Anomaly detection device and anomaly detection method

Abstract

The aim is to properly manage abnormal communications with a simpler configuration. [Solution] Anomaly management device 1 includes a second learning unit 13 configured to learn a generative model comprising generator 131 and classifier 132. The generator parameters of generator 131, which generates pre-transformed pseudo-normal data before the dependency relationships corresponding to pseudo-normal data that deviate sufficiently from the distribution of true normal data are reflected, are fixed. The second learning unit 13 updates the classifier parameters of classifier 132, which distinguishes true normal data from pseudo-normal data, in a direction that maximizes an objective function based on the probability distribution of normal data and the probability distribution of abnormal data determined from the ratio estimated by the first learning unit 11.

Images