Intrusion detection system and intrusion detection method

Abstract

Provided are an intrusion detection system and an intrusion detection method that make it possible to reduce communication data transmitted to a centralized monitoring device from information units, and for an attack to be detected by the centralized monitoring device using the reduced communication data. The centralized monitoring device generates a lightweight neural network obtained by reducing the number of nodes in an input layer of a neural network for detecting attacks, and a lightweighting method. The lightweighting method is transmitted to the information units. The information units transmit lightweight communication data lightweighted using the received lightweighting method to the centralized monitoring device, and the centralized monitoring device inputs the lightweight communication data received from the information units into the lightweight neural network and detects an attack on the information units.

Description

Intrusion Detection System and Intrusion Detection Method

[0001] This disclosure relates to an intrusion detection system and an intrusion detection method.

[0002] Conventionally, in low-resource devices with low computing power such as IoT devices, in order to perform the processing of a network intrusion detection system (NIDS: Network Intrusion Detection System), detection processing with a relatively low computational load has been used, such as detecting an attack by matching the content of a specific field included in communication data with a simple rule created in advance. However, with the diversification of the installed software and communication standards due to the increasing demand for future IoT services, the attack methods against IoT devices have become more complex. Therefore, it has become difficult to obtain sufficient attack detection accuracy with attack detection using simple rules as described above.

[0003] In the technology of Patent Document 1, each IoT device transmits communication data to a server, and the server detects an attack based on the communication data received from each IoT device. Using a server with high computing power, more complex attack detection processing using a learning model can be performed.

[0004] Japanese Patent Application Laid-Open No. 2023-12311

[0005] However, there is an upper limit to the amount of data reception that the server can receive and process. In the technology of Patent Document 1, since communication data is transmitted from each IoT device to the server, the data reception amount of the server increases, the load on the communication band becomes large, and there is a possibility that the server cannot detect an attack. However, Patent Document 1 does not disclose a technique for reducing the data reception amount.

[0006] Therefore, an object of the present disclosure is to provide an intrusion detection system and an intrusion detection method capable of reducing communication data transmitted from each information device to a centralized monitoring device and detecting an attack by the centralized monitoring device using the reduced communication data.

[0007] The intrusion detection system relating to this disclosure is an intrusion detection system comprising a central monitoring device and a plurality of information devices that are communicably connected to the central monitoring device, wherein the central monitoring device comprises: a learning model generation unit that generates an attack detection neural network that takes communication data as input and outputs attack type information, using a plurality of datasets of communication data and corresponding attack types collected when attacks were detected in the past; a lightweight learning model generation unit that generates a lightweight neural network that is lightweight in order to reduce the number of nodes in the input layer of the attack detection neural network; a lightweight method generation unit that generates a lightweight method for reducing communication data to correspond to the reduced input layer nodes in the lightweight neural network; a lightweight method transmission unit that transmits the lightweight method to each of the information devices; a lightweight communication data receiving unit that receives lightweight communication data reduced by the lightweight method from each of the information devices; and an attack detection unit that inputs the lightweight communication data received from each of the information devices to the lightweight neural network and detects attacks against each of the information devices based on the output attack type information, wherein each of the information devices is The system comprises: a weight reduction method receiving unit that receives the weight reduction method from the central monitoring device; a communication data receiving unit that receives communication data; a weight reduction communication data generation unit that reduces the received communication data using the received weight reduction method to generate the weight reduction communication data; and a weight reduction communication data transmission unit that transmits the weight reduction communication data to the central monitoring device.

[0008] An intrusion detection method relating to this disclosure is an intrusion detection method performed by a centralized monitoring device and a plurality of information devices that are communicably connected to the centralized monitoring device, comprising: a learning model generation step in which the centralized monitoring device generates a neural network for attack detection that takes communication data as input and outputs attack type information, using a dataset consisting of communication data collected when an attack was detected in the past and the corresponding attack types; a lightweight learning model generation step in which the centralized monitoring device generates a lightweight neural network that is lightweight in such a way as to reduce the number of nodes in the input layer of the neural network for attack detection; a lightweight method generation step in which the centralized monitoring device generates a lightweight method for reducing communication data to correspond to the reduced input layer nodes in the lightweight neural network; a lightweight method transmission step in which the centralized monitoring device transmits the lightweight method to each of the information devices; and a lightweight communication data reception step in which the centralized monitoring device receives lightweight communication data reduced by the lightweight method from each of the information devices. The central monitoring device comprises: an attack detection step in which the central monitoring device inputs the lightweight communication data received from each of the information devices into the lightweight neural network and detects an attack against each of the information devices based on the output attack type information; a lightweight method receiving step in which each of the information devices receives the lightweight method from the central monitoring device; a communication data receiving step in which each of the information devices receives communication data; a lightweight communication data generation step in which each of the information devices reduces the received communication data using the received lightweight method to generate lightweight communication data; and a lightweight communication data transmission step in which each of the information devices transmits the lightweight communication data to the central monitoring device.

[0009] According to the intrusion detection system and intrusion detection method described herein, the central monitoring device generates a lightweight neural network with a reduced number of nodes in the input layer into which communication data is input, generates a lightweight method for reducing communication data to correspond to the reduced number of nodes in the input layer, and transmits it to each information device. Each information device reduces the received communication data using the received lightweight method to generate lightweight communication data and transmits it to the central monitoring device. The central monitoring device inputs the lightweight communication data received from each information device into the lightweight neural network and detects an attack. Therefore, the communication data transmitted from each information device to the central monitoring device is reduced, and the central monitoring device can detect an attack using the reduced communication data.

[0010] This is a schematic diagram of the intrusion detection system according to Embodiment 1. This diagram illustrates the schematic hardware configuration of the centralized monitoring device according to Embodiment 1. This is a schematic diagram of the neural network for attack detection according to Embodiment 1. This is a schematic diagram of the intermediate layer nodes according to Embodiment 1. This diagram illustrates the generation of a lightweight neural network by pruning according to Embodiment 1. This diagram illustrates the generation of a lightweight neural network using an autoencoder method according to Embodiment 1. This diagram illustrates the lightweight method and the generation of lightweight communication data according to Embodiment 1. This diagram illustrates the schematic hardware configuration of the information equipment according to Embodiment 1. This is a schematic flowchart illustrating the processing of the centralized monitoring device according to Embodiment 1. This is a schematic flowchart illustrating the processing of the information equipment according to Embodiment 1.

[0011] 1. Embodiment 1 An intrusion detection system 1 according to Embodiment 1 will be described with reference to the drawings. Figure 1 shows a schematic configuration diagram of the intrusion detection system 1. The intrusion detection system 1 comprises a central monitoring device 10 and a plurality of information devices 30 that are communicatively connected to the central monitoring device 10.

[0012] 1-1. Centralized Monitoring Device 10 The centralized monitoring device 10 includes a learning model generation unit 11, a lightweight learning model generation unit 12, a lightweight method generation unit 13, a lightweight method transmission unit 14, a lightweight communication data receiving unit 15, and an attack detection unit 16, etc. The centralized monitoring device 10 may have other functional units besides the functional units 11 to 16 for the intrusion detection system 1. The centralized monitoring device 10 is connected to a communication network such as the Internet to which the information equipment 30 is connected. For example, the centralized monitoring device 10 is installed on a server.

[0013] As shown in Figure 2, the central monitoring device 10 includes a processing unit 80, a storage device 81, and a communication device 82, etc. Various types of processing units are used as the processing unit 80, including CPUs (Central Processing Units), various ICs (Integrated Circuits), FPGAs (Field Programmable Gate Arrays), GPUs (Graphics Processing Units), and various AI (Artificial Intelligence) chips. Various types of volatile and non-volatile memory are used as the storage device 81. The communication device 82 is connected to a communication network such as the Internet and communicates with each information device 30. Each function of the central monitoring device 10 is realized through the cooperation of the various hardware components, including the processing unit 80, storage device 81, and communication device 82. When a CPU is used for the processing unit 80, each function is realized by the CPU executing a program stored in the storage device 81. Various data, such as the settings of the trained neural network, the settings of the lightweight neural network, the lightweighting method, and the training dataset, are stored in the non-volatile storage device 81.

[0014] <Learning Model Generation Unit 11> The learning model generation unit 11 uses multiple datasets of communication data collected when attacks were detected in the past and the corresponding attack types to generate a neural network for attack detection that takes communication data as input and outputs attack type information.

[0015] Figure 3 shows a schematic diagram of a neural network for attack detection. The neural network has an input layer, a hidden layer, and an output layer. In the example shown in Figure 3, there is one hidden layer, but multiple hidden layers may be provided. Also, various known configurations may be used for the neural network configuration between the input layer and the output layer. Each layer consists of multiple nodes (also called neurons). Multiple nodes arranged in a hierarchy are connected between adjacent layers, and information propagates from the input layer to the output layer. In this embodiment, a recurrent neural network is used, and the output value of each node in the hidden layer is input to the same node, to other nodes in the same layer, or to each node in each of the preceding layers, and has recurrent connections that propagate recursively from the output layer to the input layer. The recursively propagated information is reflected when each node performs calculations for the next input of the input layer. Various known recurrent neural networks are used. The recurrent neural network can learn the relationship between the time series change of the input value and the output value. Therefore, it is possible to learn the relationship between a series of time-series communication data corresponding to each type of attack and each type of attack.

[0016] Figure 4 shows a model of the hidden layer nodes. Each hidden layer node receives the output value of each connected node as input. The total input to the node is calculated by multiplying each input value by the weight assigned to the connection of each input value, summing the results, and adding a bias. The output of this total input after passing it through an activation function is the node's output. Each output layer node receives the output value of each connected hidden layer node as input. The output is calculated by multiplying each input value by the weight assigned to the connection of each input value, summing the results, and outputting the result.

[0017] The neural network is trained by adjusting multiple weights and biases of each node to represent the relationship between input and output values. Known machine learning and deep learning methods are used for training. The settings of the trained neural network (number of layers, number of nodes in each layer, connection relationships of each node, weights of each connection, and biases of each node) are stored in a non-volatile memory device 81.

[0018] In this embodiment, packets, which are the data transmission units of communication data, are input to the input layer of the neural network for attack detection. Depending on the communication protocol, packets may be called frames instead.

[0019] A packet consists of a payload containing the data itself and a header that stores control information such as the destination. The header includes the source address, destination address, VLAN (Virtual Local Area Network) tag, type code, etc.

[0020] As shown in Figure 3, in this embodiment, the packet header is input to the input layer. The header is divided into multiple unit data. For example, the unit data is data in meaningful units of data quantity, such as 4-byte data. Then, each divided unit data is input in parallel to each node of the input layer. The number of nodes in the input layer is the same as the number of divided unit data (number of divisions).

[0021] The input layer receives multiple units of data, obtained by dividing the header of each packet, in chronological order. Specifically, multiple units of data from a given packet are input in parallel to multiple nodes in the input layer, neural network calculations are performed, and attack type information is output from the output layer. Subsequently, multiple units of data from the next packet are input to the input layer, neural network calculations are performed, and attack type information is output from the output layer.

[0022] The output layer outputs information about the type of attack. In this embodiment, the output layer has multiple nodes, each assigned to a specific type of attack, and outputs an evaluation value indicating whether or not the attack corresponds to the assigned type. Therefore, the number of nodes in the output layer is the same as the number of attack types to be evaluated. When the output value (evaluation value) of a certain output node increases, the probability that a specific type of attack corresponding to that output node has occurred increases, and when the output value (evaluation value) of a certain output node decreases, the probability that a specific type of attack corresponding to that output node has occurred decreases.

[0023] The types of attacks to be detected include various attacks that are detected by intrusion detection systems (IDS), such as unauthorized access and DoS (Denial of Service) attacks. A node in the output layer is assigned to each type of attack.

[0024] A dataset containing the type of attack and a series of time-series packets corresponding to that attack type is prepared in advance for each attack type and each attack example.

[0025] The learning model generation unit 11 learns a neural network (weights, etc.) such that when a series of time-series packets (multiple unit data of headers) corresponding to each attack are input to the input layer in time-series order, the output layer outputs information about the type of attack corresponding to that attack. For each attack, the output layer should output information about the type of attack corresponding to that attack at the time the attack is confirmed. The number of nodes and layers in the intermediate layer are adjusted by known methods so that each type of attack can be learned.

[0026] <Lightweight Learning Model Generation Unit 12> The lightweight learning model generation unit 12 generates a lightweight neural network that reduces the number of nodes in the input layer of the neural network used for attack detection.

[0027] For example, lightweighting can be achieved by a known pruning technique that removes connections between nodes with small weight values. As shown in Figure 5, pruning removes input layer nodes that no longer transmit signals to the output layer. The number of pruned branches and the number of input layer nodes removed can be increased or decreased by increasing or decreasing the threshold weight for removal. The lightweight neural network may be retrained using multiple datasets used to train the attack detection neural network.

[0028] The settings of the generated lightweight neural network (in this example, the number of layers, the number of nodes in each layer, the connection relationships of each node, the weights of each connection, the bias of each node, and the node information of the deleted input layer) are stored in the non-volatile memory device 81.

[0029] Alternatively, lightweighting may be performed using an autoencoder method. As shown in Figure 6, in the autoencoder method, training is performed with a setting where the number of nodes in the hidden layer is less than the number of nodes in the input layer. The nodes in the hidden layer with fewer nodes are used as the nodes in the lightweight input layer, and the hidden layer and output layer are so-called decoders and are used as a lightweight neural network. The input layer and the hidden layer with fewer nodes are so-called encoders and are used as a lightweighting method described later, and the output values ​​of the input layer and the hidden layer (encoder) become lightweight communication data. As shown in Figure 6, if multiple hidden layers are provided, for example, the number of nodes in the first stage hidden layer is less than the number of nodes in the input layer, the input layer and the first stage hidden layer are set as encoders, and the hidden layers from the first stage onward and the output layer are set as decoders. The settings for the generated lightweight neural network (decoder) (number of layers, number of nodes in each layer, connection relationships of each node, weights of each connection, bias of each node) and the settings for the encoder used as the lightweighting method (number of layers, number of nodes in each layer, connection relationships of each node, weights of each connection, bias of each node) are stored in the non-volatile memory device 81.

[0030] <Lightweighting Method Generation Unit 13> The lightweighting method generation unit 13 generates a lightweighting method that reduces communication data to correspond to the nodes of the reduced input layer in the lightweight neural network.

[0031] As shown in Figure 7, a method for reducing the size of packets is generated to remove unit data from the packet header corresponding to the reduced input layer nodes. For example, an address range from the beginning corresponding to the unit data to be removed is set. Alternatively, an address range from the beginning corresponding to the unit data that is not removed, corresponding to the input layer nodes after removal, may be set.

[0032] When weight reduction is performed using an autoencoder method, an encoder consisting of the input layer and intermediate layer described above is generated as the weight reduction method.

[0033] <Weight Reduction Method Transmission Unit 14> The weight reduction method transmission unit 14 transmits the weight reduction method to each information device 30.

[0034] The lightweight method transmission unit 14 transmits lightweight methods via a communication network to a plurality of information devices 30 that have been pre-configured as monitoring targets. For example, when a new lightweight neural network is generated and a new lightweight method is generated, the lightweight method transmission unit 14 transmits the new lightweight method to each information device 30. Alternatively, when a new information device 30 is configured as a monitoring target, the lightweight method transmission unit 14 transmits the lightweight method to the new information device 30.

[0035] <Lightweight Communication Data Receiving Unit 15> The lightweight communication data receiving unit 15 receives lightweight communication data, which has been reduced by the lightweighting method, from each information device 30. In this embodiment, the lightweight communication data becomes the header of the reduced frame. When lightweighting is performed using an autoencoder method, the lightweight communication data becomes the data after the encoder has processed the frame header.

[0036] <Attack Detection Unit 16> The attack detection unit 16 inputs the lightweight communication data received from each information device 30 into a lightweight neural network and detects attacks against each information device 30 based on the output attack type information.

[0037] The attack detection unit 16 provides a lightweight neural network for each information device 30 and processes the lightweight communication data of each information device 30 in parallel. By providing a lightweight neural network for each information device 30, the internal calculation values ​​of the recurrent neural network can be stored for each information device 30.

[0038] The attack detection unit 16 inputs the headers of the reduced frames from each information device 30 in chronological order into the input layer of the lightweight neural network for each information device 30, and detects attacks against each information device 30 based on the output attack type information. Specifically, the headers of the reduced frames are divided into multiple unit data corresponding to multiple nodes in the input layer, and each divided unit data is input in parallel to each node in the input layer.

[0039] The output layer has a plurality of nodes, and each node is assigned to each type of attack. When the output value (evaluation value) of any node becomes greater than the threshold value, the attack detection unit 16 determines that the type of attack assigned to the node with the increased value has occurred. Further, the attack detection unit 16 may perform statistical processing or logical processing on the determination result.

[0040] When the attack detection unit 16 detects an attack, it transmits attack detection information (type of attack, transmission address of the attack, etc.) to the information device 30 that detected the attack.

[0041] When lightweight processing using the autoencoder method is performed, the attack detection unit 16 divides the lightweight communication data of the encoder's processing into a plurality of unit data corresponding to a plurality of nodes in the input layer (intermediate layer of the decoder), and each divided unit data is input to each node in the input layer in parallel.

[0042] 1-2. Information Device 30 Each information device 30 includes a lightweight method reception unit 31, a communication data reception unit 32, a lightweight communication data generation unit 33, a lightweight communication data transmission unit 34, and the like. In addition to these functional units 31 to 34 for the intrusion detection system 1, the information device 30 has other functional units for performing its original functions. Each information device 30 is connected to a communication network such as the Internet by wired communication or wireless communication.

[0043] As shown in FIG. 8, each information device 30 includes an arithmetic processing device 90, a storage device 91, a communication device 92, and the like. As the arithmetic processing device 90, various arithmetic processing devices such as a CPU and various ICs are used.

[0044] The arithmetic processing ability of each information device 30 is lower than that of the centralized monitoring device 10, and it is assumed that the arithmetic processing ability is not sufficient to perform real-time arithmetic processing using a neural network.

[0045] As the memory device 91, various volatile memories and non-volatile memories are used. The communication device 92 is connected to a communication network such as the Internet via wireless communication or wired communication and communicates with the centralized monitoring device 10. Each function provided in each information device 30 is realized by the cooperation of each hardware such as the arithmetic processing device 90, the memory device 91, and the communication device 92. When a CPU is used for the arithmetic processing device 90, each function is realized by the CPU executing a program stored in the memory device 91. Various data such as a weight reduction method are stored in the memory device 91.

[0046] <Lightweighting method receiving unit 31> The lightweighting method receiving unit 31 receives a lightweighting method from the centralized monitoring device 10. The lightweighting method receiving unit 31 stores the received lightweighting method in the non-volatile memory device 91.

[0047] <Communication data receiving unit 32> The communication data receiving unit 32 receives communication data. For example, the communication data receiving unit 32 receives communication data from an external server, an external information device, or the like. In the present embodiment, the communication data receiving unit 32 receives data in packet units, which is a data transmission unit of communication data, as communication data. Depending on the communication protocol, it may be called a frame instead of a packet. The communication data receiving unit 32 transmits the received communication data to other functional units or transmits it to other devices arranged in close proximity.

[0048] <Lightweight communication data generation unit 33> The lightweight communication data generation unit 33 reduces the received communication data by the received lightweighting method to generate lightweight communication data.

[0049] As shown in FIG. 7, the lightweight communication data generation unit 33 deletes the address range to be deleted included in the lightweighting method from the header of the received packet to generate lightweight communication data. Alternatively, the lightweight communication data generation unit 33 extracts the address range not to be deleted from the header of the received packet to generate lightweight communication data.

[0050] When data weight reduction is performed using an autoencoder, the lightweight communication data generation unit 33 inputs the header of the received packet to an encoder consisting of an input layer and an intermediate layer included in the weight reduction method, and generates lightweight communication data by sequentially combining the output values ​​output from each node of the encoder's intermediate layer. At this time, the packet header is divided into multiple unit data, and each unit data is input to each node of the encoder's input layer.

[0051] <Lightweight Communication Data Transmission Unit 34> The lightweight communication data transmission unit 34 transmits the lightweight communication data to the central monitoring device 10.

[0052] When the centralized monitoring device 10 detects an attack based on the transmitted lightweight communication data and sends attack detection information (type of attack, attack source address, etc.) to the information device 30, the information device 30 takes action against the attack. For example, possible actions include stopping reception from the attack source address or initializing the information device 30.

[0053] As described above, the central monitoring device 10 generates a lightweight neural network with a reduced number of nodes in the input layer into which communication data is input, generates a lightweighting method to reduce communication data to correspond to the reduced number of nodes in the input layer, and transmits it to each information device 30. Each information device 30 reduces the received communication data using the received lightweighting method to generate lightweight communication data and transmits it to the central monitoring device 10. The central monitoring device 10 inputs the lightweight communication data received from each information device 30 into the lightweight neural network and detects attacks. Therefore, the communication data transmitted from each information device 30 to the central monitoring device 10 is reduced, and attacks can be detected by the central monitoring device 10 using the reduced communication data.

[0054] <Flowchart> Next, the intrusion detection method will be explained with reference to the flowcharts in Figures 9 and 10. The intrusion detection method is performed by a central monitoring device 10 and a plurality of information devices 30 that are communicatively connected to the central monitoring device 10.

[0055] Figure 9 shows a flowchart of the processing of the centralized monitoring device 10. As described above, in step S01, the centralized monitoring device 10 (learning model generation unit 11) uses multiple datasets of communication data collected when attacks were detected in the past and the corresponding attack types to generate a neural network for attack detection that receives communication data as input and outputs attack type information.

[0056] As described above, in step S02, the centralized monitoring device 10 (lightweight learning model generation unit 12) generates a lightweight neural network that reduces the number of nodes in the input layer of the neural network for attack detection.

[0057] As described above, in step S03, the centralized monitoring device 10 (lightweighting method generation unit 13) generates a lightweighting method that reduces communication data to correspond to the nodes of the reduced input layer in the lightweight neural network.

[0058] As described above, in step S04, the centralized monitoring device 10 (weight reduction method transmission unit 14) transmits the weight reduction method to each information device 30.

[0059] As described above, in step S05, the centralized monitoring device 10 (lightweight communication data receiving unit 15) receives lightweight communication data, which has been reduced by the weight reduction method, from each information device 30.

[0060] As described above, in step S06, the centralized monitoring device 10 (attack detection unit 16) inputs the lightweight communication data received from each information device 30 into a lightweight neural network and detects an attack on each information device 30 based on the output attack type information.

[0061] Steps S05 and S06 are repeatedly performed each time lightweight communication data is received from each information device 30. Steps S01 to S04 are performed, for example, each time the training dataset is updated. Steps S02 to S04 are performed each time the number of nodes reduced in the input layer is changed.

[0062] Figure 10 shows a flowchart of the processing for each information device 30. As described above, in step S11, the information device 30 (lightweighting method receiving unit 31) receives the lightweighting method from the central monitoring device 10. In step S12, the information device 30 (communication data receiving unit 32) receives the communication data. In step S13, the information device 30 (lightweight communication data generation unit 33) reduces the received communication data using the received lightweighting method to generate lightweight communication data. In step S14, the information device 30 (lightweight communication data transmission unit 34) transmits the lightweight communication data to the central monitoring device 10.

[0063] Steps S12 and S14 are repeatedly performed each time the information device 30 receives communication data. Step S11 is performed each time the weight reduction method is transmitted from the central monitoring device 10.

[0064] 2. Embodiment 2 Next, the intrusion detection system 1 according to Embodiment 2 will be described. The same components as in Embodiment 1 will not be described. The basic configuration of the intrusion detection system 1 according to this embodiment is the same as in Embodiment 1, but it differs from Embodiment 1 in that multiple lightweight neural networks and multiple lightweighting methods with different reduction numbers are generated in advance, and the lightweight neural network and lightweighting method used for attack detection are switched according to the total amount of data received from the information device 30.

[0065] In this embodiment, the lightweight learning model generation unit 12 pre-generates multiple lightweight neural networks with different numbers of nodes reduced in the input layer.

[0066] The number of lightweight neural networks to be generated, and the number of reductions for each lightweight neural network, are predetermined. Similar to Embodiment 1, lightweight neural networks are generated for each reduction count.

[0067] The lightweighting method generation unit 13 pre-generates multiple lightweighting methods corresponding to each of the generated multiple lightweight neural networks. The method for generating the lightweighting methods is the same as in Embodiment 1, so a description will be omitted.

[0068] The attack detection unit 16 calculates the total amount of lightweight communication data received by the lightweight communication data receiving unit 15 from multiple information devices 30. The attack detection unit 16 calculates the total amount of data received per unit time by summing up the amount of lightweight communication data received per unit time from each information device 30.

[0069] The attack detection unit 16 then increases or decreases the number of nodes in the input layer of the lightweight neural network used for detection, according to the total amount of data received. In this embodiment, the attack detection unit 16 selects a lightweight neural network from a plurality of lightweight neural networks that corresponds to the total amount of data received and uses it for detection. For example, the attack detection unit 16 increases or decreases the number of nodes in the input layer according to the total amount of data received, selects a lightweight neural network that is close to the increased or decreased number of nodes, and uses it for detection. For example, the attack detection unit 16 increases the number of nodes in the input layer when the total amount of data received exceeds a preset target range, and decreases the number of nodes when the total amount of data received falls below the target range. The number of nodes to be reduced is limited to the range of the number of nodes in the plurality of lightweight neural networks.

[0070] The data reduction method transmission unit 14 transmits data reduction methods corresponding to the lightweight neural network whose reduction count has been increased or decreased to each information device 30. The data reduction method transmission unit 14 selects a data reduction method from a plurality of data reduction methods that corresponds to the lightweight neural network selected in accordance with the total amount of data received, and transmits it to each information device 30.

[0071] Each information device 30 transmits the lightweight communication data, which has been reduced by the lightweight method received from the central monitoring device 10, back to the central monitoring device 10.

[0072] The central monitoring device 10 has a design upper limit on the total amount of data it can receive and process. If the total amount of data received exceeds this upper limit, there is a possibility that some information devices 30 may not be able to detect an attack. With the above configuration, the number of reductions in the lightweight neural network used for detection is increased or decreased according to the total amount of data received, and the corresponding lightweighting method is transmitted to each information device 30. This changes the degree of reduction in the lightweight communication data transmitted from each information device 30 to the central monitoring device 10, ensuring that the total amount of data received does not exceed the upper limit. On the other hand, if the number of reductions increases, the accuracy of attack detection decreases somewhat, but it is possible to suppress the occurrence of information devices 30 that cannot detect an attack.

[0073] Furthermore, since multiple lightweight neural networks with different reduction levels are pre-generated, the reduction level of the lightweight neural network used for detection can be rapidly changed in response to changes in the total amount of data received, enabling it to respond to sudden changes in the total amount of data received.

[0074] 3. Embodiment 3 Next, the intrusion detection system 1 according to Embodiment 3 will be described. The same components as in Embodiment 1 will not be described. The basic configuration of the intrusion detection system 1 according to this embodiment is the same as in Embodiment 1, but it differs from Embodiment 1 in that the number of reductions in the lightweight neural network generated is increased or decreased according to the total amount of data received, and a corresponding lightweighting method is generated.

[0075] In this embodiment, the lightweight learning model generation unit 12 calculates the total amount of lightweight communication data received by the lightweight communication data receiving unit 15 from multiple information devices 30. The lightweight learning model generation unit 12 calculates the total amount of data received per unit time by summing up the amount of lightweight communication data received per unit time from each information device 30.

[0076] The lightweight learning model generation unit 12 increases or decreases the number of nodes in the input layer of the lightweight neural network it generates, according to the total amount of data received.

[0077] For example, the lightweight learning model generation unit 12 increases or decreases the reduction number according to the total amount of data received. For example, the attack detection unit 16 increases the reduction number when the total amount of data received exceeds a preset target range, and decreases the reduction number when the total amount of data received falls below the target range.

[0078] If the reduction number changes, the lightweight learning model generation unit 12 generates a lightweight neural network with the changed reduction number, similar to the first embodiment.

[0079] The lightweighting method generation unit 13 generates lightweighting methods corresponding to lightweight neural networks with increased or decreased reductions. The method for generating lightweighting methods is the same as in Embodiment 1, so a description is omitted.

[0080] The attack detection unit 16 increases or decreases the number of nodes in the input layer of the lightweight neural network used for detection, according to the total amount of data received. In this embodiment, the attack detection unit 16 detects attacks using a lightweight neural network whose number of nodes has been increased or decreased according to the total amount of data received by the lightweight learning model generation unit 12.

[0081] The lightweighting method transmission unit 14 transmits the lightweighting method corresponding to the lightweight neural network, for which the number of reductions has been increased or decreased, to each information device 30.

[0082] Each information device 30 transmits the lightweight communication data, which has been reduced by the lightweight method received from the central monitoring device 10, back to the central monitoring device 10.

[0083] The central monitoring device 10 has a design upper limit on the total amount of data it can receive and process. If the total amount of data received exceeds this upper limit, there is a possibility that some information devices 30 may not be able to detect an attack. With the above configuration, the number of reductions in the lightweight neural network used for detection is increased or decreased according to the total amount of data received, and the corresponding lightweighting method is transmitted to each information device 30. This changes the degree of reduction in the lightweight communication data transmitted from each information device 30 to the central monitoring device 10, ensuring that the total amount of data received does not exceed the upper limit. On the other hand, if the number of reductions increases, the accuracy of attack detection decreases somewhat, but it is possible to suppress the occurrence of information devices 30 that cannot detect an attack, thereby ensuring the reliability of the entire system.

[0084] 4. Embodiment 4 Next, the intrusion detection system 1 according to Embodiment 4 will be described. The same components as in Embodiment 1 will not be described. The basic configuration of the intrusion detection system 1 according to this embodiment is the same as in Embodiment 1, but the method of transmitting the lightweight neural network and lightweight method when they are changed differs from Embodiment 1.

[0085] In Embodiment 1, when the neural network for attack detection and the lightweight neural network are regenerated due to changes in the training dataset, the neural network configuration, or the reduction number, and the corresponding lightweight method is regenerated, the lightweight method is retransmitted. In Embodiments 2 and 3, when the reduction number of the lightweight neural network used for detection is changed, the corresponding lightweight method is retransmitted.

[0086] In this embodiment, if the lightweight neural network used by the attack detection unit 16 for detection, or the lightweight method transmitted by the lightweight method transmission unit 14, is changed, the lightweight method transmission unit 14 will prioritize transmitting the changed lightweight method to the information device 30 that receives a large amount of data.

[0087] For example, the weight reduction method transmission unit 14 sets multiple categories for the amount of data received per unit time, and transmits the modified weight reduction method to the information equipment 30 corresponding to each category in order of the amount of data received.

[0088] With this configuration, the information device 30 with the greatest impact can be given priority in transmitting the data optimization method, which can then be reflected in the generation of the optimized communication data.

[0089] 5. Embodiment 5 Next, the intrusion detection system 1 according to Embodiment 5 will be described. The same components as in Embodiment 1 will be omitted from the description. The basic configuration of the intrusion detection system 1 according to this embodiment is the same as in Embodiment 1, but it differs from Embodiment 1 in that the method of reducing the data transmitted to each information device 30 is changed according to the amount of data received from each information device 30, and the number of reductions in the lightweight neural network used for detection of each information device 30 is changed.

[0090] Similar to Embodiment 2, the lightweight learning model generation unit 12 pre-generates multiple lightweight neural networks with different numbers of nodes reduced in the input layer. The lightweight method generation unit 13 pre-generates multiple lightweight methods corresponding to each of the generated multiple lightweight neural networks.

[0091] In this embodiment, the weight reduction method transmission unit 14 selects a weight reduction method to transmit to each information device 30 from a plurality of weight reduction methods based on the amount of data received from each information device 30.

[0092] For example, the data reduction method transmission unit 14 refers to a table data in which the relationship between the amount of data received per unit time and the number of reductions is predetermined, and determines the number of reductions for each information device 30 corresponding to the amount of data received per unit time for each information device 30. Then, the data reduction method transmission unit 14 selects a data reduction method from a plurality of data reduction methods that corresponds to the number of reductions for each information device 30 and transmits it to each information device 30. Alternatively, the data reduction method transmission unit 14 may determine the number of reductions for each information device 30 so that the total amount of data received is less than or equal to an upper limit. For example, the data reduction method transmission unit 14 increases or decreases the number of reductions for each information device 30 determined by referring to the table data so that the total amount of data received is less than or equal to an upper limit. The number of reductions is limited to the range of reductions of multiple lightweight neural networks. Alternatively, the data reduction method transmission unit 14 may reduce the number of reductions for information devices 30 whose amount of data received per unit time is greater than or equal to a judgment value, as these devices are likely to be under attack, thereby improving the accuracy of attack detection. The weight reduction method transmission unit 14 may improve the accuracy of attack detection by reducing the number of information devices 30 that have detected an attack.

[0093] The attack detection unit 16 selects a lightweight neural network from among multiple lightweight neural networks that corresponds to the lightweighting method used in the lightweight communication data received from each information device 30, and uses it to detect attacks against each information device 30.

[0094] With this configuration, by appropriately changing the number of information devices 30 to be reduced according to the amount of data received from each information device 30, it is possible to balance the reduction of the total amount of data received with maintaining the accuracy of attack detection.

[0095] While this disclosure describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but are applicable individually or in various combinations to the embodiments. Accordingly, countless variations not illustrated herein are conceivable within the scope of the art disclosed herein. For example, these include modifying, adding or omitting at least one component, or extracting at least one component and combining it with a component from another embodiment.

[0096] 1: Intrusion detection system, 10: Centralized monitoring device, 11: Learning model generation unit, 12: Lightweight learning model generation unit, 13: Lightweight method generation unit, 14: Lightweight method transmission unit, 15: Lightweight communication data reception unit, 16: Attack detection unit, 30: Information equipment, 31: Lightweight method reception unit, 32: Communication data reception unit, 33: Lightweight communication data generation unit, 34: Lightweight communication data transmission unit

Claims

1. An intrusion detection system comprising a central monitoring device and a plurality of information devices connected to the central monitoring device in a communicative manner, wherein the central monitoring device comprises: a learning model generation unit that generates an attack detection neural network that receives communication data and outputs attack type information, using a plurality of datasets of communication data collected when attacks were detected in the past and corresponding attack types; a lightweight learning model generation unit that generates a lightweight neural network that reduces the number of nodes in the input layer of the attack detection neural network; a lightweight method generation unit that generates a lightweight method for reducing communication data to correspond to the reduced input layer nodes in the lightweight neural network; a lightweight method transmission unit that transmits the lightweight method to each of the information devices; a lightweight communication data receiving unit that receives lightweight communication data reduced by the lightweight method from each of the information devices; and an attack detection unit that inputs the lightweight communication data received from each of the information devices to the lightweight neural network and detects attacks against each of the information devices based on the output attack type information, wherein each of the information devices is An intrusion detection system comprising: a weight reduction method receiving unit that receives the weight reduction method from the central monitoring device; a communication data receiving unit that receives communication data; a weight reduction communication data generation unit that reduces the received communication data using the received weight reduction method to generate the weight reduction communication data; and a weight reduction communication data transmission unit that transmits the weight reduction communication data to the central monitoring device.

2. The intrusion detection system according to claim 1, wherein the attack detection unit increases or decreases the number of nodes in the input layer of the lightweight neural network used for detection in accordance with the total amount of lightweight communication data received by the lightweight communication data receiving unit from a plurality of information devices, and the lightweight method transmission unit transmits the lightweight method corresponding to the lightweight neural network with the increased or decreased number of nodes to each of the information devices.

3. The intrusion detection system according to claim 2, wherein the lightweight learning model generation unit increases or decreases the number of nodes in the input layer of the lightweight neural network to be generated according to the total amount of data received, and the lightweight method generation unit generates the lightweight method corresponding to the lightweight neural network with the number of nodes increased or decreased.

4. The intrusion detection system according to claim 2, wherein the lightweight learning model generation unit pre-generates a plurality of lightweight neural networks with different reduction numbers; the lightweight method generation unit pre-generates a plurality of lightweight methods corresponding to each of the generated plurality of lightweight neural networks; the attack detection unit selects a lightweight neural network from the plurality of lightweight neural networks corresponding to the total amount of received data and uses it for detection; and the lightweight method transmission unit selects a lightweight method from the plurality of lightweight methods corresponding to the lightweight neural network selected in accordance with the total amount of received data and transmits it to each of the information devices.

5. The intrusion detection system according to any one of claims 1 to 4, wherein if the lightweight neural network used by the attack detection unit for detection and the lightweight method transmitted by the lightweight method transmission unit are changed, the lightweight method transmission unit preferentially transmits the changed lightweight method to the information device with the largest amount of data received.

6. The intrusion detection system according to claim 1, wherein the lightweight learning model generation unit pre-generates a plurality of lightweight neural networks with different numbers of node reductions in the input layer; the lightweight method generation unit pre-generates a plurality of lightweight methods corresponding to each of the generated plurality of lightweight neural networks; the lightweight method transmission unit selects a lightweight method to transmit to each information device from the plurality of lightweight methods based on the amount of data received from each information device; and the attack detection unit selects a lightweight neural network from the plurality of lightweight neural networks that corresponds to the lightweight method used in the lightweight communication data received from each information device, and uses it to detect an attack on each information device.

7. An intrusion detection method performed by a centralized monitoring device and a plurality of information devices connected to the centralized monitoring device in a communicative manner, comprising: a learning model generation step in which the centralized monitoring device generates a neural network for attack detection that takes communication data as input and outputs attack type information, using a dataset consisting of communication data collected when attacks were detected in the past and corresponding attack types; a lightweight learning model generation step in which the centralized monitoring device generates a lightweight neural network that is lightweight in such a way as to reduce the number of nodes in the input layer of the neural network for attack detection; a lightweight method generation step in which the centralized monitoring device generates a lightweight method for reducing communication data to correspond to the reduced input layer nodes in the lightweight neural network; a lightweight method transmission step in which the centralized monitoring device transmits the lightweight method to each of the information devices; and a lightweight communication data reception step in which the centralized monitoring device receives lightweight communication data reduced by the lightweight method from each of the information devices. An intrusion detection method comprising: an attack detection step in which the central monitoring device inputs the lightweight communication data received from each of the information devices into the lightweight neural network and detects an attack against each of the information devices based on the output attack type information; a lightweight method receiving step in which each of the information devices receives the lightweight method from the central monitoring device; a communication data receiving step in which each of the information devices receives communication data; a lightweight communication data generation step in which each of the information devices reduces the received communication data using the received lightweight method to generate lightweight communication data; and a lightweight communication data transmission step in which each of the information devices transmits the lightweight communication data to the central monitoring device.

Images