Information processing device and graph generation method

Abstract

This information processing device comprises: a time-series data collection unit that collects time-series data; and a graph conversion unit that generates a path graph from the time-series data.

Description

Information Processing Apparatus and Graph Generation Method

[0001] The present invention relates to a technique for converting time-series data into a graph.

[0002] In learning with a graph neural network (GNN), it is necessary to convert time-series data into a graph and input it into the GNN.

[0003] As an example of a technique for converting time-series data into a graph, Non-Patent Document 1 discloses a technique for converting a packet sequence as time-series data into a complete graph having edges between all nodes. In the complete graph, each packet is a node, the byte sequence of the packet is a node feature amount, and the packet arrival interval is an edge feature amount.

[0004] T. -L. Huoh, Y. Luo, P. Li and T. Zhang, "Flow-Based Encrypted Network Traffic Classification With Graph Neural Networks," in IEEE Transactions on Network and Service Management, vol. 20, no. 2, pp. 1224-1237, June 2023, doi: 10.1109 / TNSM.2022.3227500.

[0005] However, in the conventional technique disclosed in Non-Patent Document 1, since the obtained graph is a complete graph, the sequential relationship of data in time-series data cannot be expressed.

[0006] The present invention has been made in view of the above points, and an object thereof is to provide a technique that enables a graph capable of expressing the sequential relationship of data to be generated at high speed from time-series data. 0]

[0007] According to the disclosed technique, there is provided an information processing apparatus including a time-series data collection unit that collects time-series data, and a graph conversion unit that generates a path graph from the time-series data.

[0008] According to the disclosed technology, a technique is provided that enables the rapid generation of graphs that can represent the temporal relationships between data from time-series data.

[0009] This figure shows an example of a complete graph. This figure shows an example of a path graph. This figure shows an example of the configuration of the information processing device 100. This is a flowchart for explaining an example of the operation of the information processing device 100. This figure shows an example of a graph generated by the information processing device 100. This figure explains Example 1. This figure explains Example 2. This figure explains Example 3. This figure explains Example 4. This figure shows an example of the hardware configuration of the information processing device 100.

[0010] Hereinafter, embodiments of the present invention (this embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the embodiments described below.

[0011] (Outline of the Embodiment) First, an outline of this embodiment will be described. As mentioned above, the prior art disclosed in Non-Patent Document 1 converts a packet sequence into a complete graph with edges between all nodes. An example of such a complete graph is shown in Figure 1. However, a complete graph cannot represent the sequential relationship of data in time-series data.

[0012] Therefore, in this embodiment, the information processing device 100, which will be described later, converts the time-series data into a path graph as shown in Figure 2. A path graph is a connected graph in which all vertices except two have a degree of 2, and the remaining two vertices have a degree of 1. The vertices may also be called nodes.

[0013] In this path graph, each data point in the time series data is treated as a node, the data features at each data point are treated as the node features of the corresponding node, and the time intervals between data points are used as the edge weights of the graph. A "data point" is a data point in the time series data at a specific time. The term "data point" may also be used to mean the time of the data.

[0014] As described above, in this embodiment, a path graph is generated from time-series data, making it possible to represent the sequence of data in the time-series data. Furthermore, since time-series data (e.g., line graph) can be directly represented in graph format, no preprocessing is required, and conversion to a graph can be performed at high speed.

[0015] The configuration and operation of the information processing device 100 in this embodiment will be described in detail below.

[0016] (Device Configuration) Figure 3 shows an example of the configuration of the information processing device 100 in this embodiment. As shown in Figure 3, the information processing device 100 includes a time-series data collection unit 110 for collecting time-series data, a time-series data recording unit 120 for recording (storing) the collected time-series data, a graph conversion unit 130 for converting the time-series data into a graph, and a graph recording unit 140 for recording (storing) the graph.

[0017] Furthermore, either one or both of the time-series data recording unit 120 and the graph recording unit 140 may be located outside the information processing device 100, rather than being located inside it. Also, the graph conversion unit 130 may include a function to output the generated graph to an external location outside the information processing device 100.

[0018] (Operation Example) An operation example of the information processing device 100 will be explained with reference to the flowchart in Figure 4. This operation example describes a case in which long-term time-series data is collected and recorded, and then the time-series data is divided to generate multiple graphs.

[0019] <S1 (Step 1)> In S1, the time-series data acquisition unit 110 acquires time-series data. The time-series data to be acquired is, for example, packets, video, or sensor data captured from the network. For example, packets are acquired from access points, video is acquired from cameras, and sensor data is acquired from sensors. Examples of sensor data include temperature, acceleration, and vibration.

[0020] <S2> In S2, the collected time-series data is recorded in the time-series data recording unit 120.

[0021] <S3> In S3, the graph conversion unit 130 first divides the time series data to obtain multiple time series data. For example, it divides the time series data into multiple "N data" pieces, where N is an integer of 1 or more.

[0022] Furthermore, the graph conversion unit 130 may divide the time series data into multiple "time series data with a time duration of T". Each "time series data with a time duration of T" contains the number of data points included in the time duration T. Note that the unit of T may be seconds, minutes, hours, or any other unit.

[0023] Next, the graph conversion unit 130 converts each of the multiple "N data points" into a graph. Alternatively, the graph conversion unit 130 converts each of the multiple "time series data points with a time duration of T" into a graph. Figure 5 shows an example of a graph generated from N data points. As shown in Figure 5, the graph is a path graph, and in the path graph, each data point corresponds to each node.

[0024] <S5> In S5, the graph generated in S4 is stored in the graph recording unit 140. For example, by inputting the graph stored in the graph recording unit 140 into the GNN, analysis such as classification and prediction can be performed.

[0025] Hereafter, Examples 1 to 4 will be described as examples of graph formats generated from time-series data.

[0026] (Example 1) Example 1 will be described with reference to Figure 6. As shown in Figure 6, in Example 1, the number of data points in one graph is N for all graphs with respect to the graphs generated by the graph conversion unit 130. N is not limited to a specific value and can be determined arbitrarily.

[0027] Examples of features (called node features) that each node in a graph possesses are shown below.

[0028] If the data corresponding to a node is a packet obtained through packet capture, the node features are, for example, one or more of the following obtained from that packet: packet length, payload length, header value, and byte value.

[0029] If the data corresponding to a node is an image in a video, the node features are, for example, the RGB values ​​of the image at the time of acquisition.

[0030] If the data corresponding to a node is sensor data, the node features are, for example, the sensor data values ​​at the time of acquisition (e.g., temperature, humidity, acceleration, vibration, etc.).

[0031] Furthermore, in the graph, the edge weights (which may also be called edge features) between adjacent nodes are the normalized reciprocal of the logarithm of the data arrival interval (the time interval between data arrivals). Note that taking the logarithm is not always necessary. Also, normalization may not always be performed. If the data acquisition intervals are equal, all edge weights may be set to 1.

[0032] Since shorter time intervals between data points are considered to indicate a higher correlation between them, when using the time interval between data points as an edge weight, the reciprocal of that time interval is used as the weight.

[0033] In time series data where the variance of time intervals between data points is large, edge weights may become zero or diverge to infinity. Therefore, we take the logarithm of the time interval (arrival interval) and then take its reciprocal.

[0034] (Example 2) Example 2 will be described with reference to Figure 7. As shown in Figure 7, in Example 2, the number of data points in one graph is the number of data points included in the time length T of the time series data. T is not limited to a specific value and can be determined arbitrarily.

[0035] In Figure 7, if i is the index of the graph, then ti represents the number of data points (= number of nodes) in graph i. In other words, ti is the "number of data points included in time length T" corresponding to graph i. Also, in the example in Figure 7, i = 1, ..., g.

[0036] The examples of node features and edge weights are the same as those described in Example 1.

[0037] (Example 3) Example 3 will be described with reference to Figure 8. Example 3 is an example in which the "data" in Example 1 is packets obtained by packet capture. That is, in Example 3, the time-series data is a sequence of packets.

[0038] As shown in Figure 8, in Embodiment 3, the number of packets in one graph is set to N for all graphs with respect to the graphs generated by the graph conversion unit 130. N is not limited to a specific value and can be determined arbitrarily.

[0039] The node features of each node in the graph are one or more of the following obtained from the packet: packet length, payload length, header value, and byte value. These values ​​may also be obtained from encrypted packets.

[0040] Furthermore, in each graph, the edge weights (which may also be called edge features) between adjacent nodes are normalized from the reciprocal of the logarithm of the packet arrival interval (the time interval between packets arriving). Note that taking the logarithm may not be performed. Also, normalization may not be performed.

[0041] Since shorter time intervals between data points (packets) are considered to indicate higher correlation between data points, when using the time interval between data points as edge weights, the reciprocal of that time interval is used as the weight.

[0042] In time-series data (packet sequences) where the variance of time intervals between data points is large, edge weights may become zero or diverge to infinity. Therefore, we take the logarithm of the time interval (arrival interval) and then take its reciprocal.

[0043] (Example 4) Example 4 will be described with reference to Figure 9. Example 4 is an example in which the "data" in Example 2 is packets obtained by packet capture. That is, in Example 4, the time series data is a packet sequence. As shown in Figure 9, in Example 4, the number of packets in one graph is the number of packets included in the time length T of the time series data (packet sequence). T is not limited to a specific value and can be determined arbitrarily.

[0044] In FIG. 9, if i is the index of the graph, ti represents the number of packets (= the number of nodes) in graph i. That is, ti is the "number of packets included in the time period T" corresponding to graph i. Also, in the example of FIG. 9, i = 1,..., g.

[0045] Examples of node feature amounts and examples of edge weights are the same as those described in Example 3.

[0046] (Example of hardware configuration) The information processing apparatus 100 described in this embodiment can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0047] That is, the apparatus can be realized by using hardware resources such as a CPU and a memory built in the computer to execute a program corresponding to the processing performed by the apparatus. The above program can be recorded on a computer-readable recording medium (such as a portable memory), saved, distributed, or provided through a network such as the Internet or e-mail.

[0048] FIG. 10 is a diagram showing an example of the hardware configuration of the above computer. The computer in FIG. 10 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are mutually connected by a bus B. Note that the computer may further include a GPU.

[0049] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.

[0050] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.

[0051] (Summary of Embodiments, Effects, etc.) As described above, the technology described in this embodiment converts time-series data into a path graph, making it possible to represent the sequence of data in the time-series data. Furthermore, since the time-series data is represented directly in graph format, no preprocessing is required, and the conversion to a graph can be performed at high speed.

[0052] Furthermore, the technology according to this embodiment can improve the accuracy of time series forecasting and classification models by emphasizing the characteristics of the time intervals between data arrivals in time series data.

[0053] The following additional information is disclosed regarding the embodiments described above.

[0054] <Notes> (Note 1) An information processing device comprising: a time-series data collection unit for collecting time-series data; and a graph transformation unit for generating a path graph from the time-series data. (Note 2) The information processing device according to Note 1, wherein the graph transformation unit generates a path graph in which each data point in the time-series data is a node, each data feature in the time-series data is a node feature, and values ​​based on the time interval between data points in the time-series data are used as edge weights. (Note 3) The information processing device according to Note 1 or 2, wherein the time-series data is a series of packets collected by packet capture. (Note 4) A graph generation method executed by an information processing device, comprising: a time-series data collection step for collecting time-series data; and a graph transformation step for generating a path graph from the time-series data.

[0055] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.

[0056] 100 Information processing device 110 Time-series data acquisition unit 120 Time-series data recording unit 130 Graph conversion unit 140 Graph recording unit 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device comprising: a time-series data collection unit for collecting time-series data; and a graph conversion unit for generating a path graph from the time-series data.

2. The information processing apparatus according to claim 1, wherein the graph transformation unit generates a path graph in which each data point in the time series data is a node, each data feature in the time series data is a node feature, and values ​​based on the time interval between data points in the time series data are used as edge weights.

3. The information processing apparatus according to claim 1 or 2, wherein the time-series data is a series of packets collected by packet capture.

4. A graph generation method executed by an information processing device, comprising: a time-series data collection step of collecting time-series data; and a graph transformation step of generating a path graph from the time-series data.

Images