Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

To provide an abnormality detection device that can properly detect abnormal communication in an IoT network composed of a wide variety of IoT devices.SOLUTION: An abnormal communication detection device 1 includes: a graph generation unit 11 that extracts host pairs from communication data and generates a graph in which communication between the host pairs is regarded as a node and information on the communication is stored in an attribute of the node; a feature extraction unit 12 that, starting from a node related to a specified host pair, after extracting a subgraph from the graph, extracts a feature vector related to the host pair from the subgraph; a learning unit 13 that generates a learned model capable of detecting abnormal communication for each set using a set of feature vectors related to the same or mutually similar host pairs; and an abnormality determination unit 14 that performs abnormality determination using the learned model generated from the feature vectors related to the same or mutually similar host pairs for a feature vector related to a host pair to be determined.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an abnormality detection device, an abnormality detection method, and an abnormality detection program for detecting abnormal communication between hosts.

Background Art

[0002] In recent years, due to the evolution of communication technologies represented by 5G, as well as semiconductor and sensing technologies, the number of IoT devices has been on the rise. With a wide variety of devices connected to the Internet, new value creation through cooperation with the cloud and mutual communication between devices is expected. IoT devices are not limited to devices within a home such as home appliances and home cameras. For example, in addition to sensors within a factory, they are also used in infrastructure services such as street cameras and public routers. Under these circumstances, the demand for security technologies targeting IoT devices has been increasing.

[0003] As an example of a cyber-attack targeting IoT devices, a DDoS attack by malware can be cited, and there have also been cases where a large amount of communication by a large number of IoT devices infected with malware and botnetized has led to service disruption. Since IoT devices are not uniformly designed and can be easily used by general users without specialized knowledge, it is difficult to implement security measures for all devices. In addition, security guidelines to be observed when introducing IoT devices may not be sufficiently established or thoroughly implemented, resulting in situations such as starting operations with initial account information or insufficient management. As a result, there have also been cases where operations continued without noticing infection by malware for a long time, leading to the spread of malware infection. Due to such circumstances, IoT devices have been vulnerable to cyber-attacks. Furthermore, there are an enormous number of IoT devices, and it was unrealistic to operate and monitor all of them manually.

[0004] Therefore, automated detection of cyberattacks (abnormal communication detection) using machine learning is being implemented (see, for example, Non-Patent Documents 1-3). In recent years, research and development of abnormal communication detection using deep learning technology has been actively pursued, making a significant contribution to performance improvement. In particular, since the communication of IoT devices can be considered as a graph structure, it is well compatible with graph neural networks (GNNs), and many results have been reported.

[0005] For example, Non-Patent Documents 5 and 6 and Patent Document 1 propose an abnormal communication detection method that converts packet data or flow data of communication between multiple hosts into a graph structure and determines whether or not it is abnormal using a pre-trained model. Specifically, in the methods described in Non-Patent Documents 5 and 6, the host identifiers of the communication source and destination are treated as nodes in the graph structure, and a graph is constructed in which communication information between hosts is stored at the edges. However, since the methods for processing edge information with GNNs are limited, an E-Graph transformation is performed to swap edges and nodes, thereby constructing a graph in which communication information is stored at the nodes. Furthermore, by applying k-hop node sampling as shown in Non-Patent Document 4, small subgraphs are generated, and the large graph is processed. In addition, in the method described in Patent Document 1, E-Graph transformation is not performed, and local features obtained from subgraphs generated by k-hop node sampling are combined with global features obtained from the entire graph. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2019-149681 [Non-patent literature]

[0007] [Non-Patent Document 1] Alireza Souri and Rahil Hosseini. A state-of-the-art sur-vey of malware detection approaches using data mining techniques. Human-centric Computing and Information Sciences, 8(1):1-22, 2018.

Outdoor Tool2

Outdoor Tools3

Outdoor Tools 4

Direct Environment 5

Outdoor Configuration 6

Direct Environment 7

Outdoor Tools 8

Outdoor Tools9

[0008] However, conventional abnormal communication detection methods using graph structures treat all communications the same, assuming that the communication characteristics do not differ significantly from device to device. In other words, they targeted communications between identical or similar devices, such as smartphones or personal computers.

[0009] On the other hand, communication in an IoT network, which is composed of a wide variety of IoT devices, has different communication characteristics for each device. Therefore, it is necessary to consider both the variation in characteristics due to abnormal communication and the variation in characteristics due to differences in devices, making it impossible to simply apply conventional methods.

[0010] The present invention aims to provide an anomaly detection device that can appropriately detect abnormal communications in an IoT network composed of a wide variety of IoT devices. [Means for solving the problem]

[0011] The abnormal communication detection device according to the present invention extracts a host pair composed of a combination of a communication source host and a communication destination host from communication data, and generates a graph in which information on the communication between the host pairs is stored in the attributes of the nodes as nodes. A graph generation unit, starting from the nodes related to the specified host pair, extracting a subgraph from the graph, and then extracting a feature vector related to the host pair from the subgraph; a feature extraction unit; using a set of feature vectors related to the same or mutually similar host pairs, a learning unit that generates a learned model capable of detecting abnormal communication for each set; and an abnormal determination unit that performs an abnormal determination using the learned model generated from the feature vectors related to the host pairs that are the same or mutually similar to the host pair for the feature vector related to the host pair to be determined.

[0012] The learning unit may use, as the same or mutually similar host pairs, host pairs in which at least a part of the device information is similar to the specified host pair.

[0013] The learning unit may use, as the same or mutually similar host pairs, only when the versions of a predetermined software among the device information match.

[0014] The learning unit may determine, as the same or mutually similar host pairs, host pairs from which feature vectors within a predetermined distance are extracted for the feature vector related to the specified host pair.

[0015] The learning unit may determine, as the same or mutually similar host pairs, the host pairs belonging to each cluster by clustering a plurality of host pairs based on the distance between feature vectors.

[0016] The learning unit may determine, as the same or mutually similar host pairs, host pairs in which at least a part of the attributes of the nodes are similar.

[0017] The learning unit may generate a learned model for another set of feature vectors by replicating at least some parameters of the learned model.

[0018] The graph generation unit may generate the graph such that the same host pair appears only once.

[0019] When communication information from a first host to a second host via an intermediate host is obtained from the communication data, the graph generation unit may extract a combination of the first host and the second host as a host pair.

[0020] The abnormal communication detection method according to the present invention includes a graph generation step of extracting a host pair composed of a combination of a source host and a destination host from communication data, and generating a graph in which communication information between the host pairs is stored as an attribute of a node with the communication as a node; a feature extraction step of extracting a subgraph from the graph starting from a node related to a specified host pair, and then extracting a feature vector related to the host pair from the subgraph; a learning step of generating a learned model capable of detecting abnormal communication for each set using a set of feature vectors related to the same or similar host pairs; and an abnormal determination step of performing an abnormal determination on a feature vector related to a host pair to be determined using the learned model generated from feature vectors related to the same or similar host pairs as the host pair, which is executed by a computer.

[0021] The abnormal communication detection program according to the present invention is for causing a computer to function as the abnormal communication detection device.

Effects of the Invention

[0022] According to the present invention, abnormal communication can be appropriately detected in an IoT network composed of various IoT devices.

Brief Description of the Drawings

[0023] [Figure 1] This is a block diagram showing the functional configuration of an abnormal communication detection device in an embodiment. [Figure 2] This figure illustrates a temporary graph constructed in the embodiment. [Figure 3] This figure illustrates a graph generated in the embodiment. [Figure 4] This figure shows an image of feature vector extraction in the embodiment. [Figure 5] This figure illustrates an example of an abnormal communication detection method in an embodiment compared to a conventional method. [Figure 6] This figure illustrates communication via an intermediate host in an embodiment. [Modes for carrying out the invention]

[0024] An example of an embodiment of the present invention will be described below. The abnormal communication detection device of this embodiment aims to automatically detect abnormal communications caused by cyberattacks or malware infections, and detects abnormalities in communications taking place in an IoT network composed of a wide variety of IoT devices by comparing graph networks generated from host-to-host communications between identical or similar host pairs. The communication envisioned in this embodiment is a communication in which the source host and destination host can be configured, and targets communication data such as packet data or flow data obtained from multiple IoT devices.

[0025] Figure 1 is a block diagram showing the functional configuration of the abnormal communication detection device 1 in this embodiment. The abnormal communication detection device 1 is an information processing device that includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

[0026] The control unit 10 is the part that controls the entire abnormal communication detection device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU. Specifically, the control unit 10 comprises a graph generation unit 11, a feature extraction unit 12, a learning unit 13, and an anomaly detection unit 14.

[0027] The storage unit 20 is a storage area for various programs and data that cause the hardware group to function as an abnormal communication detection device 1, and may be ROM, RAM, flash memory, or a hard disk drive (HDD). Specifically, the storage unit 20 stores a program (abnormal communication detection program) that causes the control unit 10 to execute each function of this embodiment, and also stores received flow data, graph data, machine learning models, various parameters, etc., as processing targets.

[0028] The graph generation unit 11 extracts host pairs from the communication data, each consisting of a combination of the host identifier of the communication source and the host identifier of the communication destination. It then generates a graph in which the communication between these host pairs is treated as a node, and the communication information is stored in the attributes of the nodes.

[0029] Generally, communication data (packet data or flow data) contains information such as the IP addresses and port numbers of the source and destination, and the communication protocol. The graph generation unit 11 extracts this information as a combination of source host and destination host (host pair). Here, we can consider each host as a node and construct a temporary graph by connecting host pairs at edges. Generally, instead of constructing a graph from a single host pair, the graph is constructed from a set of multiple host pairs, as follows:

[0030] Figure 2 illustrates a temporary graph constructed in this embodiment. For example, if communication data is acquired from host 1 to hosts a-c, from host 2 to hosts b-c, and from host 3 to hosts b-c, then multiple source hosts (S) and multiple destination hosts (D) exist as nodes, and each host pair is connected at the edge.

[0031] In this temporary graph, edges represent communications, so it's conceivable to store communication information at the edges. However, in general graph structures, attribute information is often stored at the nodes rather than at the edges. Therefore, GNNs almost always assume that attribute information is stored at the nodes. To address this, the graph generation unit 11 treats temporary graph edges as nodes and performs an E-Graph transformation that treats nodes as edges. In other words, it becomes possible to treat communication between host pairs as nodes and store communication information as attribute information of the nodes.

[0032] Figure 3 is an example of a graph generated in this embodiment. In a graph (Figure 2) where hosts are temporarily constructed as nodes, the communications between host pairs represented by edges (1a), (1b), (1c), (2b), (2c), (3b), and (3c) are each converted into nodes. This generates a graph in which communication between each host pair is connected at the edge.

[0033] In this embodiment, communication data from the same host pair may be extracted multiple times. In such cases, it is not possible to store the Nth communication and the N+1th communication in the same graph, so multiple different graphs must be constructed. In this case, the graph generation unit 11 may, for example, rewrite only the attribute information of the node corresponding to the host pair in question to make it a different node so that the same host pair appears only once. Alternatively, the graph generation unit 11 may acquire the communication data used for graph generation within a specified time window or by a sampling method, thereby dividing the set of host pairs used for graph generation so that the same host pair is not included. Note that the time windows do not need to be fixed; time windows of different lengths may be mixed together.

[0034] The feature extraction unit 12 extracts subgraphs from the graph generated by the graph generation unit 11, starting from nodes related to the specified host pair, and then extracts feature vectors related to communication between the specified host pair from these subgraphs. In other words, the feature extraction unit 12 does not generate a single feature vector from the entire graph, but rather generates a feature vector for each host pair.

[0035] In this case, the feature extraction unit 12 generates a different subgraph for each host pair by random walk, starting from a specified node (host pair). Alternatively, the feature extraction unit 12 may generate a different subgraph for each host pair by sampling adjacent nodes up to a predetermined range (k-hop), starting from a specified node.

[0036] The feature extraction unit 12 converts the subgraph generated in this way into a feature vector. The conversion method is not limited; any method that can convert the graph into a feature vector is acceptable. For example, methods such as DeepWalk in Non-Patent Document 7, which involves randomly walking the nodes on a graph and then encoding them into feature vectors using a neural network, or Unsupervised GraphSAGE in Non-Patent Document 4, which uses a graph embedding model that performs Metric Learning using information on whether nodes are adjacent or not, can be used.

[0037] Figure 4 shows an image of the feature vector extraction process in this embodiment. Here, we illustrate a method using Metric Learning, where nodes that are close together (small hop count) on the graph (A and B) are trained to have a smaller vector distance in the feature space, while nodes that are far apart (large hop count) (A and C) are trained to have a larger vector distance.

[0038] In this case, the feature vector is associated with the original host pair information and device information. In Metric Learning, in addition to learning methods that make adjacent nodes closer together, methods that make nodes corresponding to the same type or similar host pairs closer together may also be used.

[0039] The learning unit 13 uses a set of feature vectors relating to the same or similar host pairs to generate a trained model capable of detecting abnormal communication for each set.

[0040] The anomaly detection unit 14 performs anomaly detection on the feature vector of the host pair to be determined, using a trained model generated from feature vectors of host pairs that are identical or similar to the host pair in question.

[0041] In anomaly detection targeting network communications, normal communications are acquired in advance, and a determination is made as to whether newly occurring communications are normal or abnormal. If this determination determines that a communication is abnormal, it is suspected that there is an anomaly in the communication between the host pair that initiated the communication, and a malware infection or DDoS attack may be suspected. When using feature vectors converted from subgraphs, as in this embodiment, the feature vectors representing normal communication are compared with the feature vectors obtained from newly generated communication, and feature vectors that are outliers are considered abnormal values. The anomaly detection algorithm is not limited; known algorithms such as the One Class SVM described in Non-Patent Document 8 or the Auto Encoder described in Non-Patent Document 9 can be used. Furthermore, if sufficient samples of abnormal communications can be obtained in addition to normal communications, a two-class classification machine learning method may be used.

[0042] However, in the IoT network targeted by this embodiment, a wide variety of IoT devices (hosts) are connected, resulting in variations in feature vectors due to differences between devices. If these variations are not taken into account and the feature vectors of all devices are mapped to the same feature space, the inter-class variance between abnormal and normal communication is small, making it difficult to distinguish between variations due to abnormal communication and variations due to differences between devices. In such cases, outlier detection (abnormal communication detection) becomes extremely difficult.

[0043] Therefore, in this embodiment, we consider how to absorb variations due to differences in devices. First, the host pair that initiated the communication is associated with the feature vectors of the previously acquired normal communication. Next, the same process of extracting feature vectors and associating them with host pairs is performed for newly occurring communications. From the feature vectors obtained from normal communication, we select the feature vectors associated with the same host pair that initiated the newly generated communication. Then, we apply the anomaly detection algorithm only to the selected feature vectors.

[0044] In this way, by thinning out communications with low relevance, the inter-class variance between abnormal and normal communications can be greatly increased. As a result, the abnormal communication detection device 1 can absorb fluctuations due to differences in devices while focusing on abnormalities caused by the communication itself for anomaly detection.

[0045] Figure 5 illustrates the method for detecting abnormal communication in this embodiment in comparison to the conventional method. Conventional methods learn a single discrimination boundary by mapping communication information between different devices into a common feature space. As a result, it becomes difficult to distinguish between feature vector variations due to device differences and feature vector variations due to abnormal communication. In other words, the identification boundary (dashed line) learned from various communications cannot accurately distinguish between normal and abnormal communications. For example, the normal communication b in the second line is judged as abnormal, and the abnormal communication d in the fourth line is judged as normal.

[0046] In contrast, the proposed method of this embodiment excludes (blacks out) communications other than those from devices A and B, and uses an identification boundary (dashed line) learned from communications from the same device to distinguish between normal and abnormal communications from devices A and B. For example, the abnormal communication d in the 4th line is judged as abnormal, and the normal communication e in the 5th line is judged as normal.

[0047] Here, the set of feature vectors selected for learning may be those relating to the same host pair, which allows for accurate learning of the discrimination boundary (threshold) for detecting abnormal communication. In addition to identical host pairs, a set of feature data relating to similar host pairs, that is, host pairs in which at least a portion of the device information is similar, such as host pairs consisting of devices of the same type or similar devices, may also be selected.

[0048] Devices of the same type include, for example, sensors with the same model number but different IP addresses in an IoT network. Similar devices include smart speakers and camera devices from different manufacturers. Because this combination results in small variations in the feature vectors for each device, the abnormal communication detection device 1 can accurately detect abnormal communications by suppressing variations due to differences in devices.

[0049] Furthermore, even with devices of the same type, changes in communication behavior may occur due to updates to specific software, such as the device's firmware. In such cases, it may be undesirable to treat a host pair consisting of devices running different versions of software as a similar host pair. Therefore, the learning unit 13 may consider the host pairs to be the same or similar only if the versions of the predetermined software match among the device information.

[0050] When using the same or similar host pair, candidate devices for the pair may be manually specified in advance. If this specification is difficult, the device with the closest distance to the feature vector obtained from previously acquired successful communication may be automatically selected. For example, the learning unit 13 may determine host pairs as similar host pairs if they are associated with feature vectors that are within a certain distance from the feature vectors of a specified host pair. Furthermore, in distance calculation, by using nearest neighbor search methods such as ANN (Approximate Nearest Neighbor) described in Non-Patent Document 10 to perform clustering, host pairs belonging to each cluster can be determined as similar host pairs. This makes it possible to speed up the calculation to a practical level.

[0051] Furthermore, for example, the learning unit 13 may determine host pairs as similar host pairs if the communication information before conversion to feature vectors is similar, that is, if at least some of the attributes of the nodes in the generated graph are similar.

[0052] According to this embodiment, the abnormal communication detection device 1 learns an abnormal communication detection model based on a set of feature vectors originating from communications between multiple identical or similar host pairs, and uses the learned model to detect abnormal communications. Therefore, the abnormal communication detection device 1 can appropriately detect abnormal communication in an IoT network composed of a wide variety of IoT devices by suppressing variations in feature vectors due to differences between devices and detecting variations in the communication itself. In this case, by generating a graph such that the same host pair appears only once, it is possible to appropriately extract the features of each communication session and generate a highly accurate learning model.

[0053] The abnormal communication detection device 1 determines the following as identical or similar host pairs: host pairs whose equipment information is similar to a specified host pair and whose software version matches a predetermined version; host pairs from which feature vectors within a predetermined distance have been extracted; host pairs that have been clustered based on the distance between feature vectors; and host pairs whose communication information is similar to a specified host pair. As a result, the abnormal communication detection device 1 can appropriately cluster similar host pairs and suppress variations in feature vectors due to differences in devices.

[0054] Furthermore, this will enable the automatic detection of abnormal communications caused by cyberattacks and malware infections in IoT networks, for example, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs): "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0055] Although an example of an embodiment of the present invention has been described above, the present invention is not limited to the embodiment described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0056] In the above-described embodiment, a host pair was formed between the source host and the destination host, and a graph was generated with direct communication between these host pairs as nodes. However, for example, in the case of a DDoS attack, host A accesses host B via multiple intermediate hosts.

[0057] Figure 6 illustrates communication via an intermediate host in this embodiment. In this example, communication originates from attacking host A and proceeds to target host B via one of the intermediate hosts C, D, E, or F.

[0058] In such cases, it is preferable to build host pairs between the attacking host and the target host, which are connected via an intermediate host, rather than building host pairs between adjacent nodes (hosts) on the graph. For example, if a directed graph is obtained as a temporary graph based on communication data between each host, reflecting the communication direction at the edges, then when the destination host of a specified edge matches the source host of an adjacent edge, this matching host can be considered an intermediate host.

[0059] Therefore, the graph generation unit 11 may consider the source host of such a designated edge and the destination host of the adjacent edge as a host pair that has passed through an intermediate host. Similarly, when passing through multiple intermediate hosts, if a directed graph is obtained from host P to host Q via these multiple intermediate hosts, host P and host Q can be considered a host pair.

[0060] As a result, even in cases of communication patterns where multiple communications from the same intermediate host cannot be observed, such as in a DDoS attack, the abnormal communication detection device 1 can determine a host pair that matches the actual communication and generate an appropriate learning model.

[0061] Furthermore, in the above-described embodiment, it was assumed that model training was performed independently for each host pair (or a set of similar host pairs). In this case, since an anomaly detection algorithm is applied to each host pair, a threshold or discrimination boundary for determining whether or not the communication is abnormal will also be prepared for each host pair. In this case, even if the host pair is different, the difference between normal and abnormal communication may be similar, so the threshold or discrimination boundary can be reused. Furthermore, if the mapping position or scale in the feature space differs due to the difference in host pairs, it is preferable to appropriately correct the discrimination boundary. For example, if the mapping position is shifted, the discrimination boundary may be shifted.

[0062] Therefore, the learning unit 13 may duplicate at least some of the parameters of the trained model to generate a trained model for other sets of feature vectors. For example, the host pair with the most communications may be designated as the representative host pair, and the threshold determined by the representative host pair may be reused for other host pairs. However, since it is difficult to reuse thresholds or identification boundaries between host pairs where the difference between normal and abnormal communication is significantly different, this may be limited to similar host pairs. As a result, the learning process is made more efficient, and the abnormal communication detection device 1 can easily and accurately detect abnormal communications.

[0063] The abnormal communication detection method by the abnormal communication detection device 1 is implemented by software. When implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of Symbols]

[0064] 1. Abnormal Communication Detection Device 10 Control Unit 11 Graph Generation Unit 12 Feature Extraction Unit 13. Learning Department 14 Abnormality determination section 20 Memory Department

Claims

1. A graph generation unit generates a temporary graph constructed from communication data, where the source and destination hosts are treated as nodes, and communication between host pairs as edges. By performing a transformation that swaps nodes and edges, the unit generates a graph in which the information of the communication is stored in the attributes of the nodes. A feature extraction unit that starts with a node related to a specified host pair, extracts a subgraph from the graph, and then extracts a feature vector from the subgraph that is associated with the host pair. A learning unit that generates a trained model capable of detecting abnormal communication for each set of feature vectors that are identical or similar to those of linked host pairs, An anomaly detection device comprising: an anomaly detection unit that performs an anomaly detection on a feature vector associated with a host pair to be judged, using the trained model generated from a set of feature vectors associated with host pairs that are identical or similar to the host pair in question.

2. The abnormal communication detection device according to claim 1, wherein the learning unit identifies a host pair whose device information is similar to that of the designated host pair as the same or similar host pair.

3. The abnormal communication detection device according to claim 2, wherein the learning unit determines the identical or similar host pair only if the predetermined software version matches among the device information.

4. The abnormal communication detection device according to claim 1, wherein the learning unit determines host pairs associated with feature vectors within a predetermined distance from the specified host pair as the same or similar host pairs.

5. The abnormal communication detection device according to claim 1, wherein the learning unit clusters a plurality of host pairs based on the distance between the feature vectors associated with each pair, thereby determining that the host pairs belonging to each cluster are the same or similar host pairs.

6. The abnormal communication detection device according to claim 1, wherein the learning unit determines host pairs having at least some of the attributes of the nodes similar as the same or similar host pairs.

7. The abnormal communication detection device according to any one of claims 1 to 6, wherein the learning unit replicates at least some of the parameters of the learned model to generate a learned model for another set of feature vectors.

8. The abnormal communication detection device according to any one of claims 1 to 6, wherein the graph generation unit generates the graph such that the same host pair appears only once.

9. An abnormal communication detection device according to any one of claims 1 to 6, wherein the graph generation unit extracts a combination of the first host and the second host as a host pair when communication information from the first host to the second host via an intermediate host is obtained from the communication data.

10. A graph generation step involves creating a temporary graph constructed from communication data, where the source and destination hosts are treated as nodes, and communication between host pairs as edges. This temporary graph is then transformed by swapping nodes and edges to generate a graph in which the information of the communication is stored in the attributes of the nodes. A feature extraction step that starts with a node relating to a specified host pair, extracts a subgraph from the graph, and then extracts a feature vector from the subgraph that is associated with the host pair, A learning step that generates a trained model capable of detecting abnormal communication for each set of feature vectors that are identical or similar to the linked host pairs, An abnormal communication detection method in which a computer performs an abnormality determination step of using a trained model generated from a set of feature vectors associated with host pairs that are identical or similar to the host pair to be determined, on a feature vector associated with the host pair to be determined.

11. An abnormal communication detection program for causing a computer to function as an abnormal communication detection device according to any one of claims 1 to 6.

Images