Feature amount evaluation device and feature amount evaluation method

Abstract

A feature amount evaluation device (100) comprises: a feature amount evaluation unit (115) that evaluates the magnitudes of feature amounts (interpolation packet lengths) of multiple pieces of series length time-series data obtained by dividing packet time-series data into predetermined series lengths (periods); and a feature amount extraction unit (114) that extracts series length time-series data having a large feature amount evaluated by the feature amount evaluation unit. The feature amount evaluation unit (115) moves the starting point of the series length time-series data multiple times by a search interval at a time, and the feature amount extraction unit (114) extracts series length time-series data having a feature amount larger than a reference value from among multiple pieces of series length time-series data generated by the movement.

Description

Feature evaluation device and feature evaluation method

[0001] The present invention relates to a feature amount evaluation device and a feature amount evaluation method for evaluating the feature amount of a communication packet.

[0002] As the transition from 4G (fourth generation mobile communication system) to 5G and beyond 5G / 6G progresses, a large number of diverse IoT devices are expected to be connected to networks. To improve network design and management, network operators need to recognize the types of devices connected to their networks, including mobile phones, PCs, and IoT devices, based on the type of communication traffic and communication services. Furthermore, technologies are known for learning features obtained from traffic behavior, and for traffic volume / congestion prediction, traffic generation, and traffic classification, with the aim of network design and control, such as anomaly detection and congestion control.

[0003] The device type classification technology described in Non-Patent Document 1 recognizes the type of source device based on traffic. This device type classification technology extracts fixed-length features that are independent of traffic characteristics from time-series traffic data over a fixed period of time that is independent of the device. The technology described in Non-Patent Document 1 extracts fixed-length features that are independent of input traffic characteristics from equally spaced time-series traffic data obtained by window aggregation. Non-Patent Document 2 also discloses a method for automatically extracting time-series data that exhibit different characteristics for each input traffic by interpolating unevenly spaced traffic data to even intervals and performing periodic analysis.

[0004] Chikako TAKASAKI, Tomohiro KORIKAWA, Kyota HATTORI, Hidenari OHWADA, Device Type Classification Based on Two-Stage Traffic Behavior Analysis, IEICE Transactions on Communications, 2024, Volume E107.B, Issue 1, Pages 117-125, Released on J-STAGE January 01, 2024. Chikako TAKASAKI, Tomohiro KORIKAWA, Kyota HATTORI, Hidenari OHWADA, "Device Estimation by Periodic Analysis Using Equally Interval Interpolation of Traffic", IEICE Technical Report, Institute of Electronics, Information and Communication Engineers, December 2023, NS2023-154, pp.163-168

[0005] The features of a communication device are thought to be expressed in the time (period) when communication packets arrive in large numbers. However, the technology in Non-Patent Document 1 extracts features based on traffic (packets, etc.) over a certain period of time, regardless of the communication device, and it is thought that there is room for improvement in the quality of the extracted features. The quality of the features refers to the amount of data of the features themselves, the accuracy of classifying device types and application types using the features, the accuracy of traffic prediction, the number of features / number of data (number of samples) / number of epochs (number of learning times) required to create a classification / prediction algorithm (model), etc.

[0006] The present invention has been made in view of the above background, and an object of the present invention is to improve the quality of feature quantities related to packets.

[0007] To achieve the above object, a feature evaluation device according to a first aspect of the present invention includes a feature evaluation unit that evaluates the magnitude of feature quantities (e.g., packet statistics (packet length, interpolated packet length, number of packets, and their average values)) of multiple sequence length time series data obtained by dividing packet time series data (e.g., non-uniformly-interval time series data, uniformly-interval time series data) into predetermined sequence lengths (including periods), and a feature extraction unit that extracts sequence length time series data with large feature quantities evaluated by the feature evaluation unit, wherein the feature evaluation unit shifts the start point of the sequence length time series data multiple times by search intervals, and the feature extraction unit extracts sequence length time series data with feature quantities larger than a reference value from the multiple sequence length time series data generated by the shifting. The device further includes a feature combination unit that combines multiple cycle length time series data based on the evaluated feature quantities, and it is preferable that the feature extraction unit selects, from the multiple extracted sequence length time series data, cycle length time series data with feature quantities larger than a reference value.

[0008] A feature evaluation device according to a second aspect of the present invention includes an interpolation unit that interpolates received non-equidistant packet time series data to form equal intervals for each unit time; a period calculation unit that calculates a period of the equally-spaced packet time series data interpolated by the interpolation unit; a feature extraction unit that extracts a plurality of cycle length time series data (sequence length time series data) having the lengths of the cycles from either the received non-equidistant packet time series data or the equally-spaced packet time series data; a feature evaluation unit that evaluates the magnitudes of features of the plurality of cycle length time series data; and a feature combination unit that combines a plurality of the cycle length time series data based on the evaluated features, wherein the feature extraction unit selects, from the extracted plurality of cycle length time series data, cycle length time series data whose feature value is greater than a reference value.

[0009] According to the present invention, it is possible to improve the quality of the feature quantity related to the packet.

[0010] 1 is a functional block diagram of a feature evaluation device according to an embodiment of the present invention. FIG. 2 is a graph showing time series data of packet lengths to be evaluated by the feature evaluation device according to an embodiment of the present invention. FIG. 3 is a graph showing time series data of interpolated packet lengths obtained by interpolating the packet length time series data of FIG. 2. FIG. 4 is a diagram showing the time series data after interpolation divided by a predetermined series length and sections with large feature amounts selected. FIG. 5 is a diagram showing an example of a waveform obtained by combining sections with large feature amounts. FIG. 6 is a diagram showing an example of a waveform obtained by combining sections with large feature amounts in chronological order. FIG. 7 is a flowchart for explaining feature evaluation processing according to an embodiment of the present invention. FIG. 8 is a diagram showing the relationship between the number of learning iterations and test loss in this embodiment. FIG. 9 is a diagram showing the relationship between the number of learning iterations and accuracy in this embodiment. FIG. 10 is a hardware configuration diagram showing an example of a computer that realizes the functions of the feature evaluation device according to an embodiment of the present invention. FIG. 11 is a diagram showing an example of a combined waveform as a comparative example of the present invention. FIG. 12 is a diagram showing the relationship between the number of iterations and test loss when training with "iterative combination", a comparative example of the present invention. FIG. 13 is a diagram showing the relationship between the number of iterations and accuracy when training with "iterative combination", a comparative example of the present invention. FIG. 14 is a diagram showing the relationship between the number of iterations and test loss when training with "zero-filling combination", a comparative example of the present invention. FIG. 10 is a diagram showing the relationship between the number of repetitions and accuracy when learning using "zero-filling connection," which is a comparative example of the present invention.

[0011] Overview of Feature Evaluation Device The following describes a feature evaluation device according to one embodiment of the present invention. The feature evaluation device executes a feature evaluation method consisting of multiple steps. First, the feature evaluation device executes a packet division step in which traffic (non-equidistant time-series data of packets) is divided into units of time. Next, the feature extraction device executes an interpolated packet length calculation step in which an interpolated packet length (see Equation (1) described below) is calculated for each unit of time (period) based on the lengths of the divided packets. This generates time-series data of interpolated packet lengths (equidistant packet time-series data). Furthermore, the feature extraction device executes a period extraction step in which a period T is calculated by regarding the interpolated packet length as time-series data. The feature extraction device then uses packet statistics (packet length, interpolated packet length, and number of packets) included in the period of the packet time-series data as features.

[0012] Furthermore, the feature extraction device executes a feature evaluation step of evaluating the magnitude of feature amounts of equally-spaced packet time series data (cycle length time series data) divided by the period T. The feature extraction device then selects multiple cycle length time series data with feature amounts greater than a reference value. At this time, it is preferable to shift the start point of the cycle length time series data by the search time and select the cycle length time series data with the largest feature amount from the multiple cycle length time series data generated by the shift. The feature extraction device then executes a combining step of combining the selected multiple cycle length time series data in descending order of feature amount or in chronological order.

[0013] Furthermore, the feature extraction device performs machine learning (including deep learning) using the combined multiple period length time series data.

[0014] Calculating features using this method improves the quality of the features. This improves the accuracy of estimating the type of source device based on the features. It also reduces the number of days and epochs of data collection required to build a machine learning model for estimating the type of source device. It also reduces the amount of data (number of samples) required for learning.

[0015] 1 is a functional block diagram of a feature evaluation device 100 according to this embodiment. The feature evaluation device 100 is a computer, and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, a keyboard, and a mouse are connected to the input / output unit 180.

[0016] The input / output unit 180 also includes a communication device, and is capable of transmitting and receiving data to and from a packet capture device 500 that collects traffic data. That is, the feature evaluation device 100 is connected to a traffic aggregation point such as a base station or access point of a network. In other words, the feature evaluation device 100 is connected to a connection point (node) of a network to which multiple types of devices are connected.

[0017] Furthermore, a media drive may be connected to the input / output unit 180, and the feature evaluation device 100 may be configured to be able to exchange communication packet data using a recording medium. Note that the traffic data includes not only the communication packets but also the acquisition time (acquisition start time) of the acquired packets, the source address, the source port number, the destination address, the destination port number, the protocol number, and the packet length.

[0018] <Feature Extraction Apparatus: Storage Unit> The storage unit 120 includes storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores a database 130 and a program 128. The program 128 includes a description of a feature evaluation process (see FIG. 8 ), which will be described later.

[0019] The database 130 stores communication packet data, the time the communication packet was acquired (capture time), the source address, the source port number, the destination address, the destination port number, the protocol number, and the packet length in association with each other.

[0020] <Feature Extraction Device: Control Unit> The control unit 110 is configured to include a CPU (Central Processing Unit) and is equipped with a packet collection unit 111, an interpolation unit 112, a period calculation unit 113, a feature extraction unit 114, a feature evaluation unit 115, a feature combination unit 116, and a feature learning unit 117. The control unit 110 may be configured to include an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), or the like.

[0021] <<Control Unit: Packet Collection Unit>> The packet collection unit 111 collects traffic and stores packets included in the collected traffic in the database 130. For example, the packet collection unit 111 stores packets acquired by the packet capture device 500 in the database 130. Note that in this embodiment, a traffic flow is a set of packets that have the same source address, source port number, destination address, destination port number, and protocol number.

[0022] 2 is a diagram showing time-series data of packet lengths that are the subject of feature evaluation according to this embodiment. The horizontal axis of the diagram represents the packet acquisition time [sec], and the vertical axis represents the packet length [bytes]. The maximum value t=30,000 [sec] on the horizontal axis represents the time when an input packet is TA-captured for a certain period of time.

[0023] <Feature Extraction Device: Interpolation Unit> The interpolation unit 112 divides the packets collected by the packet collection unit 111 into unit time segments, and calculates the length of each divided packet (divided packet) for each unit time segment.

[0024] Let us assume that the length of the unit time (period) is 1 second, and the feature evaluation device 100 receives a 4 MB packet over 2 seconds, starting at 0.5 seconds (0.5 seconds after the start of the first period). Then, the lengths of the fragmented packets in the first to third periods are 1 MB, 2 MB, and 1 MB. Note that when a packet is contained in one period, the original packet is regarded as a fragmented packet. Hereinafter, it is assumed that packets are fragmented by periods, and fragmented packets are also simply referred to as packets. The interpolation unit 112 calculates the fragmented packets in the nth period T ｎ Interpolated packet length B ｎ is calculated using the following formula (1).

[0025]

[0026] Here, the meaning of each symbol is as follows: min() is the minimum value of the number in parentheses. ｉ is the period T ｎ The last packet P ｉ The length of l ｉ＋１ is the period T ｎ＋１ The first packet P ｉ＋１ The length of P ｉ＋１ Is P ｉ The next packet of t. mean() is the average value of the numbers in the parentheses. ｉ Is, P ｉ The meaning of the start time will be explained later. ｉ－１ is the packet P ｉ The previous packet P ｉ－１ is the start time of ｉ＋１ is the packet P ｉ＋１ This is the start time.

[0027] The start time of a packet is explained below. When a packet captured from a network is divided according to a period, the start time of the first divided packet is the time when the capture started (acquisition time, capture time). The start times of the second and subsequent divided packets are the start times of the period that includes the divided packets. When a captured packet is received within one period, the start time is the time when the capture started.

[0028] The interpolation unit 112 ｎ The last packet P ｉ The length of l ｉ , the next packet P ｉ＋１ The length of l ｉ＋１ , and packet P ｉ Packets P before and after ｉ－１ , P ｉ＋１ is the ratio of the start time interval between ｉ -t ｉ－１ ) / (t ｉ＋１ -t ｉ ) based on the interpolated packet length B ｎ The interpolation packet length B ｎ is also referred to as interpolated time series data.

[0029] 3 is a diagram showing interpolated time series data obtained by interpolating the time series data of the packet length in FIG. ｎ The horizontal axis represents time [sec], and the vertical axis represents the interpolation packet length [bytes].

[0030] <Feature Extraction Device: Period Calculation Unit> Returning to FIG. 1 , the description of the control unit 110 will continue. The period calculation unit 113 calculates the period T ( FIG. 3 ) of the interpolated time series data. The period calculation unit 113 calculates the period T of the interpolated time series data using a frequency analysis method such as autocorrelation, periodogram, fast Fourier transform, or wavelet analysis. The period calculation unit 113 may perform a stationarity determination before calculating the period T, or may calculate the period T after determining that the data is not stationary. Methods for determining stationarity include, for example, an ADF test (Augmented Dickey-Fuller test) and autocorrelation.

[0031] 3, the interpolated time series data of a predetermined time (t11-t0) = 400 [sec] is equally divided into a plurality of sections T1 (t0 to t1), T2 (t1 to t3), T3 (t3 to t5), T4 (t5 to t6), T5 (t6 to t7), T6 (t7 to t9), and T7 (t9 to t11). The duration of the sections T1, T2, ..., T7 is equal to the period T.

[0032] <Feature Extraction Device: Feature Extraction Unit> The feature extraction unit 114 extracts features based on one cycle of interpolated time-series data. For example, the feature extraction unit 114 extracts the average value of one cycle of interpolated time-series data, i.e., the average value of the interpolated packet length Bn, as the feature. The feature extraction unit 114 may also extract the period and the frequency analysis result of one cycle of interpolated time-series data as the feature.

[0033] <Feature Amount Evaluation Unit> The feature amount evaluation unit 115 evaluates the magnitude of the feature amount extracted by the feature amount extraction unit 114 (e.g., the average value of the interpolated packet length Bn). If the feature amount is a vector, the magnitude is evaluated. That is, the feature amount evaluation unit 115 determines whether the feature amount (e.g., the interpolated packet length Bn) of a predetermined sequence length τ (e.g., τ = period T (FIG. 3)) is greater than a reference value. For example, in the period length time series data of FIG. 3, the feature amount evaluation unit 115 determines that the feature amounts (the average of the interpolated packet length Bn) of sections T1, T2, T3, T6, and T7 are large, and the feature amounts of sections T4 and T5 are small.

[0034] The feature evaluation unit 115 also includes a search interval shift unit 115a. In Fig. 3, the interpolated time series data is divided at the period T, but it can be divided at any series length τ (Fig. 4).

[0035] FIG. 4 shows how the interpolated time series data is divided by an arbitrary sequence length τ, and intervals Ta, Tb, and Tc with large feature quantities are selected. Note that the intervals Ta, Tb, and Tc are assumed not to overlap with one another. The search interval shifting unit 115a shifts the interval (window) of sequence length τ for evaluating feature quantities by a predetermined search interval to generate multiple (numerous) intervals. The feature quantity evaluation unit 115 then evaluates the feature quantities of the multiple intervals generated by the shifting and selects the interval with the largest feature quantity. For example, in FIG. 4, the period T (FIG. 3) is set to sequence length τ (τ=T), and the search interval shifting unit 115a shifts the start point t1 (FIG. 3) of interval T2 (FIG. 2) multiple times by the search interval. The interval with the largest feature quantity (e.g., the average of the interpolated packet lengths Bn) is designated Tb. Here, the start point is t2, and the total shift amount is ΔT=(t2-t1). The section Ta is the section T1 (FIG. 3), and the section Tc is the section where the feature amount becomes maximum by moving the section T6 (FIG. 3).

[0036] <Feature Quantity Combining Unit> The feature quantity combining unit 116 combines sections in which the feature quantities evaluated by the feature quantity evaluating unit 115 are greater than a reference value. Fig. 5 is a diagram showing an example of a waveform in which sections with large feature quantities are combined. Fig. 5 shows the combined waveform in which sections T1, T2, T3, T6, and T7 in which the feature quantities are greater than the reference value are combined in the period length time series data of Fig. 3. As a result, sections T4 and T5 (Fig. 3) in which the feature quantities are smaller than the reference value are deleted, and the waveform is shortened to five periods (5T = 300 [Sec]).

[0037] Fig. 6 is a diagram showing an example of a waveform in which sections are combined in descending order of feature amount. Fig. 6 shows sections Ta, Tb, and Tc of sequence length τ = T in Fig. 5 combined in descending order of feature amount. Section Tb has a larger feature amount than section Ta. Also, section Ta has a larger feature amount than section Tc. As a result, sections Tb, Ta, and Tc are combined in this order, and data from periods (t1 to t2), (t4 to t8), and (t10 to t11) have been deleted.

[0038] 7 is a diagram showing an example of a waveform in which sections with large feature amounts are combined in chronological order. In Fig. 7, unlike Fig. 6, sections Ta, Tb, and Tc are combined in this order.

[0039] 8 is a flowchart illustrating the feature evaluation process according to this embodiment. The following describes the feature evaluation process for evaluating the feature of an interpolated packet. It is assumed that traffic data has already been stored in the database 130 at the start of the feature evaluation process.

[0040] In step S1, the packet collection unit 111 divides (groups) packets into units to be classified / predicted using either or both of a source identification code (source MAC address / IP address / port number) and a destination identification code (destination MAC address / IP address / port number) (step S1). As a result, for example, packets are labeled with the type of device connected to the network, and a learning dataset is generated. After processing in step S1, the interpolation unit 112 converts the non-equidistant packets into equidistant time series data (time series data with an interpolated packet length) (step S2).

[0041] After the process of step S2, the period calculation unit 113 calculates the period T of the interpolated time series data (step S3). As a result, the equally-spaced time series data is divided into a plurality of intervals T1, T2, ..., T7 (FIG. 3). Note that period extraction may be performed every time a packet is input. Alternatively, period extraction may be omitted by performing the process periodically, such as once a day, and creating a dictionary of packet grouping units (MAC addresses, IP addresses, etc.) and periods T.

[0042] After the process of step S3, it is determined whether extraction of the period T (step S3) has been completed for all the divided packets divided in step S1 (step S4). If extraction of the period T (FIG. 3) has not been completed for all the divided packets ("Incomplete" in S4), the control unit 110 returns the process to S2 and performs conversion to equally-spaced time-series data. On the other hand, if extraction of the period T has been completed for all the divided packets ("Completed" in S4), the feature extraction unit 114 extracts a feature (e.g., interpolated packet length) (step S5). The feature may be a statistical value obtained from the header, such as the number of packets included in the periodic interval of the original traffic waveform, the total / average packet length, or the number of transition points included in the periodic interval of the waveform after equally-spaced conversion, or the type (variance) of the converted value.

[0043] After processing step S5, the search interval shifting unit 115a shifts the start point of an interval of an arbitrary sequence length τ (here, sequence length τ = period T) multiple times by a predetermined search interval (step S6). That is, the magnitude of the waveform features in the periodic interval slid by the window w for the uniformly spaced time series data is quantified. By the shifting in step S6, multiple waveforms of sequence length τ are generated. After processing step S6, the feature evaluation unit 115 evaluates the magnitude of the feature (e.g., interpolated packet length) of the uniformly spaced time series data (interpolated packets) for each period (step S7). Furthermore, the feature evaluation unit 115 selects the waveform with the largest feature from the multiple waveforms generated by the shifting in step S6.

[0044] After the processing of step S7, the feature combining unit 116 combines sections in which the feature evaluated in step S6 is greater than a reference value (step S8). The feature combining unit 116 combines, for example, the waveforms of sections T1, T2, T3, T6, and T7 (FIG. 5). This generates a combined waveform (FIGS. 5, 6, and 7). After the processing of step S8, the feature learning unit 117 performs learning (machine learning including deep learning) using the combined waveform combined in step S8 (step S9). This allows learning of packets labeled with the types of devices connected to the network.

[0045] 9 is a diagram showing the relationship between the number of learning iterations and test loss in this embodiment. The vertical axis represents loss, and the horizontal axis represents the number of epochs. The solid line represents input of the training data itself, and as learning is repeated, the test loss converges to 0. The dashed line represents input of data not included in the training data, and as learning is repeated, the test loss converges to approximately 0.2. Note that the test loss is the difference between the prediction result predicted by the trained model and the correct answer.

[0046] 10 is a diagram showing the relationship between the number of learning iterations and accuracy in this embodiment. The vertical axis represents accuracy, and the horizontal axis represents the number of epochs. The solid line represents input learning data, and the accuracy converges to 1 as learning is repeated. The dashed line represents input data that is not included in the learning data, and the accuracy converges to approximately 0.95 as learning is repeated. Here, accuracy refers to the percentage of prediction results that match the correct answer.

[0047] <Hardware Configuration> The feature evaluation apparatus 100 according to the embodiment described above is realized by a computer 900 having a configuration as shown in FIG. 11 , for example. FIG. 11 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the feature evaluation apparatus 100 according to the embodiment. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F (Interface) in FIG. 11 ), a communication interface 906 (referred to as a communication I / F in FIG. 11 ), and a media interface 907 (referred to as a media I / F in FIG. 11 ). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include an HDD in addition to the SSD 904.

[0048] The CPU 901 operates based on programs stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 in FIG. 1 . The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 starts up, programs related to the hardware of the computer 900, and the like. The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 and outputs generated data to the output device 911 via the input / output interface 905.

[0049] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (e.g., the packet capture device 500) via a communication network and outputs the data to the CPU 901. It also transmits data generated by the CPU 901 to other devices via the communication network. The media interface 907 reads programs or data stored in a recording medium 912 and outputs the programs to the CPU 901 via the RAM 903. The CPU 901 loads the programs from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded programs. The recording medium 912 may be an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical Disk), a magnetic recording medium, a conductive memory tape medium, or a semiconductor memory.

[0050] For example, when the computer 900 functions as the feature amount evaluation apparatus 100 according to the embodiment described above, the CPU 901 of the computer 900 executes the program 128 (see FIG. 1 ) loaded onto the RAM 903, thereby realizing the functions of the feature amount evaluation apparatus 100. The CPU 901 reads the program from the recording medium 912 and executes it. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install the program 128 from the recording medium 912 onto the SSD 904 and execute it.

[0051] 12 and 13 are diagrams showing an example of a combined waveform as a comparative example of the present invention. Fig. 12 shows a combined waveform in which waveforms in a specific section T1 are repeated and combined. This combined waveform is a "repeated combined" combined waveform in which the waveform in section T1 (Fig. 3) is repeated multiple times (e.g., three times). Fig. 13 shows a "zero-padded combined" combined waveform in which only the waveform in the specific section T1 is included and zero bytes are embedded in the other multiple sections.

[0052] Figure 14 shows the relationship between the number of iterations and test loss when training using "iterative combination," a comparative example of the present invention. The vertical axis is loss, and the horizontal axis is the number of epochs. The solid line shows training data input, and as training is repeated, the test loss converges to approximately 0. The dashed line shows data input that is not in the training data, and even after repeated training, the test loss remains above 1 and does not converge.

[0053] Figure 15 is a diagram showing the relationship between the number of repetitions and accuracy when learning with "iterative combination," a comparative example of the present invention. The vertical axis represents accuracy, and the horizontal axis represents the number of epochs. The solid line represents input learning data, and as learning is repeated, the accuracy converges to approximately 1. The dashed line represents input data that is not included in the learning data, and the accuracy after repeated learning is approximately 0.85.

[0054] FIG. 16 is a diagram showing the relationship between the number of iterations and test loss when training using "zero-filling connections," a comparative example of the present invention. The vertical axis is loss, and the horizontal axis is the number of epochs. The solid line shows training data input, and as training is repeated, the test loss converges to about 0.1. The dashed line shows data input that is not in the training data, and even after repeated training, the test loss is greater than 1 and does not converge.

[0055] Figure 17 is a diagram showing the relationship between the number of iterations and accuracy when learning with "zero-filling joins," a comparative example of the present invention. The vertical axis represents accuracy, and the horizontal axis represents the number of epochs. The solid line represents input learning data, and as learning is repeated, the accuracy converges to approximately 0.95. The dashed line represents input data that is not included in the learning data, and as learning is repeated, the accuracy converges to a range of 0.75 to 0.85.

[0056] <Features of the Feature Evaluation Device> The feature evaluation device 100 performs learning using a waveform obtained by combining sections in which interpolated time series data is divided into multiple sections with an arbitrary series length τ or period T, and sections in which feature values ​​are evaluated to be greater than a reference value. The feature evaluation device 100 divides packets captured for a certain time TA (FIG. 2) into unit times and calculates the packet lengths after division. Next, the feature evaluation device 100 calculates the interpolated packet length based on the divided packet lengths to obtain interpolated time series data. Furthermore, the feature evaluation device 100 uses one period of the interpolated time series data of the traffic flow or its average value as a feature.

[0057] In the comparative example, repeated combining ( FIG. 12 ) and zero-filling combining ( FIG. 13 ) do not result in convergence of test loss and accuracy even after repeated learning. However, as in the above-described embodiment, by combining sections of sequence-length time-series data whose feature values ​​are evaluated to be greater than a reference value, test loss and accuracy converge. In particular, by shifting the start point of a section of an arbitrary sequence length τ (e.g., sequence length τ = period T) multiple times by a predetermined search interval, and selecting and merging the waveform with the largest feature value from among the multiple waveforms generated by the shift, test loss and accuracy converge. In other words, the feature evaluation device of this embodiment enables learning with a small number of epochs. In other words, the feature evaluation device 100 extracts high-quality features.

[0058] <<Modification: Traffic Flow>> In the above-described embodiment, a traffic flow is a set of packets that have the same source address, source port number, destination address, destination port number, and protocol number. A traffic flow may be traffic data with the same source physical address (MAC address), or traffic that has been grouped and aggregated based on some aspect (e.g., source address).

[0059] <<Modification: Interpolation Unit>> In the above-described embodiment, the interpolation unit 112 interpolates the last packet P ｉ Instead, for example, the interpolation unit 112 focuses on the first packet P ｉ By focusing on the period T ｎ Interpolated packet length B ｎ may be calculated.

[0060]

[0061] Here, ｉ－１ is the packet P ｉ The previous packet P ｉ－１ The length of P ｉ－１ is the period T ｎ－１ The interpolation unit 112 also interpolates the packet length l ｉ for period T ｎ The sum of the lengths of the packets included in ｎand use the following formula (3) to calculate the period T ｎ Interpolated packet length B ｎ may be calculated.

[0062]

[0063] In addition, in the formula (3), the period T ｎ , T ｎ＋１ However, as in the case of equation (2), the period T ｎ－１ , T ｎ Furthermore, although the right-hand sides of the formulas (1) to (3) are for finding the minimum value, they may also be for finding the maximum value.

[0064] Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, in the above-described embodiments, the interpolated packet length is calculated to obtain the interpolated time-series data, but the maximum value / minimum value / average value / sum of the packet lengths within a period may be used as the corrected packet length.

[0065] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0066] <Effects> The effects of the feature amount evaluation device 100 will be described below.

[0067] The feature evaluation device 100 ( FIG. 1 ) according to the embodiment described above is characterized by including an interpolation unit 112, a period calculation unit 113, a feature extraction unit 114, a feature evaluation unit 115, a feature combination unit 116, and a feature learning unit 117. When acquired communication packets included in traffic are acquired over multiple unit times (periods), the interpolation unit 112 divides the acquired communication packets for each period to generate communication packets included in each period. Here, traffic refers to time-series data including the acquisition start time and length of communication packets acquired from a network. Furthermore, when acquired communication packets are acquired within a single period of a predetermined length, the interpolation unit 112 generates communication packets included in the period without dividing them. Next, the interpolation unit 112 calculates interpolated packet lengths for each period based on the lengths of the communication packets. Furthermore, the interpolation unit 112 calculates interpolated time-series data ( FIG. 3 ), which is time-series data of the interpolated packet lengths. The period calculation unit 113 calculates the period T ( FIG. 3 ) of the interpolated time-series data. The feature extraction unit 114 extracts traffic features (e.g., interpolated packet length) based on one period of interpolated time-series data. The feature evaluation unit 115 evaluates the magnitude of the features extracted by the feature extraction unit 114. The feature evaluation unit 115 includes a search interval shifting unit 115a, which shifts sections of the interpolated time-series data with a sequence length (e.g., sequence length τ = period T) in which the feature is higher than a reference value by the search interval. The feature evaluation unit 115 then selects the section with the highest feature from the multiple shifted sections. The feature combination unit 116 combines sections with sequence lengths in which the feature is higher than the reference value. The combination order may be in descending order of feature value or in chronological order. The feature learning unit 117 performs learning using the waveform combined by the feature combination unit 116.

[0068] According to this feature evaluation device 100, by calculating features based on the communication volume per unit time (period), features according to the communication status per period are calculated. Furthermore, features are calculated taking into account the traffic period T. This makes it possible to obtain high-quality features. Ultimately, it is possible to generate an estimation model based on data acquired over a short period. Furthermore, learning is stable and can be done quickly (with a small number of epochs). Furthermore, it becomes possible to estimate the type of source device and the type of communication service with high accuracy.

[0069] The interpolation unit 112 according to the embodiment calculates the interpolation packet length for a period based on (a) the length of the first communication packet included in the period, (b) the length of the second communication packet immediately before the first communication packet or the length of the third communication packet immediately after the first communication packet, and (c) the ratio of the start time difference between the first communication packet and the second communication packet to the start time difference between the first communication packet and the third communication packet, where the second communication packet or the third communication packet is a communication packet included in the period before or after the period (see formula (1) or formula (2)).

[0070] According to this feature evaluation device 100, the waveform (time-series data of packet lengths) is interpolated so that it has equal intervals by using the ratio of the acquisition intervals between the preceding and following packets. Feature values ​​are calculated based on the lengths of individual communication packets included in a period and the time intervals between packets. Therefore, even with small-scale data, it is expected that higher-quality feature values ​​can be obtained.

[0071] The interpolation unit 112 according to the above-described embodiment calculates the interpolation packet length for a period based on (a) the sum of the lengths of the communication packets included in the first period, which is the period in question, (b) the sum of the lengths of the communication packets included in the second period, which is the period immediately before the first period, or the sum of the lengths of the communication packets included in the third period, which is the period immediately after the first period, and (c) the ratio of the start time difference between the first communication packet included in the first period and the second communication packet immediately before the first communication packet, and the start time difference between the first communication packet and the third communication packet immediately after the first communication packet. Here, the second communication packet or the third communication packet is the communication packet included in the second period or the third period.

[0072] According to this feature evaluation device 100, feature amounts are calculated that focus on the length of the communication packets included in the period and the time intervals between the packets, and it is expected that feature amounts of even higher quality can be obtained.

[0073] 100 Feature evaluation device 110 Control unit 112 Interpolation unit 113 Period calculation unit 114 Feature extraction unit 115 Feature evaluation unit 115a Search interval shift unit 116 Feature combination unit 500 Packet capture device τ Sequence length T Period Bn Interpolated packet length

Claims

1. A feature evaluation device comprising: a feature evaluation unit that evaluates the magnitude of feature amounts of multiple sequence length time series data obtained by dividing packet time series data into predetermined sequence lengths; and a feature extraction unit that extracts sequence length time series data with large feature amounts evaluated by said feature evaluation unit, wherein said feature evaluation unit moves the starting point of said sequence length time series data multiple times by search intervals, and said feature extraction unit extracts sequence length time series data with feature amounts larger than a reference value from the multiple sequence length time series data generated by the movement.

2. A feature evaluation device comprising: an interpolation unit that interpolates received non-uniformly spaced packet time series data to uniformly spaced intervals for each unit time; a period calculation unit that calculates the period of the uniformly spaced packet time series data interpolated by the interpolation unit; a feature extraction unit that extracts a plurality of cycle length time series data of the lengths of the cycles from either the received non-uniformly spaced packet time series data or the uniformly spaced packet time series data; a feature evaluation unit that evaluates the magnitude of the feature of the plurality of cycle length time series data; and a feature combination unit that combines a plurality of the cycle length time series data based on the evaluated feature, wherein the feature extraction unit selects, from the extracted plurality of cycle length time series data, cycle length time series data whose feature is greater than a reference value.

3. The feature evaluation device according to claim 2, further comprising a search interval shifting unit that shifts a starting point by the search interval multiple times when the feature extraction unit extracts the period length time series data, wherein the feature extraction unit selects multiple period length time series data whose feature amount is greater than a reference value from the multiple period length time series data shifted by the search interval shifting unit, and the feature combining unit combines the selected multiple period length time series data in descending order of feature amount or in chronological order.

4. A feature evaluation method, characterized in that a feature evaluation device executes a feature evaluation step of evaluating the magnitude of feature amounts of multiple sequence length time series data obtained by dividing packet time series data into predetermined sequence lengths, and a feature extraction step of extracting sequence length time series data with large feature amounts evaluated in the feature evaluation step, wherein the feature evaluation step moves the starting point of the sequence length time series data multiple times by search intervals, and the feature extraction step extracts sequence length time series data with feature amounts larger than a reference value from the multiple sequence length time series data obtained by the movement.

Images