Information processing device, information processing method, program, and recording medium

Abstract

In order to provide security measures spanning a plurality of protocols, an information processing device (1) comprises: an acquisition unit (11) that acquires a communication packet including a protocol stack; a tokenization unit (12) that generates a plurality of tokens by tokenizing at least a portion of the communication packet; and an evaluation unit (14) that inputs the plurality of tokens into a model trained through machine learning, and evaluates the security of the communication packet by referring to the output of the model.

Description

Information Processing Apparatus, Information Processing Method, Program, and Recording Medium

[0001] The present invention relates to an information processing apparatus, an information processing method, a program, and a recording medium for evaluating the security of communication packets.

[0002] In communication systems, various security monitoring techniques are known. As an example, Patent Document 1 discloses a security monitoring apparatus that determines whether alerts generated by each of a plurality of security products are alerts regarding the same threat.

[0003] International Publication No. 2024 / 009741

[0004] In conventional techniques including Patent Document 1, security techniques conforming to the protocols of each layer of the protocol stack included in communication packets are used, and security measures such as encryption and security scans are applied at each layer of the protocol.

[0005] However, since it is not known which layer of the protocol stack has security risks, security measures spanning multiple protocols are desired. One aspect of the present invention aims to provide security measures spanning multiple protocols.

[0006] To solve the above problems, an information processing apparatus according to one aspect of the present invention includes an acquisition unit that acquires a communication packet including a protocol stack, a tokenization unit that generates a plurality of tokens by tokenizing at least a part of the communication packet, and an evaluation unit that inputs the plurality of tokens into a machine-learned model and evaluates the security of the communication packet by referring to the output of the model.

[0007] To solve the above problems, an information processing apparatus according to one aspect of the present invention includes an acquisition unit that acquires a communication packet including a protocol stack, a tokenization unit that generates a plurality of tokens by tokenizing the communication packet, and a learning unit that inputs the plurality of tokens into a model for evaluating the security of the communication packet to train the model.

[0008] To solve the above problems, an information processing method according to one aspect of the present invention includes an acquisition step of acquiring a communication packet, a tokenization step of generating a plurality of tokens by tokenizing the communication packet, and an evaluation step of inputting the plurality of tokens into a machine learning model and evaluating the security of the communication packet by referring to the output of the model.

[0009] To solve the above problems, an information processing method according to one aspect of the present invention includes an acquisition step of acquiring a communication packet, a tokenization step of generating a plurality of tokens by tokenizing the communication packet, and a learning step of training a model that evaluates the security of the communication packet by inputting the plurality of tokens into the model.

[0010] Each aspect of the present invention may be implemented by a computer, in which case the program for the information processing device that enables the computer to implement the information processing device by operating the computer as each part (software element) of the information processing device, and the computer-readable recording medium on which the program is recorded, also fall within the scope of the present invention.

[0011] According to one aspect of the present invention, security measures can be provided that span multiple protocols.

[0012] This is a block diagram showing the configuration of a communication system according to an embodiment. This is a flowchart showing the processing flow in the learning phase of the communication device according to an embodiment. This is a diagram for explaining the processing in the learning phase of the communication device according to an embodiment. This is a flowchart showing the processing flow in the inference phase of the communication device according to an embodiment. This is a diagram for explaining the processing in the inference phase of the communication device according to an embodiment. This is a flowchart showing an example of display by the communication device according to an embodiment. This is a block diagram showing the configuration of a communication system according to an embodiment.

[0013] [Embodiment 1] The configuration of the communication system 100 according to this embodiment will be described below with reference to Figures 1 to 6. Broadly speaking, the communication system 100 is a system that includes a plurality of communication devices, and these communication devices communicate with one another.

[0014] Figure 1 is a block diagram showing the configuration of the communication system 100 according to this embodiment. As shown in Figure 1, the communication system 100 comprises a communication device 1 and a plurality of other communication devices 50-1, 50-2, ..., and these communication devices are connected to each other so as to be able to communicate with each other via a network N. Furthermore, these communication devices 1, 50-1, 50-2, ... send and receive communication packets, including a protocol stack that hierarchically includes multiple types of protocols, via the network N. The specific configuration of the network N is not particularly limited, but as an example, a wired LAN (Local Area Network), a wireless LAN, a WAN (Wide Area Network), a public telephone network, a mobile data communication network, or a combination of these networks can be used.

[0015] (Communication device 1) As shown in Figure 1, the communication device 1 comprises a control unit 10, a storage unit 20, a communication unit 30, and an input / output unit 40. The communication device 1 itself, or a device including at least a part of the components of the communication device 1, is also referred to as an information processing device or a communication control device. As an example, the information processing device (communication control device) according to this embodiment comprises a control unit 10 and a storage unit 20.

[0016] (Input / Output Unit 40) The input / output unit 40 is an interface to an input device that accepts data input and an output device that outputs data. Examples of input devices include, but are not limited to, a microphone, camera, eye-tracking device, keyboard, and touchpad. Examples of output devices include, but are not limited to, a speaker and liquid crystal display.

[0017] (Communication Unit 30) The communication unit 30 is an interface for sending and receiving communication packets over the network N. Here, the communication packets sent and received by the communication unit 30 include a protocol stack (also called a protocol suite) which includes, for example, several types of protocols in a hierarchical structure. The communication unit 30 is configured to execute various processes defined by these protocols. However, some of these protocols (for example, layers 5 to 7) may be executed by the control unit 10, which will be described later. In the following example, the protocols of each layer may also include security protocols to protect data from unauthorized acts such as eavesdropping, tampering, and impersonation. In the following example, layer names in accordance with the OSI reference model and protocol names in accordance with TCP / IP are given as examples, but these are not limited to this embodiment.

[0018] (Example of protocol stack) Layer 7 (L7): Application layer Examples of L7 protocols: HTTP, FTP, DNS, SMTP, S / MIME, PGP, SHTTP, SSH, etc. Layer 6 (L6): Presentation layer Examples of L6 protocols: SMTP, FTP, etc. Layer 5 (L5): Session layer Examples of L5 protocols: SSL, TLS, etc. Layer 4 (L4): Transport layer Examples of L4 protocols: TCP, UDP, etc. Layer 3 (L3): Network layer Examples of L3 protocols: IP, IPSec, etc. Layer 2 (L2): Data link layer Examples of L2 protocols: Ethernet®, WEP, WPA, etc. Layer 1 (L1): Physical layer (Storage unit 20) The storage unit 20 stores various data referenced by the control unit 10, and various data derived by the control unit 10. As an example, as shown in Figure 1, the memory unit 20 stores: • Communication packet CP • Token sequence TS • Evaluation model EM • Evaluation result ER • Reference information RI, etc. Here, the communication packet CP includes, as an example, the protocol stack described above. A specific example of the communication packet CP will be described later.

[0019] The token sequence TS contains one or more tokens generated from at least a portion of the communication packet CP by the tokenization unit 12, which will be described later. Specific examples of the token sequence TS will be described later. The evaluation model EM is a machine learning model constructed by the learning unit 13, which will be described later, and is implemented as a language model, for example. The evaluation model EM can be described as a model that has learned (machine learned) the relationships and meanings of each part of at least a portion of the bit sequences contained in the communication packet CP. Specific examples of the evaluation model EM will be described later. The evaluation result ER is the evaluation result generated by the evaluation unit 14, which will be described later, and includes an evaluation of the security of the communication packet CP. Specific examples of the evaluation result ER will be described later. The reference information RI is information referenced in the evaluation process by the evaluation unit 14, which will be described later. Specific examples of the reference information RI will be described later.

[0020] (Control Unit 10) As shown in Figure 1, the control unit 10 includes an acquisition unit 11, a tokenization unit 12, a learning unit 13, an evaluation unit 14, and a communication control unit 15.

[0021] (Acquisition Unit 11) The acquisition unit 11 acquires communication packets CP. The communication packets CP acquired by the acquisition unit 11 include, as an example, the protocol stack described above. In the learning phase, which is the phase in which the evaluation model EM described later is trained (built), the acquisition unit 11 acquires communication packets CP for learning. In addition, in the inference phase (evaluation phase, prediction phase), which is the phase in which evaluation is performed using the evaluation model EM, the acquisition unit 11 acquires communication packets CP to be evaluated. In the inference phase, the communication packets CP acquired by the acquisition unit 11 include, as an example, communication packets of the monitored target (evaluation target) acquired from any of the other communication devices 50-1, 50-2, ... but this is not limited to this embodiment. Note that in the learning phase, the acquisition unit 11 can be configured to acquire the correct label of the communication packets CP along with the communication packets CP for learning.

[0022] (Tokenization Unit 12) The tokenization unit 12 generates one or more tokens by tokenizing at least a portion of the communication packet CP acquired by the acquisition unit 11. Here, the series of tokens generated by the tokenization unit 12 is also called the token sequence TS. The tokenization unit 12 can generate one or more tokens from at least a portion of the communication packet CP using, for example, a tokenization algorithm executed by a machine learning-trained tokenizer. More specific processing by the tokenization unit 12 will be described later.

[0023] (Learning Unit 13) The learning unit 13 trains the evaluation model EM by inputting one or more tokens generated by the tokenization unit 12 during the learning phase. Here, the learning unit 13 may also be configured to further train the evaluation model EM by referring to the correct labels described above. The learning unit 13 stores the trained evaluation model EM in the storage unit 20. More specific processing by the learning unit 13 will be described later.

[0024] (Evaluation Unit 14) The evaluation unit 14 evaluates the security of the communication packet CP by inputting one or more tokens generated from the communication packet CP by the tokenization unit 12 in the inference phase into a trained (machine-learned) evaluation model EM. The evaluation results by the evaluation unit 14 may be presented to the user via a display provided by the input / output unit 40, as an example. More specific processing by the evaluation unit 14 will be described later.

[0025] (Communication Control Unit 15) The communication control unit 15 controls the communication unit 30 by referring to the evaluation results from the evaluation unit 14. Alternatively, the communication control unit 15 decides how to process an accepted communication packet CP by referring to the evaluation results from the evaluation unit 14. For example, the communication control unit 15 obtains the evaluation results from the evaluation unit 14 for each communication packet CP received via the communication unit 30 and decides whether or not to discard the communication packet CP by referring to the evaluation results. For example, if the evaluation result from the evaluation unit 14 for the target communication packet CP indicates a security concern, the communication control unit 15 controls the communication unit 30 to block the target communication packet CP or controls the storage unit 20 to discard the target communication packet CP.

[0026] Furthermore, as described above, the communication device (information processing device) 1 can be used to evaluate the security of communication packets CP received from one or more edge servers, for example, using a machine learning-based evaluation model EM, and is also referred to as RIC (RAN Intelligent Controller). However, this name is not limited to this embodiment.

[0027] (Processing flow in the learning phase) Next, the processing flow of the learning phase performed by the communication device 1 will be explained with reference to Figures 2 and 3. Figure 2 is a flowchart showing the processing flow of the learning phase performed by the communication device 1. Figure 3 is a diagram for explaining the processing in the learning phase of the communication device 1.

[0028] (Step S11) In step S11, the acquisition unit 11 acquires a communication packet CP for learning. The communication packet CP acquired by the acquisition unit 11 here includes, as an example, the protocol stack described above. The acquisition unit 11 also acquires a correct label indicating the degree of security of the communication packet CP.

[0029] The upper part of Figure 3 shows an example of a learning communication packet CP acquired in this step. In the example shown in the upper part of Figure 3, the communication packet CP is configured as an Ethernet frame containing a payload, TCP packets, and IP packets in a hierarchical structure. The communication packet CP may also be described as being configured as a protocol stack containing a payload, TCP packets, IP packets, and an Ethernet frame.

[0030] In the example shown in the upper part of Figure 3, the MAC header includes, for example, information such as the destination MAC address, source MAC address, and Ethereum type. The IP header includes, for example, information such as version information, header length, service type, and packet length. The TCP header includes, for example, information such as source port number, destination port number, and sequence number. However, these examples are not limiting to this embodiment.

[0031] Furthermore, the learning communication packet CP acquired in this step is not limited to the example above, and may be a physical layer packet configured as a protocol stack, or any other packet. (Step S12) Next, in step S12, the tokenization unit 12 generates one or more tokens by tokenizing at least a portion of the communication packet CP acquired by the acquisition unit 11. The middle section of Figure 3 shows an example of a token sequence TS including multiple tokens generated by the tokenization unit 12.

[0032] In the example shown in the middle of Figure 3, the entire Ethernet frame (communication packet CP), including the MAC header, IP header, TCP header, and payload, is subject to tokenization. More specifically, in the example shown in the middle of Figure 3, the bit sequence contained in the Ethernet frame is tokenized in 16-bit = 2-byte units, generating a token sequence TS that can contain 65,536 different tokens. Note that the tokenization unit is not limited to 16 bits; tokenization may be performed using other bit units.

[0033] (Step S13) Next, in step S13, the learning unit 13 inputs the token sequence TS generated by the tokenization unit 12 in step S12 into the evaluation model EM (step S13-1), thereby training the evaluation model EM (step S13-2). Here, the evaluation model EM has one or more parameters that are the target of learning (updating).

[0034] The lower part of Figure 3 shows an example of the configuration of the evaluation model EM. In the example shown in the lower part of Figure 3, the evaluation model EM is an attention-equipped transformer that takes the token sequence TS as input and outputs one or more features. This configuration can also be said to be a model configuration that is suitably applicable as a language model. In other words, a model that is suitably applicable as a language model can be used as the evaluation model EM.

[0035] More specifically, the evaluation model EM, as shown in the lower part of Figure 3, includes an attention layer AL to which a token sequence TS is input, and a fully connected layer EL to which the output of the attention layer AL is input.

[0036] Furthermore, in the attention layer AL, the Q (Query) matrix, K (Key) matrix, and V (Value) matrix are calculated by referring to the token sequence, and then the attention matrix is ​​calculated using the Q and K matrices. As an example, the product of the attention matrix and the V matrix is ​​input to the fully connected layer EL. The fully connected layer EL calculates one or more features from the product of the attention matrix and the V matrix.

[0037] Then, the learning unit 13 updates one or more parameters of the evaluation model EM so that the difference between the degree of safety indicated by one or a feature output by the evaluation model EM (in other words, the degree of safety estimated by the evaluation model EM) and the correct label indicating the degree of safety of the Ethernet frame (communication packet CP) acquired in step S11 becomes smaller (step S13-2). In this way, the learning unit 13 trains the evaluation model EM.

[0038] By performing the above processing, the learning unit 13 can construct an evaluation model EM that has learned (machine learning) the relationships and meanings of each part of at least some of the bit sequences included in the communication packet CP.

[0039] (Effects of the learning phase) As described above, the learning phase performed by the communication device 1 employs the following configuration: - Acquire a communication packet CP for learning that includes a protocol stack (step S11), - Generate multiple tokens (token sequence TS) by tokenizing the communication packet CP (step S12), and - Train an evaluation model EM that evaluates the security of the communication packet by inputting the multiple tokens (token sequence TS) into the evaluation model EM (step S13).

[0040] With the above configuration, the evaluation model EM is trained using a token sequence TS generated from a training communication packet CP containing the protocol stack, thus enabling the construction of an evaluation model capable of detecting risks across multiple protocols.

[0041] (Processing flow in the inference phase) Next, the processing flow of the inference phase performed by the communication device 1 will be explained with reference to Figures 4 and 5. Figure 4 is a flowchart showing the processing flow of the inference phase performed by the communication device 1. Figure 5 is a diagram for explaining the processing in the inference phase of the communication device 1.

[0042] (Step S21) In step S21, the acquisition unit 11 acquires a communication packet CP to be evaluated. Here, as an example, the communication packet CP acquired by the acquisition unit 11 includes the protocol stack described above.

[0043] An example of the communication packet CP to be evaluated acquired in this step is shown in the upper part of FIG. 5. Similar to the example shown in FIG. 3, the communication packet CP to be evaluated acquired in this step is also configured, as an example, as an Ethernet frame hierarchically including a payload, a TCP packet, and an IP packet. Since the specific configuration of the communication packet CP is the same as the configuration described in step 11, duplicate explanations are omitted. Note that the learning communication packet CP acquired in this step is not limited to the above example, and may be a physical layer packet configured as a protocol stack, or other packets.

[0044] (Step S22) Subsequently, in step S22, the tokenization unit 12 generates one or more tokens by tokenizing at least a part of the communication packet CP to be evaluated acquired by the acquisition unit 11. An example of a token sequence TS including a plurality of tokens generated by the tokenization unit 12 is shown in the middle part of FIG. 5. Since the token sequence TS generation process by the tokenization unit 12 is the same as the process described in step S12, duplicate explanations are omitted.

[0045] (Step S24) Subsequently, in step S24, the evaluation unit 14 inputs the token sequence TS generated by the tokenization unit 12 in step S22 into the learned evaluation model EM (step S24-1), thereby evaluating the security of the communication packet CP (step S24-2). Here, the learned evaluation model EM refers to, as an example, the evaluation model EM learned by the above-described step S13.

[0046] The evaluation unit 14 generates an evaluation result ER by referring to one or more feature quantities output by the learned evaluation model EM. As an example, when the degree of risk indicated by the feature quantity output by the evaluation model EM is equal to or higher than a predetermined threshold, the evaluation target packet CP may be evaluated as being dangerous. Also, when the degree of risk indicated by the feature quantity output by the evaluation model EM is less than a predetermined threshold, the evaluation target packet CP may be evaluated as being safe. Note that these specific evaluation processes do not limit this embodiment.

[0047] For example, the evaluation unit 14 may perform a process of classifying the evaluation target packet CP into any one of classes of risk level 1 to risk level 5 by executing a classification process based on the feature quantity output by the evaluation model EM.

[0048] (Step S25) Subsequently, in step S25, the communication control unit 15 controls the communication unit 30 by referring to the evaluation result by the evaluation unit 14 in step S24. Alternatively, the communication control unit 15 determines the process for the received communication packet CP by referring to the evaluation result by the evaluation unit 14 in step S24. Since the specific process by the communication control unit 15 has been described above, duplicate explanations are omitted.

[0049] Note that the communication control unit 15 may be configured to present warning information regarding the evaluation target communication packet CP to the user via a display included in the input / output unit 40 by referring to the evaluation result by the evaluation unit 14 in step S24.

[0050] FIG. 6 shows an example of warning information generated by the communication control unit 15 and displayed on the display when the evaluation result by the evaluation unit 14 in step S24 indicates that the evaluation target communication packet CP is dangerous. In the example shown in FIG. 6, the communication control unit 15 notifies the user that the evaluation target communication packet CP (Ethernet frame 1) is dangerous, and blocks the communication packet CP (Ethernet frame 1) by controlling the communication unit 30.

[0051] (Effects of the inference phase) As described above, the inference phase performed by the communication device 1 employs the following configuration: - Acquires a communication packet CP to be evaluated, including the protocol stack (step S21); generates a plurality of tokens (token sequence TS) by tokenizing at least a part of the communication packet CP (step S22); inputs the plurality of tokens (token sequence TS) into a trained evaluation model EM and evaluates the security of the communication packet CP by referring to the output of the trained evaluation model EM (step S23).

[0052] According to the above configuration, the token sequence TS generated from the communication packet CP to be evaluated, including the protocol stack, is input to a trained evaluation model EM, and the security of the communication packet CP is evaluated by referring to the output of the evaluation model EM, thereby enabling the detection of risks that span multiple protocols.

[0053] (Additional notes regarding Embodiment 1) The processing by the communication device 1 is not limited to the example described above. If each layer included in the communication packet CP is encrypted, the communication device 1 may refer to information regarding the encryption.

[0054] For example, in the learning phase, in step S11 described above, the acquisition unit 11 may further acquire reference information RI related to the encryption of the communication packet CP for learning, and the learning unit 13 may further input the reference information RI to the evaluation model EM in step S13 described above. Also, in the inference phase, in step S21 described above, the acquisition unit 11 may further acquire reference information RI related to the encryption of the communication packet CP to be evaluated, and the evaluation unit 14 may further input the reference information RI to the evaluation model EM in step S24 described above.

[0055] Here, as an example of the above-mentioned reference information RI, information that explicitly or implicitly indicates the type and version of encryption can be used. However, this example is not limited to this embodiment.

[0056] [Embodiment 2] The configuration of the communication system 100A according to Embodiment 2 will be described below with reference to Figure 7. Figure 7 is a block diagram showing the configuration of the communication system 100A according to this embodiment. As shown in Figure 7, the communication device 1A (also called an information processing device) according to this embodiment does not have the learning unit 13 that is included in the communication device 1 according to Embodiment 1. Furthermore, the other configurations of the communication device 1A according to this embodiment are the same as those of the communication device 1 according to Embodiment 1.

[0057] Thus, in the communication device 1A according to this embodiment, the following configuration is adopted: - Acquire a communication packet CP to be evaluated, including a protocol stack; generate a plurality of tokens (token sequence TS) by tokenizing at least a part of the communication packet CP; input the plurality of tokens (token sequence TS) into a trained evaluation model EM; and evaluate the security of the communication packet CP by referring to the output of the trained evaluation model EM.

[0058] According to the above configuration, the token sequence TS generated from the communication packet CP to be evaluated, including the protocol stack, is input to a trained evaluation model EM, and the security of the communication packet CP is evaluated by referring to the output of the evaluation model EM, thereby enabling the detection of risks that span multiple protocols.

[0059] [Example of implementation by software] The functions of the communication devices 1 and 1A (hereinafter referred to as "devices") can be implemented by programs that cause computers to function as the devices, and by programs that cause computers to function as each control block of the devices (especially each part included in the control unit 10).

[0060] In this case, the device includes a computer having at least one control device (e.g., a processor) and at least one storage device (e.g., memory) as hardware for executing the program. By executing the program using this control device and storage device, the functions described in each of the embodiments are realized.

[0061] The above program may be recorded on one or more computer-readable recording media, not temporary ones. These recording media may or may not be provided by the above device. In the latter case, the program may be supplied to the above device via any wired or wireless transmission medium.

[0062] Furthermore, some or all of the functions of each of the above control blocks can also be realized by logic circuits. For example, an integrated circuit in which logic circuits functioning as each of the above control blocks are formed is also included in the scope of the present invention. In addition, it is also possible to realize the functions of each of the above control blocks by, for example, a quantum computer.

[0063] Furthermore, each process described in the above embodiments may be performed by AI (Artificial Intelligence). In this case, the AI ​​may operate on the control device described above, or it may operate on another device (for example, an edge computer or a cloud server).

[0064] (Additional Notes) This specification includes at least the following components:

[0065] (Configuration 1) An information processing device comprising: an acquisition unit that acquires a communication packet including a protocol stack; a tokenization unit that generates a plurality of tokens by tokenizing at least a portion of the communication packet; and an evaluation unit that inputs the plurality of tokens into a trained model and evaluates the security of the communication packet by referring to the output of the trained model.

[0066] (Configuration 2) The information processing apparatus according to claim 1, wherein the acquisition unit acquires an Ethernet frame or a physical layer packet as the communication packet.

[0067] (Configuration 3) The information processing device according to Configuration 1 or 2, wherein the model is a model that has learned the relationships and meanings of each part of at least a portion of the bit sequence contained in the communication packet.

[0068] (Configuration 4) The information processing device according to any one of Configurations 1 to 3, wherein the model is a transformer with an attention mechanism that takes the plurality of tokens as input and outputs one or more feature quantities.

[0069] (Configuration 5) An information processing device according to any one of Configurations 1 to 4, comprising a learning unit that trains the model by referencing a plurality of tokens generated by tokenizing a training communication packet including a protocol stack.

[0070] (Configuration 6) The information processing device according to any one of Configurations 1 to 5, wherein the acquisition unit further acquires reference information relating to the encryption of the communication packet, and the evaluation unit further inputs the reference information into the model.

[0071] (Configuration 7) An information processing device comprising: an acquisition unit that acquires a communication packet including a protocol stack; a tokenization unit that generates a plurality of tokens by tokenizing the communication packet; and a learning unit that trains a model for evaluating the security of the communication packet by inputting the plurality of tokens into the model.

[0072] (Configuration 8) The information processing device according to Configuration 7, wherein the acquisition unit acquires an Ethernet frame or a physical layer packet as the communication packet.

[0073] (Configuration 9) The information processing device according to Configuration 7 or 8, wherein the model is a model that has learned the relationships and meanings of each part of the bit sequence contained in the communication packet.

[0074] (Configuration 10) The information processing device according to any one of Configurations 7 to 9, wherein the model is a transformer with an attention mechanism that takes the plurality of tokens as input and outputs one or more feature quantities.

[0075] (Configuration 11) The information processing device according to any one of Configurations 7 to 10, wherein the acquisition unit further acquires reference information relating to the encryption of the communication packet, and the learning unit further inputs the reference information into the model.

[0076] (Configuration 12) An information processing method comprising: an acquisition step of acquiring a communication packet; a tokenization step of generating a plurality of tokens by tokenizing the communication packet; and an evaluation step of inputting the plurality of tokens into a trained model and evaluating the security of the communication packet by referring to the output of the trained model.

[0077] (Configuration 13) An information processing method comprising: an acquisition step of acquiring a communication packet; a tokenization step of generating a plurality of tokens by tokenizing the communication packet; and a learning step of training a model that evaluates the security of the communication packet by inputting the plurality of tokens into the model.

[0078] (Configuration 14) A program for causing a computer to function as an information processing device as described in Configuration 1, wherein the acquisition unit, the tokenization unit, and the evaluation unit of the computer are the same as the computer.

[0079] (Configuration 15) A program for causing a computer to function as an information processing device as described in Configuration 7, wherein the acquisition unit, the tokenization unit, and the learning unit of the computer are the same as the computer.

[0080] (Configuration 16) A computer-readable recording medium on which the program described in Configuration 14 or 15 is recorded.

[0081] The present invention is not limited to the embodiments described above, and various modifications are possible within the scope of the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention.

[0082] 1, 1A ... Communication device (information processing device) 11 ... Acquisition unit 12 ... Tokenization unit 13 ... Learning unit 14 ... Evaluation unit 15 ... Communication control unit

Claims

1. An information processing device comprising: an acquisition unit that acquires a communication packet including a protocol stack; a tokenization unit that generates a plurality of tokens by tokenizing at least a portion of the communication packet; and an evaluation unit that inputs the plurality of tokens into a machine learning model and evaluates the security of the communication packet by referring to the output of the model.

2. The information processing apparatus according to claim 1, wherein the acquisition unit acquires an Ethernet frame or a physical layer packet as the communication packet.

3. The information processing apparatus according to claim 1 or 2, wherein the model is a model that has learned the relationships and meanings of each part of at least a portion of the bit sequence contained in the communication packet.

4. The information processing apparatus according to any one of claims 1 to 3, wherein the model is a transformer with an attention mechanism that takes the plurality of tokens as input and outputs one or more feature quantities.

5. The information processing device according to any one of claims 1 to 4, further comprising a learning unit that trains a model by referencing a plurality of tokens generated by tokenizing a training communication packet including a protocol stack.

6. The information processing apparatus according to any one of claims 1 to 5, wherein the acquisition unit further acquires reference information relating to the encryption of the communication packet, and the evaluation unit further inputs the reference information into the model.

7. An information processing device comprising: an acquisition unit that acquires a communication packet including a protocol stack; a tokenization unit that generates a plurality of tokens by tokenizing the communication packet; and a learning unit that trains a model for evaluating the security of the communication packet by inputting the plurality of tokens into the model.

8. The information processing apparatus according to claim 7, wherein the acquisition unit acquires an Ethernet frame or a physical layer packet as the communication packet.

9. The information processing apparatus according to claim 7 or 8, wherein the model is a model that has learned the relationships and meanings of each part of the bit sequence contained in the communication packet.

10. The information processing apparatus according to any one of claims 7 to 9, wherein the model is a transformer with an attention mechanism that takes the plurality of tokens as input and outputs one or more feature quantities.

11. The information processing apparatus according to any one of claims 7 to 10, wherein the acquisition unit further acquires reference information relating to the encryption of the communication packet, and the learning unit further inputs the reference information into the model.

12. An information processing method comprising: an acquisition step of acquiring a communication packet; a tokenization step of generating a plurality of tokens by tokenizing the communication packet; and an evaluation step of inputting the plurality of tokens into a machine learning model and evaluating the security of the communication packet by referring to the output of the model.

13. An information processing method comprising: an acquisition step of acquiring a communication packet; a tokenization step of generating a plurality of tokens by tokenizing the communication packet; and a learning step of training a model that evaluates the security of the communication packet by inputting the plurality of tokens into the model.

14. A program for causing a computer to function as an information processing device according to claim 1, wherein the computer functions as the acquisition unit, the tokenization unit, and the evaluation unit.

15. A program for causing a computer to function as an information processing device according to claim 7, wherein the computer functions as the acquisition unit, the tokenization unit, and the learning unit.

16. A computer-readable recording medium having the program described in claim 14 or 15 recorded on it.

Images