Traffic anomaly detection device and traffic anomaly detection method

Abstract

The purpose is to more reliably detect traffic anomalies. [Solution] The traffic anomaly detection device 1 includes a learning unit 11 configured to construct a multivariate probability model using traffic volume in each time interval of a plurality of time intervals and generate a matrix representing a conditional dependency between any two time intervals from the multivariate probability model, and a determination unit 12 configured to determine a traffic anomaly based on the values ​​of components in the matrix generated by the learning unit 11 that represent the conditional dependency between the two time intervals.

Description

[Technical Field]

[0001] The present invention relates to a traffic anomaly detection device and a traffic anomaly detection method. [Background technology]

[0002] In recent years, the number of devices (both fixed and mobile) connected to the Internet has exploded, resulting in a massive amount of traffic. Among these, there are occasional cases of devices transmitting abnormal traffic, such as burst traffic exceeding the set bandwidth, due to malfunctions (including software bugs) or malicious third parties, causing congestion in networks, such as the core network in 5G communication standards.

[0003] A method has been proposed for estimating abnormal traffic such as burst traffic by using statistical estimation such as maximum likelihood estimation or machine learning based on a discriminant model (see Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-216585 Summary of the Invention [Problem to be solved by the invention]

[0005] With conventional methods, it can be difficult to estimate or detect abnormal traffic when a large amount of past data on abnormal traffic cannot be collected. In addition, there is little past data on burst traffic, making it difficult to establish standards for the traffic that should be collected in the first place. Furthermore, conventionally, it has also been difficult to identify terminals that generate abnormal traffic such as burst traffic.

[0006] The present invention has been made to solve the above-mentioned problems, and has an object to more reliably detect traffic anomalies. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems, the traffic anomaly detection device of the present invention includes a learning unit configured to construct a multivariate probabilistic model using traffic volumes in each time interval of a plurality of time intervals and generate, from the multivariate probabilistic model, a matrix representing a conditional dependency between any two time intervals among the plurality of time intervals; and a determination unit configured to determine a traffic anomaly based on the values ​​of components in the matrix generated by the learning unit that represent the conditional dependency between the two time intervals.

[0008] Furthermore, in the traffic anomaly detection device according to the present invention, the plurality of time intervals may correspond to a plurality of time intervals obtained by dividing each period of an observation period including a plurality of periods, and the learning unit may be further configured to construct, as the multivariate probability model, a multivariate normal distribution model with a sample mean of 0, using the traffic volume of each time interval of each period of the observation period, and to generate, as the matrix, a precision matrix of the multivariate normal distribution model.

[0009] Furthermore, in the traffic anomaly detection device according to the present invention, the determination unit determines, based on the precision matrix generated for a certain observation period and the precision matrix generated for an observation period prior to the certain observation period, whether a value of a component indicating the conditional dependency between two time periods has changed from 0 to a value other than 0, whether a value of a component indicating the conditional dependency between two time periods has changed from a value other than 0 to 0, or whether a value of a component indicating the conditional dependency between two time periods has exceeded a threshold. The device may be further configured to determine at least one of:

[0010] The traffic abnormality detection device according to the present invention may further include an alarm unit configured to generate an alarm based on the determination of a traffic abnormality made by the determination unit.

[0011] In addition, in the traffic anomaly detection device according to the present invention, the traffic volume in each time interval of the plurality of time intervals is acquired for each of a plurality of user terminals, and the learning unit is further configured to, for each user terminal, construct the multivariate probabilistic model using the traffic volume acquired for that user terminal in each time interval of the plurality of time intervals, and generate a matrix representing a conditional dependency between any two of the plurality of time intervals from the multivariate probabilistic model constructed for that user terminal, and the determination unit is further configured to determine a traffic anomaly based on values ​​of components indicating the conditional dependency between two time intervals in the matrix generated for that user terminal by the learning unit, and the alarm unit is further configured to generate an alarm when a traffic anomaly is determined for at least one of the plurality of user terminals, and the alarm may include information identifying the user terminal determined to have a traffic anomaly.

[0012] Furthermore, the traffic abnormality detection device according to the present invention may be provided in a system equipped with a traffic control device, and the traffic control device may be configured to instruct a network device that functions as a gateway for the user terminal determined to have a traffic abnormality, based on the received alarm, to impose bandwidth restrictions on communications by the user terminal determined to have a traffic abnormality.

[0013] In order to solve the above-mentioned problems, the traffic anomaly detection method according to the present invention includes a learning step of constructing a multivariate probabilistic model using traffic volumes in each of a plurality of time intervals and generating, from the multivariate probabilistic model, a matrix indicating a conditional dependency between any two of the plurality of time intervals; and a determination step of determining a traffic anomaly based on values ​​of components indicating the conditional dependency between the two time intervals in the matrix generated in the learning step.

[0014] In addition, in the traffic anomaly detection method according to the present invention, the learning step may include a step of constructing, as the multivariate probability model, a multivariate normal distribution model with a sample mean of 0, using traffic volume in each time interval of each period in an observation period including a plurality of periods, and generating, as the matrix, a precision matrix of the multivariate normal distribution model.

[0015] Furthermore, in the traffic anomaly detection method according to the present invention, the determining step determines whether a value of a component indicating the conditional dependency between two time intervals changes from 0 to a value other than 0, whether a value of a component indicating the conditional dependency between two time intervals changes from a value other than 0 to 0, or whether a value of a component indicating the conditional dependency between two time intervals exceeds a threshold, based on the precision matrix generated for a certain observation period and the precision matrix generated for an observation period prior to the certain observation period. The method may include determining at least one of:

[0016] The traffic abnormality detection method according to the present invention may further include a step of generating an alarm based on the determination of the traffic abnormality in the determining step.

[0017] In addition, in the traffic anomaly detection method according to the present invention, the traffic volume in each time interval of the plurality of time intervals is acquired for each of a plurality of user terminals, and the learning step may include a step of constructing, for each user terminal, the multivariate probabilistic model using the traffic volume acquired for that user terminal in each time interval of the plurality of time intervals, and generating a matrix representing a conditional dependency between any two of the plurality of time intervals from the multivariate probabilistic model constructed for that user terminal, and the determination step may include a step of determining, for each user terminal, a traffic anomaly based on values ​​of components indicating the conditional dependency between two time intervals in the matrix generated for that user terminal in the learning step, and the warning step may include a step of generating an alarm when a traffic anomaly is determined for at least one of the plurality of user terminals, and the alarm may include information identifying the user terminal determined to have a traffic anomaly.

[0018] Furthermore, in the traffic abnormality detection method according to the present invention, the traffic abnormality detection method may further include a step of instructing a network device that functions as a gateway for the user terminal determined to have a traffic abnormality, based on the alarm, to impose bandwidth restrictions on communications by the user terminal determined to have a traffic abnormality. [Effects of the Invention]

[0019] According to the present invention, a multivariate probabilistic model is constructed using traffic volumes in each of a plurality of time intervals, and a matrix indicating the conditional dependency between any two of the plurality of time intervals is generated from the multivariate probabilistic model, thereby enabling more reliable detection of traffic anomalies. [Brief explanation of the drawings]

[0020] [Figure 1A]FIG. 1A is a block diagram showing the configuration of a system including a traffic anomaly detection device and a traffic control device according to a first embodiment of the present invention. [Figure 1B] FIG. 1B is a block diagram showing the configuration of a system including a traffic anomaly detection device and a traffic control device according to a second embodiment of the present invention. [Figure 2] FIG. 2 is a schematic diagram for explaining the traffic volume in a time section. [Figure 3] FIG. 3 is a schematic diagram for explaining the configuration of a learning unit included in the traffic anomaly detection device according to this embodiment. [Figure 4A] FIG. 4A is a schematic diagram for explaining the configuration of a learning unit included in the traffic anomaly detection device according to this embodiment. [Figure 4B] FIG. 4B is a schematic diagram for explaining the configuration of the learning unit included in the traffic anomaly detection device according to this embodiment. [Figure 5] FIG. 5 is a block diagram showing the hardware configuration of a traffic anomaly detection device according to this embodiment. [Figure 6] FIG. 6 is a sequence diagram showing the operation of a system including a traffic abnormality detection device and a traffic control device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0021] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will now be described in detail with reference to FIGS. 1A to 6. FIG.

[0022] [System Configuration] First, with reference to Fig. 1A, an overview of a system including a traffic anomaly detection device 1 according to a first embodiment of the present invention and a traffic control device 2 will be described. Note that components other than the traffic anomaly detection device 1 and the traffic control device 2 shown in Fig. 1A may be considered to be included in this system, or may be considered to be included in this system.

[0023] A traffic anomaly detection device 1 and a traffic control device 2 according to the first embodiment are provided in association with a mobile communication network conforming to the 5G communication standard, for example. The mobile communication network includes a core network 4. The core network 4 includes a UPF (User Plane Function) 44A as its functional node. Although only one UPF 44A is depicted in FIG. 1A, the number of UPFs 44A included in the core network 4 may be any number equal to or greater than one. Functional nodes included in the core network 4 other than the UPF 44A will be described later.

[0024] In the first embodiment, the traffic abnormality detection device 1 and the traffic control device 2 are connected via a network NW1. The network NW1 may be considered to be composed of one or more networks. The traffic abnormality detection device 1 and the traffic control device 2 are connected so that at least the traffic control device 2 can receive an alarm generated by the traffic abnormality detection device 1. Note that in FIG. 1A, the traffic abnormality detection device 1 and the traffic control device 2 are separate devices, but this is not limiting, and the traffic abnormality detection device 1 and the traffic control device 2 may be a single integrated device. Furthermore, the traffic control device 2 is not essential to the first embodiment.

[0025] In the first embodiment, the traffic abnormality detection device 1 and the core network 4 are connected via a network NW1. The traffic abnormality detection device 1 and the core network 4 are connected at least so that the traffic abnormality detection device 1 can collect traffic volume (communication volume) as described below. The network NW2 can be considered to be composed of one or more networks including a data network such as the Internet. Note that the traffic abnormality detection device 1 may also be connected directly to the core network 4 without going through the network NW1.

[0026] In the first embodiment, the traffic control device 2 and the core network 4 are connected via a network NW1. The traffic control device 2 and the core network 4 are connected at least so that the traffic control device 2 can instruct the UPF 44A included in the core network 4 to limit bandwidth. The traffic control device 2 may also have a function as an operation center that issues arbitrary instructions to the core network 4. The traffic control device 2 may also be connected directly to the core network 4 without going through the network NW1.

[0027] The user terminal 5A is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, etc. The user terminal 5A is equipped with a SIM, and the contract profile of the SIM stores the user's subscriber identification information, and includes identifier information such as a subscriber identification number (IMSI: International Mobile Subscriber Identity) assigned to a mobile phone line contract, the telephone number of the subscriber user (MSISDN: Mobile Subscriber International Subscriber Directory Number), and a SIM card number (ICCID: Integrated Circuit Card Identifier). The user terminal 5A is uniquely identified by the IMSI.

[0028] The user terminal 5A is also assigned a terminal IP address that uniquely identifies the terminal. The IP address is assigned to the user terminal 5A through the SMF 42, which will be described later, after the session is established. The user terminal 5A accesses the network NW2 from the UPF 44A via the base station 3 in which it is located. Note that although only one user terminal 5A is depicted in FIG. 1A, there are actually multiple user terminals 5A. Also, although only one base station 3 is depicted in FIG. 1A, the number of base stations 3 may be any number equal to or greater than one. The user terminal 5A is located in different base stations 3 depending on its geographical location, and when the user terminal 5A accesses the network, a different UPF 44A (which, as described above, may be any number equal to or greater than one) is assigned depending on the base station 3 in which it is located.

[0029] When the user terminal 5A moves within a communication area, periodically updates its location, or when the power is turned on, the user terminal 5A transmits a location registration request signal to the core network 4 via the base station 3. The location registration request signal transmitted by the user terminal 5A includes the IMSI.

[0030] The base station 3 is composed of a wireless base station compatible with the 5G system, and relays communications between a user terminal 5A present in the communication area and the core network 4. The base station 3 is connected to the core network 4 via a network such as a backhaul link. The base station 3 is uniquely identified by a base station ID. The base station ID also makes it possible to ascertain the geographical location of the base station 3.

[0031] The core network 4 further includes an Access and Mobility Management Function (AMF) 40, a Unified Data Management (UDM) / Unified Data Repository (UDR) 41, a Session Management Function (SMF) 42, and a Policy Control Function (PCF) 43, which are nodes in the C-plane. The UPF 44A included in the core network 4 is a node in the U-plane. Functional nodes in the U-plane and C-plane other than those mentioned above that the core network 4 includes are not shown in the figure.

[0032] The AMF 40 is an access and mobility management device that manages the registration and wireless connection of the user terminal 5A that moves to each communication area.

[0033] The UDM / UDR 41 manages subscriber profiles, performs authentication, and manages mobility. The UDM / UDR 41 records the traffic volume for each user terminal 5A as information related to traffic on the C-plane.

[0034] The SMF 42 is a session management function that establishes, modifies, and releases a PDU (Packet Data Unit) session between the user terminal 5A and the network NW2 (a data network such as the Internet). The SMF 42 sets an appropriate communication path for data communication between the user terminal 5A and the UPF 44A based on a PCC (Policy and Charging Control) policy from the PCF 43.

[0035] The PCF 43 determines QoS and policies and provides them to the SMF 42. The PCF 43 applies PCC rules according to the 3GPP (registered trademark) specifications and creates a PCC policy for setting a communication path for the UPF 44A with which the user terminal 5A communicates.

[0036] The UPF 44A is a user plane function that processes packets between the base station 3 and the network NW2 (a data network such as the Internet). The UPF 44A functions as a gateway between the core network 4 and the external network NW2. The UPF 44A records the traffic volume for all user terminals 5A for which it processes traffic. As described above, the number of UPFs 44A and base stations 3 may be any number greater than or equal to one. When a plurality of UPFs 44A and base stations 3 are provided in the core network 4, each UPF 44A may be directly connected to each base station 3, in a so-called full mesh connection. In this embodiment, the UPF 44A transmits packets from the user terminal 5A to the network NW2. The UPF 44A also forwards packets transmitted from the network NW2 to the user terminal 5A. The UPF 44A has an IP address, which allows the UPF 44A to be uniquely identified.

[0037] Referring to FIG. 1B, a traffic anomaly detection device 1 and a traffic control device 2 according to this embodiment are provided independently of a mobile communication network compatible with the 5G communication standard.

[0038] Next, with reference to Fig. 1B, an overview of a system including a traffic anomaly detection device 1 according to a second embodiment of the present invention and a traffic control device 2 will be described. Note that components other than the traffic anomaly detection device 1 and the traffic control device 2 shown in Fig. 1B may be considered to be included in this system, or may be considered to be included in this system.

[0039] The traffic anomaly detection device 1 and traffic control device 2 according to the second embodiment are provided independently of a mobile communication network conforming to the 5G communication standard. The traffic anomaly detection device 1 and traffic control device 2 are connected via a network NW1. The network NW1 may be considered to be composed of one or more networks including a local area network (LAN). The traffic anomaly detection device 1 and traffic control device 2 are connected so that the traffic control device 2 can receive at least an alarm generated by the traffic anomaly detection device 1. Note that in FIG. 1B, the traffic anomaly detection device 1 and the traffic control device 2 are separate devices, but this is not limiting and the traffic anomaly detection device 1 and the traffic control device 2 may be integrated into a single device. Furthermore, the traffic control device 2 is not essential to the second embodiment.

[0040] In the second embodiment, the traffic abnormality detection device 1 and the router 44B are connected via a network NW1. The traffic abnormality detection device 1 and the router 44B are connected so that at least the traffic abnormality detection device 1 can collect traffic volume as described below. The network NW2 can be considered to be composed of one or more networks including a data network such as the Internet. The traffic abnormality detection device 1 and the router 44B may also be directly connected by a wired cable or wirelessly via WiFi or the like, without going through the network NW1.

[0041] In the second embodiment, the traffic control device 2 and the router 44B are connected via a network NW1. The traffic control device 2 and the router 44B are connected at least so that the traffic control device 2 can instruct the router 44B to limit bandwidth. The traffic control device 2 may also function as an operation center that issues arbitrary instructions to the router 44B. The traffic control device 2 and the router 44B may also be directly connected by wired cable or wirelessly via WiFi or the like, without going through the network NW1.

[0042] The user terminal 5B is realized as a mobile communication terminal such as a smartphone, a tablet computer, a laptop computer, or the like. The user terminal 5B and the router 44B are connected via a network NW1. The user terminal 5B and the router 44B may be directly connected via a wired cable or wirelessly via WiFi or the like, without using the network NW1. The user terminal 5B and the router 44B are connected so that at least the user terminal 5B can access the network NW2 via the router 44B. Therefore, the router 44B functions as a gateway between the user terminal 5B and an external network. A terminal IP address that uniquely identifies the terminal is assigned to the user terminal 5B. Although only one user terminal 5B is depicted in FIG. 1B, the number of user terminals 5B is actually multiple.

[0043] [Functional block of traffic anomaly detection device] Next, functional blocks of a traffic anomaly detection device 1 according to a first embodiment and a second embodiment will be described with reference to the block diagrams of FIGS. 1A and 1B. Since the functions of the traffic anomaly detection device 1 (and the traffic control device 2) are basically the same in the first embodiment and the second embodiment, hereinafter, the first embodiment and the second embodiment will be referred to as "this embodiment" without distinction, and FIGS. 1A and 1B will be referred to as "FIG. 1" without distinction. As shown in FIG. 1, the traffic anomaly detection device 1 includes a preparation unit 10, a learning unit 11, a determination unit 12, an alarm unit 13, and a storage unit 15.

[0044] The preparation unit 10 prepares data on the traffic volume in each of a plurality of time intervals to be used by the learning unit 11. The plurality of time intervals may correspond to a plurality of intervals obtained by dividing each period of an observation period including a plurality of periods. Therefore, the preparation unit 10 may prepare data on the traffic volume in each time interval of each period of an observation period including a plurality of periods. It is preferable that the lengths of the time intervals are equal, but this is not a limitation. Furthermore, an example of the length of each time interval is one second, but this is not a limitation.

[0045] The traffic volume in each time interval may be expressed in terms of the number of packets, bytes, or bits, or a value obtained by dividing this by the length of the time interval (for example, bps), but is not limited to these.

[0046] An example of traffic volume in a certain time interval will be described below with reference to FIG. 2. 210 is a graph plotting an example of time variation of traffic volume. In this graph, the vertical axis corresponds to traffic volume [bit] and the horizontal axis corresponds to time [s]. Note that, because traffic volume is generally acquired at discrete time intervals, the actual plot may be stepped; however, FIG. 2 depicts a smooth plot for illustrative purposes. 220 is an axis showing an example of an observation period. As will be described later, there may be multiple observation periods. Each observation period is assigned a number (1st, 2nd, ...) expressed as a natural number so that one observation period can be identified from multiple observation periods. In FIG. 2, a portion of the first observation period is shown. 230 is an axis showing an example of a period included in the observation period. Hereinafter, each period is assigned a number (1st, 2nd, ..., Nth) expressed as a natural number so that one period can be identified from multiple periods in each observation period. In FIG. 2, the entire first period and part of the second period are shown. 240 is an axis showing an example of multiple time intervals obtained by dividing each period. Hereinafter, it is assumed that each time interval is assigned a number (1st, 2nd, ..., Mth) expressed as a natural number so that one time interval can be identified from the multiple time intervals in each period. In FIG. 2, all of the first to Mth time intervals included in the first period (some are omitted with "...") and parts of the first to Mth time intervals included in the second period are shown. Here, the area indicated by 240 corresponds to an example of the traffic volume in the second time interval of the first period of the first observation period.

[0047] The traffic volume in each time interval may be, for example, the U-plane traffic volume or the C-plane traffic volume of the user terminal 5A in each time interval. In this example, the preparation unit 10 may collect the traffic volume in each time interval for each user terminal 5A. According to this example, the traffic volume in each time interval will be obtained for each of the multiple user terminals 5A.

[0048] Alternatively, the traffic volume in each time interval may be, for example, the amount of data that user terminal 5A or 5B (hereinafter referred to indistinguishably as "user terminal 5") transmits to network NW2 in each time interval, the amount of data that user terminal 5 receives from network NW2 in each time interval, or the sum of the amount of data that user terminal 5 transmits to network NW2 and the amount of data that user terminal 5 receives from network NW2 in each time interval. In this example, preparation unit 10 may collect the traffic volume in each time interval for each user terminal 5. According to this example, the traffic volume in each time interval will be obtained for each of multiple user terminals 5.

[0049] Alternatively, the traffic volume in each time interval may be, for example, the total amount of data that UPF 44A or router 44B (hereinafter referred to without distinction as "network device 44") transmits to network NW2 in each time interval, the total amount of data that network device 44 receives from network NW2 in each time interval, or the sum of the total amount of data that network device 44 transmits to network NW2 and the total amount of data that it receives from network NW2 in each time interval.

[0050] Alternatively, the traffic volume in each time interval may be the traffic volume of the entire predetermined network (for example, the network NW2, but is not limited to this) in each time interval.

[0051] The traffic volume in each time interval is not limited to the above examples.

[0052] The traffic volume data for one period of an observation period that includes multiple periods is expressed as the observed value x = (x1, x2, . . . , x M ) where each element x of one observation x m(m=1, 2, . . . , M) is the traffic volume in the m-th time interval of one cycle. An example of the length of one cycle is one minute, but this is not limiting. As described above, the preparation unit 10 may collect the traffic volume in each time interval for each user terminal 5. Therefore, the preparation unit 10 may prepare an observation value x for each user terminal 5.

[0053] The preparation unit 10 uses any method to collect the traffic volume in each time interval of the multiple time intervals. For example, if the network device 44 measures and publishes the traffic volume in each time interval, the preparation unit 10 may simply acquire the traffic volume in each time interval from the network device 44. The preparation unit 10 may also measure the traffic volume in each time interval using any technique. The method by which the preparation unit 10 collects the traffic volume in each time interval is not limited to these.

[0054] The preparation unit 10 collects the observed values ​​x for each period for each observation period to generate a data set D=(x (1) ,x (2) ,···,x (N) ) can be prepared. Here, each element x of a data set D (n) (n=1, 2, . . . , N) is the observation value x of the nth period in one observation period. An example of the length of the observation period is 5 hours, but is not limited to this. If the length of the observation period is 5 hours and the length of the period is 1 minute, N=5 (hours)×60 (minutes) / 1 (minute)=300. One data set D corresponds to the traffic volume in each time interval of each period in one observation period. As described above, the preparation unit 10 may prepare the observation value x for each user terminal 5. Therefore, the preparation unit 10 may prepare a data set D for each user terminal 5.

[0055] The learning unit 11 constructs a multivariate probability model using the traffic volume in each time interval of a plurality of time intervals, and generates from this multivariate probability model a matrix indicating the conditional dependency between any two time intervals in the plurality of time intervals. The learning unit 11 may construct a multivariate normal distribution model with a sample mean of 0 as the multivariate probability model using the traffic volume in each time interval of each period of an observation period including multiple periods, i.e., a dataset D, and generate a precision matrix of the multivariate normal distribution model as a matrix indicating the conditional independence (dependence) between any two time intervals in the plurality of time intervals. In this case, each element x of the observation value x included in the dataset D m are the variables of the multivariate data for the multivariate normal distribution model. As described above, the preparation unit 10 may prepare a dataset D for each user terminal 5. Therefore, the learning unit 11 may construct a multivariate probability model (e.g., a multivariate normal distribution model) for each user terminal 5 using the dataset D prepared for that user terminal 5, and may generate a matrix (e.g., a precision matrix) indicating a conditional dependency between any two time intervals among multiple time intervals from the multivariate probability model constructed for that user terminal 5.

[0056] The learning unit 11 learns the essential dependencies between variables using the traffic volume in each time interval of a plurality of time intervals as a variable. Figures 3(a) and (b) show a directed graph used by the learning unit 11. Each node a, b, and c represents a variable and indicates the traffic volume in each time interval. Each edge represents a direct probability dependency. In the directed graph of Figure 3(a), the value of node c is unobserved. In this case, the joint probability distribution ρ(a, b, c) of variables a, b, and c is expressed by the following equation (1).

number

[0057] By marginalizing the variable c, it can be expressed as the following equation (2).

number

[0058] In the above equation (2), the two variables a and b are not independent, since they cannot generally be expressed as ρ(a)ρ(b). On the other hand, in the directed graph of Figure 3(b), variable c is observed. The joint probability ρ(a, b|c) when variable c is observed is expressed by the following equation (3).

number

[0059] In equation (3) above, when the value of the observed variable c, which is a common condition, is taken into consideration, it can be seen that variables a and b do not affect each other, i.e., they are independent. This is called conditional independence. By taking conditional independence into consideration, it becomes possible to extract the essential or true relationship between variables. For example, even if there appears to be a correlation between the traffic volume between a certain node (time interval) a and another node b (time interval), when the traffic volume at yet another node c (time interval) is also taken into consideration, this corresponds to a case in which the traffic volumes between node a (time interval) and node b (time interval) do not affect each other.

[0060] As mentioned above, the traffic volume in each time interval of one period is expressed as an M-dimensional observation value x = (x1, x2, . . . , x M ) and a data set D consisting of N observations x is expressed as D={x (1) ,x (2) ,···,x (N) In this case, the multivariate normal distribution model is expressed by the following equation (4).

number

[0061] In the above equation (4), μ is the sample mean when the observed value x is used as a sample, Σ is the covariance matrix, and |·| is the determinant. The learning unit 11 performs maximum likelihood estimation to find μ and Σ, which are parameters of the multivariate normal distribution model, from a dataset D of observed data. The log likelihood L(μ,Σ|D) of the dataset D is expressed by the following equation (5).

number

[0062] Substituting the above equation (4) into the above equation (5) gives the following equation (6).

number

[0063] The parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) in the above equation (6) are estimated as the most likely solution. For the most likely solution of the parameters μ and Σ, μ and Σ are respectively -1 Differentiating with and setting it to 0, the maximum likelihood solutions of the parameters μ and Σ are expressed by the following equations (7) and (8), respectively.

number

number

[0064] Inverse matrix Σ of parameters Σ -1 is called the precision matrix Λ. The precision matrix Λ can be obtained by calculating the inverse matrix of the above formula (8). Note that in the maximum likelihood estimation shown in the above formulas (7) and (8), if regularization is not effective and there is a risk of overlearning, the learning unit 11 can also perform estimation by applying maximum a posteriori estimation (MAP estimation) to the parameters μ and Σ.

[0065] Here, the correlation structure in a multivariate normal distribution is expressed by a graph model. Such a graph model is called a Gaussian graphic model. Below, we will explain how to calculate conditional probability when applying a multivariate normal distribution model to graph theory. In the multivariate normal distribution model of the above formula (4), the inverse matrix Σ of the parameter Σ is -1 When the precision matrix Λ is used and the parameter μ is set to 0, it is expressed by the following equation (9).

number

[0066] The ρ(x) in the above equation (9) is called a Gaussian graphic model. Under a multivariate normal distribution, the conditional probability ρ(x1,x2|x3,...,x M ) is expressed by the following equation (10).

number

[0067] The function of variables x1 and x2 in the above equation (10) is ρ(x) in the above equation (9), that is, N(x|0,Λ -1 ), so if we extract all the parts of the above equation (9) related to the variables x1 and x2, we obtain the relationship in the following equation (11).

number

[0068] where the conditional independence ρ(x1|x3, ,x M )ρ(x2|x3, ,x M The condition for satisfying this is given by the following equation (12):

number

[0069] The above equation (12) indicates that the values ​​of the first and second components of the precision matrix Λ are zero, i.e., there is no edge between variables x1 and x2, as in the case of variables a and b in the directed graph of Figure 3. Figures 4A and 4B are schematic diagrams showing the relationship between the correlation between variables on a graph of a Gaussian graphical model and the precision matrix Λ. Each node in Figures 4A and 4B corresponds to a time interval among multiple time intervals.

[0070] Figure 4A shows that there is a correlation between the traffic volume between the second node (time interval) and the ninth node (time interval), and between the third node (time interval) and the thirteenth node (time interval) during a certain observation period. In this case, the precision matrix Λ has at least two 9 components Λ in addition to the diagonal components. 2,9 , and ,3,13 components Λ 3,13In Figures 4A and 4B, non-zero values ​​are represented by "*".

[0071] On the other hand, Figure 4B shows that in the observation period after the above-mentioned certain observation period, the correlation of the traffic volume between the second node (time interval) and the ninth node (time interval) has disappeared, but the correlation of the traffic volume between the third node (time interval) and the thirteenth node (time interval) has been maintained, and furthermore, a new correlation of the traffic volume has appeared between the second node (time interval) and the M-1th node (time interval). At this time, the 2nd and 9th components Λ of the precision matrix Λ 2,9 changes from non-zero to zero, and the 3, 13 component Λ 3,13 maintains non-zero values, and furthermore, 2,M-1 components Λ 2,M-1 will change from a zero value to a non-zero value.

[0072] If the traffic volume between two time intervals is normally uncorrelated, a change in the value of the corresponding element of the precision matrix Λ from zero to non-zero can be considered a traffic anomaly. A subsequent change in the value of the element from non-zero to zero can be considered a resolution of the traffic anomaly. If the traffic volume between two time intervals is normally correlated, a change in the value of the corresponding element of the precision matrix Λ from non-zero to zero can be considered a traffic anomaly. If the value of a specific element of the precision matrix Λ is zero, it means that the two corresponding variables are conditionally independent. Therefore, the precision matrix Λ makes it possible to determine traffic anomalies by looking only at the direct relationship between variables, without being affected by noise or indirect relationships.

[0073] In order to be able to use the above formula (9), the learning unit 11 may construct a multivariate normal distribution model after setting the sample mean μ to 0. Therefore, the learning unit 11 may construct a multivariate normal distribution model after setting the n-th element x (n) (n=1 N) (observation value) m-th element (m=1 M)x m (n) Normalization transformation for (traffic volume at node)

number

number

[0074] Returning to FIG. 1 , the determination unit 12 determines a traffic anomaly based on the value of a component indicative of a conditional independence (dependence) between two of the multiple time intervals in the matrix generated by the learning unit 11. The traffic anomalies determined by the determination unit 12 include anomalies due to attack traffic as well as anomalies due to faults or misconfigurations. The traffic anomalies determined by the determination unit 12 also include burst traffic. As described above, the learning unit 11 may generate, for each user terminal 5, a matrix indicative of a conditional dependence between any two of the multiple time intervals. Therefore, the determination unit 12 may determine a traffic anomaly for each user terminal 5 based on the value of a component indicative of a conditional independence (dependence) between two of the multiple time intervals in the matrix generated for that user terminal 5.

[0075] The following describes a case where the learning unit 11 uses a precision matrix Λ of a multivariate normal distribution model constructed with the sample mean set to 0. Based on the precision matrix Λ generated for a certain observation period and the precision matrix Λ generated for an observation period prior to the certain observation period, the determination unit 12 may determine that the value of a component in the precision matrix Λ indicating a conditional dependency between two time intervals has changed from zero to non-zero (hereinafter referred to as "Case 1"). As described above, a change from zero to non-zero of the value of a component indicating a conditional dependency between two time intervals that are normally uncorrelated can be considered a traffic anomaly. Therefore, the determination unit 12 may determine that a traffic anomaly has occurred when at least one of one or more components in the precision matrix Λ indicating a conditional dependency between two time intervals that are normally uncorrelated corresponds to Case 1. In particular, when burst traffic occurs due to, for example, a DDoS (Distributed Denial of Service), the amount of traffic tends to increase simultaneously over multiple time intervals or multiple cycles, so components that show a conditional dependency between two time intervals that are normally uncorrelated, especially when multiple such components fall into Case 1 (or Case 3, described below), can be said to indicate the possibility of the occurrence of burst traffic. Therefore, by determining that such an event has occurred, it will at least be easier to detect burst traffic.

[0076] The determination unit 12 may determine whether the value of a component in the precision matrix Λ that indicates a conditional dependency between two time intervals has changed from non-zero to zero (hereinafter referred to as "Case 2") based on the precision matrix Λ generated for a certain observation period and the precision matrix Λ generated for an observation period prior to the certain observation period. Normally, a change in the value of a component that indicates a conditional dependency between two correlated time intervals from non-zero to zero can be considered a traffic anomaly. For example, Case 2 includes a case where traffic in two time intervals that previously fluctuated simultaneously no longer fluctuates simultaneously in a subsequent observation period.

[0077] Therefore, the determination unit 12 may determine that a traffic anomaly has occurred when at least one of one or more components in the precision matrix Λ that indicates a conditional dependency between two time intervals that are normally correlated corresponds to Case 2. Furthermore, the determination unit 12 may determine that a traffic anomaly has been resolved when a component that previously corresponded to Case 1 (or Case 3, which will be described later) now corresponds to Case 2.

[0078] The determination unit 12 may perform the determination after setting a threshold value, taking into consideration that component values ​​in the precision matrix Λ that are essentially zero may take on slightly non-zero values ​​due to noise, sampling error, etc. Therefore, the determination unit 12 may determine that the value of a component in the precision matrix Λ that indicates a conditional dependency between two time intervals exceeds a threshold value (hereinafter referred to as "Case 3"), based on the precision matrix Λ generated for a certain observation period and the precision matrix Λ generated for an observation period prior to the certain observation period. The determination unit 12 may determine that a traffic anomaly has occurred when at least one of one or more components in the precision matrix Λ that indicates a conditional dependency between two time intervals that are normally uncorrelated corresponds to Case 3.

[0079] The threshold may be a predetermined threshold (fixed value) or a value that depends on the value of a past component. An example of a threshold that depends on the value of a past component is a value obtained by multiplying the value of a component in the precision matrix Λ generated by the learning unit 11 for an observation period prior to a certain observation period by a predetermined value. In other words, when the component in the precision matrix Λ generated by the learning unit 11 for a certain observation period is multiplied by Λ, i,j current , the components in the precision matrix Λ generated by the learning unit 11 for an observation period prior to a certain observation period are denoted by Λ i,j old Then, the decision unit 12 determines Λ i,j current / Λ i,j old >T (T is a predetermined value).

[0080] Therefore, the determination unit 12 may determine at least one of Cases 1 to 3 based on the precision matrix Λ generated for a certain observation period and the precision matrix Λ generated for an observation period prior to the certain observation period. As described above, the learning unit 11 may generate a precision matrix for each user terminal 5. Therefore, the determination unit 12 may determine at least one of Cases 1 to 3 for each user terminal 5 based on the precision matrix Λ generated for the user terminal 5 for a certain observation period and the precision matrix Λ generated for the user terminal 5 for an observation period prior to the certain observation period.

[0081] The warning unit 13 generates an alarm based on the determination of a traffic abnormality by the determination unit 12. The warning unit 13 may generate an alarm when the determination unit 12 determines a traffic abnormality. As described above, the determination unit 12 may determine a traffic abnormality for each user terminal 5. Therefore, the warning unit 13 may generate an alarm when it determines a traffic abnormality for at least one of multiple user terminals 5. In this case, the alarm may include information identifying the user terminal 5 for which a traffic abnormality has been determined. Examples of such information include, but are not limited to, the IMSI and IP address of the user terminal 5.

[0082] As described above, the determination unit 12 determines whether a traffic abnormality exists, by determining which of Cases 1 to 3 the traffic abnormality exists. The warning unit 13 may generate an alarm when one or more elements of the precision matrix Λ correspond to any of Cases 1 to 3, rather than when the determination unit 12 determines whether a traffic abnormality exists. The alarm may include information indicating which of Cases 1 to 3 the traffic abnormality exists. As described above, the learning unit 11 may generate a precision matrix for each user terminal 5. Therefore, the determination unit 12 may generate an alarm when one or more elements of the precision matrix Λ generated for at least one of the multiple user terminals 5 correspond to any of Cases 1 to 3.

[0083] As time passes, the preparation unit 10 sequentially generates a dataset D for a different observation period, the learning unit 11 sequentially generates a precision matrix Λ using the different datasets D, and the determination unit 12 sequentially determines traffic anomalies in the different precision matrices Λ. Therefore, the warning unit 13 may generate an alarm when a component corresponding to any of Cases 1 to 3 is found multiple times in succession in the sequentially determined precision matrix Λ. For example, the warning unit 13 may generate an alarm when a component corresponding to Case 3 is found 10 times in succession in the sequentially determined precision matrix Λ.

[0084] The storage unit 15 may store parameters of the multivariate probability model constructed by the learning unit 11 (e.g., parameters μ, Σ of a multivariate normal distribution model) and a matrix generated by the learning unit 11 (e.g., precision matrix Λ). As described above, the learning unit 11 may construct a multivariate probability model (e.g., multivariate normal distribution model) for each user terminal 5 and generate a matrix (e.g., precision matrix Λ) indicating a conditional dependency between any two time intervals among multiple time intervals. Therefore, the storage unit 15 may store, for each user terminal 5, parameters of the multivariate probability model constructed for the user terminal 5 (e.g., parameters μ, Σ of a multivariate normal distribution model) and the generated matrix (e.g., precision matrix Λ). Furthermore, the learning unit 11 may store the results of the determination made by the determination unit 12 for Cases 1 to 3. As described above, the determination unit 12 may make determinations for Cases 1 to 3 for each user terminal 5. Therefore, the storage unit 15 can store the determination results for Cases 1 to 3 for each user terminal 5. The information stored in the storage unit 15 is not limited to these.

[0085] [Traffic control device functions] Next, the function of the traffic control device 2 according to this embodiment will be described. The traffic control device 2 receives an alarm issued by the alarm unit 13 of the traffic abnormality detection device 1, and based on the received alarm, can instruct bandwidth limitation for communications by a user terminal determined to have a traffic abnormality. As described above, the alarm can include information identifying the user terminal determined to have a traffic abnormality. Note that any method can be used to instruct bandwidth limitation.

[0086] As described above, the alarm can include information indicating which of Cases 1 to 3 has occurred. Therefore, the traffic control device 2 may issue a command to limit the bandwidth when any of Cases 1 to 3 has occurred. For example, the traffic control device 2 may issue a command to limit the bandwidth when Case 3 has occurred.

[0087] Since traffic abnormalities may occur unintentionally due to a malfunction of a user terminal or the like, it may be unreasonable to go as far as limiting the bandwidth. Therefore, for traffic abnormalities determined by this embodiment, it is possible to limit the bandwidth to issuing an alarm and not limit the bandwidth.

[0088] [Hardware configuration of traffic anomaly detection device and traffic control device] Next, an example of a hardware configuration for realizing the traffic anomaly detection device 1 and the traffic control device 2 having the above-described functions will be described with reference to FIG.

[0089] 5, traffic anomaly detection device 1 can be realized by, for example, a computer including a processor 102, a main memory device 103, a communication interface 104, an auxiliary memory device 105, and an input / output (I / O) device 106, all connected via a bus 101, and a program for controlling these hardware resources. Furthermore, traffic anomaly detection device 1 includes a display device 107.

[0090] The processor 102 is realized by a CPU, a GPU, an FPGA, an ASIC, or the like.

[0091] The main memory device 103 pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory device 103 implement the functions of the traffic anomaly detection device 1, such as the preparation unit 10, learning unit 11, determination unit 12, and alarm unit 13 shown in FIG.

[0092] The communication interface 104 is an interface circuit for connecting the traffic anomaly detection device 1 to various external electronic devices via a network. The communication interface 104 realizes at least a part of the configuration of the preparation unit 10 and the alarm unit 13.

[0093] The auxiliary storage device 105 is composed of a readable / writable storage medium and a drive for reading and writing various information such as programs and data from and to the storage medium. The auxiliary storage device 105 can use a semiconductor memory such as a hard disk or flash memory as the storage medium.

[0094] The auxiliary storage device 105 has a program storage area for storing a traffic anomaly detection program. The auxiliary storage device 105 also has a program storage area for storing a learning program that estimates parameters using a multivariate normal distribution model executed by the traffic anomaly detection device 1 and generates a precision matrix. The auxiliary storage device 105 realizes the storage unit 15 described in FIG. 1. Furthermore, the auxiliary storage device 105 may have, for example, a backup area for backing up the data and programs described above.

[0095] The input / output I / O 106 is an input / output device that inputs signals from external devices and outputs signals to external devices.

[0096] The display device 107 is configured by an organic EL display, a liquid crystal display, etc. The display device 107 can display on the screen information such as the fact that an abnormality has been determined.

[0097] The traffic control device 2 may also have the same hardware configuration as the traffic anomaly detection device 1. That is, the processor 102 and main memory device 103 of the traffic control device 2 realize the above-mentioned functions of the traffic control device 2. Furthermore, the communication interface 104 of the traffic control device 2 realizes at least a part of the configuration of the above-mentioned functions. The auxiliary memory device 105 of the traffic control device 2 has a program storage area for storing a control program for instructing the network device 44 to impose a bandwidth restriction. The display device 107 of the traffic control device 2 can display the status of the bandwidth restriction of the network device 44 on a screen.

[0098] [System Operation] Next, the operation of a system including the traffic anomaly detection device 1 and traffic control device 2 having the above-described configuration will be described with reference to the sequence in Fig. 6. Note that Fig. 6 shows a sequence for one operation that is repeated in this system. Therefore, it should be noted that steps S1 to S10, which will be described later, are repeatedly executed multiple times.

[0099] 6, first, the preparation unit 10 of the traffic abnormality detection device 1 collects the traffic volume in each of the multiple time intervals (step S1). In step S1, the preparation unit 10 may collect the traffic volume in each of the multiple time intervals for each of the multiple user terminals 5.

[0100] Next, the preparation unit 10 prepares data on the traffic volume in each time interval from the traffic volume in each time interval collected in step S1 (step S2). In step S2, the preparation unit 10 may prepare data on the traffic volume in each time interval for each user terminal 5 from the traffic volume in each time interval collected for that user terminal 5 in step S1. In step S2, the preparation unit 10 may prepare one data set D of observed values ​​x from the traffic volume in each time interval of each cycle of one observation period. That is, the preparation unit 10 prepares data on the M-dimensional observed values ​​x=(x1, x2, . . . , x M) based on the data set D={x (1) ,x (2) ,···,x (N) In step S2, the preparation unit 10 may prepare, for each user terminal 5, one data set D of observation values ​​x from the traffic volume collected for that user terminal 5 in each time interval of each cycle of one observation period.

[0101] Next, the learning unit 11 constructs a multivariate probability model using the traffic volume in each time interval (step S3). In step S3, the multivariate probability model may be a multivariate normal distribution model. That is, the learning unit 11 may estimate, by maximum likelihood estimation, the maximum likelihood solution of parameters μ and Σ of the multivariate normal distribution model for a dataset D, which is multivariate data with the traffic volume in each time interval as a variable. In step S3, the learning unit 11 may use the above equation (6) to estimate the parameters μ and Σ that maximize the log likelihood L(μ,Σ|D) as the maximum likelihood solution (the above equations (7) and (8)).

[0102] In step S3, the maximum likelihood solution for the parameters of the multivariate normal distribution model may be estimated twice. That is, using the maximum likelihood solution for the parameters μ and Σ estimated for the original data set D so that the sample mean μ when each observed value x is a sample is 0, standardization transformation may be performed on the data set D using the above equation (13), and the maximum likelihood solution for the parameters μ and Σ may be estimated again for the data set D after standardization transformation. However, since the maximum likelihood solution for the parameter μ estimated the second time should be 0, the second estimation of the parameter μ may be omitted. Therefore, in step S3, the learning unit 11 may construct a multivariate normal distribution model with a sample mean of 0 as a multivariate probability model using the traffic volume in each time interval of each period of an observation period including multiple periods, i.e., the data set D.

[0103] In addition, in the maximum likelihood estimation shown in the above equations (7) and (8), if there is a risk that regularization is not effective and overlearning may occur, in step S3, the learning unit 11 can also perform estimation by applying maximum a posteriori estimation (MAP estimation) to the parameters μ and Σ.

[0104] In step S3, the learning unit 11 may construct, for each user terminal 5, a multivariate probability model (for example, a multivariate normal distribution model) using the traffic volume collected for that user terminal 5 in each time interval.

[0105] Next, the learning unit 11 generates a matrix representing a conditional dependency between any two time intervals among the plurality of time intervals from the constructed multivariate probability model (step S4). In step S4, the learning unit 11 may generate, for each user terminal 5, a matrix representing a conditional dependency between any two time intervals among the plurality of time intervals from the multivariate probability model constructed for that user terminal 5. In step S4, the learning unit 11 may generate a precision matrix Λ of the multivariate normal distribution model as a matrix indicating conditional independence between any two time intervals among the plurality of time intervals. In this case, in step S4, the learning unit 11 generates an inverse matrix Σ of the parameters Σ estimated in step S3. -1 In step S4, the learning unit 11 may generate, for each user terminal 5, a precision matrix Λ from the multivariate normal distribution model constructed for that user terminal 5. The learning unit 11 may store the generated precision matrix Λ in the storage unit 15. The learning unit 11 may store, for each user terminal 5, the precision matrix Λ generated for that user terminal 5 in the storage unit 15.

[0106] Next, the determination unit 12 determines whether there is a traffic abnormality based on the values ​​of components indicating the conditional dependency between two time intervals in the matrix generated in step S4 (step S5). In step S5, the determination unit 12 may determine whether there is a traffic abnormality for each user terminal 5 based on the values ​​of components indicating the conditional dependency between two time intervals in the matrix generated for that user terminal 5. In step S5, the determination unit 12 may determine whether there is a traffic abnormality for at least one of cases 1 to 3 described above based on the precision matrix generated in the most recently executed step S4 and the precision matrix generated in the step S4 executed immediately before the most recently executed step S4. The determination unit 12 may acquire the precision matrix Λ used in step S5 from the storage unit 15. Furthermore, the determination unit 12 may determine whether there is a traffic abnormality after step S4 has been executed a predetermined number of times, rather than every time step S4 is executed. Therefore, the determination unit 12 may determine one of Cases 1 to 3 based on the precision matrix generated for a certain observation period (for example, the precision matrix generated in the previously executed step S4) and the precision matrix generated for an observation period prior to the certain observation period (for example, the precision matrix generated in the step S4 executed immediately before the previously executed step S4). In step S5, the determination unit 12 may determine one of Cases 1 to 3 for each user terminal 5 based on the precision matrix generated for the user terminal 5 for a certain observation period and the precision matrix generated for the user terminal 5 for an observation period prior to the certain observation period.

[0107] In step S5, as described above, the determination unit 12 may determine the possibility of burst traffic occurrence based on the number of components that fall under case 1 or case 3. In step S5, the determination unit 12 may determine the possibility of burst traffic occurrence for each user terminal 5 based on the number of components that fall under case 1 or case 3.

[0108] Next, the warning unit 13 determines whether to issue an alarm based on the determination of the traffic abnormality by the determination unit 12 (step S6). In step S6, the warning unit 13 may determine that an alarm should be issued when the determination unit 12 determines that a traffic abnormality has occurred. In step S6, the warning unit 13 may determine that an alarm should be issued when the determination unit 12 determines that a traffic abnormality has occurred for at least one of the multiple user terminals 5. Alternatively, in step S6, the warning unit 13 may determine that an alarm should be issued when one or more elements of the precision matrix Λ fall under any of cases 1 to 3. In step S6, the warning unit 13 may determine that an alarm should be issued when one or more elements of the precision matrix Λ generated for at least one of the multiple user terminals 5 fall under any of cases 1 to 3. Alternatively, in step S6, the warning unit 13 may determine that an alarm should be issued when the precision matrix Λ, which is determined sequentially, contains a component that corresponds to any one of Cases 1 to 3 multiple times in succession. If it is determined in step S6 that an alarm should be issued (step S6: YES), the process proceeds to step S7; if not (step S6: NO), the sequence ends and the process proceeds to step S1 in the next sequence (not shown).

[0109] If it is determined that an alarm should be issued (step S6: YES), the warning unit 13 issues an alarm (step S7). That is, in step S7, the warning unit 13 issues an alarm based on the determination of a traffic abnormality made by the determination unit 12. The alarm may be received by at least the traffic control device 2. As described above, the alarm may include information indicating which of Cases 1 to 3 has occurred. Furthermore, if the determination of a traffic abnormality is made for each user terminal 5, the alarm may include information identifying the user terminal 5 that has been determined to have a traffic abnormality.

[0110] Thereafter, the traffic control device 2 that has received the alarm determines whether or not to impose a bandwidth restriction based on the received alarm (step S8). In step S8, the traffic control device 2 may refer to the received alarm and determine that a bandwidth restriction is necessary if any of cases 1 to 3 applies. If it is determined that a bandwidth restriction is necessary in step S8 (step S8: YES), the process proceeds to step S9; if not (step S8: NO), the sequence ends and the process proceeds to step S1 in the next sequence (not shown).

[0111] If the traffic control device 2 determines that bandwidth should be limited (step S8: YES), it instructs the network device 44 to limit the bandwidth of the communication by the user terminal determined to have a traffic abnormality (step S9). That is, in step S9, the traffic control device 2 instructs the network device 44 to limit the bandwidth of the communication by the user terminal determined to have a traffic abnormality based on the received alarm.

[0112] Thereafter, the network device 44 that has received the instruction executes the bandwidth restriction (step S10).

[0113] As described above, since it may be unreasonable to go so far as to limit the bandwidth, steps S8 to S10 may be omitted. Furthermore, steps S8 to S10 are based on the premise that a traffic abnormality determination is performed for each user terminal 5. As described above, the traffic volume in each time interval may be the total amount of data transmitted by the network device 44 to the network NW2 in each time interval, the total amount of data received by the network device 44 from the network NW2 in each time interval, the sum of the total amount of data transmitted by the network device 44 to the network NW2 and the total amount of data received by the network device 44 from the network NW2 in each time interval, or the traffic volume of the entire predetermined network in each time interval. Note that, when using such traffic volume in each time interval, steps S1 to S7 can be performed, but steps S8 to S10 are omitted because a "user terminal 5 determined to have a traffic abnormality" cannot be conceived.

[0114] As described above, the traffic anomaly detection device 1 according to this embodiment focuses on the fact that when a traffic anomaly, such as burst traffic, occurs, increases and decreases in traffic volume are observed over multiple time intervals or multiple cycles. Then, a multivariate model is constructed from the traffic volume in each time interval, and a matrix representing the conditional dependency between time intervals for the traffic volume, such as a precision matrix Λ, is calculated to determine correlation anomalies between time intervals, and traffic anomalies are detected based on the results. This makes it possible to more reliably detect traffic anomalies, including the possibility of burst traffic.

[0115] Furthermore, the traffic abnormality detection device 1 according to this embodiment determines a traffic abnormality based on the traffic volume in each time interval and generates an alarm, thereby making it possible to notify the user of a traffic abnormality more quickly.

[0116] Furthermore, a system including the traffic abnormality detection device 1 and traffic control device 2 according to this embodiment can determine a traffic abnormality for each user terminal 5 based on the traffic volume in each time interval, and can instruct the network device 44 to impose a bandwidth restriction on communications by a user terminal determined to have a traffic abnormality. This makes it possible to take measures against traffic abnormalities more effectively.

[0117] The traffic abnormality detection device 1 according to this embodiment can also be configured to collect traffic volume across the entire communication network and determine traffic abnormalities occurring across the entire communication network. In this case, the preparation unit 10 collects traffic volume across the entire communication network for each of a plurality of time intervals. Furthermore, when the determination unit 12 determines a traffic abnormality, the alarm unit 13 issues an alarm indicating that a communication abnormality has occurred in the communication network. For example, the alarm unit 13 can notify an external management and monitoring system, such as the traffic control device 2, of the alarm. Therefore, the traffic abnormality detection device 1 according to this embodiment can more effectively determine traffic abnormalities across the entire communication network than traffic abnormalities for individual user terminals 5.

[0118] In the embodiment described above, the learning unit 11 employs a Gaussian graphic model to analyze conditional independence through a precision matrix, which is the inverse matrix of the covariance matrix. However, the algorithm employed by the learning unit 11 is not limited to the Gaussian graphic model. For example, in sparse estimation such as Graphical Lasso, it can be employed in combination with Maximum A Posteriori Estimation (MAP). Alternatively, Bayesian network structure learning can be employed.

[0119] The above describes embodiments of the traffic anomaly detection device and traffic anomaly detection method of the present invention. However, the present invention is not limited to the described embodiments, and various modifications that can be imagined by those skilled in the art can be made within the scope of the invention described in the claims. [Explanation of symbols]

[0120] 1...traffic anomaly detection device, 2...traffic control device, 3...base station, 10...preparation unit, 11...learning unit, 12...judgment unit, 13...alarm unit, 15...memory unit, 101...bus, 102...processor, 103...main memory device, 104...communication interface, 105...auxiliary memory device, 106...input / output I / O, 107...display device, 4...core network, 40...AMF, 41...UDM / UDR, 42...SMF, 43...PCF, 44A...UPF, 44B...router, 5A, 5B...user terminal, NW1, NW2...network, 210...graph plotting exemplary time fluctuations in traffic volume, 220...axis showing an example of an observation period, 230...axis showing an example of a period, 240...axis showing an example of a time interval.

Claims

1. a learning unit configured to construct a multivariate probabilistic model using traffic volume in each of a plurality of time intervals, and to generate, from the multivariate probabilistic model, a matrix representing a conditional dependency between any two of the plurality of time intervals; a determination unit configured to determine a traffic anomaly based on a value of an element in the matrix generated by the learning unit that indicates the conditional dependency between two time intervals; and A traffic anomaly detection device comprising:

2. 2. The traffic anomaly detection device according to claim 1, the plurality of time intervals correspond to a plurality of time intervals obtained by dividing each period of an observation period including a plurality of periods; The learning unit is further configured to construct, as the multivariate probability model, a multivariate normal distribution model with a sample mean set to 0, using the traffic volume in each time interval of each period of the observation period, and to generate, as the matrix, a precision matrix of the multivariate normal distribution model. A traffic anomaly detection device comprising:

3. 3. The traffic anomaly detection device according to claim 2, The determination unit determines, based on the precision matrix generated for a certain observation period and the precision matrix generated for an observation period prior to the certain observation period, the value of the component indicating the conditional dependency between two time intervals changes from 0 to a non-zero value; The value of the component indicating the conditional dependency between two time intervals changes from non-zero to zero; and the value of the component indicating the conditional dependency between two time intervals exceeds a threshold; and and further configured to determine at least one of A traffic anomaly detection device comprising:

4. 2. The traffic anomaly detection device according to claim 1, The system further includes an alarm unit configured to generate an alarm based on the determination of the traffic abnormality by the determination unit. A traffic anomaly detection device comprising:

5. 5. The traffic anomaly detection device according to claim 4, the traffic volume in each of the plurality of time periods is acquired for each of a plurality of user terminals; the learning unit is further configured to construct, for each user terminal, the multivariate probabilistic model using traffic volumes acquired for the user terminal in each of a plurality of time intervals, and to generate, from the multivariate probabilistic model constructed for the user terminal, a matrix representing a conditional dependency between any two of the plurality of time intervals; the determination unit is further configured to determine, for each user terminal, a traffic anomaly based on a value of an element indicative of the conditional dependency between two time intervals in the matrix generated for the user terminal by the learning unit; the alarm unit is further configured to generate an alarm when a traffic abnormality is determined to have occurred in at least one of the plurality of user terminals; The alarm includes information identifying a user terminal for which a traffic abnormality has been determined. A traffic anomaly detection device comprising:

6. The traffic anomaly detection device according to claim 5; A traffic control device A system comprising: The traffic control device is configured to instruct a network device that functions as a gateway for the user terminal determined to have a traffic abnormality to limit bandwidth for communication by the user terminal determined to have a traffic abnormality, based on the received alarm. A system characterized by:

7. a learning step of constructing a multivariate probability model using traffic volume in each of a plurality of time intervals, and generating, from the multivariate probability model, a matrix indicating a conditional dependency between any two of the plurality of time intervals; a determining step of determining whether there is a traffic anomaly based on values ​​of components in the matrix generated in the learning step that indicate the conditional dependency between two time intervals; A traffic anomaly detection method comprising:

8. The traffic anomaly detection method according to claim 7, The learning step includes a step of constructing a multivariate normal distribution model with a sample mean of 0 as the multivariate probability model using traffic volume in each time interval of each period of an observation period including a plurality of periods, and generating a precision matrix of the multivariate normal distribution model as the matrix. A traffic anomaly detection method comprising:

9. 9. The traffic anomaly detection method according to claim 8, The determining step is based on the precision matrix generated for a certain observation period and the precision matrix generated for an observation period prior to the certain observation period, the value of the component indicating the conditional dependency between two time intervals changes from 0 to a non-zero value; The value of the component indicating the conditional dependency between two time intervals changes from non-zero to zero; and the value of the component indicating the conditional dependency between two time intervals exceeds a threshold; and determining at least one of A traffic anomaly detection method comprising:

10. The traffic anomaly detection method according to claim 7, Further, the method includes an alarm step of generating an alarm based on the determination of the traffic abnormality in the determination step. A traffic anomaly detection method comprising:

11. The traffic anomaly detection method according to claim 10, the traffic volume in each of the plurality of time periods is acquired for each of a plurality of user terminals; the learning step includes a step of constructing, for each user terminal, the multivariate probabilistic model using traffic volumes acquired for the user terminal in each of a plurality of time intervals, and generating, from the multivariate probabilistic model constructed for the user terminal, a matrix representing a conditional dependency between any two of the plurality of time intervals; the determining step includes a step of determining, for each user terminal, a traffic anomaly based on a value of an element indicative of the conditional dependency between two time intervals in the matrix generated for the user terminal in the learning step; the warning step includes a step of generating an alarm when a traffic abnormality is determined to have occurred in at least one of the plurality of user terminals; The alarm includes information identifying a user terminal for which a traffic abnormality has been determined. A traffic anomaly detection method comprising:

12. The traffic anomaly detection method according to claim 11, The traffic anomaly detection method further includes a step of instructing a network device that functions as a gateway for the user terminal determined to have a traffic anomaly, based on the alarm, to limit bandwidth for communication by the user terminal determined to have a traffic anomaly. A traffic anomaly detection method comprising:

Images