Communication management device and communication management method

Abstract

The aim is to more reliably manage signs of communication abnormalities. [Solution] The communication management device 1 includes an acquisition unit 10 configured to acquire the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal 2; a classification unit 13 configured to take the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal 2, acquired by the acquisition unit 10, as an unknown input, provide it to a trained classification model 12A that has learned the correlation of communication characteristics between communication channels, perform calculations on the trained classification model 12A, and output a classification result regarding signs of communication abnormality; and a presentation unit 14 configured to present the classification result output by the classification unit 13.

Description

[Technical Field]

[0001] The present invention relates to a communication management device and a communication management method. [Background technology]

[0002] In recent years, malware infections caused by Mirai variants that exploit security vulnerabilities in IoT devices (for example, flaws in initial password settings) to turn IoT devices into bots and execute DDoS attacks and other actions based on commands from a Command & Control (C&C) server have become a problem in the telecommunications industry (see Non-Patent Literature 1).

[0003] IoT devices infected with the Mirai variant communicate with an external C&C server and operate according to commands from that C&C server. Infected devices may exhibit unusual communication behavior, such as attempts to infiltrate other IoT devices or generating a large volume of communications to a specific destination. To detect such malicious communication behavior, technologies have been proposed that register the characteristics and patterns of malware communications observed in the past as signatures and detect anomalies based on matches with these signatures, or that determine anomalies by comparing past communication states with current communication states (see Patent Document 1).

[0004] However, recent malware, including Mirai variants, operates by changing communication patterns such as communication content, communication volume, and port numbers used, making detection difficult with detection methods based on fixed signatures. Furthermore, methods based on simple comparisons with past communication states for each terminal may fail to adequately distinguish between legitimate communication fluctuations caused by changes in the communication environment or usage, and signs of abnormal communication, including malicious communication, potentially leading to false positives or missed detections. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2022-127966 [Non-patent literature]

[0006] [Non-Patent Document 1] National Institute of Information and Communications Technology (NICT), Cybersecurity Research Institute, Cybersecurity Nexus "NICTER Observation Report 2023", [online], [Retrieved January 18, 2026], Internet <chrome-extension: / / efaidnbmnnnibpcajpcglclefindmkaj / https: / / csl.nict.go.jp / report / NICTER_report_2023.pdf> [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] Thus, with conventional technology, it was difficult to reliably manage signs of communication abnormalities.

[0008] This invention was made to solve the above-mentioned problems and aims to more reliably manage abnormal signs in communications. [Means for solving the problem]

[0009] To solve the above-mentioned problems, the communication management device according to the present invention comprises: an acquisition unit configured to acquire the time-dependent communication volume of each of the multiple communication channels provided by a communication terminal; a classification unit configured to take the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal, acquired by the acquisition unit, as an unknown input, provide it to a trained classification model that has learned the correlation of communication characteristics between communication channels, perform calculations on the trained classification model, and output a classification result regarding signs of communication abnormality; and a presentation unit configured to present the classification result output by the classification unit.

[0010] In addition, in the communication management device according to the present invention, further, for the traffic volume of each of the plurality of communication channels included in the communication terminal at each time, using teacher data with the preset pattern of the communication abnormality sign as the correct label, a learning unit configured to learn a feature amount representing the correlation of the communication characteristics between the communication channels, and a storage unit configured to store the learned classification model constructed by the learning unit may be provided.

[0011] In addition, in the communication management device according to the present invention, further, when the classification result output by the classification unit indicates the communication abnormality sign, a communication management unit configured to issue an instruction to execute a preset relief process according to the pattern of the communication abnormality sign may be provided.

[0012] In addition, in the communication management device according to the present invention, further, an input data creation unit configured to create matrix data representing the correlation of the communication characteristics between the communication channels based on the traffic volume of each of the plurality of communication channels included in the communication terminal at each time is provided, and the classification unit may provide the matrix data created by the input data creation unit as unknown input to the learned classification model.

[0013] In addition, in the communication management device according to the present invention, the classification model may include a convolutional neural network.

[0014] In addition, in the communication management device according to the present invention, the classification model may further include an attention mechanism configured to weight the feature amounts based on the importance of a plurality of feature maps constituting the feature amounts to emphasize the feature amounts, which are extracted by the convolutional neural network.

[0015] In addition, in the communication management device according to the present invention, the plurality of communication channels may be a plurality of ports.

[0016] To solve the above-mentioned problems, the communication management method according to the present invention comprises: an acquisition step of acquiring the time-dependent communication volume of each of the multiple communication channels provided by a communication terminal; a classification step of using the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal acquired in the acquisition step as an unknown input, providing it to a trained classification model that has learned the correlation of communication characteristics between communication channels, performing calculations on the trained classification model, and outputting a classification result regarding signs of communication abnormality; and a presentation step of presenting the classification result output in the classification step.

[0017] Furthermore, the communication management method according to the present invention may further include a learning step in which a classification model learns feature quantities representing the correlation of communication characteristics between communication channels using training data in which pre-set patterns of abnormal signs of communication are assigned as correct labels to the time-based communication volume of each of the plurality of communication channels provided by the communication terminal, and a storage step in which the learned classification model constructed in the learning step is stored in a storage unit.

[0018] Furthermore, the communication management method according to the present invention may also include a communication management step that, when the classification result output in the classification step indicates an abnormality in the communication, instructs the execution of a pre-set remediation process corresponding to the pattern of the abnormality in the communication.

[0019] Furthermore, the communication management method according to the present invention further includes an input data creation step in which matrix data representing the correlation of communication characteristics between communication channels is created based on the time-dependent communication volume of each of the plurality of communication channels provided by the communication terminal, and the classification step may provide the matrix data created in the input data creation step as an unknown input to the trained classification model. [Effects of the Invention]

[0020] According to the present invention, the time-dependent communication volume of each of the multiple communication channels provided by a communication terminal is taken as an unknown input and fed into a trained classification model that has learned the correlation of communication characteristics between communication channels. The trained classification model then performs calculations to output a classification result regarding signs of communication abnormalities. Therefore, signs of communication abnormalities can be managed more reliably. [Brief explanation of the drawing]

[0021] [Figure 1] Figure 1 is a block diagram showing the configuration of a communication management system including a communication management device according to an embodiment of the present invention. [Figure 2] Figure 2 is a diagram illustrating the multiple ports provided by the communication terminal according to this embodiment. [Figure 3] Figure 3 is a block diagram showing the configuration of the learning unit of the communication management device according to this embodiment. [Figure 4] Figure 4 is a block diagram showing the hardware configuration of the communication management device according to this embodiment. [Figure 5] Figure 5 is a flowchart showing the operation of the communication management device according to this embodiment. [Figure 6] Figure 6 is a flowchart showing the operation of the communication management device according to this embodiment. [Modes for carrying out the invention]

[0022] Preferred embodiments of the present invention will be described in detail below with reference to Figures 1 to 6. In this specification, "communication channel" refers to a logical or physical transmission unit for identifying communication data, and the following description will exemplify the case where the communication channel is a port (port number) of a communication protocol.

[0023] [Configuration of the communication management system] First, an overview of a communication management system comprising a communication management device 1 according to an embodiment of the present invention will be described. As shown in Figure 1, the communication management system comprises a communication management device 1 and a plurality of communication terminals 2, and the communication management device 1 and the communication terminals 2 are connected via a network NW such as the Internet.

[0024] The communication terminal 2 can be realized by a computer equipped with a processor, main memory, communication interface, auxiliary storage, and input / output I / O, and a program that controls these hardware resources. The communication terminal 2 is configured as an IoT device to which a terminal IP address that uniquely identifies the terminal is assigned. In this embodiment, there are n communication terminals 2 (where n is a positive integer of 2 or more). The communication terminal 2 can be realized as a tablet computer, laptop computer, wearable device, industrial robot, smartphone or other portable communication terminal. The communication terminal 2 is identified based on the IP address used for communication or the MAC address unique to the communication terminal 2.

[0025] When communication terminal 2 performs cellular communication, it is equipped with a SIM (Subscriber Identity Module) and connects to the network based on the subscriber identification information (IMSI: International Mobile Subscriber Identity) stored in the SIM. In this case, communication terminal 2 can also be identified by its IMSI.

[0026] Communication terminal 2 is equipped with multiple ports for communicating with external devices. These multiple ports are identified by port numbers. Port numbers are identifiers used in communication protocols to identify the type and purpose of communication. Communication terminal 2 can simultaneously use multiple communication services through the ports with port numbers. Figure 2 is Table 200, which shows some of the typical port numbers provided by communication terminal 2, and an example of the communication protocols and services corresponding to these port numbers.

[0027] As shown in Table 200 of Figure 2, for example, port number 20 is used for FTP (File Transfer Protocol) data transfer using the TCP protocol. Port number 21 is used for FTP control communication using the TCP protocol. Port number 22 is used for remote connections via SSH (Secure Shell) using the TCP protocol. Port number 23 is used for Telnet communication using the TCP protocol. Port number 25 is used for sending emails via SMTP (Simple Mail Transfer Protocol) using the TCP protocol.

[0028] The types of port numbers actually used by communication terminal 2, as well as the communication volume and frequency for each port number, vary depending on the purpose and state of each communication terminal 2. It has long been known that malware such as Mirai exhibits behavior in which the communication volume on port number 23, used for Telnet communication, increases. However, when a malware infection occurs, the timing of the increase in communication volume on easily targeted port numbers such as port number 23 may coincide with a corresponding change in the communication volume on other port numbers, such as port number 443 for HTTPS communication. Thus, when there is a correlation between specific port numbers, it can be managed as a high possibility of malware infection, such as a Mirai variant infection. In this embodiment, we focus on the correlation between multiple port numbers and the relationship between changes in communication volume between multiple port numbers to manage signs of abnormal communication when a malware infection occurs.

[0029] [Functional blocks of the communication management device] As shown in Figure 1, the communication management device 1 comprises an acquisition unit 10, an input data creation unit 11, a learning unit 12, a classification unit 13, a presentation unit 14, a communication management unit 15, and a storage unit 16.

[0030] The acquisition unit 10 acquires the communication volume for each of the multiple ports provided by the communication terminal 2 at each given time. The acquisition unit 10 acquires the traffic volume (number of bytes, etc.) and the number of packets as communication volume. The acquisition unit 10 monitors the communication transmitted and received between each of the multiple communication terminals 2 and an external device via the network NW, and acquires the communication volume for each of the multiple port numbers provided by the communication terminal 2 based on the communication information contained in the communication. The acquisition unit 10 divides the acquired communication volume into predetermined time intervals, aggregates the communication volume for each port number within each time interval, and records the aggregated communication volume in association with time information. As a result, the acquisition unit 10 acquires the communication volume for each time t k The amount of data transmitted across M port numbers (k=1,...,K) is D={x1,x2,...x M Get}.

[0031] The input data creation unit 11 creates matrix data representing the correlation of communication characteristics between ports based on the time-dependent communication volume of each of the multiple ports equipped with the communication terminal 2, which is acquired by the acquisition unit 10. The matrix data created by the input data creation unit 11 is used as input data for the classification model 12A equipped with the learning unit 12 and classification unit 13, which will be described later. More specifically, the input data creation unit 11 creates matrix data representing the correlation of communication characteristics between ports based on the time-dependent communication volume of each of the multiple ports equipped with the communication terminal 2, which is acquired by the acquisition unit 10. k The traffic volume vector D = {x1, x2, ... x} of the M port numbers. M Based on this, a matrix is ​​created that represents the relationships between the components of the communication volume vector.

[0032] The input data creation unit 11 generates the communication volume vector D and its transpose vector D. T Based on the product of the two, we create an M×M matrix data represented by the following equation (1).

number

[0033] Each element of the matrix data in equation (1) above reflects the simultaneous fluctuation relationship of communication volume between different ports and is used as a feature of the classification model 12A described later, which represents the correlation of communication characteristics between ports. The input data creation unit 11 generates the matrix data in equation (1) above (hereinafter referred to as "input matrix" or "input matrix X") at time t k Create a total of K items for each (k=1...K) interval.

[0034] The input data creation unit 11 further uses the created input matrix X to create training data to be used by the learning unit 12. More specifically, the input data creation unit 11 creates training data at time t k For each input matrix X created using equation (1) above (k=1...K), a correct label corresponding to one of the pre-defined normal patterns 1-O and abnormal patterns 1-P is assigned to create training data. Abnormal patterns 1-P are communication behaviors defined in advance as types that indicate a risk of malware infection on communication terminal 2 based on the correlation of communication characteristics between ports.

[0035] The learning unit 12 includes a classification model 12A. The learning unit 12 uses training data in which pre-configured patterns of abnormal communication signs are assigned as correct labels to the time-dependent communication volume of each of the multiple ports of the communication terminal 2, and the classification model 12A learns feature quantities that represent the correlation of communication characteristics between ports. More specifically, the learning unit 12 learns the classification model 12A using training data in which correct labels are assigned to the input matrix X created by the input data creation unit 11. Feature quantities are individual numerical values ​​that represent the correlation between ports, and the learning unit 12 learns the combinations and distribution trends of these multiple feature quantities as patterns that indicate the communication state during a specific malware infection.

[0036] FIG. 3 is a block diagram showing an example of the classification model 12A included in the learning unit 12. As shown in FIG. 3, the classification model 12A includes a convolutional neural network (CNN). The classification model 12A further includes an attention mechanism that weights the feature amounts of the communication characteristics between port numbers extracted by the CNN based on the importance of a plurality of feature maps constituting the feature amounts to emphasize the feature amounts. In the present embodiment, SENet (Squeeze-and-Excitation Network) is adopted as the classification model 12A. SENet includes an attention mechanism that weights the feature maps extracted by the hidden layer 121 of the CNN.

[0037] The classification model 12A is mainly composed of three major stages: a hidden layer 121 which is a feature extraction part by CNN, a SE block 122 which is a feature enhancement part by SENet, and an output layer 124 which is a classification output part. In the classification model 12A shown in FIG. 3, the input layer 120 and the hidden layer 121 have configurations corresponding to the CNN.

[0038] The input layer 120 inputs the input matrix X of the above formula (1) based on the M-dimensional traffic volume D = {x1, x2,... x k} for each port number of the communication terminal 2 at time t. The input matrix X is a matrix created by the input data creation unit 11. The input matrix X is input to the hidden layer 121 through the input layer 120.

[0039] The hidden layer 121 includes a convolutional layer that performs convolutional processing on the data input from the input layer 120, an activation layer that uses the ReLU function as an activation function, and a pooling layer that aggregates feature amounts, and extracts a group of feature maps composed of a plurality of feature maps from the input matrix X. Also, L processing blocks including the convolutional layer and the pooling layer may be provided from the input layer 120 to the output layer 124. With these input layer 120 and hidden layer 121, the correlation of the communication characteristics between ports included in the input matrix X is expressed as a spatial feature.

[0040] ​​ On the other hand, the SE block 122 and the multiplier 123 are configured to support an attention mechanism that enhances features in the channel direction, taking into account the importance of the feature maps extracted by the CNN. The SE block 122 takes the feature maps output from the hidden layer 121 of the CNN as input and performs global average pooling to aggregate spatial information for each channel.

[0041] SE block 122 performs linear transformations using multiple connected layers and nonlinear transformations using an activation function (ReLU) on the aggregated input vector x, and calculates weight coefficients representing the importance of each channel for each number of feature maps extracted by the hidden layer 121 of the CNN. SE block 122 can be applied to the feature map group output from the final stage of the L-stage convolutional and pooling layers of the hidden layer 121 of the CNN, or to intermediate stages of multiple stages. The transformation process of SE block 122 is expressed by the following equation (2).

number

[0042] In equation (2) above, W is the weight matrix in the fully connected layer, b is the bias term, and f is an activation function such as the ReLU function or Sigmoid function. This allows the calculation of a weight coefficient vector y representing the importance of each channel. SE block 122 outputs the calculated weight coefficient vector y, which is then input to the subsequent multiplication unit 123.

[0043] The multiplication unit 123 further weights the features extracted by the CNN by multiplying the weight coefficients calculated by the SE block 122 by the corresponding channels in the feature map set output from the hidden layer 121 of the CNN. The multiplication unit 123 emphasizes features that contribute to classification by highlighting features of high-importance channels and suppressing features of low-importance channels.

[0044] The output layer 124 takes a set of feature maps, further weighted by the multiplication unit 123, as input and outputs classification results corresponding to multiple normal and abnormal patterns. Output value y1 ~ y O ,y O+1 ~ y O+P Each output value y i (i=1~O+P) represents the probability or likelihood that the input matrix X, based on the traffic volume data for each input port number, belongs to each classification class. For example, it is output as a normalized value using the Softmax function. In this case, each output value y i The value can be between 0 and 1, and the sum of all output values ​​is 1.

[0045] Classification model 12A outputs value y1 ~ y O The normal pattern group shown and the output value y O+1 ~ y O+P By distinguishing between the abnormal pattern group indicated by the input data, it is determined whether the input matrix X, based on the input communication volume data, belongs to an abnormal pattern indicating abnormal communication signs seen during malware infection, or to a normal pattern that does not show such abnormal communication signs. For example, if the classification class showing the largest output value belongs to the abnormal pattern group, the input data is determined to have signs of abnormality due to malware infection.

[0046] Here, the training data used by the learning unit 12 to train the classification model 12A is, as mentioned above, data in which the input matrix X is assigned a ground truth label corresponding to one of the pre-set normal patterns 1 to O and abnormal patterns 1 to P. The ground truth label y is given as a label vector corresponding to the number of classes (O+P) (hereinafter referred to as "C" (=O+P)) consisting of normal patterns 1 to O and abnormal patterns 1 to P.

[0047] In this embodiment, the example given is that the correct label y is given as a probability distribution for multiple classes, but it may also be expressed in one-hot notation. That is, the correct label y is y=(y1,y2,…,y C) is expressed as, and each element y c The value can be between 0 and 1, and the sum of all elements in all correct labels is 1.

[0048] The learning unit 12 inputs the training data input matrix X to the classification model 12A, and the classification model 12A calculates the estimated value vector y^(y-hat) represented by the following equation (3) through a forward propagation process.

number

[0049] In equation (3) above, each element y C ^ represents the probability that the input matrix X belongs to class C. The learning unit 12 calculates the objective function based on the difference between the correct label y and the estimated value vector y^. A loss function based on multi-level cross-entropy is used as the objective function. For example, the loss L is expressed by the following equation (4).

number

[0050] In the loss function L of equation (4) above, N represents the total number of input matrices X, which are the input data used for training, and C represents the total number of classes to be classified. c (i) This represents the probability of belonging to class c, given for the i-th input matrix X. c ^ (i) This represents the predicted probability belonging to class c, obtained by inputting the i-th input matrix X (an M×M-dimensional input matrix X) into the CNN.

[0051] The learning unit 12 calculates the gradient by backpropagation or the like to minimize the value of the loss L in equation (4) above, and updates the parameters of each layer included in the classification model 12A. At this time, not only the filter coefficients of the convolutional layers and the weight coefficients of the fully connected layers of the CNN, but also the weight parameters of the fully connected layers included in the SE block 122 are updated. In other words, in this embodiment, SENet, a network configuration combining a CNN (input layer 120, hidden layer 121, output layer 124) and an SE block 122, is learned integrally based on a single objective function. The learned classification model 12A is stored in the memory unit 16, which will be described later.

[0052] The classification unit 13 takes the time-dependent communication volume of each of the multiple ports of the communication terminal 2, acquired by the acquisition unit 10, as an unknown input, provides it to a trained classification model 12A that has learned the correlation of communication characteristics between ports, performs calculations on the trained classification model 12A, and outputs a classification result regarding signs of communication abnormalities. More specifically, for each of the multiple communication terminals 2, the classification unit 13 provides the trained classification model 12A with the input matrix X of equation (1) above, which is created by the input data creation unit 11 based on time-series data of communication volume for each port number collected over a certain period, as the input data to be classified.

[0053] The classification unit 13 at time t k The K input matrices X of equation (1) above, based on the time-series data of the amount of communication for each time, are sequentially input to the pre-trained classification model 12A, and at time t k The system can output classification results for normal or abnormal patterns for each input matrix X. This allows for the continuous output of classification results for abnormal communication signs along a time series over a certain period during which communication volume data has been collected. For example, abnormal patterns include types of abnormal communication signs observed during malware infection, where changes in communication volume on other port numbers are observed in combination, such as an increase in communication volume on port 23 used for Telnet communication and an increase in communication volume on port 443 used for HTTP communication.

[0054] The display unit 14 displays the classification results output by the classification unit 13. The display unit 14 can display the classification results on the display device 107, which will be described later. Alternatively, it can send the classification results to an external server via a network NW.

[0055] The communication management unit 15 issues an instruction to execute a pre-configured remediation measure corresponding to the pattern of the communication anomaly if the classification result output by the classification unit 13 indicates an indication of a communication anomaly. The communication management unit 15 is configured to activate the corresponding remediation scenario according to the output of the classification unit 13, based on remediation scenarios associated with each anomaly pattern (1 to P) that are pre-stored in the memory unit 16. The remediation scenario includes a processing procedure that executes multiple remediation measures in a predetermined order.

[0056] For example, if the output of the classification unit 13 indicates an abnormal pattern (1 to P), the communication management unit 15 issues instructions to perform remedial actions according to the abnormal pattern, such as telnetting to each IP address of the communication terminal 2 and removing malware-infected software or blocking communication with the C&C server. In this case, the communication management unit 15 sends instructions to perform the remedial action to an external network device or management device (not shown) that is provided separately from the communication management device 1. The external network device or management device is, for example, a firewall, router, switch, etc., and based on the instructions from the communication management unit 15, it performs actions such as blocking or restricting communication on a per-IP-address basis for the communication terminal 2.

[0057] Furthermore, the communication management unit 15 can be configured to autonomously execute corrective measures according to abnormal patterns using the management functions provided by the communication management device 1. For example, the communication management unit 15 can perform management communication on a per-IP-address basis of the communication terminal 2 and perform pre-configured controls to delete malware-infected software running on the communication terminal 2, reset settings, or block communication with the C&C server.

[0058] The memory unit 16 stores the learned classification model 12A constructed by the learning unit 12. The learned classification model 12A is a learned model that is applied in common to multiple communication terminals 2. The memory unit 16 also stores rescue scenarios associated with each abnormal pattern (1 to P).

[0059] [Hardware configuration of the communication management device] Next, an example of a hardware configuration for realizing the communication management device 1 having the functions described above will be explained using Figure 3.

[0060] As shown in Figure 2, the communication management device 1 can be implemented, for example, by a computer equipped with a processor 102, main memory 103, communication interface 104, auxiliary storage 105, and input / output I / O 106 connected via a bus 101, and a program to control these hardware resources. The communication management device 1 also includes a display device 107 connected via the bus 101.

[0061] The processor 102 is a circuit or device that performs arithmetic processing, and can be implemented by, for example, a general-purpose central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc. Alternatively, some or all of these may be combined to form the processor.

[0062] The main memory 103 is composed of, for example, volatile random access memory (RAM), and pre-stores programs for the processor 102 to perform various controls and calculations. The processor 102 and the main memory 103 work together to realize the various functions of the communication management device 1, such as the acquisition unit 10, input data creation unit 11, learning unit 12, classification unit 13, presentation unit 14, and communication management unit 15 shown in Figure 1.

[0063] The communication interface 104 is an interface circuit for networking the communication management device 1 with various external electronic devices.

[0064] The auxiliary storage device 105 consists of a read / write storage medium and a drive device for reading and writing various information such as programs and data to the storage medium. The auxiliary storage device 105 can use non-volatile storage such as a hard disk or flash memory as the storage medium.

[0065] The auxiliary storage device 105 has a program storage area for storing the communication management program. The auxiliary storage device 105 also has a program storage area for storing the learning program executed by the communication management device 1. Furthermore, the auxiliary storage device 105 has a program storage area for storing the communication management program executed by the communication management unit 15.

[0066] The auxiliary storage device 105 enables the storage unit 16 described in Figure 1. Furthermore, it may have, for example, a backup area for backing up the aforementioned data and programs.

[0067] The I / O106 is an input / output device that accepts signals from external devices and outputs signals to external devices.

[0068] The display device 107 is composed of an organic EL display, a liquid crystal display, or the like. The display device 107 displays information related to the classification result on the screen.

[0069] [Operation of the communication management device] Next, the operation of the communication management device 1 having the above-described configuration will be explained with reference to the flowcharts in Figures 5 and 6. Figure 5 is a flowchart showing the learning process by the communication management device 1. Figure 6 is a flowchart showing the classification process and communication management process by the communication management device 1 using the learned classification model 12A.

[0070] First, as shown in Figure 5, the acquisition unit 10 acquires the traffic volume (number of bytes, etc.) and number of packets for each of the multiple ports provided by the communication terminal 2 at each time point as the communication volume (step S1). In step S1, the acquisition unit 10 acquires the traffic volume (number of bytes, etc.) and number of packets for each time point over a certain period of time. k The amount of data transmitted across M port numbers (k=1,...,K) is D={x1,x2,...x M Get}.

[0071] Next, the input data creation unit 11 processes each time t over a certain period of time obtained in step S1. k The amount of data transmitted across M port numbers (k=1,...,K) is D={x1,x2,...x M Based on the above equation (1), K M×M dimensional input matrices X are created to produce training data (step S2). The input data creation unit 11 creates training data by assigning a correct label to each of the created input matrices X that corresponds to one of the pre-set normal patterns 1 to O and abnormal patterns 1 to P.

[0072] Next, the learning unit 12 uses the training data generated in step S2 to learn features representing the correlation of communication characteristics between ports using the classification model 12A (step S3). More specifically, the learning unit 12 uses the training data created in step S2 to perform supervised learning of the classification model 12A, which consists of a CNN and SE Net equipped with SE blocks 122. The learning unit 12 calculates the gradient by backpropagation or the like to minimize the value of the loss function L in equation (4) above, and updates the parameters of each layer included in the classification model 12A. At this time, not only the filter coefficients of the convolutional layers and the weight parameters of the fully connected layers are updated, but also the weight parameters of the fully connected layers included in the SE block 122.

[0073] The memory unit 16 stores the trained classification model 12A constructed in the learning process of step S3 (step S4).

[0074] Next, the classification process and communication management process will be explained with reference to the flowchart shown in Figure 6. First, the acquisition unit 10 acquires the traffic volume or number of packets for each time period of each of the multiple port numbers of each communication terminal 2 for a certain period of time (step S10). Subsequently, the input data creation unit 11 acquires the data for each time period of the communication terminal 2 acquired in step S10 for each time period t k The amount of data transmitted across M port numbers (k=1,...,K) is D={x1,x2,...x M Based on}, we create the input matrix X of equation (1) above (step S11).

[0075] Next, the classification unit 13 reads the learned classification model 12A from the memory unit 16 and, using the input matrix X created in step S11 based on the time-dependent communication volume of each of the multiple port numbers provided by the communication terminal 2 as an unknown input, provides it to the learned classification model 12A, which has learned the correlation of communication characteristics between ports, performs calculations on the learned classification model 12A, and outputs a classification result regarding signs of communication abnormalities (step S12).

[0076] In step S12, the classification unit 13 performs the following at each time t over a certain period of time k The amount of data transmitted across M port numbers (k=1,...,K) is D={x1,x2,...x M By sequentially inputting K input matrices X, created based on}, into the pre-trained classification model 12A in a time-series manner, the classification results for abnormal communication signs can be output continuously in a time-series manner. In step S12, the input matrices X created similarly for each of the multiple communication terminals 2 are used as input data to be classified, and the classification results for abnormal communication signs for each of the multiple communication terminals 2 are output.

[0077] Next, the presentation unit 14 presents the classification results obtained from the calculation of the learned classification model 12A by the classification unit 13 in step S12 (step S13). The presentation unit 14 can display the classification results on the display device 107. In addition, for each abnormal pattern (1 to P), the presentation unit 14 can present information on specific malware that has been previously associated with a high degree of relevance, along with the information on the abnormal pattern.

[0078] Next, if the classification result output by the classification unit 13 in step S13 indicates any abnormal communication pattern (1 to P), the communication management unit 15 issues an instruction to the storage unit 16 to execute a recovery process corresponding to the abnormal pattern (1 to P) that is previously stored in the storage unit 16 (step S14).

[0079] For example, in step S14, if the output of the classification unit 13 is abnormal pattern 1, the communication management unit 15 telnets to the IP address of the communication terminal 2 and issues instructions to perform remediation, such as deleting malware-infected software or blocking communication with the C&C server, in accordance with the remediation process for abnormal pattern 1 stored in the storage unit 16. In addition to sending instructions to execute remediation measures to an external network device or management device provided separately from the communication management device 1, the communication management unit 15 can autonomously execute remediation measures according to the abnormal pattern using the management functions provided by the communication management device 1.

[0080] As described above, the communication management device 1 according to this embodiment takes the traffic volume or number of packets for each of the multiple port numbers provided by the communication terminal 2 as an unknown input, provides it to a trained classification model 12A that has learned the correlation of communication characteristics between ports, performs calculations on the trained classification model 12A, and outputs a classification result regarding signs of communication abnormality. Unlike conventional methods that refer to fragmentary features of malware as signatures, the communication management device 1 according to this embodiment captures the correlation between port numbers and changes in communication volume, which appear as behaviors specific to malware infection, as multidimensional features. As a result, even for unknown malware or variants for which signatures have not been registered, signs of communication abnormality can be managed and detected more reliably.

[0081] Furthermore, according to the communication management device 1 of this embodiment, the communication volume vector D of each port number and its transpose vector D T Structural changes in communication patterns are extracted from a correlation matrix based on the product of these factors. Therefore, even when it is difficult to analyze packet contents, characteristic communication behaviors observed in the early stages of malware infection can be captured, enabling early and robust detection of signs of malware infection.

[0082] Furthermore, according to the communication management device 1 of this embodiment, the time-series input matrix X, based on time-series data of communication volume for each port number over a certain period for each managed communication terminal 2, is fed to the trained classification model 12A in order from the input matrix X corresponding to the earliest time, and the classification result is output. As a result, it becomes possible to analyze changes in the communication state that change moment by moment in real time, and it becomes possible to detect signs of abnormal communication associated with malware infection early and with high accuracy before the attack becomes full-scale.

[0083] Furthermore, according to the communication management device 1 of this embodiment, since it includes a classification unit 13 and a communication management unit 15, when an abnormality is detected in a specific port number by the classification model 12A based on the input matrix X, it can automatically execute remedial measures such as network blocking of the target communication terminal 2 based on the detection information indicated by the classification result. This improves the speed of the entire response process, from identifying signs of malware infection to preventing further damage, and minimizes damage.

[0084] In the above-described embodiment, the case in which SENet is used as the classification model 12A was explained. However, the classification model 12A is not limited to SENet; for example, it may be a CNN-only configuration without a self-attention mechanism. Alternatively, the classification model 12A may be composed of a recurrent neural network (RNN) and a Transformer, autoencoder, or graph neural network (GNN) equipped with a self-attention mechanism.

[0085] Furthermore, the above-described embodiment explained the case in which both the learning unit 12, which performs learning processing, and the classification unit 13, which performs classification processing, are mounted on the communication management device 1. However, in addition to the case in which the learning unit 12 and the classification unit 13 are provided as the same hardware configuration, the learning processing and classification processing can also be distributed by multiple servers, etc., on a network NW. When the learning unit 12 is provided on the learning server and the classification unit 13 is provided on the operation server, the present invention can also stand independently as a learning device in which the learning server is equipped only with the learning unit 12 and the purpose is to generate and output a learned classification model 12A.

[0086] Furthermore, in the embodiment described above, the case was explained in which the communication management unit 15, when an abnormal pattern is detected in the managed communication terminal 2, uses the IP address of the communication terminal 2 to execute a pre-configured recovery process. However, the communication management unit 15 can also adopt a configuration in which it uses the IMSI of the communication terminal 2 to execute the recovery process, in addition to the IP address of the communication terminal 2.

[0087] Furthermore, in the embodiments described above, the case where the communication channel is a port (port number) of a communication protocol was used as an example. However, a communication channel is not limited to a port; for example, it may be a logical communication path distinguished by the type of communication protocol, the type of application to be communicated, information identifying a specific service, or a combination of IP addresses or MAC addresses.

[0088] Although embodiments of the communication management device and communication management method of the present invention have been described above, the present invention is not limited to the embodiments described above, and various modifications that a person skilled in the art can envision are possible within the scope of the invention described in the claims. [Explanation of Symbols]

[0089] 1...Communication management device, 2...Communication terminal, 10...Acquisition unit, 11...Input data creation unit, 12...Learning unit, 13...Classification unit, 14...Presentation unit, 15...Communication management unit, 16...Storage unit, 101...Bus, 102...Processor, 103...Main memory, 104...Communication interface, 105...Auxiliary memory, 106...Input / output I / O, 107...Display device, 120...Input layer, 121...Hidden layer, 122...SE block, 123...Multiplication unit, 124...Output layer, NW...Network.

Claims

1. An acquisition unit configured to acquire the amount of data transmitted at each time point for each of the multiple communication channels provided by the communication terminal, A classification unit is configured to take the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal, acquired by the acquisition unit, as an unknown input, provide it to a trained classification model that has learned the correlation of communication characteristics between communication channels, perform calculations on the trained classification model, and output a classification result regarding signs of communication abnormalities. A presentation unit configured to display the classification results output by the classification unit, A communication management device equipped with the following features.

2. In the communication management device according to claim 1, Furthermore, the learning unit is configured to learn feature quantities representing the correlation of communication characteristics between the communication channels by classifying data, using training data in which pre-set patterns of abnormal communication signs are assigned as correct labels to the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal. A storage unit configured to store the learned classification model constructed by the learning unit, A communication management device equipped with the following features.

3. In the communication management device according to claim 1, Furthermore, the system includes a communication management unit configured to issue instructions to execute a pre-set recovery process corresponding to the pattern of the communication abnormality when the classification result output by the classification unit indicates an abnormality in the communication. A communication management device characterized by the following features.

4. In the communication management device according to claim 1, Furthermore, the system includes an input data creation unit configured to create matrix data representing the correlation of communication characteristics between the communication channels based on the amount of communication at each time for each of the multiple communication channels provided by the communication terminal, The classification unit provides the matrix data created by the input data creation unit as an unknown input to the trained classification model. A communication management device characterized by the following features.

5. In the communication management device according to claim 2, The aforementioned classification model includes a convolutional neural network. A communication management device characterized by the following features.

6. In the communication management device according to claim 5, The classification model further includes an attention mechanism configured to weight the features extracted by the convolutional neural network based on the importance of multiple feature maps constituting the features, thereby emphasizing the features. A communication management device characterized by the following features.

7. In the communication management device according to claim 1 or claim 2, The aforementioned multiple communication channels are multiple ports. A communication management device characterized by the following features.

8. A communication management method performed by a computer, A step to obtain the amount of data transmitted at each time point for each of the multiple communication channels provided by the communication terminal, A classification step in which the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal, acquired in the acquisition step, is given as an unknown input to a trained classification model that has learned the correlation of communication characteristics between communication channels, and the trained classification model is used to perform calculations and output a classification result regarding signs of communication abnormality, A presentation step which presents the classification results output in the classification step, and A communication management method comprising the following features.

9. In the communication management method described in claim 8, Furthermore, the learning step involves learning a feature quantity that represents the correlation of communication characteristics between the communication channels by classifying data, using training data in which pre-set patterns of abnormal communication signs are assigned as correct labels to the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal, and a classification model. A storage step in which the trained classification model constructed in the above learning step is stored in the memory unit. A communication management method comprising the following features.

10. In the communication management method described in claim 8, Furthermore, if the classification result output in the classification step indicates an abnormality in the communication, the system includes a communication management step that issues instructions to execute a pre-configured remediation process corresponding to the pattern of the abnormality in the communication. A communication management method characterized by the following:

11. In the communication management method described in claim 8, Furthermore, the system includes an input data creation step that creates matrix data representing the correlation of communication characteristics between the communication channels based on the time-dependent communication volume of each of the multiple communication channels provided by the communication terminal, The classification step provides the matrix data created in the input data creation step as an unknown input to the trained classification model. A communication management method characterized by the following:

Images