Communication management device and communication management method

Abstract

The objective is to improve the accuracy of the data on the number of abnormal packets generated. [Solution] The communication management device 1 includes a generator 131 that generates pseudo-data statistically similar to true data, using each of the sequences of packet counts observed for each time period corresponding to the second data as true data, and a discriminator 132 that identifies whether the pseudo-data generated by the generator 131 belongs to the class corresponding to true data or the class corresponding to pseudo-data. The third learning unit 13 is configured to learn multiple generative models, each having an objective function set with the probability distribution of the second data and the probability distribution of the first data determined from the ratio estimated by the first learning unit 11, and the second parameter estimated by the second learning unit 12.

Description

[Technical Field]

[0001] The present invention relates to a communication management device and a communication management method. [Background technology]

[0002] In recent years, IoT devices such as home appliances and smart meters have become widespread, in addition to smartphones and tablets. As the number of IoT devices grows enormously, the amount of traffic on the entire communication network is increasing, making communication traffic management even more important.

[0003] It has long been known that malicious attackers can cause congestion and even resource depletion by intentionally sending a large number of short packets to a specific device. To detect such abnormal communication, for example, Patent Document 1 discloses a technique that uses a generative model to generate data similar to abnormal traffic caused by short packets. However, the technique disclosed in Patent Document 1 has many elements that depend on a combination of multiple learning conditions set during the training of the generative model, and it was sometimes difficult for the generated data to adequately reflect the characteristics of actual abnormal traffic. [Prior art documents] [Patent Documents]

[0004] [Patent Document 1] Patent No. 7762830 [Overview of the project] [Problems that the invention aims to solve]

[0005] Thus, with conventional technology, improving the accuracy of the data on the number of abnormal packets generated was a challenge.

[0006] This invention was made to solve the above-mentioned problems and aims to improve the accuracy of the generated abnormal packet count data. [Means for solving the problem]

[0007] To solve the above-mentioned problems, the communication management device according to the present invention includes a first learning unit configured to learn a first parameter representing the ratio between the probability distribution of first data, which is a sequence of normal packet counts observed in each time period, and the probability distribution of second data, which is a sequence of packet counts that deviates from the range of normal packet counts, and to estimate the ratio based on the learned first parameter; a second learning unit configured to treat each of the sequences of packet counts observed in each time period as an observed value, treat each observed value as a conditionally independent discrete value, and estimate a second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value; and corresponding to the second data The system comprises: a generator that generates pseudo-data statistically similar to true data, using each of the sequences of packet counts observed in each time period as true data; a discriminator that identifies whether the pseudo-data generated by the generator belongs to a class corresponding to true data or a class corresponding to pseudo-data; a third learning unit configured to learn a plurality of generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit; and a generation unit configured to generate the pseudo-data using each of the plurality of trained generators obtained by the learning of the third learning unit.

[0008] Furthermore, the communication management device according to the present invention may further include an identification unit configured to identify whether each of the pseudo-data generated by the generation unit belongs to a class corresponding to true data or a class corresponding to pseudo-data, using each of a plurality of trained classifiers obtained by learning by the third learning unit, and a storage unit configured to store each of the pseudo-data identified by the identification unit as belonging to a class corresponding to true data.

[0009] Furthermore, the communication management device according to the present invention may further include an acquisition unit configured to acquire a series of the number of managed packets received at each time period in the communication node, and a determination unit configured to determine that the number of managed packets is abnormal when the series of managed packets acquired by the acquisition unit matches the pseudo-data stored in the storage unit.

[0010] Furthermore, the communication management device according to the present invention may also include a notification unit configured to notify an alarm when the determination unit determines that the number of packets is abnormal.

[0011] Furthermore, in the communication management device according to the present invention, the probability distribution of the first data is the probability density function of the first data, the probability distribution of the second data is the probability density function of the second data, and the ratio may be the density ratio of the probability density function of the first data and the probability density function of the second data.

[0012] To solve the above-mentioned problems, the communication management method according to the present invention includes: a first learning step in which a first parameter is learned that represents the ratio between the probability distribution of first data, which is a sequence of normal packet counts observed in each time period, and the probability distribution of second data, which is a sequence of packet counts that deviates from the range of normal packet counts, and estimates the ratio based on the learned first parameter; a second learning step in which each of the sequences of packet counts observed in each time period is treated as an observed value, each observed value is treated as a conditionally independent discrete value, and a second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data is estimated based on the frequency of occurrence of each observed value; and each of the time periods corresponding to the second data The system includes a generator that generates pseudodata statistically similar to true data, with each of the sequences of packet counts observed in the interband being true data; a discriminator that identifies whether the pseudodata generated by the generator belongs to a class corresponding to true data or a class corresponding to pseudodata; a third learning step in which a plurality of generative models are trained, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated in the first learning step, and the second parameter estimated in the second learning step; and a generation step in which the pseudodata is generated using each of the plurality of trained generators obtained through the learning in the third learning step.

[0013] Furthermore, the communication management method according to the present invention may further include an identification step in which each of the pseudo-data generated in the generation step belongs to either a class corresponding to true data or a class corresponding to pseudo-data, using each of the plurality of trained classifiers obtained by learning in the third learning step; and a storage step in which each of the pseudo-data identified in the identification step as belonging to the class corresponding to true data is stored in a storage unit.

[0014] Furthermore, the communication management method according to the present invention may further include an acquisition step of acquiring a series of the number of managed packets received at each time period in the communication node, and a determination step of determining that the number of managed packets is abnormal if the series of managed packets acquired in the acquisition step matches the pseudo-data stored in the storage unit.

[0015] Furthermore, the communication management method according to the present invention may also include a notification step that notifies an alarm if it is determined in the determination step that the number of packets is abnormal. [Effects of the Invention]

[0016] According to the present invention, the system includes a generator that generates pseudo-data statistically similar to true data, using each of the sequences of packet counts observed in each time period corresponding to the second data as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to true data or the class corresponding to pseudo-data. The system learns multiple generative models, each having an objective function set with the probability distributions of the first data and the second data determined from the ratios estimated by the first learning unit, and a second parameter estimated by the second learning unit. Therefore, the accuracy of the generated abnormal packet count data can be improved. [Brief explanation of the drawing]

[0017] [Figure 1] Figure 1 is a block diagram showing the configuration of a communication management system equipped with a communication management device according to an embodiment of the present invention. [Figure 2] Figure 2 is a diagram illustrating the overview of the communication management system according to this embodiment. [Figure 3] Figure 3 is a diagram illustrating the third learning unit included in the communication management device according to this embodiment. [Figure 4] Figure 4 is a diagram illustrating the third learning unit included in the communication management device according to this embodiment. [Figure 5]Figure 5 is a diagram illustrating the third learning unit included in the communication management device according to this embodiment. [Figure 6] Figure 6 is a block diagram showing an example of the hardware configuration of the communication management device according to this embodiment. [Figure 7] Figure 7 is a flowchart showing the operation of the communication management device according to this embodiment. [Figure 8] Figure 8 is a flowchart showing the operation of the communication management device according to this embodiment. [Figure 9] Figure 9 is a flowchart showing the operation of the communication management device according to this embodiment. [Figure 10] Figure 10 is a flowchart showing the operation of the communication management device according to this embodiment. [Modes for carrying out the invention]

[0018] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to Figures 1 to 10.

[0019] [Configuration of the communication management system] First, with reference to Figure 1, an overview of a communication management system comprising a communication management device 1 according to an embodiment of the present invention will be described.

[0020] The communication management system according to this embodiment comprises a communication management device 1 and a communication node 2. The communication management system is installed in a mobile communication network compliant with 3G, 4G / LTE, 5G, 6G, etc., or in a network utilizing a fixed line. As shown in Figure 1, the communication management device 1 is connected to the communication node 2 via a network NW such as a LAN, WAN, or the Internet.

[0021] Communication node 2 is a network device that has the function of counting the number of received packets, recording them in a log file, and sending it externally. It can be implemented as a router, access point, switch, etc. Communication node 2 can record the number of packets received at regular time intervals, such as every 10 minutes. In addition, communication node 2 records the number of received packets over an arbitrarily set period, such as one month, as the number of normal received packets and the number of received packets that deviate from the range of normal received packets, which are acquired by the acquisition unit 10 of the communication management device 1 described later.

[0022] Communication node 2 can be implemented, for example, by a computer equipped with a processor, main memory, communication interface, auxiliary storage, and input / output I / O connected via a bus, and a program that controls these hardware resources.

[0023] Figure 2 illustrates the first data set, which shows a series of normal received packet counts, and the second data set, which shows a series of received packet counts that deviate from normal received packet counts. The horizontal axis represents time, and the vertical axis represents the number of packets (pps) received at communication node 2. A time period is a unit of time that is shorter than the time period in which short packets appear in clusters, but long enough not to be buried in noise. For example, 1 to 100 ms can be used, but the length of the time period can be varied according to the network characteristics. The dotted line value in Figure 2 represents the first data set a1, which is the normal number of received packets over the entire time period. A normal number of received packets refers to the number of received packets when the number of packets observed in each time period under normal communication conditions is within an acceptable range based on, for example, past communication history.

[0024] On the other hand, the solid line in Figure 2 shows a sharp increase in the number of received packets in section c. The solid line representing the number of received packets in this section is the second data b1, which is the number of received packets that deviate from the range of normal received packets. The second data reflects abnormal behavior caused by attacks, malfunctions, etc., and indicates that a number of packets that could overwhelm the packet processing performance of communication node 2, such as a router, were received in each time period of section c. In the example in Figure 2, an attack occurred in which a large number of short packets were sent in a short period of time. In this way, the second data can be used to identify packets that represent anomalies, especially those with a relatively small number of received bytes and that are difficult to detect based on communication volume, and can be targeted for anomaly detection.

[0025] [Functional blocks of the communication management device] Next, the functional blocks of the communication management device 1 according to this embodiment will be described with reference to the block diagram in Figure 1. As shown in Figure 1, the communication management device 1 includes an acquisition unit 10, a first learning unit 11, a second learning unit 12, a third learning unit 13, a generation unit 14, an identification unit 15, an abnormal packet count database (storage unit) 16, a determination unit 17, a notification unit 18, and a storage unit 19.

[0026] The acquisition unit 10 acquires a series of packets received by the communication node 2 during each time period. The acquisition unit 10 acquires first data, which shows a series of normal packets received by the communication node 2 during each time period, and second data, which shows a series of packets that deviate from the normal packet count range. The acquisition unit 10 can label the acquired received packet counts based on rule-based or statistical thresholds, classify the first data and second data, and acquire these data. The identification information of the communication node 2 is associated with the series of received packets during each time period.

[0027] The acquisition unit 10 acquires the first data and second data used for learning by the first learning unit 11, the second learning unit 12, and the third learning unit 13, respectively. The acquisition unit 10 also acquires the number of received packets for each managed time period, which the determination unit 17 will use to determine if there are any abnormal packets.

[0028] The first learning unit 11 learns a parameter (first parameter) representing a ratio between the probability distribution of the first data that is a series of normal packet numbers observed in each time period and the probability distribution of the second data that is a series of packet numbers deviating from the range of normal packet numbers, and estimates the ratio based on the learned parameter.

[0029] More specifically, the first learning unit 11 learns a parameter representing the density ratio of the probability density functions of the first data and the second data by using the series data of the received packet numbers observed in each time period. Also, the first learning unit 11 estimates the density ratio from the learned parameter.

[0030] Here, let the set of training data including the second data be D = {x (1) , x (2) , …, x (N)}, and the set of training data including the first data be D’ = {x’ (1) , x’ (2) , …, x’ (N’)}. x indicates the received packet number for each time period. Each observed data x (n) is M-dimensional, and x (n) = (x1 (n) , x2 (n) , …, x S M (n) ). For example, when the number of time periods is 1000 (= M), it is 1000-dimensional. Each component x i (n) indicates the received packet number in time period i.

[0031] In the following, D will be referred to as the second data and D' as the first data, with the probability density function of the second data D being p(x) and the probability density function of the first data D' being p'(x). In this embodiment, the probability density function p(x) of the second data D represents a probability distribution that is a reference distribution, indicating the number of packets x that deviate from the range of normal received packets. The probability density function of the first data D' represents a probability distribution that is a non-reference distribution, indicating the number of normal received packets x, and the first learning unit 11 directly models the likelihood of anomaly. The density ratio r(x) of the probability density function p(x) of the second data D and the probability density function p'(x) of the first data D' is expressed by the following equation (1).

number

[0032]

number

[0033] The basis function ψ(x) is defined using the RBF (Radial Basis Function) kernel and expressed by the following equation (3).

number

[0034] Here, based on equation (1) above, the specific form of equation (3) where the number of basis vectors b is the number of training data N (b=N) is given by the following equation (4).

number

[0035] Equation (4) above expresses the density ratio as a linear sum of RBFs centered on all learning points. Here, we introduce the generalized Kullback-Leibler divergence, which measures the information-theoretic distance between the non-negative functions f and g shown in equation (5).

number

[0036] In density ratio estimation, f=p(x) and g=r θ Substitute p'(x) into equation (5) above, and the objective function is given by equation (6).

number

[0037] In equation (6) above, each x n , x' n’ The optimization objective function obtained by approximating the integral with an empirical distribution that sets all values ​​except θ to 0, ignoring terms that do not depend on the parameter θ, and removing constants is expressed by the following equation (7).

number

[0038] By minimizing J(θ) in equation (7) above, the density ratio r θ This is estimated. Since J(θ) is a convex function, the first learning unit 11 updates the parameter θ from the initial value to convergence using the parameter θ update formula by gradient descent shown in equation (8) below.

number

[0039] The result of specifically calculating the gradient in equation (7) above is expressed by the following equation (9).

number

[0040] The first term of equation (9) above represents the contribution from the first data, and the second term represents the contribution from the second data. Before calculating the optimal solution for parameter θ using equations (7) to (9) above, the first learning unit 11 determines an appropriate value for the bandwidth h in equation (4) above using cross-validation or an information criterion (KL divergence minimization criterion). Based on the optimal solution for parameter θ obtained by the KL density ratio estimation method, the first learning unit 11 uses equation (2) above to calculate the density ratio r for any input x. θ An estimated value can be obtained.

[0041] The second learning unit 12 treats each of the sequences of received packet counts observed for each time period as an observed value, and treats each observed value as a conditionally independent discrete value. Based on the frequency of occurrence of each observed value, it estimates the parameters (second parameters) of the class-specific probability distribution model corresponding to the classes of the first data and the second data. The second learning unit 12 sets up a class-specific probability distribution model using a multinomial distribution for the received packet count data for each time period of the first data and the received packet count data for each time period of the second data, estimates its parameters, and calculates the log-likelihood of the sequence of each observed value based on the class-specific probability distribution model. The second learning unit 12 uses integer discrete values ​​as observed values ​​of the received packet count for each time period in the received packet count observed over multiple time periods.

[0042] The second learning unit 12 focuses on the fact that the simple Bayes method treats each observation as a conditionally independent discrete variable, and extends the simple Bayes method to a multinomial distribution model to set up a class-based probability distribution model. Here, as shown in equation (10) below, the observed value X is a vector representing the number of occurrences of M categories, which corresponds to the number of packets received in each time period. X = x = (x1, x2, ..., x M ) ···(10)

[0043] Furthermore, the class label to which the observed value X belongs, i.e., the event Y, is defined as a binary variable by the following equation (11).

number

[0044] In equation (11) above, the class of abnormal packet counts is the class representing the number of received packets that deviates from the range of normal received packets, and the class of normal packet counts is the class representing the number of normal received packets. In this embodiment, the second learning unit 12 defines the class of abnormal packet counts as event Y=1 and the class of normal packet counts as event Y=0 in order to directly learn and evaluate the characteristics of the number of received packets that deviate from the range of normal received packets, using the number of normal received packets as the reference state. When each of the conditional probabilities P(X|Y) for the occurrence of observed value X under the conditions that event Y occurs are independent, the observed variable x under the given conditions that event Y occurs i The variables are conditionally independent of each other, and the likelihood ρ(x|y) is given by the simple Bayesian estimation method in equation (12).

[0045]

number

[0046] In this embodiment, since we are dealing with a data sequence of integer values ​​representing the number of received packets per time period, we are dealing with a vector of occurrences for each category x=(x1,x2,···,x MWe consider ) as one sample and extend it to a multinomial distribution probability model while maintaining the naive assumption that the data on the number of received packets for each time period are conditionally independent. The occurrence probabilities θ1,···,θ for each marginal probability P(X) in which the observed value X is observed are M Under the constraints that the variables are independent and the sum of their probabilities of occurrence is 1, the probability model of the multinomial distribution can be expressed by the following equation (13).

[0047]

number

[0048] As shown in equation (13) above, the observed value x is the data count value corresponding to the number of packets received in each time period. i The sum of (x1 + x2 + ... + x M Once the values ​​are determined, the distribution becomes the product of equation (14), and the observed value x corresponds to the number of received packets in the i-th time period in the series. i Each with an independent probability θ i xi It is possible to find this.

number

[0049] Therefore, it can be seen that the relationship is similar to that of the simple Bayes method in (12). Here, the prior probability P(Y) is a binary problem of the class of the first data (number of normal packets) (Y=0) and the class of the second data (number of abnormal packets) (Y=1), and the unknown parameters of each are θ. 0 ,θ 1 Let's define D as the marginal probability (result), and the observed value of the first data (number of normal packets) (Y=0) be D. 0 The observed value of the second data (number of abnormal packets) (Y=1) is D 1 Let's assume that equation (14) above can be expressed as equation (15) by transforming the product form into a sum under the Naive Bayes independence assumption and decomposing the log-likelihood for the data set, the set of observed values ​​D, into class-specific forms.

[0050]

number

[0051] Here, the constraint is expressed by equation (16).

number

[0052] Furthermore, applying the Lagrangian multiplier method, the parameter θ related to the class of the first data (number of normal packets) is obtained. 0 The maximum value of the log-likelihood for the i-th component is given by equation (17).

number

[0053] Parameter θ related to the class of the second data (number of abnormal packets) 1 Similarly, when we find the maximum value of the log-likelihood for this as well, under the constraint of equation (16) above, the parameter θ corresponds to the class of the second data (number of abnormal packets) and the class related to the first data (number of normal packets), respectively. 1 θ 0 This can be expressed by the following equation (18).

number

[0054] Note that x i Since x takes an integer value, i (n)To prevent the multinomial distribution from diverging when θ is 0, smoothing can be performed by specifying +α (e.g., α=1) smoothing. In this way, the second learning unit 12 considers the sequence of observed data corresponding to the number of received packets in each time period to follow a multinomial distribution, estimates the parameters of the class-specific probability distribution model by counting the frequency of occurrence of each category, and uses the likelihood based on this model to evaluate the degree of normal packets represented by the first data and abnormal packets represented by the second data. The parameter θ estimated by the second learning unit 12 1 θ 0 It will be handed over to the 3rd Learning Department, 13.

[0055] The third learning unit 13 includes a generator 131 that generates pseudo-data statistically similar to the true data, using each sequence of received packets observed for each time period corresponding to the second data as true data, and a discriminator 132 that identifies whether the pseudo-data generated by the generator 131 belongs to the class corresponding to the true data or the class corresponding to the pseudo-data. The third learning unit 13 learns multiple generative models, each having an objective function set with the probability distribution of the first data and the probability distribution of the second data determined from the density ratio estimated by the first learning unit 11, and the parameters (second parameters) estimated by the second learning unit 12.

[0056] As shown in Figure 3, the third learning unit 13 performs adversarial learning on a Generative Adversarial Network (GAN) having a generator 131 and a discriminator 132. As shown in Figure 3, the third learning unit 13 performs adversarial learning on each of the multiple Generative Adversarial Networks (GANs) provided for each observation value i (i=1,...,M) corresponding to the number of received packets for each time period. Through the learning of the third learning unit 13, a total of M trained generators 131' are constructed, each corresponding to an observation value 1 to M for the number of received packets in each time period.

[0057] Figures 4 and 5 schematically represent the neural network configuration of the GAN generator 131 and discriminator 132 used by the first learning unit 11. As shown in Figure 4, the generator 131 consists of a neural network having an input layer, a hidden layer, and an output layer. The generator 131 is a model that generates pseudodata from random noise. For example, m randomly sampled Gaussian noise vectors are input to the input nodes of the generator 131 (z1~z m ).

[0058] The generator 131 outputs an output G(z) after performing a sum-of-products operation on the input and weight parameters, followed by thresholding using an activation function. The output G(z) from the generator 131 is pseudo-data similar to the observed value corresponding to the number of received packets in the i-th time period corresponding to the second data. A CNN or ResNet can be used as the neural network that constitutes the generator 131.

[0059] The classifier 132 shown in Figure 5 consists of a neural network having an input layer, a hidden layer, and an output layer. In the example in Figure 5, the input to the training data is an observed value x corresponding to the number of received packets in the i-th time period corresponding to the second data, which is acquired by the acquisition unit 10.

[0060] The classifier 132 outputs a probability value in the range of 1 to 0 after performing a sum-of-products operation on the input and weight parameters and thresholding using an activation function. When the classifier 132 correctly identifies the training data relating to the input true data as true data, it outputs a probability value close to y=1. On the other hand, when it correctly identifies the training data relating to the input pseudo-data as pseudo-data, it outputs a probability value close to y=0. In this way, the classifier 132 is a model that distinguishes the model distribution generated by the generator 131 from the data distribution of the training data, which is the true distribution. A CNN can be used as the neural network that constitutes the classifier 132.

[0061] Figure 3 is a block diagram illustrating adversarial learning of the GAN by the third learning unit 13. The generator 131 of the GAN adopted by the first learning unit 11 is denoted as function G, and the discriminator 132 is denoted as function D. The true data is denoted as x, the predicted value output by the discriminator 132 is denoted as y, and the correct label is denoted as t. The correct label t is set to 1 for the true data and 0 for the pseudo-data generated by the generator 131. In this case, the discriminator 132 is a binary classification problem with the cross-entropy E given by equation (19) below. CE It can be expressed as follows.

[0062]

number

[0063] The first term inside the brace in equation (19) above represents t n lny n In this case, the predicted value y of the classifier 132 n However, the true correct label for the data is t n It is desirable to approach the value of =1. On the other hand, the second term inside the brace represents (1-t n )ln(1-y n In this case, the predicted value y of the classifier 132 n However, the value of the correct label (1-t) that distinguishes the pseudodata from the real data. n It is desirable for cross-entropy E to approach 0. CE This value is maximized when the predicted value matches the correct label value.

[0064] Here, the generator 131 that constitutes the GAN has parameter w G ,θ G It has a function G(w G ,θ G ) is expressed as. Also, the classifier 132 has parameter w D ,θ D It has a function D(w D ,θ D This is expressed as ). The cross-entropy E in equation (19) above CE The objective function E of a GAN comprising a generator 131 and a discriminator 132 based on the above can be expressed by the following equation (20).

number

[0065] The first term of equation (20) above represents E D(x)=1 lnD(w D ,θ D ) is the expected value that the classifier 132 identifies as true data. The second term of equation (20) above represents E D(x)=0 ln(1-D(G(w G ,θ G ),w D ,θ D )) is the expected value that the classifier 132 identifies the pseudodata generated by the generator 131 as pseudodata. Here, the expected value of equation (20) above can be expressed as equation (21) using a probability distribution.

[0066]

number

[0067] Here, for the probability density function p(x) of the second data (number of abnormal packets) and the probability density function p'(x) of the first data (number of normal packets) in equation (1) above, we set p(x) ≡ ρ(x|y=1) and p'(x) ≡ ρ(x|y=0) in order to make it a probabilistic labeled classification problem for min-max learning of the GAN. The density ratio r estimated by the first learning unit 11 θ (x) is defined by the following equation (22).

number

[0068] The probability density function ρ(x|y=0), which is the conditional probability distribution of the first data (number of normal packets) in equation (22) above, can be calculated using the maximum likelihood estimation method or the like from the M-dimensional data of the number of received packets for each time period of the first data acquired in advance by the acquisition unit 10. Using the calculated probability density function ρ(x|y=0) of the first data, the probability density function ρ(x|y=1), which is the conditional probability distribution of the second data (number of abnormal packets), can be expressed by the following equation (23).

number

[0069] Substitute the probability density function ρ(x|y=1) of the second data set and the probability density function ρ(x|y=0) of the first data set in equation (23) into the objective function E in equation (21), and set the prior probability ρ(y=1) which is the class of abnormal packet counts (y=1) and the prior probability ρ(y=0) which is the class of normal packet counts (y=0) into the parameter θ corresponding to the observed value x corresponding to the number of received packets in the i-th time period corresponding to the normal packet count class and the abnormal packet count class estimated by the second learning unit 12. 1 θ 0 We use the following. Furthermore, for the observed value x corresponding to the number of received packets in the i-th time period, the posterior probability ρ(y=1|x) that is the number of abnormal packets is given by D(w) in the optimal solution of equation (22) above. D ,θ D ) corresponds to the observed value x corresponding to the number of received packets in the i-th time period, and the posterior probability ρ(y=0|x) that is the number of normal packets is given by 1-D(G(w) in the optimal solution of equation (21) above. G ,θ G ),w D ,θ D This corresponds to the density ratio r. θ And it can be determined from the prior probability.

[0070] In the learning of the GAN, the generator 131 and the discriminator 132 are adversarially learned by min-max optimization of the objective function E. Therefore, the generator 131 is learned so as to be able to generate pseudo-data that can deceive the discriminator 132, and the discriminator 132 is learned so as to identify the pseudo-data generated by the generator 131 as pseudo-data.

[0071] In the learning of the discriminator 132, when true data is given, the discriminator 132 outputs an output close to y = 1 to maximize the first term of the objective function E in the above equation (21). On the other hand, when pseudo-data is given, learning is performed so that the discriminator 132 outputs an output close to y = 0 to maximize the second term of the objective function E.

[0072] In the learning of the generator 131, D(G(w G ,θ G ),w D ,θ D )(D(G(z)) in FIG. 3) in the above equation (21) is made close to 1, and by outputting G(w[[ID=N17]] G ,θ G )(G(z) in FIG. 3), the objective function E is minimized. The third learning unit 13 uses a learning procedure for alternately updating the parameters of the generator 131 and the parameters of the discriminator 132. The details of the learning procedures of the generator 131 and the discriminator 132 by the third learning unit 13 will be described later.

[0073] When the objective function E of the GAN is optimized, the third learning unit 13 passes the learned generator 131' constructed for each observed value i corresponding to the number of received packets in the time zone to the generation unit 14. Therefore, finally, M learned generators 131' are constructed.

[0074] The generation unit 14 generates pseudo-data using each of the learned generators 131' obtained by the learning by the third learning unit 13. Therefore, the generation unit 14 generates a set of M pseudo-data.

[0075] The identification unit 15 uses each of the multiple trained classifiers 132' obtained through training by the third learning unit 13 to identify whether each of the pseudo-data generated by the generation unit 14 belongs to the class corresponding to true data or the class corresponding to pseudo-data. Each trained classifier 132' outputs a probability value indicating whether each of the pseudo-data generated by the trained generator 131' is true data or pseudo-data. The identification unit 15 identifies the data as belonging to the class of true data (number of abnormal packets) if the probability value output by each trained classifier 132' is close to 1, and identifies it as belonging to the class of pseudo-data (number of normal packets) if the probability value is close to 0.

[0076] The abnormal packet count database 16 stores each of the pseudo-data generated by the generation unit 14 that has been identified by the identification unit 15 as belonging to a class corresponding to true data. The abnormal packet count database 16 stores pseudo-data for each communication node 2. In this way, the abnormal packet count database 16 stores time-series data of the number of received packets that deviates from the range of normal received packet counts, i.e., the number of received packets that can be considered abnormal data, as a template for abnormality detection.

[0077] The determination unit 17 determines that the number of managed packets is abnormal if the sequence of managed packets observed for each time period received at the communication node 2, acquired by the acquisition unit 10, matches the pseudo-data stored in the abnormal packet count database 16. The determination unit 17 can determine that the number of packets received at the communication node 2 is abnormal if at least a portion of the sequence of managed packets matches the pseudo-data stored in the abnormal packet count database 16.

[0078] The determination unit 17 compares the number of received packets in each time period in the pseudo-data, starting from the earliest time period, and can determine that the number of packets received at communication node 2 is abnormal when a time period with a matching number of received packets occurs. The determination unit 17 can also compare the pseudo-data stored in the abnormal packet count database 16 with the series of received packets for each time period under management, and make a determination based on whether the similarity meets a predetermined threshold. The threshold is a criterion for determining the similarity between the series of received packets for each time period under management and the pseudo-data stored in the abnormal packet count database 16, and can be arbitrarily set based on, for example, the distribution of previously observed series of received packets or the conditions for generating pseudo-data. Even when using a threshold, the comparison may be performed based on the entire series of received packets for each time period, or based on the number of received packets for some of the time periods included in the series.

[0079] The notification unit 18 issues an alarm when the determination unit 17 determines that the number of packets is abnormal. Specifically, the notification unit 18 can notify an operation center (not shown) via the network NW of an alarm indicating that an abnormal number of packets have been received at the managed communication node 2.

[0080] The memory unit 19 stores the parameters and density ratios estimated by the first learning unit 11, as well as the parameters estimated by the second learning unit 12. The memory unit 19 stores M trained generators 131'.

[0081] [Hardware configuration of the communication management device] Next, an example of a hardware configuration for realizing the communication management device 1 having the functions described above will be explained using Figure 6.

[0082] As shown in Figure 6, the communication management device 1 can be implemented, for example, by a computer equipped with a processor 102, main memory 103, communication interface 104, auxiliary storage 105, and input / output I / O 106 connected via a bus 101, and a program that controls these hardware resources. Furthermore, the communication management device 1 includes a display device 107.

[0083] The processor 102 is a circuit or device that performs arithmetic processing, and can be implemented by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc. Alternatively, some or all of these may be combined to form the processor.

[0084] The main memory 103 is composed of, for example, volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory 103 work together to realize the various functions of the communication management device 1, such as the acquisition unit 10, the first learning unit 11, the second learning unit 12, the third learning unit 13, the generation unit 14, the identification unit 15, the determination unit 17, and the notification unit 18 shown in Figure 1.

[0085] The communication interface 104 is an interface circuit for networking the communication management device 1 with various external electronic devices.

[0086] The auxiliary storage device 105 consists of a read / write storage medium and a drive device for reading and writing various information such as programs and data to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0087] The auxiliary storage device 105 has a program storage area for storing the communication management program. The auxiliary storage device 105 also has a program storage area for storing parameters representing the density ratio of the probability density functions of the first and second data, and a first learning program for estimating the density ratio, which is executed by the communication management device 1. The auxiliary storage device 105 also has a program storage area for storing a second learning program for estimating parameters using polynomial Bayes, which is executed by the second learning unit 12. The auxiliary storage device 105 also has a program storage area for storing a third learning program for performing adversarial learning of a generative model, which is executed by the third learning unit 13.

[0088] The auxiliary storage device 105 enables the implementation of the abnormal packet count database 16 and storage unit 19 described in Figure 1. Furthermore, it may also have, for example, a backup area for backing up the aforementioned data and programs.

[0089] The I / O106 is an input / output device that accepts signals from external devices and outputs signals to external devices.

[0090] The display device 107 is composed of an organic EL display or a liquid crystal display. The display device 107 displays information related to communication management, such as the sequence of packet counts for each time period under management and the judgment results.

[0091] [Operation of the communication management device] Next, the operation of the communication management device having the above-described configuration will be explained with reference to the flowcharts in Figures 7 to 10.

[0092] As shown in Figure 7, first, the acquisition unit 10 acquires, from the sequence of packet counts for each time period received by the communication node 2, a sequence of packet counts observed for each time period corresponding to the first data relating to the normal number of packets, and a sequence of packet counts observed for each time period corresponding to the second data relating to the number of packets that deviated from the normal range of packets (step S1).

[0093] Next, the first learning unit 11 performs first learning processing (step S2). FIG. 8 is a flowchart for explaining the first learning processing in step S2. As shown in FIG. 8, the first learning unit 11 learns a parameter θ representing a density ratio r between the probability density function of the first data and the probability density function of the second data (step S20). The first learning unit 11 updates the parameter θ by using the above equations (7) to (9) and a gradient descent method or the like, and obtains an optimal solution of the parameter θ. θ Then, based on the above equation (2), the first learning unit 11 estimates the density ratio r from the learned parameter θ obtained in step S20 (step S21).

[0094] Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. θ

[0095] Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 θ 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7. 1 θ 0 Returning to FIG. 7, the second learning unit 12 executes second learning processing (step S3). FIG. 9 is a flowchart for explaining the second learning processing in step S3. As shown in FIG. 9, the second learning unit 12 sets parameters θ for observation values corresponding to the number of packets in each time zone related to the class of the number of abnormal packets and the class of the number of normal packets (step S31). Subsequently, the second learning unit 12 defines the log-likelihood according to the above equation (13) (step S32). In step S32, the second learning unit 12 converts the objective function for optimization from a product form (Equation (14)) to a sum form. Next, the second learning unit 12 uses the Lagrange multiplier method of the above equation (17) to estimate the parameter θ corresponding to the class of the second data (number of abnormal packets) that maximizes the log-likelihood (Equation (15)) under the constraint (Equation (16)), and the parameter θ corresponding to the class of the first data (number of normal packets) (Equation (18)) (step S33). The estimated parameters θ and θ are stored in the storage unit 19, and the process proceeds to step S4 in FIG. 7.

[0096] ​Next, the third learning unit 13 executes the third learning process (step S4). In step S4, the third learning unit 13 includes a generator 131 that generates pseudo-data statistically similar to the true data, using the observed number of received packets per time period corresponding to the second data as the true data, and a discriminator 132 that identifies whether the pseudo-data generated by the generator 131 belongs to the class corresponding to the true data or the class corresponding to the pseudo-data. The third learning unit 13 learns multiple generative models, each having an objective function set with the probability density function of the first data and the probability density function of the second data determined from the density ratio estimated by the first learning unit 11 in step S2, and the parameters estimated by the second learning unit 12 in step S3.

[0097] Figure 10 is a flowchart illustrating the third learning process in step S4. As shown in Figure 10, first, the third learning unit processes the density ratio r estimated in the first learning process in step S2 of Figure 7. θ The probability density function ρ(x|y=1) of the second data and the probability density function ρ(x|y=0) of the first data (equation (21) above), determined from the above, are set as the objective function E of the GAN (equation (21)) (step S50). More specifically, the third learning unit 13 calculates the probability density function ρ(x|y=0), which is the conditional probability distribution of the first data, from the first data acquired by the acquisition unit 10 in step S1, using the maximum likelihood estimation method or the like. The third learning unit 13 also determines the probability density function ρ(x|y=1), which is the conditional probability distribution of the second data, expressed by equation (23) above, from the calculated probability density function ρ(x|y=0) of the first data.

[0098] Next, the third learning unit 13 calculates the parameters θ corresponding to the classes of abnormal packets and normal packets, respectively, which were estimated in the second learning process of step S3 in Figure 7. 1 ,θ 0 The prior probability ρ(y=1) represents the number of abnormal packets, and the prior probability ρ(y=0) represents the number of normal packets, and these are set as the objective function E of the GAN (Equation (22)) (Step S51). Furthermore, in the optimal solution of the objective function E in Equation (21) above, D(w D ,θD ) is the posterior probability ρ(y=1|x) that the observed value x corresponding to the number of packets in a given time period is an abnormal number of packets, and 1-D(G(w G ,θ G ),w D ,θ D ) is the posterior probability ρ(y=0|x) that the number of normal packets is given by the observed value x corresponding to the number of packets in a given time period. These posterior probabilities ρ(y=1|x) and ρ(y=0|x) are given by the estimated density ratio r θ It can also be calculated from the prior probabilities ρ(y=1) and ρ(y=0).

[0099] Next, the third learning unit 13 acquires each of the sequences of packet counts observed for each time period corresponding to the second data acquired in step S1 of Figure 7 as true data (step S52). In step S52, the observed packet count for the time period i=1, which corresponds to one of the observed packet counts for the M time periods corresponding to the second data (i=1), is taken as true data.

[0100] Next, the third learning unit 13 inputs the true data, which is the observed number of packets during the time period i=1 related to the second data acquired in step S52, as training data 134 into the classifier 132, and sets the parameter w of the classifier 132 so that the true data can be identified as true data (y=1). D ,θ D Learn and update (step S53). As shown in the block diagram of the third learning unit 13 in Figure 3, the true data is used as training data 134 that is input when training the classifier 132.

[0101] In step S53, the third learning unit 13 can train the classifier 132 on true data using, for example, the backpropagation method. Step S53 pre-constructs a classifier 132 that can distinguish true data from other true data.

[0102] Next, the third learning unit 13 generates Gaussian noise and provides a random vector of the generated Gaussian noise as input to the generator 131 (step S54). Subsequently, the generator 131 uses the input z and weight parameter w based on the given Gaussian noise. G ,θ G The sum-of-products operation and thresholding using an activation function are performed to generate pseudo-data G(z) (step S55).

[0103] Next, the third learning unit 13 trains the classifier 132. The training of the classifier 132 involves the parameters w of the generator 131. D ,θ D This is done with fixed parameters. First, the third learning unit 13 provides the true data acquired in step S52 as training data 134 to the classifier 132 as input. Then, the third learning unit 13 uses backpropagation or the like to maximize the objective function E in equation (22) above, and the parameters w D ,θ D Update (step S56). Note that the label for training data 134 is set to 1 (true data).

[0104] Next, the third learning unit 13 provides the pseudo-data generated by the generator 131 in step S55 as input to the discriminator 132, and processes the parameters w using backpropagation or the like so that the objective function E in equation (21) above is maximized. D ,θ D Update (step S57). That is, in steps S56 and S57, in order to maximize the objective function E in equation (21) above, the first term is D(w D ,θ D )=1 is output, and the second term is D(G(w G ,θ G ),w D ,θ D The optimization is performed so that ) = 0. Note that the training data 134 has a label of 0 (pseudodata).

[0105] The learning of the classifier 132 in steps S56 and S57 corresponds to the dashed arrows in the block diagram of the third learning unit 13 shown in Figure 3, which indicate that the classifier error is calculated in block 135 of the objective function E based on the output 133 from the classifier 132, and then the error is backpropagated to the classifier 132.

[0106] Next, the third learning unit 13 trains the generator 131. During the training of the generator 131, the parameters of the discriminator 132 are fixed. The third learning unit 13 trains the generator 131 so that when random Gaussian noise is supplied to the generator 131, pseudo-data is generated. Specifically, the first learning unit 11 uses methods such as backpropagation to minimize the objective function E in equation (21) above, thereby adjusting the parameters w G ,θ G Update (Step S58).

[0107] The learning in step S58 corresponds to the dashed arrow flow in the block diagram of the third learning unit 13 in Figure 3, which indicates that the error is backpropagated to the generator 131. In other words, step S58 corresponds to the dashed arrow flow in which the pseudo-data generated by the generator 131 in Figure 3 is input to the discriminator 132, the generator error is calculated from its output 133 in block 135 of the objective function E, and then the error is backpropagated to the generator 131.

[0108] Subsequently, the learning of the discriminator 132 and generator 131 from steps S55 to S58 is repeated until the value of the objective function E reaches a Nash equilibrium and converges (step S59: NO). On the other hand, if the value of the objective function E converges (step S59: YES), the processing from steps S53 to S59 is repeated until the generator 131 and discriminator 132 are learned using all the true data (step S60: NO). Note that the processing from steps S52 to S58 and from steps S59 to S60 can be performed in batches.

[0109] Subsequently, if the generator 131 and discriminator 132 have been trained using all the true data (step S60: YES), the third learning unit 13 stores the trained generator 131' corresponding to the observed number of packets in the time period i=1 in the storage unit 19 (step S61). Further, as shown in connector a, adversarial learning is performed on each of the generative models constructed for each of the observed number of packets in the time periods i=2, ..., M (step S61: NO), and after storing M trained generators 131' in the storage unit 19 (step S61: YES), the process moves to step S5 in Figure 7.

[0110] Next, the generation unit 14 generates pseudo-data corresponding to the observed number of packets in each time period using each of the trained generators 131' constructed by the third learning unit 13 (step S5). Subsequently, the identification unit 15 identifies whether each of the pseudo-data generated in step S5 belongs to the class corresponding to true data or the class corresponding to pseudo-data (step S6). Then, the abnormal packet count database 16 stores each of the pseudo-data identified in step S6 as belonging to the class of true data (step S7).

[0111] Subsequently, the acquisition unit 10 acquires a series of packet counts observed for each time period received by the managed communication node 2 from the said communication node 2 (step S8). The series of packet counts for each time period acquired in step S7 is data for each communication node 2. Next, the determination unit 17 determines that the number of packets received by the managed communication node 2 is abnormal if the series of packet counts observed for each time period acquired in step S8 matches the pseudo-data stored in the abnormal packet count database 16 in step S7 (step S9).

[0112] Subsequently, if the determination unit 17 determines in step S9 that an abnormal number of packets have been received, the notification unit 18 notifies an operation center (not shown) via the network NW of an alarm indicating that an abnormal number of packets have been received at communication node 2 (step S10).

[0113] As described above, according to the communication management device of this embodiment, the probability density function and parameters obtained by the first learning unit 11 and the second learning unit 12 are set as the objective function of the GAN, adversarial learning of the GAN is performed using each of the observed values ​​corresponding to the number of received packets for each time period corresponding to the second data as true data, and pseudo-data is generated using each of the generated trained generators 131'. Therefore, the accuracy of the generated abnormal packet count data can be improved.

[0114] According to the communication management device 1 of this embodiment, a generation model is constructed for each observed value corresponding to the number of received packets for each of the M time periods. For each generation model corresponding to each observed value, parameters are set for the class of normal packets (first data) and the class of abnormal packets (second data) corresponding to the observed value related to the number of received packets for that time period estimated by the second learning unit 12 in the objective function. As a result, the learning accuracy of the generation model can be further improved.

[0115] In the embodiment described, the first learning unit 11 was configured to learn parameters representing the ratio of the probability distributions of the first data and the second data, and the case where the density ratio between probability density functions was estimated was described. However, the probability distribution is not limited to a probability density function, but may be represented as a discrete distribution, a mixture distribution, or a model that approximates these. Furthermore, the first learning unit 11 is not limited to learning the density ratio representing the ratio of the probability distribution of the first data and the second data, but may be configured to learn one or more parameters including a weighting coefficient, likelihood ratio, score value, or evaluation index for distinguishing between the first data and the second data, derived based on the ratio.

[0116] Furthermore, in the embodiments described, the third learning unit 13 was explained using the example of a case where the generative model has the configuration of a GAN, but the generative model is not limited to this. For example, the generative model may be constructed based on any generative model that learns the distribution of the second data and generates pseudo-data, such as a VAE (Variational Autoencoder) or an Energy-Based Model (EBM). In this case as well, the discrimination process for determining whether the generated pseudo-data is statistically equivalent to the real data is not limited to the configuration included in the generative model, and may be performed by a separate classifier or evaluation model.

[0117] Although embodiments of the communication management device and communication management method of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications that a person skilled in the art can envision are possible within the scope of the invention described in the claims. [Explanation of Symbols]

[0118] 1...Communication management device, 2...Communication node, 10...Acquisition unit, 11...First learning unit, 12...Second learning unit, 13...Third learning unit, 14...Generation unit, 15...Identification unit, 16...Abnormal packet count database, 17...Determination unit, 18...Notification unit, 19...Storage unit, 101...Bus, 102...Processor, 103...Main memory, 104...Communication interface, 105...Auxiliary memory, 106...Input / output I / O, 107...Display device, 131...Generator, 132...Discriminator, 133...Output, 134...Training data, 135...Block of objective function E.

Claims

1. A first learning unit is configured to learn a first parameter that represents the ratio between the probability distribution of first data, which is a series of normal packet counts observed in each time period, and the probability distribution of second data, which is a series of packet counts that deviate from the range of normal packet counts, and to estimate the ratio based on the learned first parameter. A second learning unit is configured to take each sequence of packet counts observed in each time period as an observed value, treat each observed value as a conditionally independent discrete value, and estimate the second parameter of a class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value. A third learning unit is configured to learn multiple generative models, each having an objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit. The third learning unit includes a generator that generates pseudo-data statistically similar to the true data, with each of the sequences of packets observed in each time period corresponding to the second data being used as true data, and a discriminator that identifies whether the pseudo-data generated by the generator belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, and each objective function set by the probability distribution of the first data and the probability distribution of the second data determined from the ratio estimated by the first learning unit, and the second parameter estimated by the second learning unit. A generation unit configured to generate the pseudo-data using each of the multiple trained generators obtained by the learning of the third learning unit, A communication management device equipped with the following features.

2. In the communication management device according to claim 1, Furthermore, an identification unit is configured to use each of the multiple trained classifiers obtained through training by the third learning unit to identify whether each of the pseudo-data generated by the generation unit belongs to the class corresponding to the true data or the class corresponding to the pseudo-data, A storage unit configured to store each of the pseudo-data identified by the identification unit as belonging to a class corresponding to true data, A communication management device equipped with the following features.

3. In the communication management device according to claim 2, Furthermore, the acquisition unit is configured to acquire a series of the number of managed packets received at each time period in the communication node, A determination unit is configured to determine that the number of managed packets is abnormal when the sequence of managed packets acquired by the acquisition unit matches the pseudo-data stored in the storage unit. A communication management device characterized by comprising the following:

4. In the communication management device according to claim 3, Furthermore, the system includes a notification unit configured to send an alarm if the determination unit determines that the number of packets is abnormal. A communication management device characterized by the following features.

5. In the communication management device according to claim 1, The probability distribution of the first data is the probability density function of the first data, The probability distribution of the second data is the probability density function of the second data, The ratio is the density ratio of the probability density function of the first data to the probability density function of the second data. A communication management device characterized by the following features.

6. A communication management method performed by a computer, A first learning step involves learning a first parameter that represents the ratio between the probability distribution of the first data, which is a sequence of normal packet counts observed in each time period, and the probability distribution of the second data, which is a sequence of packet counts that deviate from the range of normal packet counts, and estimating the ratio based on the learned first parameter. A second learning step involves taking each sequence of packet counts observed in each time period as an observed value, treating each observed value as a conditionally independent discrete value, and estimating the second parameter of the class-specific probability distribution model corresponding to the class corresponding to the first data and the class corresponding to the second data, respectively, based on the frequency of occurrence of each observed value. A third learning step involves learning multiple generative models, each having an objective function set by the probability distributions of the first data and the second data determined from the ratios estimated in the first learning step, and the second parameters estimated in the second learning step. The objective function is set by the probability distributions of the first data and the second data determined from the ratios estimated in the first learning step. A generation step in which pseudo-data is generated using each of the multiple trained generators obtained through the learning in the third learning step, A communication management method comprising the following features.

7. In the communication management method described in claim 6, Furthermore, the identification step involves using each of the multiple trained classifiers obtained through the learning in the third learning step to identify whether each of the pseudo-data generated in the generation step belongs to the class corresponding to the true data or the class corresponding to the pseudo-data. A storage step in which each of the pseudo-data identified in the identification step as belonging to a class corresponding to the true data is stored in a storage unit. A communication management method comprising the following features.

8. In the communication management method described in claim 7, Furthermore, the acquisition step involves obtaining a series of the number of managed packets received at each time period in the communication node, A determination step in which, if the sequence of the number of managed packets acquired in the acquisition step matches the pseudo-data stored in the storage unit, the number of managed packets is determined to be abnormal. A communication management method characterized by comprising:

9. In the communication management method described in claim 8, Furthermore, the system includes a notification step that issues an alarm if the determination step determines that the number of packets is abnormal. A communication management method characterized by the following features.

Images