Feature amount extraction device and feature amount extraction method

Abstract

A feature amount extraction device (100) comprises an interpolation unit (112) that: when an acquired communication packet included in traffic and acquired from a network is acquired over a plurality of prescribed length periods, divides the acquired communication packet by period to create a communication packet included in each of the periods; when the acquired communication packet is acquired within one period, does not divide the acquired communication packet and designates same as a communication packet included in the relevant period; calculates an interpolation packet length on the basis of the length of the communication packet for each period; and calculates post-interpolation time-series data that is time-series data having the interpolation packet length. The feature amount extraction device also comprises: a cycle calculation unit (113) that calculates the cycle of the post-interpolation time-series data; and a feature amount extraction unit (114) that extracts a feature amount of the traffic on the basis of the post-interpolation time-series data for one cycle.

Description

Feature extraction device and feature extraction method

[0001] The present invention relates to a feature extraction device and a feature extraction method for extracting features of communication traffic.

[0002] As the transition from 4G (fourth generation mobile communication system) to 5G and beyond 5G / 6G progresses, a large number of diverse IoT devices are expected to be connected to networks. To improve network design and management, network operators need to identify the types of devices connected to the network, including mobile phones, PCs, and IoT devices, based on the type of communication traffic (also referred to simply as traffic) and communication services. Furthermore, technologies are known for learning features obtained from traffic behavior, traffic volume / congestion prediction, traffic generation, and traffic classification, with the aim of network design and control, such as anomaly detection and congestion control.

[0003] The device type classification technology described in Non-Patent Document 1 recognizes the type of source device based on traffic. This device type classification technology extracts fixed-length features that are independent of traffic characteristics from time-series traffic data over a fixed period of time that is independent of device. The technology described in Non-Patent Document 1 extracts fixed-length features that are independent of input traffic characteristics from equally spaced time-series traffic data obtained by window aggregation.

[0004] C. Takasaki, et al., "Traffic Behavior-based Device Type Classification," 2023 International Conference on Computing, Networking and Communications (ICNC), Honolulu, HI, USA, 2023, pp. 353-357, doi: 10.1109 / ICNC57223.2023.10074041.

[0005] The features of a communication device are thought to be expressed in the time (period) when communication packets arrive in large numbers. However, the technology of Non-Patent Document 1 extracts features based on traffic over a fixed period of time, regardless of the communication device, and it is thought that there is room for improvement in the quality of the extracted features. The quality of the features refers to the amount of data for the features themselves, the accuracy of classifying device types and application types using the features, the accuracy of traffic prediction, the number of features / number of data (number of samples) / number of epochs (number of learning times) required to create a classification / prediction algorithm (model), etc. The present invention was made in light of this background, and aims to enable the improvement of the quality of traffic-related features.

[0006] In order to solve the above-described problems, a feature extraction device according to the present invention includes: an interpolation unit that, when acquired communication packets included in traffic, which is time-series data including acquisition start times and lengths of acquired communication packets, which are communication packets acquired from a network, are acquired over a plurality of periods of a predetermined length, divides the acquired communication packets for each of the periods to obtain communication packets included in each of the periods; when the acquired communication packets are acquired within one period of the predetermined length, obtains communication packets included in that period without dividing them; calculates an interpolated packet length for each of the periods based on the lengths of the communication packets and calculates interpolated time-series data that is time-series data of the interpolated packet length; a period calculation unit that calculates a period of the interpolated time-series data; and a feature extraction unit that extracts features of the traffic based on one period of the interpolated time-series data.

[0007] According to the present invention, it is possible to improve the quality of traffic-related features.

[0008] FIG. 1 is a functional block diagram of a feature extraction device according to the present embodiment; FIG. 2 is a graph showing one traffic flow that is a target of feature extraction according to the present embodiment; FIG. 3 is a graph showing interpolated time-series data of the traffic in FIG. 2 according to the present embodiment; FIG. 4 is a graph showing feature quantities of the traffic in FIG. 2 according to the present embodiment; FIG. 5 is a flowchart of feature extraction processing according to the present embodiment; FIG. 6 is a graph showing the accuracy of estimating the device type of the source using the feature quantities according to the present embodiment; and FIG. 7 is a hardware configuration diagram showing an example of a computer that realizes the functions of the feature extraction device according to the present embodiment.

[0009] Overview of Feature Extraction Device A feature extraction device according to a mode (embodiment) for carrying out the present invention will be described below. The feature extraction device divides traffic (communication packets / packet time-series data) into periods of a predetermined length. Next, the feature extraction device calculates an interpolated packet length (see equation (1) below) for each period based on the lengths of the divided packets. The feature extraction device then determines a period by treating the interpolated packet length as time-series data, and uses the interpolated packet length for one period as a feature. In other words, the feature extraction device divides and interpolates traffic at equal intervals, extracts packet transmission (acquisition) periods that differ depending on the device through period analysis, and extracts features from one period.

[0010] Calculating features using this method improves the quality of the features. For example, the accuracy of estimating the type of source device based on features is improved compared to conventional methods (see Figure 6 below). Furthermore, the number of data collection days and epochs required to build a machine learning model for estimating the type of source device can be reduced. The amount of data (number of samples) required for training can also be reduced.

[0011] 1 is a functional block diagram of a feature extraction device 100 according to this embodiment. The feature extraction device 100 is a computer, and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, keyboard, and mouse are connected to the input / output unit 180.

[0012] The input / output unit 180 also includes a communication device, and is capable of transmitting and receiving data to and from the packet capture device 500 that collects traffic data. A media drive may also be connected to the input / output unit 180, enabling traffic data to be exchanged using a recording medium. The traffic data includes the acquisition time (acquisition start time) of the acquired packet, the source address, the source port number, the destination address, the destination port number, the protocol number, and the packet length.

[0013] <Feature Extraction Device: Storage Unit> The storage unit 120 includes storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores a traffic database 130 and a program 128. The program 128 includes a description of a feature extraction process (see FIG. 5 ), which will be described later.

[0014] The traffic database 130 stores the packet capture time, source address, source port number, destination address, destination port number, protocol number, and packet length in association with each other.

[0015] <Feature Extraction Device: Control Unit> The control unit 110 includes a CPU (Central Processing Unit) and is equipped with a traffic collection unit 111, an interpolation unit 112, a period calculation unit 113, and a feature extraction unit 114. The control unit 110 may also include an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), etc.

[0016] <<Control Unit: Traffic Collection Unit>> The traffic collection unit 111 collects traffic and stores it in the traffic database 130. For example, the traffic collection unit 111 stores traffic data acquired by the packet capture device 500 in the traffic database 130.

[0017] 2 is a graph showing one traffic flow that is the target of feature extraction according to this embodiment. The horizontal axis of the graph represents the packet acquisition time (unit: seconds), and the vertical axis represents the packet length (unit: bytes). In this embodiment, a traffic flow is a set of packets that have the same source address, source port number, destination address, destination port number, and protocol number. Other traffic flows will be described later. The acquired traffic data includes one or more traffic flows, but when it is clear from the context that it is a single traffic flow, it may be simply referred to as traffic.

[0018] Feature Extraction Device: Interpolation Unit Returning to Fig. 1, the description of the control unit 110 continues. The interpolation unit 112 divides packets included in the traffic flow into periods of a predetermined length according to the acquisition time, and calculates the length of the divided packets (divided packets) for each period. Next, the interpolation unit 112 calculates the interpolated packet length based on the lengths of the divided packets.

[0019] Let us assume that the length of a period is 1 second, and a 4 MB packet is received over 2 seconds starting from 0.5 seconds (0.5 seconds after the start of the first period). Then, the lengths of the fragmented packets in the first to third periods are 1 MB, 2 MB, and 1 MB. When a packet is contained in one period, the original packet is regarded as a fragmented packet. Hereinafter, it is assumed that packets are fragmented by periods, and fragmented packets are also simply referred to as packets. The interpolation unit 112 performs the interpolation for the nth period T ｎ Interpolated packet length B ｎ is calculated using the following formula (1).

[0020]

[0021] Here, the meaning of each symbol is as follows: min() is the minimum value of the number in parentheses. ｉ is the period T ｎ The last packet P ｉ The length of l ｉ＋１ is the period T ｎ＋１ The first packet P ｉ＋１ The length of Pｉ＋１ Is P ｉ The next packet of t. mean() is the average value of the numbers in the parentheses. ｉ Is, P ｉ The meaning of the start time will be explained later. ｉ－１ is the packet P ｉ The previous packet P ｉ－１ is the start time of ｉ＋１ is the packet P ｉ＋１ This is the start time.

[0022] The start time of a packet is explained below. When a packet captured from a network is divided according to a period, the start time of the first divided packet is the time when the capture started (acquisition time, capture time). The start times of the second and subsequent divided packets are the start times of the period that includes the divided packets. When a captured packet is received within one period, the start time is the time when the capture started.

[0023] The interpolation unit 112 ｎ The last packet P ｉ The length of the next packet P ｉ＋１ The length of the packet P ｉ Packets P before and after ｉ－１ , P ｉ＋１ The ratio of the start time interval between ｉ -t ｉ－１ ) / (t ｉ＋１ -t ｉ ) based on the interpolated packet length B ｎ The interpolated packet length B ｎ is also referred to as interpolated time series data. Fig. 3 is a graph showing interpolated time series data of the traffic (traffic flow) of Fig. 2 according to this embodiment. The length of the period is 100 ms. The vertical axis represents the interpolated packet length in bytes.

[0024] <Feature Extraction Device: Period Calculation Unit> Returning to FIG. 1 , the description of the control unit 110 continues. The period calculation unit 113 calculates the period of the interpolated time series data. The period calculation unit 113 calculates the period of the interpolated time series data using a frequency analysis method such as autocorrelation, periodogram, fast Fourier transform, or wavelet analysis. The period calculation unit 113 may perform a stationarity determination before calculating the period, or may calculate the period after determining that the data is not stationary. Methods for determining stationarity include, for example, an ADF test (Augmented Dickey-Fuller test) and autocorrelation.

[0025] <Feature Extraction Device: Feature Extraction Unit> The feature extraction unit 114 extracts features based on one cycle of interpolated time series data. For example, the feature extraction unit 114 may extract one cycle of interpolated time series data itself as a feature. The feature extraction unit 114 may divide the interpolated time series data into periods and then use any one cycle of interpolated time series data as a feature. The feature extraction unit 114 may also use the average of multiple one cycles of interpolated time series data as a feature. Alternatively, the feature extraction unit 114 may use the results of frequency analysis of the period and one cycle of interpolated time series data as a feature. Figure 4 is a graph showing one cycle of interpolated time series data, which is a feature of the traffic in Figure 2 according to this embodiment. The width of the graph is 126.6 seconds, which is the period of the interpolated time series data (see Figure 3) extracted by the period calculation unit 113.

[0026] <Feature Extraction Process> Fig. 5 is a flowchart of the feature extraction process according to this embodiment. The process of extracting traffic flow features will be described with reference to Fig. 5. It is assumed that traffic data has already been stored in the traffic database 130 at the start of the feature extraction process.

[0027] In step S11, the traffic collection unit 111 acquires one traffic flow from the traffic database 130. In step S12, the interpolation unit 112 calculates interpolated time-series data based on the traffic flow acquired in step S11.

[0028] In step S13, if the interpolated time series data is stationary (step S13→YES), the period calculation unit 113 proceeds to step S15, and if not stationary (step S13→NO), the period calculation unit 113 proceeds to step S14. In step S14, the period calculation unit 113 calculates the period of the interpolated time series data.

[0029] In step S15, the feature extractor 114 extracts one period of interpolated time series data as a feature of the traffic flow. If the interpolated time series data is stationary (step S13 → YES), the feature extractor 114 extracts the interpolated time series data for a predetermined period as a feature.

[0030] <Features of the Feature Extraction Device> The feature extraction device 100 divides captured packets according to a period and calculates the packet length after division for each period. Next, the feature extraction device 100 calculates an interpolated packet length based on the divided packet lengths to obtain interpolated time-series data. Furthermore, the feature extraction device 100 extracts one period of the interpolated time-series data of the traffic flow as a feature.

[0031] In conventional technology, feature amounts are calculated based on the acquisition start time and packet length of the captured packets before they are divided. However, the feature extraction device 100 calculates feature amounts based on the communication volume for each period (packet length after division), thereby enabling calculation of feature amounts according to the communication status for each period.

[0032] For example, in the conventional technique, when the time when packets arrive in a concentrated manner is shorter than the window (packet acquisition time) period, data from a time period with few characteristics is also extracted. Furthermore, in the conventional technique, when the time when packets arrive in a concentrated manner is longer than the window period, data with insufficient characteristics is extracted. In contrast, the technique of this embodiment acquires features based on data that matches the traffic flow period, making it possible to adequately capture the characteristics of the traffic flow.

[0033] FIG. 6 is a graph showing the estimation accuracy of the source device type using features according to this embodiment. A deep learning discrimination model (classification model) using features as explanatory variables is used for the estimation. The horizontal axis represents the number of days (2 days / 4 days / 8 days) required to collect traffic data to build the discrimination model. The vertical axis represents the estimation accuracy. Compared to the estimation accuracy using features of the conventional method, shown by the dotted line graph, the accuracy is higher when using features of the method according to this embodiment, shown by the solid line graph. This method also demonstrates that a highly accurate discrimination model can be built using data from a short period of time. Furthermore, learning is more stable than with conventional methods, requiring fewer epochs for learning. In other words, the feature extraction device 100 extracts high-quality features.

[0034] <<Modification: Traffic Flow>> In the above-described embodiment, a traffic flow is a set of packets that have the same source address, source port number, destination address, destination port number, and protocol number. A traffic flow may be traffic data with the same source physical address (MAC address), or traffic that has been grouped and aggregated based on some aspect (e.g., source address).

[0035] <<Modification: Interpolation Unit>> In the above embodiment, the interpolation unit 112 interpolates the last packet P ｉ Instead, for example, the interpolation unit 112 focuses on the first packet P ｉ By focusing on the period T ｎ Interpolated packet length B ｎ may be calculated.

[0036]

[0037] Here, ｉ－１ is the packet P ｉ The previous packet P ｉ－１ The length of P ｉ－１ is the period T ｎ－１ The interpolation unit 112 also interpolates the packet length l ｉ for period T ｎ The sum of the lengths of the packets included in ｎand use the following formula (3) to calculate the period T ｎ Interpolated packet length B ｎ may be calculated.

[0038]

[0039] In the formula (3), the period T ｎ , T ｎ＋１ However, as in the case of equation (2), the period T ｎ－１ , T ｎ Furthermore, although the right-hand sides of the formulas (1) to (3) are for finding the minimum value, they may also be for finding the maximum value.

[0040] Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, in the above-described embodiments, the interpolated packet length is calculated to obtain the interpolated time-series data, but the maximum value / minimum value / average value / sum of the packet lengths within a period may be used as the corrected packet length.

[0041] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0042] <Hardware Configuration> The feature extraction device 100 according to the embodiment described above is realized by a computer 900 having a configuration as shown in Fig. 7, for example. Fig. 7 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the feature extraction device 100 according to the embodiment. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F (Interface) in Fig. 7), a communication interface 906 (referred to as a communication I / F in Fig. 7), and a media interface 907 (referred to as a media I / F in Fig. 7). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include an HDD in addition to the SSD 904.

[0043] The CPU 901 operates based on programs stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 in Fig. 1. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 starts up, programs related to the hardware of the computer 900, and the like. The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 and outputs generated data to the output device 911 via the input / output interface 905.

[0044] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (e.g., the packet capture device 500) via a communication network and outputs the data to the CPU 901. It also transmits data generated by the CPU 901 to other devices via the communication network. The media interface 907 reads programs or data stored on a recording medium 912 and outputs the programs to the CPU 901 via the RAM 903. The CPU 901 loads the programs from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded programs. The recording medium 912 may be an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical Disk), a magnetic recording medium, a conductive memory tape medium, or a semiconductor memory.

[0045] For example, when the computer 900 functions as the feature extraction device 100 according to the above-described embodiment, the CPU 901 of the computer 900 executes the program 128 (see FIG. 1 ) loaded onto the RAM 903, thereby realizing the functions of the feature extraction device 100. The CPU 901 reads and executes the program from the recording medium 912. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install and execute the program 128 from the recording medium 912 onto the SSD 904.

[0046] <Effects> The effects of the feature extraction device 100 will be described below.

[0047] The feature extraction device 100 according to the embodiment described above is characterized by including an interpolation unit 112, a period calculation unit 113, and a feature extraction unit 114. When acquired communication packets included in traffic, which is time-series data including the acquisition start times and lengths of acquired communication packets, are acquired from a network, and are acquired over multiple periods of a predetermined length, the interpolation unit 112 divides the acquired communication packets for each period to obtain communication packets included in each of the periods. Furthermore, when acquired communication packets are acquired within a single period of a predetermined length, the interpolation unit 112 does not divide the acquired communication packets into communication packets included in that period. Next, the interpolation unit 112 calculates an interpolated packet length for each period based on the length of the communication packets. Furthermore, the interpolation unit 112 calculates interpolated time-series data, which is time-series data of the interpolated packet length. The period calculation unit 113 calculates the period of the interpolated time-series data. The feature extraction unit 114 extracts traffic features based on one period of the interpolated time-series data.

[0048] According to this feature extraction device 100, by calculating features based on the communication volume for each period, features according to the communication status for each period are calculated. Furthermore, features are calculated taking into account the traffic periodicity. Therefore, features of higher quality can be obtained than with conventional methods. Furthermore, an estimation model can be generated based on data acquired over a short period. Furthermore, learning is more stable than with conventional methods, and learning can be performed quickly (with a smaller number of epochs). Furthermore, it becomes possible to estimate the type of source device and the type of communication service with high accuracy.

[0049] The interpolation unit 112 according to the above-described embodiment calculates the interpolation packet length for a period based on (a) the length of the first communication packet included in the period, (b) the length of the second communication packet immediately before the first communication packet or the length of the third communication packet immediately after the first communication packet, and (c) the ratio of the start time difference between the first communication packet and the second communication packet to the start time difference between the first communication packet and the third communication packet, where the second communication packet or the third communication packet is a communication packet included in the period before or after the period (see Equation (1) or Equation (2)).

[0050] The feature extraction device 100 uses the ratio of the acquisition intervals between the preceding and following packets to interpolate the waveform (packet length) so that it is evenly spaced. Feature extraction is performed by focusing on the length of each communication packet included in the period and the time intervals between packets. Therefore, even with small-scale data, it is expected that higher-quality feature extraction can be achieved.

[0051] The interpolation unit 112 according to the above-described embodiment calculates the interpolation packet length for a period based on (a) the sum of the lengths of the communication packets included in the first period, which is the period in question, (b) the sum of the lengths of the communication packets included in the second period, which is the period immediately before the first period, or the sum of the lengths of the communication packets included in the third period, which is the period immediately after the first period, and (c) the ratio of the start time difference between the first communication packet included in the first period and the second communication packet immediately before the first communication packet, and the start time difference between the first communication packet and the third communication packet immediately after the first communication packet. Here, the second communication packet or the third communication packet is the communication packet included in the second period or the third period.

[0052] According to this feature extraction device 100, features are calculated that focus on the length of the communication packets included in the period and the time intervals between the packets, and it is expected that features of even higher quality can be obtained.

[0053] 100 Feature extraction device 111 Traffic collection unit 112 Interpolation unit 113 Period calculation unit 114 Feature extraction unit 130 Traffic database

Claims

1. When the acquired communication packet included in the traffic, which is time-series data including the acquisition start time and length of the acquired communication packet acquired from a network, is acquired over a plurality of periods of a predetermined length, the acquired communication packet is divided for each period to be communication packets included in each period. When the acquired communication packet is acquired within one period of the predetermined length, it is used as the communication packet included in that period without division. For each period, an interpolated packet length is calculated based on the length of the communication packet, and an interpolation unit that calculates interpolated time-series data, which is time-series data of the interpolated packet length, a period calculation unit that calculates the period of the interpolated time-series data, and a feature amount extraction unit that extracts a feature amount of the traffic based on the interpolated time-series data for one period are provided. A feature amount extraction device.

2. The interpolation unit calculates the interpolated packet length of the period based on the length of the first communication packet included in the period, the length of the second communication packet one before the first communication packet, or the length of the third communication packet one after the first communication packet, and the ratio of the start time difference between the first communication packet and the second communication packet and the start time difference between the first communication packet and the third communication packet. The second communication packet or the third communication packet is a communication packet included in a period before or after the period. The feature amount extraction device according to claim 1.

3. The interpolation unit calculates the interpolated packet length of the period based on the sum of the lengths of the communication packets included in the first period, which is the period, the sum of the lengths of the communication packets included in the second period, which is the period one before the first period, or the sum of the lengths of the communication packets included in the third period, which is the period one after the first period, and the ratio of the start time difference between the first communication packet included in the first period and the second communication packet one before the first communication packet and the start time difference between the first communication packet and the third communication packet one after the first communication packet. The second communication packet or the third communication packet is a communication packet included in the second period or the third period. The feature amount extraction device according to claim 1.

4. When the acquisition communication packet included in the traffic, which is time-series data including the acquisition start time and length of the acquisition communication packet that is a communication packet acquired from the network, is acquired over a plurality of periods of a predetermined length, the step of dividing the acquisition communication packet for each period to obtain communication packets included in each period; when the acquisition communication packet is acquired within one period of the predetermined length, the step of using the communication packet included in that period without division; for each period, the step of calculating an interpolation packet length based on the length of the communication packet; the step of calculating interpolated time-series data that is time-series data of the interpolation packet length; the step of calculating the period of the interpolated time-series data; and the step of extracting a feature amount of the traffic based on the interpolated time-series data for one period. A feature amount extraction method that executes these steps.

Images