each time period, thereby enabling appropriate management of anomalous communications with a simpler configuration. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram showing the configuration of an abnormality management system including an abnormality management device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining an overview of the number of received packets at a communication node managed by the abnormality management device according to this embodiment. [Figure 3] FIG. 3 is a diagram for explaining the operation of the feature extraction unit included in the abnormality management device according to this embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of the learning unit and the derivation unit included in the abnormality management device according to this embodiment. [Figure 5] FIG. 5 is a block diagram showing the hardware configuration of the abnormality management device according to this embodiment. [Figure 6] FIG. 6 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 7]FIG. 7 is a flowchart showing the operation of the abnormality management device according to this embodiment. [Figure 8] FIG. 8 is a flowchart showing the operation of the abnormality management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS.

[0019] [Configuration of anomaly management system] First, an overview of an anomaly management system including an anomaly management device 1 according to an embodiment of the present invention will be described with reference to Fig. 1. The anomaly management system extracts the characteristic direction of normal data, derives the probability distribution of abnormal data based on the probability distribution of normal data estimated by learning a probabilistic model, and sets the maximum singular value based on the probability distribution of normal data and abnormal data as a determination threshold for the number of abnormal received packets.

[0020] The fault management system according to this embodiment includes a fault management device 1 and a communication node 2. The fault management system is provided in a mobile communication network conforming to 3G, 4G / LTE, 5G, 6G, etc. or a network using a fixed line. As shown in Fig. 1, the fault management device 1 is connected to the communication node 2 via a network NW such as a LAN, a WAN, or the Internet.

[0021] The communication node 2 is a network device that has the function of counting the number of received packets, recording them in a log file, and sending them externally, and is realized by a router, access point, switch, etc. The communication node 2 can record the number of received packets for a certain time period, for example, every 10 minutes. The communication node 2 also records the number of received packets over an arbitrarily set period, for example, one month, as normal data indicating the number of normal received packets, which is used by the feature extraction unit 11 of the abnormality management device 1, which will be described later.

[0022] The communication node 2 can be realized by, for example, a computer having a processor, a main memory device, a communication interface, an auxiliary memory device, and an input / output I / O device connected via a bus, and a program that controls these hardware resources.

[0023] FIG. 2 is a diagram illustrating normal data indicating the number of normally received packets and abnormal data indicating the number of abnormally received packets. The horizontal axis indicates time, and the vertical axis indicates the number of packets received by communication node 2. The dotted line in FIG. 2 indicates normal data a1, which is the number of normally received packets over the entire time period. The number of normally received packets refers to the number of received packets observed in each time period in a normal communication environment when the number of packets is within an allowable range based on, for example, past communication history.

[0024] On the other hand, the number of received packets shown by the solid line in Figure 2 shows a sudden increase in the number of received packets in section c. The number of received packets shown by the solid line in this section is anomalous data b1, which is an abnormal number of received packets. Abnormal data indicates the number of received packets that deviates from the range of packet numbers considered normal. Furthermore, anomalous data reflects abnormal behavior caused by attacks, malfunctions, etc., and indicates that a number of packets that could strain the packet processing performance of communication nodes 2, such as routers, were received during each time period in section c. In the example in Figure 2, an attack has occurred in which a large number of short packets are sent in a short period of time. In this way, anomalies in which the number of received bytes is relatively small and which are difficult to detect based on communication volume can be treated as anomalous data and targeted for anomaly detection.

[0025] [Function block of the abnormality management device] Next, functional blocks of the fault management device 1 according to this embodiment will be described with reference to the block diagram of Fig. 1. As shown in Fig. 1, the fault management device 1 includes a collection unit 10, a feature extraction unit 11, a learning unit 12, a derivation unit 13, a calculation unit 14, a setting unit 15, a determination unit 16, a notification unit 17, and a storage unit 18.

[0026] The collection unit 10 collects normal data indicating the number of normal packets received by the communication node 2 in each time period. The collection unit 10 collects the number of received packets per unit time (e.g., 10 minutes) received and recorded by the communication node 2 for a certain period (e.g., one month). The collection unit 10 collects data in which the number of normal packets is equal to or greater than a certain number as normal data, and passes it to the feature extraction unit 11.

[0027] The collection unit 10 also collects the number of packets received at the communication node 2 to be managed, which is the target of abnormality determination by the determination unit 16. More specifically, the collection unit 10 collects first data, which is the number of packets received in each time period of a first interval, and second data, which is the number of packets received in each time period of a second interval following the first interval, as the number of packets received in each time period at the communication node 2 to be managed. Each of the first interval and the second interval is made up of N time periods.

[0028] The feature extraction unit 11 extracts the feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data, which is the number of normal packets received in each time period. More specifically, the feature extraction unit 11 extracts the transformation matrix U of the normal data including a group of orthonormal basis vectors as the feature direction of the normal data by performing singular value decomposition on the data matrix composed of a plurality of observation vectors representing the normal data.

[0029] Furthermore, the feature extraction unit 11 extracts a feature direction of the first data and a feature direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, both of which are included in the number of packets received in each time period at the managed communication node 2. The feature extraction unit 11 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first data including a group of orthonormal basis vectors as the feature direction of the first data. Similarly, the feature extraction unit 11 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second data including a group of orthonormal basis vectors as the feature direction of the second data.

[0030] 3 is a diagram for explaining the feature directions of normal data extracted by the feature extraction unit 11. In FIG. 3, if the total number of data points in each section is N, then data points t1 to t N indicates the number of received packets observed at each time (time period) collected by the collection unit 10, and here, time series data of the number of normal received packets is shown. Therefore, the number of received packets observed in the n-th time period is expressed as t n The feature extraction unit 11 uses a sliding window with a window width M to convert the time series data of the number of normal received packets into a set of M-dimensional vectors indicated by the arrows of each sliding window into a plurality of observation vectors. The time series data consisting of the observed values ​​of the number of received packets with length L is expressed as L=N-M+1.

[0031] The observation vector, which is a partial time series of length M sequentially extracted by the feature extraction unit 11 by moving the sliding window from left to right in the time series data of the number of normal received packets, is expressed by the following equation (1).

number

[0032] Here, the data matrix X=[x (1) ,…,x (L) ] (an M×L-dimensional real-valued matrix), consider the linear combination Xν of the following equation (2).

number

[0033] From the above equation (2), ν T Under the constraint ν=1, ||Xν|| 2 This can be achieved by introducing the Lagrangian function of the following equation (3) obtained using the multiplier γ.

number

[0034] In order for the above equation (3) to be maximized, 2X differentiated with respect to the vector ν T The value of Xν-2γν is 0. Therefore, the following conditional expression (4) is obtained.

number

[0035] From the above equation (4), X T It can be seen that the eigenvalue of X is γ and the eigenvector is ν. Furthermore, the vector μ is defined by the following equation (5).

number

[0036] Using the above equations (5) and (4), the relationship shown in the following equation (6) can be found.

number

[0037] Furthermore, multiplying both sides of the above equation (4) by X and using the above equation (5) yields the following relational equation (7).

number

[0038] By applying the above equation (5) to the above equation (7), the following relational expression (8) is obtained.

number

[0039] Here, U and V are set as follows:

number

[0040] The above equation (9) can be expressed as the following equation (10).

number

[0041] U is an orthogonal matrix, and U T By multiplying and transposing both sides of the above equation (10), the relationship of the following equation (11) is obtained.

number

[0042] The above equation (11) is called the singular value decomposition of X. Let U be the left singular vector, V be the right singular vector, and Γ 1 / 2 are called singular values. That is, U is a transformation matrix that represents the feature direction, which is the main direction or pattern of normal data. V represents the axis transformation, which is the direction to which the vector is projected. Γ represents the importance of each feature direction.

[0043] The matrix U of left singular vectors is expressed by the following equation (12).

number

[0044] For example, if there are 10,000 pieces of normal data for the number of received packets in the section (N=1000), 10,000 left singular vectors U are calculated. Each component vector μ of the left singular vector U in the normal data xx The probability distribution of is obtained by the learning unit 12 using the maximum likelihood estimation method.

[0045] The learning unit 12 uses the feature directions of the normal data extracted by the feature extraction unit 11 as training data to learn, by maximum likelihood estimation, parameters of a probability model that outputs the posterior probability that the number of packets received in each time period corresponding to each feature direction of the normal data is normal. In a situation where there is little abnormal data, the learning unit 12 learns the probability model by maximum likelihood estimation using the feature directions of the normal data.

[0046] Here, each element μ of the matrix of the left singular vector Uxx Let x be the number of packets received at a certain observation point in a certain time period (μ xx = x). In addition, the density function of normal data is expressed as ρ d (μ xx ), and the density function of the abnormal data is ρ g (μ xx ) are defined as follows: d (μ xx )=ρ d (x), ρ g (μ xx )=ρ g (x).

number

[0047] In the above equation (13), y=1 indicates the normal class and y=0 indicates the abnormal class. d (μ xx ) is the number of packets μ xx shows the tendency of appearance of ρ g (x) is the number of received packets μ when they belong to the abnormal class y=0. xx The probability distribution of both normal and abnormal data follows a normal distribution.

[0048] The density ratio γ(μ xx ) is expressed by the following equation (14).

number

[0049]

number

[0050] Here, if π=ρ(y=1), the above equation (15) can be further expressed as the following equation (16).

number

[0051] Therefore, first, the observed value μ xx The posterior probability ρ(y=1|μ xx ) is calculated. Observed value μ xx If there is a large amount of xx )≒ρ(μ xx |y=1) can be approximated. In other words, the posterior probability ρ(y=1|μ xx ) can be estimated. For the sake of explanation, we will use the observed value μ xxis denoted as x. At an observation point x n Assuming that the normal distribution is assumed, it is defined as shown in the following equation (17).

number

[0052] Furthermore, the output of the probabilistic model f(x n ) can be expressed as a linear combination as shown in the following equation (18).

number

[0053]

number

[0054]

number

[0055] Furthermore, the number of received packets f(x n ) and the actual number of successfully received packets t n The average error from the (teacher signal) is the variance σ of the normal distribution shown in the following equation (21). 2 The value becomes

number

[0056] In this way, when a linear combination probability model estimates the posterior probability that the number of received packets is normal for an input x, each observation t is calculated based on the estimated value f(x n ) is assumed to follow a normal distribution with mean x n ,t n ) by maximum likelihood estimation, we can obtain the parameters w and error variance σ of the probability model. 2 Estimate.

[0057] 4 is a diagram for explaining the configuration of the learning unit 12 and the derivation unit 13. As shown in FIG. xx Therefore, the learning unit 12 calculates each component μ of the matrix U of left singular vectors obtained by performing singular value decomposition on the data matrix of normal data. xx Probability distribution ρ for d (μ xx ) is calculated. If there is a matrix U of 10,000 left singular vectors, each component μ xx Ten thousand normal probability distributions are calculated. The learning unit 12 calculates the components μ xx As described above, there are as many matrices U of left singular vectors as there are normal data. Therefore, the learning unit 12 performs maximum likelihood estimation the number of times corresponding to the number of matrices U of left singular vectors.

[0058] Here, again μ xx By expressing x as the normal data posterior probability ρ(y=1|x), we can approximately estimate ρ(y=1|x)≒q wThe relationship is (y=1|x). The estimated posterior probability that the number of input received packets x is normal is q w Based on (y=1|x), the cross entropy is defined as the loss function L as shown in the following equation (22).

number

[0059] The convergence value (minimum value) of the loss function L in the above equation (22) is expressed by the following equation (23).

number

[0060] The derivation unit 13 transforms the above equation (23) into the following equation (24), and calculates the density function ρ g Derive (x).

number

[0061] x to μ xx When substituted, the above equation (24) becomes the following equation (25).

number

[0062] In the above equation (25), the probability distribution of normal data, i.e., the density function of normal data, ρ d (μ xx ) is calculated from the normal data collected by the collection unit 10. The prior probability of normal data, π, is much larger than the prior probability of abnormal data, (1-π), and can be set to, for example, 0.99. Furthermore, the observed value μ xx For (=x), the log likelihood lnq when y=1 w (y=1|μ xx ) is calculated by maximum likelihood estimation based on a large amount of normal data (teacher signal), as shown in the above equations (18) to (21). In this way, even if there is a small amount of abnormal data, the probability distribution of abnormal data can be calculated from the normal data.

[0063] The derivation unit 13 calculates the estimated value q of the posterior probability of normal data estimated by the probability model learned by the learning unit 12. w (y=1|μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) and the prior probability π of normality, the density function ρ for the feature direction of the abnormal data indicating the number of abnormal received packets that deviates from the range of the number of normal received packets is calculated. g (μ xx ) is derived. As mentioned above, the posterior probability estimate of normal data, q w (y=1|μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) is normally distributed, the density function ρ g (μ xx ) is also normally distributed.

[0064] The derivation unit 13 calculates the estimated value q of the posterior probability of normal data. w (y=1|μ xx ) (for example, 10,000) and the same number of abnormal data density functions ρ g (μ xx ) of the density function ρ g (μ xx ) is the sum of the anomalous data density function ρ g (μ xx ) as the final solution. The derivation unit 13 also calculates the density function ρ d (μ xx ) is the density function ρ d (μ xx ) is the final solution.

[0065] Here, the density function ρ for the feature direction of normal data is d (μ xx ) and the density function ρ for the feature direction of the abnormal data g (μ xx) are expressed by the following matrix (26).

number

[0066] The calculation unit 14 calculates the density function ρ g (μ xx ) (probability distribution) and the density function ρ for the feature direction of normal data d (μ xx ) (probability distribution) for the characteristic direction of the abnormal data. g (μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) as the first index value. Specifically, the calculation unit 14 calculates the maximum singular value of the matrix formed based on the matrix 2-norm ∥ρ d (μ xx ) T ρ g (μ xx )||2 is calculated as the first index value.

[0067]

number

[0068] The sum of the vector components of each column in the above equation (27) is S1, ,S M Then, the matrix 2-norm is calculated by the following equation (28).

number

[0069] The calculation unit 14 also calculates a second index value indicating the degree of spatial coincidence formed between the feature directions of the first data and the feature directions of the second data, each indicating the number of packets received in each time period at the communication node 2 to be managed, extracted by the feature extraction unit 11. More specifically, the calculation unit 14 calculates, as the second index value, the matrix 2 norm of the transposed matrix U1 of the left singular vectors of the first data and the matrix U2 of the left singular vectors of the second data.

[0070] The setting unit 15 sets the first index value calculated by the calculation unit 14 as a determination threshold for the number of abnormal packets received in each time period.

[0071] If the second index value calculated by the calculation unit 14 exceeds the threshold value, the determination unit 16 determines that an abnormal number of packets has been received in the second interval.

[0072] The notification unit 17 issues an alarm when an abnormal number of packets is received by the determination unit 16. Specifically, the notification unit 17 can notify the communication node 2 to be managed of the alarm via the network NW. The alarm includes information on multiple time periods included in the section in which the abnormal number of packets was received.

[0073] The storage unit 18 stores the threshold value set by the setting unit 15.

[0074] [Hardware configuration of the fault management device] Next, an example of a hardware configuration for realizing the abnormality management device 1 having the above-described functions will be described with reference to FIG.

[0075] 5, the fault management device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) 106 connected via a bus 101, and a program for controlling these hardware resources. Furthermore, the fault management device 1 includes a display device 107.

[0076] The processor 102 is a circuit or device that performs arithmetic processing, and is realized by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. Alternatively, the processor 102 may be configured by combining some or all of these.

[0077] The main memory device 103 is configured, for example, by a volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the abnormality management device 1, such as the collection unit 10, feature extraction unit 11, learning unit 12, derivation unit 13, calculation unit 14, setting unit 15, determination unit 16, and notification unit 17 shown in FIG.

[0078] The communication interface 104 is an interface circuit for connecting the abnormality management device 1 to various external electronic devices via a network.

[0079] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0080] The auxiliary storage device 105 has a program storage area for storing an abnormality management program. The auxiliary storage device 105 also has a program storage area for storing a feature extraction program for extracting characteristic directions of normal data using the subspace method executed by the abnormality management device 1. The auxiliary storage device 105 also has a program storage area for storing a learning program for a probability model executed by the abnormality management device 1. The auxiliary storage device 105 realizes the storage unit 18 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the above-mentioned data, programs, etc.

[0081] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0082] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display on a screen time-series data of the number of packets received in the communication node 2 to be managed.

[0083] [Operation of the abnormality management device] Next, the operation of the abnormality management device 1 having the above-described configuration will be described with reference to the flowcharts of FIGS.

[0084] 6, first, the collection unit 10 collects time-series data on the number of received packets containing a certain amount of normal data or more (step S1). The collection unit 10 collects, for example, the number of received packets in which 99% or more are normal data from the communication node 2 via the network NW. In step S1, the collection unit 10 acquires the number of received packets in each time period (for example, in 10-minute increments) over a set period (for example, one month).

[0085] Next, the feature extraction unit 11 extracts feature directions of the normal data based on a data matrix composed of multiple observation vectors representing normal data (step S2). The feature extraction unit 11 extracts multiple observation vectors of a partial time series by shifting the data on the number of received packets of normal data over each time period using a sliding window with a window width M as shown in FIG. 3. The feature extraction unit 11 performs singular value decomposition on the data matrix X, which is a compilation of the observation vectors expressed by the above formula (1), and extracts the transformation matrix U expressed by the above formulas (11) and (12). In step S2, for example, if there are 10,000 normal data pieces in the number of received packets in the interval (N=1000), 10,000 transformation matrices U are calculated.

[0086] Next, the learning unit 12 uses the feature directions of the normal data extracted by the feature extraction unit 11 in step S2 as training data to learn parameters of a probability model that outputs the posterior probability that the number of packets received in each time period corresponding to each of the feature directions of the normal data is normal by maximum likelihood estimation (step S3).After that, the derivation unit 13 derives a probability distribution for the feature directions of the abnormal data, which indicates the number of abnormal received packets received in each time period that deviates from the range of the number of normal received packets, based on the posterior probability of normal data estimated by the probability model learned by the learning unit 12 in step S3, the probability distribution for the feature directions of the normal data, and the prior probability of normality (step S4).

[0087] 7 is a flowchart illustrating steps S3 and S4 in more detail. As shown in step S30 of FIG. 7, the learning unit 12 uses the transformation matrix U of the normal data obtained in step S2 as training data, and calculates the components μ xx For each, the number of received packets μ xx The posterior probability estimate q is normal w (y=1|μ xx ) parameters w,σ of the probabilistic model that outputs 2 is learned by maximum likelihood estimation (step S30). If there are 10,000 transformation matrices U of normal data, 10,000 estimated values ​​q w (y=1|μ xx) is obtained. In step S30, the learning unit 12 performs learning by maximum likelihood estimation in accordance with the above equations (18) to (21).

[0088] Furthermore, the learning unit 12 calculates the components μ of the transformation matrix U of the normal data. xx The number of normal packets received in each time slot μ xx Based on the normal data density function ρ d (μ xx ) (normal distribution) is estimated (step S31). In step S31, as shown in FIG. 4, maximum likelihood estimation is performed for each column vector of the transformation matrix U, and each component μ xx The density function ρ of normal data for d (μ xx In step S31, maximum likelihood estimation is performed for each of the multiple transformation matrices U.

[0089] Next, the derivation unit 13 adds the log likelihood lnq of the posterior probability calculated in step S30 to the above equation (25). w (y=1|μ xx ), the density function ρ of the normal data obtained in step S31 d (μ xx ), and the prior probability of normal data π (e.g., 0.99) to obtain the density function ρ of the abnormal data. g (μ xx ) is derived (step S33). The density function ρ g (μ xx ) is calculated by the log likelihood lnq w (y=1|μ xx ) is the same number as the number of

[0090] Thereafter, the process proceeds to step S5 in Fig. 6. Subsequently, in step S4, the calculation unit 14 calculates the density function ρ g (μ xx ) (probability distribution) and the density function ρ for the feature direction of normal data d (μ xx) (probability distribution) for the characteristic direction of the abnormal data is calculated (step S5). g (μ xx ) and the density function ρ for the feature direction of normal data d (μ xx ) is the maximum singular value of the matrix constructed based on the matrix 2-norm ||ρ d (μ xx ) T ρ g (μ xx )||2 is calculated as the first index value.

[0091] Next, the setting unit 15 sets the matrix 2 norm calculated in step S5 as a threshold for determining the number of abnormal received packets (step S6). After that, the collection unit 10 collects time series data of the number of packets received in each time period in the communication node 2 to be managed (step S7). Specifically, as shown in FIG. 8, the collection unit 10 collects time series data of the number of packets received in the communication node 2 to be managed from time periods t1 to t N The collection unit 10 collects first data indicating the number of packets received in each time period included in the first section from t N+1 From t N+N Second data indicating the number of packets received in each time period included in the second section from

[0092] Next, the feature extraction unit 11 performs singular value decomposition on the first data matrix to extract a transformation matrix U1 of the first data, which includes a group of orthonormal basis vectors, as the feature direction of the first data. Similarly, the feature extraction unit 11 performs singular value decomposition on the second data matrix to extract a transformation matrix U2 of the second data, which includes a group of orthonormal basis vectors, as the feature direction of the second data (step S8). Here, as shown in "step S8" in FIG. 8, the sliding windows for the first and second intervals are shifted to the right for each set time period (e.g., each time period), and singular value decomposition is performed on each of the first and second data matrices. Furthermore, FIG. 8 shows that the transformation matrices U1 and U2 are extracted as matrices of left singular vectors. In this way, the feature extraction unit 11 performs singular value decomposition to extract the transformation matrices U1 and U2 each time the sliding window is shifted.

[0093] Next, the calculation unit 14 calculates a second index value indicating the spatial degree of coincidence formed between the feature direction of the first data observed in the first interval extracted in step S8 and the feature direction of the second data observed in the second interval (step S9). The calculation unit 14 calculates the maximum singular value, i.e., the matrix 2-norm ||U1 T U2∥2 is calculated as the second index value (“Step S9” in FIG. 8).

[0094] Next, in step S9, if the second index value calculated by the calculation unit 14 exceeds the threshold value set in step S6, the determination unit 16 determines that the number of abnormal packets has been received in the second interval in the communication node 2 to be managed (step S10). If no abnormality is determined in step S10, as shown in FIG. 8, the first and second intervals are sequentially shifted to the right, and the processing from step S7 to step S10 is repeated each time. When the processing from step S7 to step S10 is repeated while shifting the first and second intervals to the right along the time axis, the processing can be repeated by sequentially shifting the intervals by any set time interval. In addition to repeating the processing by shifting the intervals by one time period as described above, for example, the interval that was the second interval in the first determination processing can be used as the first interval in the next determination processing, and steps S7 to S8 can be executed.

[0095] Next, the notification unit 17 notifies an alert to the communication node 2 under management that has been determined to have received an abnormal number of packets (step S11). The communication node 2 that has received the alert can identify the source of the packets with the abnormal number of packets based on the information in the alert about the time period in which the abnormal number of packets was received, and can take measures such as cutting off communication.

[0096] As described above, the anomaly management device 1 according to this embodiment performs singular value decomposition on the data matrix of normal data using the subspace method, and uses the matrix U of the obtained left singular vectors as training data to learn parameters of a probabilistic model that outputs the posterior probability that the number of received packets is normal using maximum likelihood estimation, thereby estimating the posterior probability that the number of received packets is normal. Furthermore, the device derives a density function for abnormal data based on the estimated posterior probability, the density function for normal data, and the prior probability of normal data. Furthermore, the maximum singular value of the matrix of the derived density function for abnormal data and the density function for normal data is set as a threshold for determining the number of abnormal received packets. Therefore, abnormal communications can be appropriately managed based on normal data with a simpler configuration.

[0097] Furthermore, according to the abnormality management device 1 of this embodiment, the time window for the number of received packets, which is the observed value, is shifted sequentially, and an abnormality is judged using the judgment threshold for the number of abnormal received packets obtained by learning based on normal data, so that it is possible to detect the occurrence of an abnormal number of received packets in real time.

[0098] In the embodiment described above, the anomaly management system is described as a system conforming to the 5G standard, but the communication standard may be 3G, 4G / LTE, 6G, etc. Furthermore, the anomaly management system is not limited to a mobile communication network and may be a network using a fixed line as described above. In this case, the anomaly management system may be configured to collect a log of the number of received packets via a wireless router or a wireless access point.

[0099] The above describes embodiments of the abnormality management device and abnormality management method of the present invention, but the present invention is not limited to the described embodiments, and various modifications that a person skilled in the art can conceive are possible within the scope of the invention described in the claims. [Explanation of symbols]

[0100] 1...abnormality management device, 2...communication node, 10...collection unit, 11...feature extraction unit, 12...learning unit, 13...derivation unit, 14...calculation unit, 15...setting unit, 16...judgment unit, 17...notification unit, 18...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, NW...network.

Claims

1. a feature extraction unit configured to extract a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating the number of normal packets received in each time period; a learning unit configured to learn, by maximum likelihood estimation, parameters of a probability model that outputs a posterior probability that the number of packets received in each time period corresponding to each of the characteristic directions of the normal data is normal, using the characteristic directions of the normal data extracted by the characteristic extraction unit as training data; a derivation unit configured to derive a probability distribution for a characteristic direction of abnormal data indicating the number of abnormal packets received in each time period that deviates from the range of the number of normal packets, based on the posterior probability estimated by the probability model learned by the learning unit, a probability distribution for the characteristic direction of the normal data, and a prior probability of normality; a calculation unit configured to calculate a first index value indicating a spatial degree of coincidence formed between the probability distribution for the characteristic direction of the abnormal data derived by the derivation unit and the probability distribution for the characteristic direction of the normal data; a setting unit configured to set the first index value calculated by the calculation unit as a determination threshold value for the number of abnormal packets; An abnormality management device comprising:

2. 2. The abnormality management device according to claim 1, a collection unit configured to collect, as the number of packets received in each time period at a communication node to be managed, first data indicating the number of packets received in each time period of a first section and second data indicating the number of packets received in each time period of a second section following the first section; the feature extraction unit extracts a feature direction of the first data and a feature direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, the calculation unit calculates a second index value indicating a degree of spatial coincidence formed between the extracted feature direction of the first data and the extracted feature direction of the second data; The communication device further includes a determination unit configured to determine that an abnormal number of packets has been received in the second section when the second index value calculated by the calculation unit exceeds the determination threshold value. An abnormality management device characterized by:

3. 3. The abnormality management device according to claim 2, The communication device further includes a notification unit configured to issue a warning when the determination unit determines that an abnormal number of packets has been received. An abnormality management device characterized by:

4. 2. The abnormality management device according to claim 1, The feature extraction unit extracts a transformation matrix of the normal data including a group of orthonormal basis vectors as a feature direction of the normal data by performing singular value decomposition on the data matrix. An abnormality management device characterized by:

5. A computer-implemented anomaly management method, comprising: a feature extraction step of extracting a feature direction of the normal data based on a data matrix composed of a plurality of observation vectors representing normal data indicating the number of normal packets received in each time period; a learning step of learning, by maximum likelihood estimation, parameters of a probabilistic model that outputs a posterior probability that the number of packets received in each time period corresponding to each of the characteristic directions of the normal data is normal, using the characteristic directions of the normal data extracted in the characteristic extraction step as training data; a derivation step of deriving a probability distribution for characteristic directions of abnormal data indicating the number of abnormal packets received in each time period outside the range of the number of normal packets, based on the posterior probability estimated by the probability model learned in the learning step, a probability distribution for characteristic directions of the normal data, and a prior probability of normality; a calculation step of calculating a first index value indicating a spatial degree of coincidence formed between the probability distribution for the characteristic direction of the abnormal data derived in the derivation step and the probability distribution for the characteristic direction of the normal data; a setting step of setting the first index value calculated in the calculation step as a determination threshold value for the number of abnormal packets; An abnormality management method comprising:

6. 6. The abnormality management method according to claim 5, further comprising a collecting step of collecting first data indicating the number of packets received in each time period of a first section and second data indicating the number of packets received in each time period of a second section following the first section as the number of packets received in each time period at a communication node to be managed, the feature extraction step extracts a feature direction of the first data and a feature direction of the second data based on a first data matrix constituted by observation vectors representing the first data and a second data matrix constituted by observation vectors representing the second data, the calculating step calculates a second index value indicating a degree of spatial coincidence formed between the extracted feature direction of the first data and the extracted feature direction of the second data; The method further includes a determination step of determining that an abnormal number of packets has been received in the second section when the second index value calculated in the calculation step exceeds the determination threshold value. An abnormality management method characterized by:

7. 7. The abnormality management method according to claim 6, The method further includes a notification step of issuing an alarm when it is determined in the determination step that an abnormal number of packets has been received. An abnormality management method characterized by:

8. 6. The abnormality management method according to claim 5, The feature extraction step extracts a transformation matrix of the normal data including a group of orthonormal basis vectors as a feature direction of the normal data by performing singular value decomposition on the data matrix. An abnormality management method characterized by:

Images