Anomaly detection device and anomaly detection method

Abstract

The goal is to manage abnormal traffic without collecting a large amount of historical abnormal traffic data. [Solution] Anomaly management device 1 includes a second learning unit 13 configured to learn a generative model comprising generator 131 and discriminator 132. The second learning unit 13 keeps the generator parameters of generator 131 fixed, which generates pseudo-normal data that deviates sufficiently from the distribution of true normal data, while updating the discriminator parameters of discriminator 132, which distinguishes true normal data from pseudo-normal data, in order to maximize an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit 11.

Images